CVE-2025-31678 AI (Artificial Intelligence) - Moderately critical - Access bypass, Information Disclosure - SA-CONTRIB-2025-004

Missing Authorization vulnerability in Drupal AI Artificial Intelligence allows Forceful Browsing.This issue affects AI Artificial Intelligence: from 0.0.0 before 1.0.3...

PT-2025-13849 · Drupal · Open Social

Name of the Vulnerable Software and Affected Versions: Open Social versions 0.0.0 through 12.3.10 Open Social versions 12.4.0 through 12.4.9 Description: The issue is related to a Missing Authorization vulnerability in Drupal Open Social, which allows Forceful Browsing. Recommendations: For Open...

SUSE CVE-2025-25199

go-crypto-winnative Go crypto backend for Windows using Cryptography API: Next Generation CNG. Prior to commit f49c8e1379ea4b147d5bff1b3be5b0ff45792e41, calls to cng.TLS1PRF don't release the key handle, producing a small memory leak every time. Commit f49c8e1379ea4b147d5bff1b3be5b0ff45792e41...

PT-2025-7182 · Milliard · Line-Up-Exactly

Name of the Vulnerable Software and Affected Versions: Related Posts Line-up-Exactly by Milliard versions 0.0.0 through 0.0.22 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actio...

PT-2025-4935 · Unknown · Bilal Tas Responsivity

Name of the Vulnerable Software and Affected Versions: Bilal TAS Responsivity versions 0.0.0 through 0.0.6 Description: The issue is related to improper neutralization of input during web page generation, which allows Reflected XSS. This means that an attacker can inject malicious scripts into th...

PT-2025-5198 · Unknown · Ella Van Durpe Slides & Presentations

Name of the Vulnerable Software and Affected Versions: Ella van Durpe Slides & Presentations versions 0.0.0 through 0.0.39 Description: The issue is related to the improper neutralization of script-related HTML tags in a web page, which allows for code injection. This is a basic Cross-Site...

CVE-2024-13283

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Facets allows Cross-Site Scripting XSS.This issue affects Facets: from 0.0.0 before 2.0.9...

CVE-2024-13287 Views SVG Animation - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-051

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Views SVG Animation allows Cross-Site Scripting XSS.This issue affects Views SVG Animation: from 0.0.0 before 1.0.1...

CVE-2024-13269 Advanced Varnish - Moderately critical - Access bypass - SA-CONTRIB-2024-033

Insertion of Sensitive Information Into Sent Data vulnerability in Drupal Advanced Varnish allows Forceful Browsing.This issue affects Advanced Varnish: from 0.0.0 before 4.0.11...

CVE-2024-13264 Opigno module - Critical - Arbitrary PHP code execution - SA-CONTRIB-2024-028

Improper Neutralization of Directives in Statically Saved Code 'Static Code Injection' vulnerability in Drupal Opigno module allows PHP Local File Inclusion.This issue affects Opigno module: from 0.0.0 before 3.1.2...

CVE-2024-13243

Missing Authorization vulnerability in Drupal Entity Delete Log allows Forceful Browsing.This issue affects Entity Delete Log: from 0.0.0 before 1.1.1...

CVE-2024-13240

Improper Access Control vulnerability in Drupal Open Social allows Collect Data from Common Resource Locations.This issue affects Open Social: from 0.0.0 before 12.05...

CVE-2024-13261 Acquia DAM - Moderately critical - Cross Site Request Forgery, Denial of Service - SA-CONTRIB-2024-025

Cross-Site Request Forgery CSRF vulnerability in Drupal Acquia DAM allows Cross Site Request Forgery.This issue affects Acquia DAM: from 0.0.0 before 1.0.13, from 1.1.0 before 1.1.0-beta3...

CVE-2024-13252 TacJS - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-016

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal TacJS allows Cross-Site Scripting XSS.This issue affects TacJS: from 0.0.0 before 6.5.0...

PT-2025-4504 · Unknown · Ella Van Durpe Slides & Presentations

Name of the Vulnerable Software and Affected Versions: Ella van Durpe Slides & Presentations versions 0.0.0 through 0.0.39 Description: The issue is related to improper neutralization of input during web page generation, which allows for stored cross-site scripting XSS. This means that an attacke...

PT-2025-4525 · Unknown · Ella Van Durpe Slides & Presentations

Name of the Vulnerable Software and Affected Versions: Ella van Durpe Slides & Presentations versions 0.0.0 through 0.0.39 Description: The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels. Recommendations: Fo...

PT-2024-10085 · Drupal · Download All Files

Name of the Vulnerable Software and Affected Versions: Download All Files versions 0.0.0 through 2.0.1 Description: The issue is related to a Missing Authorization vulnerability in the Download All Files module for the Drupal CMS, which allows for Forceful Browsing. This vulnerability can be...

PT-2024-10087 · Drupal · Drupal Entity Form Steps

Name of the Vulnerable Software and Affected Versions: Drupal Entity Form Steps versions 0.0.0 through 1.1.3 Description: The issue is related to improper neutralization of input during web page generation, allowing for Cross-Site Scripting XSS attacks. This can enable a remote attacker to conduc...

PT-2024-10478 · Post File +1 · Post File +1

Name of the Vulnerable Software and Affected Versions: Drupal POST File versions 0.0.0 through 1.0.2 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability in the POST File module of the Drupal CMS system. This vulnerability can be exploited by a remote attacker to...

PT-2024-10479 · Drupal · Drupal Post File

Name of the Vulnerable Software and Affected Versions: Drupal POST File versions 0.0.0 through 1.0.2 Description: The issue is related to improper neutralization of input during web page generation, which allows Cross-Site Scripting XSS. This can enable a remote attacker to conduct cross-site...