CVE-2026-118561

The Single Content Sync module for Drupal (versions 0.0.0 to 1.4.19 ) is vulnerable to an External Control of File Name or Path (CWE-73) issue. The root cause is the module's failure to sufficiently validate file sources and destinations during content imports. An attacker with the import single ...

CVE-2026-118561

External Control of File Name or Path vulnerability in Drupal Single Content Sync allows Path Traversal. This issue affects Single Content Sync versions: from 0.0.0 to 1.4.19...

EUVD-2026-113498

External Control of File Name or Path vulnerability in Drupal Single Content Sync allows Path Traversal. This issue affects Single Content Sync versions: from 0.0.0 to 1.4.19...

CVE-2026-118562

The Drupal Single Content Sync module (versions 0.0.0 to 1.4.19) is vulnerable to a Deserialization of Untrusted Data flaw (CWE-502). A maliciously crafted import file can trigger the deserialization of untrusted data, potentially leading to Object Injection and Remote Code Execution (RCE) . The ...

CVE-2026-118562

Deserialization of Untrusted Data vulnerability in Drupal Single Content Sync allows Object Injection. This issue affects Single Content Sync versions: from 0.0.0 to 1.4.19...

EUVD-2026-113497

Deserialization of Untrusted Data vulnerability in Drupal Single Content Sync allows Object Injection. This issue affects Single Content Sync versions: from 0.0.0 to 1.4.19...

CVE-2026-118568

The Drupal Content Sync (content-sync.io) module (versions 0.0.0 to 3.2.2 ) contains an Insecure Storage of Sensitive Information vulnerability (CWE-922 ). The root cause is that the module fails to sufficiently encrypt the password of the system user used for content synchronization. This flaw c...

EUVD-2026-113683

Insecure Storage of Sensitive Information vulnerability in Drupal Content Sync content-sync.io allows Retrieve Embedded Sensitive Data. This issue affects Content Sync content-sync.io versions: from 0.0.0 to 3.2.2...

PT-2026-130589

Single Content Sync enables exporting and importing content, referenced entities, and files between Drupal sites. The module does not sufficiently validate file sources and destinations during content imports. An attacker can write arbitrary files, disclose sensitive local files accessible to the...

PT-2026-130590

Single Content Sync enables exporting and importing content, referenced entities, and files between Drupal sites. A maliciously crafted import file can cause untrusted data to be deserialized, potentially leading to remote code execution. This vulnerability is mitigated by the fact that an attack...

CVE-2026-13600 AutoNetTV Relay < 3.0.14 - Unauthenticated Privilege Escalation via Scheduled Sync Cron

The AutoNetTV Relay WordPress plugin before 3.0.14 does not perform any capability or authentication check before setting a WordPress administrator authentication cookie during its scheduled content-synchronization task. On server configurations where the scheduled task executes before the HTTP...

Malware in strapi-plugin-content-sync

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious Package

Overview strapi-plugin-content-sync is a malicious package. This package contains malicious code that conceals a command-and-control agent and credential harvester. A malicious actor published a coordinated campaign of thirty-six packages disguised as community Strapi CMS plugins. These packages...

EUVD-2025-16014

Malicious code in bioql PyPI...

CVE-2025-9894

The Sync Feedly plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.1. This is due to missing or incorrect nonce validation on the crsfcronjobfunc function. This makes it possible for unauthenticated attackers to trigger content synchronizati...

CVE-2025-48009

Missing Authorization vulnerability in Drupal Single Content Sync allows Functionality Misuse.This issue affects Single Content Sync: from 0.0.0 before 1.4.12...

CVE-2025-48009

The Drupal Single Content Sync module, versions 0.0.0 through 1.4.11 , is vulnerable to a Missing Authorization issue (CWE-862 ) that allows for Functionality Misuse . The vulnerability occurs because the module's export feature, while intentionally bypassing some access controls to allow content...

CVE-2025-48009 Single Content Sync - Moderately critical - Access bypass - SA-CONTRIB-2025-060

Missing Authorization vulnerability in Drupal Single Content Sync allows Functionality Misuse.This issue affects Single Content Sync: from 0.0.0 before 1.4.12...

CVE-2025-48009 Single Content Sync - Moderately critical - Access bypass - SA-CONTRIB-2025-060

Missing Authorization vulnerability in Drupal Single Content Sync allows Functionality Misuse.This issue affects Single Content Sync: from 0.0.0 before 1.4.12...

CVE-2025-48009 Single Content Sync - Moderately critical - Access bypass - SA-CONTRIB-2025-060

Missing Authorization vulnerability in Drupal Single Content Sync allows Functionality Misuse.This issue affects Single Content Sync: from 0.0.0 before 1.4.12...