CVE-2025-7717: Missing Authorization

Missing Authorization vulnerability in Drupal File Download allows Forceful Browsing.This issue affects File Download: from 0.0.0 before 1.9.0, from 2.0.0 before 2.0.1...

CVE-2025-7393: Improper Restriction of Excessive Authentication Attempts

Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Mail Login allows Brute Force.This issue affects Mail Login: from 3.0.0 before 3.2.0, from 4.0.0 before 4.2.0...

CVE-2025-7716: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Real-time SEO for Drupal allows Cross-Site Scripting XSS.This issue affects Real-time SEO for Drupal: from 2.0.0 before 2.2.0...

CVE-2025-7715: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Block Attributes allows Cross-Site Scripting XSS.This issue affects Block Attributes: from 0.0.0 before 1.1.0, from 2.0.0 before 2.0.1...

Drupal Mail Login 安全漏洞

Drupal Mail Login is an email address login plugin for the Drupal community. A security vulnerability exists in Drupal Mail Login versions prior to 3.2.0 and prior to 4.2.0, which stems from an improperly restricted authentication attempt that could lead to a brute force cracking attack...

CVE-2025-48294

Server-Side Request Forgery SSRF vulnerability in Kerfred FG Drupal to WordPress fg-drupal-to-wp allows Server Side Request Forgery.This issue affects FG Drupal to WordPress: from n/a through = 3.90.0...

CVE-2025-48294

Server-Side Request Forgery SSRF vulnerability in Kerfred FG Drupal to WordPress fg-drupal-to-wp allows Server Side Request Forgery.This issue affects FG Drupal to WordPress: from n/a through = 3.90.0...

CVE-2025-48294 WordPress FG Drupal to WordPress plugin <= 3.90.0 - Server Side Request Forgery (SSRF) Vulnerability

Server-Side Request Forgery SSRF vulnerability in Kerfred FG Drupal to WordPress allows Server Side Request Forgery. This issue affects FG Drupal to WordPress: from n/a through 3.90.0...

CVE-2025-48294

CVE-2025-48294 is an SSRF vulnerability in the FG Drupal to WordPress plugin (Kerfred FG Drupal to WordPress) affecting versions from n/a up to 3.90.0. The issue is described as an authenticated (Admin+) Server-Side Request Forgery vulnerability, with patch status indicating a fix in later than 3...

CVE-2025-48294 WordPress FG Drupal to WordPress plugin <= 3.90.0 - Server Side Request Forgery (SSRF) Vulnerability

Server-Side Request Forgery SSRF vulnerability in Kerfred FG Drupal to WordPress fg-drupal-to-wp allows Server Side Request Forgery.This issue affects FG Drupal to WordPress: from n/a through = 3.90.0...

PT-2025-30310

Name of the Vulnerable Software and Affected Versions Drupal Block Attributes versions 0.0.0 through 1.0.9 Drupal Block Attributes versions 2.0.0 through 2.0.0 Description A flaw exists in Drupal Block Attributes that allows for Cross-Site Scripting XSS. This issue is due to improper neutralizati...

WordPress plugin FG Drupal to WordPress 代码问题漏洞

WordPress FG Drupal to WordPress is a plugin tool for migrating Drupal website content to WordPress, which supports the import of basic content such as articles, images, etc., but the free version does not include the comment import function. WordPress FG Drupal to WordPress suffers from a...

Drupal File Download module < 1.9.0,2.0.0 - Unauthenticated Broken Access Control vulnerability

Unauthenticated Broken Access Control vulnerability discovered by Willem Drupal enthousiast willempje2 in WordPress Module File Download versions 1.9.0,2.0.0...

Drupal Real-time SEO for Drupal module 2.0.0-2.1.0 - Unauthenticated Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS vulnerability discovered by Pierre Rudloff prudloff in WordPress Module Real-time SEO for Drupal versions 2.0.0-2.1.0...

Real-time SEO for Drupal - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-091

This module enables you to analyze the content that you're authoring for a website. It shows you a preview of what a search result might look like. The module doesn't sufficiently escape the metadata from content while rendering the preview, opening up the possibility of a XSS attack. This...

PT-2025-29728 · Unknown · Kerfred Fg Drupal To Wordpress

Name of the Vulnerable Software and Affected Versions: Kerfred FG Drupal to WordPress versions n/a through 3.90.0 Description: A Server-Side Request Forgery SSRF vulnerability exists in Kerfred FG Drupal to WordPress, allowing Server Side Request Forgery. Recommendations: Update Kerfred FG Drupal...

CVE-2025-48294: Server-Side Request Forgery (SSRF)

Server-Side Request Forgery SSRF vulnerability in Kerfred FG Drupal to WordPress fg-drupal-to-wp allows Server Side Request Forgery.This issue affects FG Drupal to WordPress: from n/a through = 3.90.0...

CVE-2025-7031

Missing Authentication for Critical Function vulnerability in Drupal Config Pages Viewer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Config Pages Viewer: from 0.0.0 before 1.0.4...

CVE-2025-7030

Privilege Defined With Unsafe Actions vulnerability in Drupal Two-factor Authentication TFA allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Two-factor Authentication TFA: from 0.0.0 before 1.11.0...

DRUPAL-CONTRIB-2025-088

This module enables users to login by email address with the minimal configurations. The module included some protection against brute force attacks on the login form, however they were incomplete. An attacker could bypass the brute force protection allowing them to potentially gain access to an...