CVE-2025-5682

The Klaro Cookie & Consent Management module for Drupal is vulnerable to a Cross-Site Scripting (XSS) flaw due to the improper neutralization of input during web page generation. Specifically, the module fails to sufficiently sanitize certain HTML attributes , which can lead to persistent XSS att...

CVE-2025-5682 Klaro Cookie & Consent Management - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-080

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Klaro Cookie & Consent Management allows Cross-Site Scripting XSS.This issue affects Klaro Cookie & Consent Management: from 0.0.0 before 3.0.7...

CVE-2025-48921 Open Social - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-079

Cross-Site Request Forgery CSRF vulnerability in Drupal Open Social allows Cross Site Request Forgery.This issue affects Open Social: from 0.0.0 before 12.3.14, from 12.4.0 before 12.4.13...

CVE-2025-48921 Open Social - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-079

Cross-Site Request Forgery CSRF vulnerability in Drupal Open Social allows Cross Site Request Forgery.This issue affects Open Social: from 0.0.0 before 12.3.14, from 12.4.0 before 12.4.13...

CVE-2025-48921

A Cross-Site Request Forgery (CSRF) vulnerability exists in Drupal Open Social , a social networking platform. The flaw stems from a default module that fails to sufficiently protect certain routes from CSRF attacks, specifically those involving event enrollments . This allows an attacker to tric...

CVE-2025-48922 GLightbox - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-078

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal GLightbox allows Cross-Site Scripting XSS.This issue affects GLightbox: from 0.0.0 before 1.0.16...

CVE-2025-48922 GLightbox - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-078

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal GLightbox allows Cross-Site Scripting XSS.This issue affects GLightbox: from 0.0.0 before 1.0.16...

CVE-2025-48922

A Cross-Site Scripting (XSS) vulnerability exists in the Drupal GLightbox JavaScript image and video displayer due to improper input neutralization . The module fails to sufficiently filter user-supplied text for the GLightbox library, allowing attackers to execute malicious scripts. This issue a...

CVE-2025-48922 GLightbox - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-078

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal GLightbox allows Cross-Site Scripting XSS.This issue affects GLightbox: from 0.0.0 before 1.0.16...

CVE-2025-48923 Toc.js - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-077

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Toc.Js allows Cross-Site Scripting XSS.This issue affects Toc.Js: from 0.0.0 before 3.2.1...

CVE-2025-48923 Toc.js - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-077

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Toc.Js allows Cross-Site Scripting XSS.This issue affects Toc.Js: from 0.0.0 before 3.2.1...

CVE-2025-48923

The Drupal Toc.Js module is vulnerable to Cross-site Scripting (XSS) due to improper input neutralization during web page generation. This issue specifically involves the module's failure to sufficiently sanitize data attributes , which could lead to persistent XSS attacks. The vulnerability affe...

CVE-2025-48923 Toc.js - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-077

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Toc.Js allows Cross-Site Scripting XSS.This issue affects Toc.Js: from 0.0.0 before 3.2.1...

Drupal Paragraphs table 安全漏洞

Drupal Paragraphs table is a table generation tool for the Drupal community. A security vulnerability exists in Drupal Paragraphs table versions prior to 2.0.5 that stems from improper input neutralization and could lead to a cross-site scripting attack...

Drupal GLightbox 安全漏洞

Drupal GLightbox is a JavaScript image and video displayer for the Drupal community. A security vulnerability exists in Drupal GLightbox versions prior to 1.0.16 that stems from improper input neutralization and could lead to a cross-site scripting attack...

Drupal Enterprise MFA - TFA for Drupal 安全漏洞

Drupal Enterprise MFA - TFA for Drupal is a module plugin in the Drupal content management system from the Drupal community. A security vulnerability exists in Drupal Enterprise MFA - TFA for Drupal versions prior to 4.8.0, prior to 5.2.1, prior to 5.0., and prior to 5.1. that stems from an...

CVE-2025-6675: Authentication Bypass Using an Alternate Path or Channel

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Enterprise MFA - TFA for Drupal allows Authentication Bypass.This issue affects Enterprise MFA - TFA for Drupal: from 0.0.0 before 4.8.0, from 5.2.0 before 5.2.1, from 0.0.0 before 5.0., from 0.0.0 before 5.1...

PT-2025-26964 · Drupal · Enterprise Mfa - Tfa For Drupal

Name of the Vulnerable Software and Affected Versions: Enterprise MFA - TFA for Drupal versions 0.0.0 through 4.8.0 Enterprise MFA - TFA for Drupal versions 5.2.0 through 5.2.0 Enterprise MFA - TFA for Drupal versions 0.0.0 through 5.0. Enterprise MFA - TFA for Drupal versions 0.0.0 through 5.1...

Drupal Klaro Cookie & Consent Management 安全漏洞

Drupal Klaro Cookie & Consent Management is a module plugin in the Drupal content management system for the Drupal community. A security vulnerability exists in Drupal Klaro Cookie & Consent Management versions prior to 3.0.7, which stems from improper input neutralization and could lead to a...

PT-2025-26966 · Drupal · Drupal Paragraphs

Name of the Vulnerable Software and Affected Versions: Drupal Paragraphs table versions 2.0.0 through 2.0.4 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS, in the Drupal Paragraphs table. This allows for...