CVE-2025-31679

The Drupal Ignition Error Pages component is vulnerable to Cross-Site Scripting (XSS) due to improper neutralization of user-controlled input during web page generation. This flaw allows an attacker to inject and execute malicious scripts in a user's browser via crafted input. The vulnerability a...

CVE-2025-31679 Ignition Error Pages - Critical - Cross Site Scripting - SA-CONTRIB-2025-007

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Ignition Error Pages allows Cross-Site Scripting XSS.This issue affects Ignition Error Pages: from 0.0.0 before 1.0.4...

CVE-2025-31679 Ignition Error Pages - Critical - Cross Site Scripting - SA-CONTRIB-2025-007

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Ignition Error Pages allows Cross-Site Scripting XSS.This issue affects Ignition Error Pages: from 0.0.0 before 1.0.4...

CVE-2025-31678 AI (Artificial Intelligence) - Moderately critical - Access bypass, Information Disclosure - SA-CONTRIB-2025-004

Missing Authorization vulnerability in Drupal AI Artificial Intelligence allows Forceful Browsing.This issue affects AI Artificial Intelligence: from 0.0.0 before 1.0.3...

CVE-2025-31678 AI (Artificial Intelligence) - Moderately critical - Access bypass, Information Disclosure - SA-CONTRIB-2025-004

Missing Authorization vulnerability in Drupal AI Artificial Intelligence allows Forceful Browsing.This issue affects AI Artificial Intelligence: from 0.0.0 before 1.0.3...

CVE-2025-31678 AI (Artificial Intelligence) - Moderately critical - Access bypass, Information Disclosure - SA-CONTRIB-2025-004

Missing Authorization vulnerability in Drupal AI Artificial Intelligence allows Forceful Browsing.This issue affects AI Artificial Intelligence: from 0.0.0 before 1.0.3...

CVE-2025-31678

The Drupal AI (Artificial Intelligence) module is vulnerable to a Missing Authorization issue (CWE-862), which enables Forceful Browsing . This vulnerability affects versions 0.0.0 through 1.0.2 . An unauthenticated network attacker can bypass authorization controls to access restricted content. ...

CVE-2025-31677 AI (Artificial Intelligence) - Critical - Cross Site Request Forgery - SA-CONTRIB-2025-003

Cross-Site Request Forgery CSRF vulnerability in Drupal AI Artificial Intelligence allows Cross Site Request Forgery.This issue affects AI Artificial Intelligence: from 1.0.0 before 1.0.2...

CVE-2025-31677 AI (Artificial Intelligence) - Critical - Cross Site Request Forgery - SA-CONTRIB-2025-003

Cross-Site Request Forgery CSRF vulnerability in Drupal AI Artificial Intelligence allows Cross Site Request Forgery.This issue affects AI Artificial Intelligence: from 1.0.0 before 1.0.2...

CVE-2025-31677

The Drupal AI (Artificial Intelligence) module is vulnerable to a Cross-Site Request Forgery (CSRF) vulnerability in versions 1.0.0 through 1.0.1 . This flaw allows an attacker to trick an authenticated user into performing unintended actions on the web application without their consent. To remed...

CVE-2025-31677 AI (Artificial Intelligence) - Critical - Cross Site Request Forgery - SA-CONTRIB-2025-003

Cross-Site Request Forgery CSRF vulnerability in Drupal AI Artificial Intelligence allows Cross Site Request Forgery.This issue affects AI Artificial Intelligence: from 1.0.0 before 1.0.2...

CVE-2025-31676

The Drupal Email TFA community module is vulnerable to a weak authentication issue in versions 0.0.0 through 2.0.2 . This flaw allows an attacker to perform brute force attacks to bypass the second factor of authentication. While the impact is significant, it is mitigated by the requirement for t...

CVE-2025-31676 Email TFA - Moderately critical - Access bypass - SA-CONTRIB-2025-001

Weak Authentication vulnerability in Drupal Email TFA allows Brute Force.This issue affects Email TFA: from 0.0.0 before 2.0.3...

CVE-2025-31676 Email TFA - Moderately critical - Access bypass - SA-CONTRIB-2025-001

Weak Authentication vulnerability in Drupal Email TFA allows Brute Force.This issue affects Email TFA: from 0.0.0 before 2.0.3...

CVE-2025-31676 Email TFA - Moderately critical - Access bypass - SA-CONTRIB-2025-001

Weak Authentication vulnerability in Drupal Email TFA allows Brute Force.This issue affects Email TFA: from 0.0.0 before 2.0.3...

CVE-2025-31675 Drupal core - Moderately critical - Cross Site Scripting - SA-CORE-2025-004

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Drupal core allows Cross-Site Scripting XSS.This issue affects Drupal core: from 8.0.0 before 10.3.14, from 10.4.0 before 10.4.5, from 11.0.0 before 11.0.13, from 11.1.0 before 11.1.5. It al...

CVE-2025-31675

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Drupal core allows Cross-Site Scripting XSS.This issue affects Drupal core: from 8.0.0 before 10.3.14, from 10.4.0 before 10.4.5, from 11.0.0 before 11.0.13, from 11.1.0 before 11.1.5. It al...

CVE-2025-31675

A Cross-Site Scripting (XSS) vulnerability exists in Drupal core due to the improper neutralization of input during web page generation. This flaw impacts multiple versions, including Drupal core (8.0.0 before 10.3.14, 10.4.0 before 10.4.5, 11.0.0 before 11.0.13, and 11.1.0 before 11.1.5) and the...

CVE-2025-31675 Drupal core - Moderately critical - Cross Site Scripting - SA-CORE-2025-004

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Drupal core allows Cross-Site Scripting XSS.This issue affects Drupal core: from 8.0.0 before 10.3.14, from 10.4.0 before 10.4.5, from 11.0.0 before 11.0.13, from 11.1.0 before 11.1.5. It al...

CVE-2025-31675 Drupal core - Moderately critical - Cross Site Scripting - SA-CORE-2025-004

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Drupal core allows Cross-Site Scripting XSS.This issue affects Drupal core: from 8.0.0 before 10.3.14, from 10.4.0 before 10.4.5, from 11.0.0 before 11.0.13, from 11.1.0 before 11.1.5. It al...