DRUPAL-CONTRIB-2025-028

This module enables users to log in using a short access code instead of providing a username/password combination. The module doesn't sufficiently protect against brute force attacks to guess a user's access code. This vulnerability is mitigated by the fact that access code based logins are off ...

DRUPAL-CONTRIB-2025-027

This module enables sites to comply with the European cookie law using tarteaucitron.js. The module doesn't sufficiently filter user-supplied markup inside of content leading to a persistent Cross Site Scripting XSS vulnerability. This vulnerability is mitigated by the fact that an attacker needs...

Drupal Email TFA security vulnerability

Drupal Email TFA is a Drupal community module that provides email-based two-factor authentication functionality for Drupal. A security vulnerability exists in Drupal Email TFA versions prior to 2.0.3, which stems from weak authentication and could lead to brute force exploits...

Drupal Matomo Analytics Cross-Site Request Forgery Vulnerability

Drupal Matomo Analytics is a Drupal community module for integrating Matomo an open source web analytics platform into Drupal websites to track and analyze user behavior. A cross-site request forgery vulnerability exists in Drupal Matomo Analytics versions prior to 1.24.0, which stems from...

Drupal General Data Protection Regulation Cross-Site Request Forgery Vulnerability

Drupal General Data Protection Regulation is a module of the Drupal community. A cross-site request forgery vulnerability exists in Drupal General Data Protection Regulation versions prior to 3.0.1 and versions prior to 3.1.0 through 3.1.2, which stems from cross-site request forgery...

DRUPAL-CONTRIB-2025-022

The AI Automators module a submodule of AI enables you to create different automated tasks that fills out a field data using LLM outputs. The module contains a potential PHP Object Injection vulnerability that if combined with another exploit could lead to Arbitrary File Deletion. It may be...

DRUPAL-CONTRIB-2025-020

Provides OAuth2 server functionality based on the oauth2-server-php library. The module does not consistently enforce admin configurations allowing users on a disabled server to still authenticate...

DRUPAL-CONTRIB-2025-018

The GDPR Task submodule enables you to create GDPR tasks. The module doesn't sufficiently protect against Cross Site Request Forgery CSRF attacks by validating user identity and intent when creating tasks...

Drupal OAuth2 Server module < 2.1.0 - Unauthenticated Broken Access Control vulnerability

Unauthenticated Broken Access Control vulnerability discovered by Pierre Rudloff prudloff in WordPress Module OAuth2 Server versions 2.1.0...

DRUPAL-CONTRIB-2025-016

This module enables your site to obfuscate Email addresses and prevent spambots to collect them. The module doesn't sanitize HTML data attributes when an email address link is transformed to separate span HTML elements and then transformed back by JavaScript leading to a Cross Site Scripting XSS...

Smart IP Ban Module Drupal Settings Access

The vulnerability of the Smart IP Ban module in the Drupal CMS system is related to deficiencies in the authentication mechanism. Exploiting this vulnerability allows a malicious actor to remotely view and modify settings...

Advanced Varnish CMS Drupal Module Forceful Browsing

The vulnerability of the Advanced Varnish CMS system, Drupal, is related to insufficient protection of operational data. Exploiting this vulnerability allows a malicious actor to bypass security restrictions and execute a Forceful Browsing attack...

DRUPAL-CONTRIB-2025-012

This module enables you to integrate the site with the Google Tag Manager GTM application. The module doesn't sufficiently validate the enabling or disabling of a tag container. The routes involved are not protected against Cross Site Request Forgery CSRF. This vulnerability is mitigated by the...

Opigno Learning path CMS Drupal Module Code Execution

The vulnerability of the Opigno Learning path CMS system’s Drupal component is related to errors in data processing during syntax analysis of code. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

Open Social CMS Drupal XSS

The vulnerability of the Open Social CMS system, Drupal, is related to the lack of measures taken to protect the structure of web pages. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks remotely...

Acquia DAM CMS CSRF

The vulnerability of Acquia DAM CMS system’s Drupal module is related to the manipulation of cross-site requests. Exploiting this vulnerability allows a malicious actor to perform a CSRF attack or cause service failures...

Open Social CMS Drupal Access Control Bypass

The vulnerability of the Open Social CMS system, Drupal, is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to bypass security restrictions remotely...

Mailjet CMS Drupal Module RCE

The vulnerability of the Mailjet CMS system’s Drupal module is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

Megamenu Framework CMS Drupal Module Code Execution

The vulnerability of the Megamenu Framework CMS system’s Drupal module is related to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

Open Social CMS Drupal Authentication Bypass Forced Browsing

The vulnerability of the Open Social CMS system, Drupal, is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to bypass security restrictions and execute a Forceful Browsing attack...