17335 matches found
PT-2026-97660
Name of the Vulnerable Software and Affected Versions Drupal affected versions not specified Description Insufficient sanitization of tooltips and help text within the Webform module allows for cross-site scripting XSS, a technique where malicious scripts are injected into trusted websites...
PT-2026-97661
Name of the Vulnerable Software and Affected Versions Drupal Webform module affected versions not specified Description When the Webform module is used with JSON:API enabled, submissions may be cached without varying correctly by the authenticated user. This occurs when a webform is configured to...
PT-2026-97654
Name of the Vulnerable Software and Affected Versions Drupal affected versions not specified Description The Webform module, used for creating forms and processing submissions, contains a flaw in how it handles Remote Post handlers. These handlers send data to external servers via APIs. The modul...
Diba carousel slider - Moderately critical - Cross Site Scripting (XSS) - SA-CONTRIB-2026-191
The Diba Carousel Slider adds a Bootstrap carousel slider block that can be used directly without creating a View or custom integration. When the "Allow HTML description" option is enabled, slide descriptions are rendered using the raw stored field value instead of the field's rendered output. Th...
Tawk.to - Live chat application - Critical - Cross Site Request Forgery - SA-CONTRIB-2026-184
This module provides integration of the tawk.to live chat for Drupal sites. The module does not sufficiently validate certain requests. This may allow an attacker to trick an authenticated user into performing unintended actions through a Cross-Site Request Forgery CSRF vulnerability...
REST & JSON API Authentication for Drupal - Moderately critical - Access bypass - SA-CONTRIB-2026-182
This module enables you to add an extra authentication layer to the API. The module does not sufficiently validate authentication requirements for all API requests, which can result in an access bypass vulnerability...
PT-2026-97653
Name of the Vulnerable Software and Affected Versions Drupal Webform module affected versions not specified Description The Webform module fails to sufficiently sanitize text counter configuration before passing options to the bundled jQuery Text Counter library. This flaw allows markup from...
PT-2026-97659
Name of the Vulnerable Software and Affected Versions Drupal Webform versions 6.2.x through 6.3.x Description The Webform module does not sufficiently restrict access to the custom attributes YAML editor. Users with permissions to create or edit webforms, but lacking permissions to edit the webfo...
PT-2026-97657
Name of the Vulnerable Software and Affected Versions Drupal Webform module affected versions not specified Description The Webform module fails to sufficiently validate an optional token query value. In specific configurations where a form is rendered for anonymous visitors, a malicious request...
Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-158
The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. The module includes a rating element, which did not sufficiently validate its data. Under specific circumstances, this could allow cross-site scripting on a page with a...
Webform - Less critical - Access bypass - SA-CONTRIB-2026-173
The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. The module did not sufficiently restrict access to certain submission view modes. Under certain conditions, a user who can view a submission could access a more...
PT-2026-97658
Name of the Vulnerable Software and Affected Versions Drupal Webform affected versions not specified Description Insufficient validation of a managed file upload element during the processing of new submissions allows a user with submission access to potentially access other managed files they ar...
PT-2026-97678
This module provides integration of the tawk.to live chat for Drupal sites. The module does not sufficiently validate certain requests. This may allow an attacker to trick an authenticated user into performing unintended actions through a Cross-Site Request Forgery CSRF vulnerability...
PT-2026-97656
Name of the Vulnerable Software and Affected Versions Drupal Webform module affected versions not specified Description The Webform Share submodule, which allows site builders to expose webforms for embedding on other sites, contains a flaw where submissions for Ajax-enabled webforms can bypass...
PT-2026-97647
Name of the Vulnerable Software and Affected Versions Drupal affected versions not specified Description The Webform module fails to sufficiently exclude certain format templates from token replacement. This allows an attacker to submit data that is evaluated as template code during the rendering...
PT-2026-97652
Name of the Vulnerable Software and Affected Versions Drupal affected versions not specified Description An issue exists in the Webform module, which is used to create forms and collect submissions. Due to improper sanitization of announcement text used for assistive technologies, specially craft...
PT-2026-97649
Name of the Vulnerable Software and Affected Versions Drupal Webform module affected versions not specified Description The Webform module fails to properly force the download of certain uploaded file types when they are served. In specific site configurations, a file uploaded via a webform can b...
Drupal - Remote Code Execution
Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because of an issue affecting multiple subsystems with default or common module configurations. id: CVE-2018-7600 info: name: Drupal - Remote Code Execution author:...
Drupal SEoL (7.x)
According to its version, Drupal is 7.x. It is, therefore, no longer maintained by its vendor or provider. Lack of support implies that no new security patches for the product will be released by the vendor. As a result, it may contain security vulnerabilities. %NASLMINLEVEL 80900 C Tenable, Inc...
