Linux Distros Unpatched Vulnerability : CVE-2022-25275

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In some situations, the Image module does not correctly check access to image files not stored in the standard public files directory when generating derivative...

Linux Distros Unpatched Vulnerability : CVE-2019-6341

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Drupal 7 versions prior to 7.65; Drupal 8.6 versions prior to 8.6.13;Drupal 8.5 versions prior to 8.5.14. Under certain circumstances the File module/subsyst...

Drupal AI SEO Link Advisor module < 1.0.6 - Authenticated Other Vulnerability Type vulnerability

Authenticated Other Vulnerability Type vulnerability discovered by Alberto Cocchiara bigbabert in WordPress Module AI SEO Link Advisor versions 1.0.6...

Linux Distros Unpatched Vulnerability : CVE-2015-6658

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Cross-site scripting XSS vulnerability in the Autocomplete system in Drupal 6.x before 6.37 and 7.x before 7.39 allows remote attackers to inject arbitrary web...

Linux Distros Unpatched Vulnerability : CVE-2022-25278

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Under certain circumstances, the Drupal core form API evaluates form element access incorrectly. This may lead to a user being able to alter data they should no...

Linux Distros Unpatched Vulnerability : CVE-2022-25277

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Drupal core sanitizes filenames with dangerous extensions upon upload reference: SA-CORE-2020-012 and strips leading and trailing dots from filenames to prevent...

Linux Distros Unpatched Vulnerability : CVE-2019-6342

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An access bypass vulnerability exists when the experimental Workspaces module in Drupal 8 core is enabled. This can be mitigated by disabling the Workspaces...

Linux Distros Unpatched Vulnerability : CVE-2015-3233

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Open redirect vulnerability in the Overlay module in Drupal 7.x before 7.38 allows remote attackers to redirect users to arbitrary web sites and conduct phishin...

Linux Distros Unpatched Vulnerability : CVE-2017-6381

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A 3rd party development library including with Drupal 8 development dependencies is vulnerable to remote code execution. This is mitigated by the default...

Linux Distros Unpatched Vulnerability : CVE-2024-55636

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Deserialization of Untrusted Data vulnerability in Drupal Core allows Object Injection.This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0...

Linux Distros Unpatched Vulnerability : CVE-2015-6661

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Drupal 6.x before 6.37 and 7.x before 7.39 allows remote attackers to obtain sensitive node titles by reading the menu. CVE-2015-6661 Note that Nessus relies on...

Linux Distros Unpatched Vulnerability : CVE-2017-6929

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A jQuery cross site scripting vulnerability is present when making Ajax requests to untrusted domains. This vulnerability is mitigated by the fact that it...

Linux Distros Unpatched Vulnerability : CVE-2014-5021

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Cross-site scripting XSS vulnerability in the Form API in Drupal 6.x before 6.32 and possibly 7.x before 7.29 allows remote authenticated users with the...

DRUPAL-CONTRIB-2025-094

This module enables you to integrate Google Tag Manager GTM into your Drupal site by allowing administrators to configure and embed GTM container snippets. The module doesn't sufficiently sanitize the GTM container ID under the scenario where a user with the Administer gtm permission enters...

DRUPAL-CONTRIB-2025-093

This module enables you to access an edit page for a config page. The module doesn't sufficiently check the access permissions hookENTITYTYPEaccess wasn't taken into account. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "edit ID config page" an...

Drupal GoogleTag Manager module < 1.10.0 - Authenticated Cross Site Scripting (XSS) vulnerability

Authenticated Cross Site Scripting XSS vulnerability discovered by Pierre Rudloff prudloff in WordPress Module GoogleTag Manager versions 1.10.0...

GoogleTag Manager - Moderately critical - Cross-site scripting - SA-CONTRIB-2025-094

This module enables you to integrate Google Tag Manager GTM into your Drupal site by allowing administrators to configure and embed GTM container snippets. The module doesn't sufficiently sanitize the GTM container ID under the scenario where a user with the Administer gtm permission enters...

drupwn

This is an offensive tool for Drupal enumeration and exploitation. The tool, named Drupwn, is designed to automate Drupal information gathering and exploitation. It can be run in two modes: enum and exploit. The enum mode allows performing enumerations, while the exploit mode allows checking and...

CVE-2025-7716

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Real-time SEO for Drupal allows Cross-Site Scripting XSS.This issue affects Real-time SEO for Drupal: from 2.0.0 before 2.2.0...

CVE-2025-7392

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Cookies Addons allows Cross-Site Scripting XSS.This issue affects Cookies Addons: from 1.0.0 before 1.2.4...