CVE-2025-31688

CVE-2025-31688 is a Cross-Site Request Forgery (CSRF) vulnerability in the Drupal Configuration Split module. The issue affects Configuration Split versions prior to 1.10.0 and prior to 2.0.2 (i.e., 0.0.0–1.9.x and 2.0.0–2.0.1). The root cause is improper CSRF protection on routes that enable/dis...

CVE-2025-31688 Configuration Split - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-017

Cross-Site Request Forgery CSRF vulnerability in Drupal Configuration Split allows Cross Site Request Forgery.This issue affects Configuration Split: from 0.0.0 before 1.10.0, from 2.0.0 before 2.0.2...

CVE-2025-31687

CVE-2025-31687 records an XSS vulnerability in the Drupal SpamSpan filter. Public sources indicate the issue affects SpamSpan filter versions 0.0.0 through 3.2.0 and stems from improper input neutralization during web page generation, enabling cross-site scripting. The vulnerability is fixed in v...

CVE-2025-31687 SpamSpan filter - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-016

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal SpamSpan filter allows Cross-Site Scripting XSS.This issue affects SpamSpan filter: from 0.0.0 before 3.2.1...

CVE-2025-31687 SpamSpan filter - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-016

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal SpamSpan filter allows Cross-Site Scripting XSS.This issue affects SpamSpan filter: from 0.0.0 before 3.2.1...

CVE-2025-31687 SpamSpan filter - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-016

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal SpamSpan filter allows Cross-Site Scripting XSS.This issue affects SpamSpan filter: from 0.0.0 before 3.2.1...

CVE-2025-31686

CVE-2025-31686 concerns Drupal Open Social. Multiple connected sources confirm a Missing Authorization vulnerability allowing Forceful Browsing in Open Social variants: 0.0.0…12.3.10 and 12.4.0…12.4.9. Root cause is lack of authorization checks enabling access to restricted resources. Impact desc...

CVE-2025-31685 Open Social - Moderately critical - Access bypass - SA-CONTRIB-2025-014

Missing Authorization vulnerability in Drupal Open Social allows Forceful Browsing.This issue affects Open Social: from 0.0.0 before 12.3.11, from 12.4.0 before 12.4.10...

CVE-2025-31685 Open Social - Moderately critical - Access bypass - SA-CONTRIB-2025-014

Missing Authorization vulnerability in Drupal Open Social allows Forceful Browsing.This issue affects Open Social: from 0.0.0 before 12.3.11, from 12.4.0 before 12.4.10...

CVE-2025-31685

CVE-2025-31685 affects Drupal Open Social. A Missing Authorization vulnerability allows Forceful Browsing across Open Social versions affected: 0.0.0–12.3.10 and 12.4.0–12.4.9. Root cause is lack of proper access control, enabling unauthenticated access to otherwise restricted resources. Reported...

CVE-2025-31684

CVE-2025-31684 affects Drupal OAuth2 Client (versions 0.0.0 through 4.1.2). The issue is a Cross-Site Request Forgery (CSRF) vulnerability in the OAuth2 Client module that can enable unauthorized actions on behalf of a user. According to CVSS data, impact includes high integrity and availability ...

CVE-2025-31684 OAuth2 Client - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-013

Cross-Site Request Forgery CSRF vulnerability in Drupal OAuth2 Client allows Cross Site Request Forgery.This issue affects OAuth2 Client: from 0.0.0 before 4.1.3...

CVE-2025-31684 OAuth2 Client - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-013

Cross-Site Request Forgery CSRF vulnerability in Drupal OAuth2 Client allows Cross Site Request Forgery.This issue affects OAuth2 Client: from 0.0.0 before 4.1.3...

CVE-2025-31683 Google Tag - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-012

Cross-Site Request Forgery CSRF vulnerability in Drupal Google Tag allows Cross Site Request Forgery.This issue affects Google Tag: from 0.0.0 before 1.8.0, from 2.0.0 before 2.0.8...

CVE-2025-31683 Google Tag - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-012

Cross-Site Request Forgery CSRF vulnerability in Drupal Google Tag allows Cross Site Request Forgery.This issue affects Google Tag: from 0.0.0 before 1.8.0, from 2.0.0 before 2.0.8...

CVE-2025-31683

The CVE-2025-31683 entry concerns a Cross-Site Request Forgery (CSRF) vulnerability in the Drupal Google Tag module. Affected versions are Google Tag 0.0.0 through 1.7.x and 2.0.0 through 2.0.7 (i.e., before 1.8.0 and before 2.0.8). The issue arises from CSRF weaknesses in Drupal Google Tag’s req...

CVE-2025-31683 Google Tag - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-012

Cross-Site Request Forgery CSRF vulnerability in Drupal Google Tag allows Cross Site Request Forgery.This issue affects Google Tag: from 0.0.0 before 1.8.0, from 2.0.0 before 2.0.8...

CVE-2025-31682 Google Tag - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-011

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Google Tag allows Cross-Site Scripting XSS.This issue affects Google Tag: from 0.0.0 before 1.8.0, from 2.0.0 before 2.0.8...

CVE-2025-31682

The CVE-2025-31682 entry describes an XSS vulnerability in the Drupal Google Tag module caused by improper input neutralization during web page generation. Affected versions are: 0.0.0 through 1.7.x and 2.0.0 through 2.0.7 . The issue can be exploited to inject malicious scripts via the Google Ta...

CVE-2025-31682 Google Tag - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-011

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Google Tag allows Cross-Site Scripting XSS.This issue affects Google Tag: from 0.0.0 before 1.8.0, from 2.0.0 before 2.0.8...