CVE-2019-19826

The Views Dynamic Fields module through 7.x-1.0-alpha4 for Drupal makes insecure unserialize calls in handlers/viewshandlerfilterdynamicfields.inc, as demonstrated by PHP object injection, involving a fieldnames object and an ArchiveTar object, for file deletion. Code execution might also be...

Drupal OAuth2 Client module < 4.1.3 - Unauthenticated Cross Site Request Forgery (CSRF) vulnerability

Unauthenticated Cross Site Request Forgery CSRF vulnerability discovered by Tobias Bähr in WordPress Module OAuth2 Client versions 4.1.3...

The vulnerability of the Diff module in the Drupal system, related to incorrect authentication procedures, allows attackers to access confidential information.

The vulnerability of the Diff module in the Drupal system is related to incorrect authentication procedures. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain access to confidential information...

The vulnerability of the Advanced Varnish CMS system’s Drupal module, related to insufficient protection of operational data, allows attackers to bypass security restrictions and execute a Forceful Browsing attack.

The vulnerability of the Advanced Varnish CMS system, Drupal, is related to insufficient protection of operational data. Exploiting this vulnerability allows a malicious actor to bypass security restrictions and execute a Forceful Browsing attack...

The vulnerability of the Freelinking module in Drupal CMS systems, related to improper authentication, allows attackers to expose protected information and execute a Forceful Browsing attack.

The vulnerability of the Freelinking module in the Drupal CMS system is related to improper authentication. Exploiting this vulnerability allows a malicious actor to disclose protected information and execute a Forceful Browsing attack...

The vulnerability of the Content Entity Clone module in the Drupal CMS system, related to improper authentication, allows attackers to disclose protected information and execute a Forceful Browsing attack.

The vulnerability of the Content Entity Clone module in the Drupal CMS system is related to improper authentication. Exploiting this vulnerability can allow a malicious actor to disclose protected information and execute a Forceful Browsing attack...

The vulnerability of the Basic HTTP Authentication module in Drupal CMS systems allows attackers to circumvent existing security restrictions.

The vulnerability of the Basic HTTP Authentication module in Drupal CMS systems is related to deficiencies in the authentication mechanism. Exploiting this vulnerability allows a malicious actor to bypass existing security restrictions remotely...

The vulnerability of the POST module of the Drupal CMS system allows a hacker to perform a CSRF attack.

The vulnerability of the POST module in the Drupal CMS system is related to the manipulation of cross-site requests. Exploiting this vulnerability allows a malicious actor to perform a CSRF attack remotely...

The vulnerability of the Tarte au Citron module in the Drupal CMS system allows attackers to perform cross-site scripting attacks.

The vulnerability of the Tarte au Citron module in the Drupal CMS system is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks remotely...

The vulnerability of the POST module in the Drupal CMS system allows attackers to perform cross-site scripting attacks.

The vulnerability of the POST module of the Drupal CMS system is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks remotely...

Drupal Information Disclosure Vulnerability (GHSA-mg8j-w93w-xjgc) - Active Check

Drupal is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:drupal:drupal";...

The vulnerability of the Node export module in the Drupal CMS system allows a hacker to execute arbitrary code.

The vulnerability of the Node export module in the Drupal CMS system is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

Drupal Information Disclosure Vulnerability (GHSA-mg8j-w93w-xjgc) - Linux - Version Check

Drupal is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:drupal:drupal";...

Drupal Full Path Disclosures

Drupal versions prior to 10.2.9, 10.3.x 10.3.6 and 11.0.x 11.0.5 are affected by Full Path Disclosure even when error logging is None if the value of hashsalt is filegetcontents of a file that does not exist. No source data...

Drupal Information Disclosure Vulnerability (GHSA-mg8j-w93w-xjgc) - Windows - Version Check

Drupal is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:drupal:drupal";...

DRUPAL-CONTRIB-2025-012

This module enables you to integrate the site with the Google Tag Manager GTM application. The module doesn't sufficiently validate the enabling or disabling of a tag container. The routes involved are not protected against Cross Site Request Forgery CSRF. This vulnerability is mitigated by the...

DRUPAL-CONTRIB-2025-011

This module enables you to integrate the site with the Google Tag Manager GTM application. The module doesn't have the "restrict access" flag on the "administer google\tag\container" permission. A user with this permission can load a GTM container that completely changes the page or inserts...

DRUPAL-CONTRIB-2025-010

The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466s-becoming-owner-maintainer-or-co-mai...

Drupal Google Tag module < 1.8.0,2.0.0-2.0.7 - Unauthenticated Cross Site Request Forgery (CSRF) vulnerability

Unauthenticated Cross Site Request Forgery CSRF vulnerability discovered by Pierre Rudloff in WordPress Module Google Tag versions 1.8.0,2.0.0-2.0.7...

Drupal Google Tag module < 1.8.0,2.0.0-2.0.7 - Authenticated Cross Site Scripting (XSS) vulnerability

Authenticated Cross Site Scripting XSS vulnerability discovered by Pierre Rudloff in WordPress Module Google Tag versions 1.8.0,2.0.0-2.0.7...