DRUPAL-CONTRIB-2024-051

This module enables you to animate an SVG graphic by selecting certain rows in a view. The module doesn't sufficiently sanitize the SVG file before embedding it into the html. This vulnerability is mitigated by the fact that an attacker must have a role with the permission to upload SVG files...

DRUPAL-CONTRIB-2024-050

This module enables you to embed the content of an SVG file into the body html of a node and optionally allows to translate text contained within the image. The module doesn't sufficiently sanitize the SVG file before embedding it into the html. This vulnerability is mitigated by the fact that an...

Drupal Smartling Connector module < 7.x-4.19,< 7.x-3.8 - Unauthenticated Open Redirection vulnerability

Unauthenticated Open Redirection vulnerability discovered by Pierre Rudloff in WordPress Module Smartling Connector versions 7.x-4.19,7.x-3.8...

Drupal Smartling Connector module < 7.x-4.19,< 7.x-3.8 - Authenticated Open Redirection vulnerability

Authenticated Open Redirection vulnerability discovered by Pierre Rudloff in WordPress Module Smartling Connector versions 7.x-4.19,7.x-3.8...

Drupal Smartling Connector module < 7.x-4.19,< 7.x-3.8 - Authenticated Open Redirection vulnerability

Authenticated Open Redirection vulnerability discovered by Pierre Rudloff in WordPress Module Smartling Connector versions 7.x-4.19,7.x-3.8...

Drupal Loft Data Grids module < 7.x-2.7,< 7.x-3.0 - Authenticated Multiple Vulnerabilities

Authenticated Multiple Vulnerabilities discovered by Juraj Nemec in WordPress Module Loft Data Grids versions 7.x-2.7, 7.x-3.0...

Drupal Loft Data Grids module < 7.x-2.7,< 7.x-3.0 - Authenticated Content Injection vulnerability

Authenticated Content Injection vulnerability discovered by Juraj Nemec in WordPress Module Loft Data Grids versions 7.x-2.7,7.x-3.0...

Drupal Smartling Connector module < 7.x-4.19,< 7.x-3.8 - Administrator+ Multiple Vulnerabilities

Administrator+ Multiple Vulnerabilities discovered by Pierre Rudloff in WordPress Module Smartling Connector versions 7.x-4.19, 7.x-3.8...

PT-2025-2102 · Drupal · Drupal Views Svg Animation

Name of the Vulnerable Software and Affected Versions: Drupal Views SVG Animation versions 0.0.0 through 1.0.0 Description: The issue is related to improper neutralization of input during web page generation, which allows Cross-Site Scripting XSS. This can be exploited by a remote attacker to...

Drupal Smartling Connector module < 7.x-4.19,< 7.x-3.8 - Unauthenticated Open Redirection vulnerability

Unauthenticated Open Redirection vulnerability discovered by Pierre Rudloff in WordPress Module Smartling Connector versions 7.x-4.19,7.x-3.8...

Drupal Loft Data Grids module < 7.x-2.7,< 7.x-3.0 - Authenticated Broken Access Control vulnerability

Authenticated Broken Access Control vulnerability discovered by Juraj Nemec in WordPress Module Loft Data Grids versions 7.x-2.7,7.x-3.0...

Drupal Loft Data Grids module < 7.x-2.7,< 7.x-3.0 - Unauthenticated Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure vulnerability discovered by Juraj Nemec in WordPress Module Loft Data Grids versions 7.x-2.7,7.x-3.0...

Drupal Smartling Connector module < 7.x-4.19,< 7.x-3.8 - Unauthenticated Open Redirection vulnerability

Unauthenticated Open Redirection vulnerability discovered by Pierre Rudloff in WordPress Module Smartling Connector versions 7.x-4.19,7.x-3.8...

Drupal Monster Menus module < 9.3.4,9.4.0-9.4.1 - Unauthenticated Remote Code Execution (RCE) vulnerability

Unauthenticated Remote Code Execution RCE vulnerability discovered by Drew Webber in WordPress Module Monster Menus versions 9.3.4,9.4.0-9.4.1...

Drupal Loft Data Grids module < 7.x-2.7,< 7.x-3.0 - Unauthenticated Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS vulnerability discovered by Juraj Nemec in WordPress Module Loft Data Grids versions 7.x-2.7,7.x-3.0...

Smartling Connector - Less critical - Multiple vulnerabilities - SA-CONTRIB-2024-053

Smartling module allows you to translate content in Drupal 7 using the Smartling Translation Management Platform. The module includes an outdated version of the Guzzle package guzzlehttp/guzzle 6.3.3, which has known security vulnerabilities...

Drupal Loft Data Grids module < 7.x-2.7,< 7.x-3.0 - Unauthenticated XML External Entity (XXE) vulnerability

Unauthenticated XML External Entity XXE vulnerability discovered by Juraj Nemec in WordPress Module Loft Data Grids versions 7.x-2.7,7.x-3.0...

PT-2025-2103 · Drupal · Drupal Monster Menus

Name of the Vulnerable Software and Affected Versions: Drupal Monster Menus versions 0.0.0 through 9.3.3 Drupal Monster Menus versions 9.4.0 through 9.4.1 Description: The issue is related to the deserialization of untrusted data, which allows object injection. This can potentially enable a remot...

Drupal Improper Error Handling Vulnerability (SA-CORE-2024-002) - Windows

Drupal is prone to an improper error handling vulnerability. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:drupal:drupal";...

Drupal Improper Error Handling Vulnerability (SA-CORE-2024-002) - Linux

Drupal is prone to an improper error handling vulnerability. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:drupal:drupal";...