CVE-2022-25271

Removed by vendor...

Drupal 输入验证错误漏洞

Drupal is an open source content management system developed in the PHP language by the Drupal community. Drupal has a security vulnerability that stems from a flaw in the forms API of Drupal core, where certain contributed or custom module forms may be vulnerable to incorrect input validation...

CVE-2022-25271

Drupal core's form API has a vulnerability where certain contributed or custom modules' forms may be vulnerable to improper input validation. This could allow an attacker to inject disallowed values or overwrite data. Affected forms are uncommon, but in certain cases an attacker could alter...

CVE-2022-25271

Drupal core's form API has a vulnerability where certain contributed or custom modules' forms may be vulnerable to improper input validation. This could allow an attacker to inject disallowed values or overwrite data. Affected forms are uncommon, but in certain cases an attacker could alter...

Drupal core - Moderately critical - Improper input validation - SA-CORE-2022-003

Drupal core's form API has a vulnerability where certain contributed or custom modules' forms may be vulnerable to improper input validation. This could allow an attacker to inject disallowed values or overwrite data. Affected forms are uncommon, but in certain cases an attacker could alter...

DLA-2925-1 drupal7 - security update

Bulletin has no description...

PT-2022-1767 · Drupal +1 · Drupal Core +1

Name of the Vulnerable Software and Affected Versions: Drupal core affected versions not specified Description: The issue is related to insufficient input validation in the Drupal core's form API, which may allow an attacker to inject disallowed values or overwrite data. This could potentially...

PT-2022-1768 · Drupal +2 · Drupal +2

Name of the Vulnerable Software and Affected Versions: Drupal affected versions not specified Description: The issue is related to the Quick Edit module in the Drupal content management system, which does not properly check entity access in some circumstances. This could result in users with the...

CVE-2022-25271

Drupal core's form API has a vulnerability where certain contributed or custom modules' forms may be vulnerable to improper input validation. This could allow an attacker to inject disallowed values or overwrite data. Affected forms are uncommon, but in certain cases an attacker could alter...

CVE-2022-25271

The provided materials confirm CVE-2022-25271 affects Drupal core via the form API. The root cause is improper input validation in certain contributed or custom modules’ forms, potentially allowing an attacker to inject disallowed values or overwrite data. Affected forms are described as uncommon...

Drupal 7.x < 7.88 / 9.2.x < 9.2.13 / 9.3.x < 9.3.6 Multiple Vulnerabilities (drupal-2022-02-16)

According to its self-reported version, the instance of Drupal running on the remote web server is 7.x prior to 7.88, 9.2.x prior to 9.2.13, or 9.3.x prior to 9.3.6. It is, therefore, affected by multiple vulnerabilities. - The Quick Edit module does not properly check entity access in some...

Droopescan - A Plugin-Based Scanner That Aids Security Researchers In Identifying Issues With Several CMSs, Mainly Drupal And Silverstripe

A plugin-based scanner that aids security researchers in identifying issues with several CMS. Usage of droopescan for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability...

Access Restriction Bypass

Drupal is vulnerable to access restriction bypass. The sites with JSON:API module enabled bypass the restriction of access to certain content...

Cross Site Request Forgery

drupal is vulnerable to cross-site request forgery. Lack of secure validation of access to routes allows an attacker to perform cross-site request forgery under some circumstances. It affects the application if the QuickEdit module which comes with the Standard profile is installed...

Information Disclosure

Drupal is vulnerable to information disclosure. File metadata of a permanent private file can be accessed by an attacker who can guess ID of the file...

Cross-site Scripting (XSS)

drupal is vulnerable to cross-site scripting. An attacker is able to inject malicious script via \Drupal\Core\Form\FormBuilder's renderPlaceholderFormAction and/or buildFormAction methods...

Drupal core Cross-site Scripting (XSS) vulnerability in ckeditor

Cross-site Scripting XSS vulnerability in ckeditor of Drupal Core allows attacker to inject XSS. This issue affects: Drupal Core 8.8.x versions prior to 8.8.10.; 8.9.x versions prior to 8.9.6; 9.0.x versions prior to 9.0.6...

Drupal core Cross-site Scripting (XSS) vulnerability

Cross-site Scripting XSS vulnerability in Drupal core's sanitization API fails to properly filter cross-site scripting under certain circumstances. This issue affects: Drupal Core 9.1.x versions prior to 9.1.7; 9.0.x versions prior to 9.0.12; 8.9.x versions prior to 8.9.14; 7.x versions prior to...

GHSA-J586-CJ67-VG4P Cross-Site Request Forgery in Drupal core

The QuickEdit module does not properly validate access to routes, which could allow cross-site request forgery under some circumstances and lead to possible data integrity issues. Sites are only affected if the QuickEdit module which comes with the Standard profile is installed. Removing the...

GHSA-C533-C843-67H8 Drupal core Cross-site Scripting (XSS) vulnerability in ckeditor

Cross-site Scripting XSS vulnerability in ckeditor of Drupal Core allows attacker to inject XSS. This issue affects: Drupal Core 8.8.x versions prior to 8.8.10.; 8.9.x versions prior to 8.9.6; 9.0.x versions prior to 9.0.6...