CVE-2026-114541

The Frontend Editing module for Drupal (versions 0.0.0 to 1.9.3 ) is vulnerable to Cross-Site Request Forgery (CSRF) . The module fails to sufficiently protect routes used to delete and reorder paragraphs on rendered pages. An attacker could trick a logged-in editor with sufficient permissions in...

EUVD-2026-113532

Cross-Site Request Forgery CSRF vulnerability in Drupal Frontend Editing allows Cross Site Request Forgery. This issue affects Frontend Editing versions: from 0.0.0 to 1.9.3...

CVE-2026-114553

The Drupal Frontend Editing module (versions 0.0.0 to 1.9.3 ) is vulnerable to an incorrect authorization issue that allows Forceful Browsing . The root cause is that the module fails to sufficiently check field access permissions when users add, edit, or delete paragraph items in entity referenc...

EUVD-2026-113531

Incorrect Authorization vulnerability in Drupal Frontend Editing allows Forceful Browsing. This issue affects Frontend Editing versions: from 0.0.0 to 1.9.3...

Frontend Editing - Moderately critical - Cross-Site Request Forgery (CSRF) - SA-CONTRIB-2026-240

This module enables editors to edit content, including paragraphs, directly on the rendered page. The module doesn't sufficiently protect the routes used to delete and reorder paragraphs against Cross-Site Request Forgery CSRF. An attacker could trick an editor into visiting a crafted link, which...

Frontend Editing - Less critical - Access bypass - SA-CONTRIB-2026-241

This module enables editors to edit content, including paragraphs, directly on the rendered page. The module doesn't sufficiently check field access permissions when editing, deleting or adding paragraph items to entity reference revisions fields. This vulnerability is mitigated by the fact that ...

PYSEC-2026-3823 django CMS: Missing authorization in `render_object_structure` discloses non-PageContent placeholder structure to low-privileged staff

Summary The django-cms frontend-editing structure endpoint GET //admin/cms/placeholder/object//structure// did not perform an object-level authorization check for non-PageContent objects. Any authenticated, active staff user could request the structure endpoint for a frontend-editable object a...

django CMS: Missing authorization in `render_object_structure` discloses non-PageContent placeholder structure to low-privileged staff

SummaryThe django-cms frontend-editing structure endpointGET //admin/cms/placeholder/object//structure//did not perform an object-level authorization check for non-PageContent objects. Any authenticated, active staff user could request the structure endpoint for a frontend-editable object a model...

EUVD-2009-3609

Malware in sbrugna...

[20210307] - Core - ACL violation within com_content frontend editing

Incorrect ACL checks could allow unauthorized change of the category for an article...

TYPO3 Multiple Vulnerabilities (Oct 2009)

TYPO3 is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:typo3:typo3"; ifdescription...

Sql injection

SQL injection vulnerability in the traditional frontend editing feature in the Frontend Editing subcomponent in TYPO3 4.0.13 and earlier, 4.1.x before 4.1.13, 4.2.x before 4.2.10, and 4.3.x before 4.3beta2 allows remote authenticated users to execute arbitrary SQL commands via unspecified...

CVE-2009-3632

SQL injection vulnerability in the traditional frontend editing feature in the Frontend Editing subcomponent in TYPO3 4.0.13 and earlier, 4.1.x before 4.1.13, 4.2.x before 4.2.10, and 4.3.x before 4.3beta2 allows remote authenticated users to execute arbitrary SQL commands via unspecified...

CVE-2009-3632

SQL injection vulnerability in the traditional frontend editing feature in the Frontend Editing subcomponent in TYPO3 4.0.13 and earlier, 4.1.x before 4.1.13, 4.2.x before 4.2.10, and 4.3.x before 4.3beta2 allows remote authenticated users to execute arbitrary SQL commands via unspecified...

CVE-2009-3632

SQL injection vulnerability in the traditional frontend editing feature in the Frontend Editing subcomponent in TYPO3 4.0.13 and earlier, 4.1.x before 4.1.13, 4.2.x before 4.2.10, and 4.3.x before 4.3beta2 allows remote authenticated users to execute arbitrary SQL commands via unspecified...

CVE-2009-3632: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the traditional frontend editing feature in the Frontend Editing subcomponent in TYPO3 4.0.13 and earlier, 4.1.x before 4.1.13, 4.2.x before 4.2.10, and 4.3.x before 4.3beta2 allows remote authenticated users to execute arbitrary SQL commands via unspecified...