CVE-2025-31674 Drupal core - Moderately critical - Gadget Chain - SA-CORE-2025-003

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection.This issue affects Drupal core: from 8.0.0 before 10.3.13, from 10.4.0 before 10.4.3, from 11.0.0 before 11.0.12, from 11.1.0 before 11.1.3...

CVE-2024-13305 Entity Form Steps - Moderately critical - Cross site scripting - SA-CONTRIB-2024-071

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Entity Form Steps allows Cross-Site Scripting XSS.This issue affects Entity Form Steps: from 0.0.0 before 1.1.4...

CVE-2024-13298 Tarte au Citron - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-064

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Tarte au Citron allows Cross-Site Scripting XSS.This issue affects Tarte au Citron: from 2.0.0 before 2.0.5...

CVE-2024-13292 Tooltip - Moderately critical - Cross site scripting - SA-CONTRIB-2024-058

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Tooltip allows Cross-Site Scripting XSS.This issue affects Tooltip: from 0.0.0 before 1.1.2...

CVE-2024-13289 Cookiebot + GTM - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-055

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Cookiebot + GTM allows Cross-Site Scripting XSS.This issue affects Cookiebot + GTM: from 0.0.0 before 1.0.18...

CVE-2024-13287 Views SVG Animation - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-051

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Views SVG Animation allows Cross-Site Scripting XSS.This issue affects Views SVG Animation: from 0.0.0 before 1.0.1...

CVE-2024-13287 Views SVG Animation - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-051

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Views SVG Animation allows Cross-Site Scripting XSS.This issue affects Views SVG Animation: from 0.0.0 before 1.0.1...

CVE-2024-13280 Persistent Login - Moderately critical - Access bypass - SA-CONTRIB-2024-044

Insufficient Session Expiration vulnerability in Drupal Persistent Login allows Forceful Browsing.This issue affects Persistent Login: from 0.0.0 before 1.8.0, from 2.0. before 2.2.2...

CVE-2024-13262

The View Password module for the Drupal CMS is vulnerable to Cross-Site Scripting (XSS) due to improper input neutralization during web page generation. The root cause is a lack of validation on the classes field, where an administrative user can add arbitrary content to the help icon button for ...

CVE-2024-13252 TacJS - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-016

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal TacJS allows Cross-Site Scripting XSS.This issue affects TacJS: from 0.0.0 before 6.5.0...

CVE-2024-13250

The Drupal Symfony Mailer Lite module (versions 0.0.0 through 1.0.6) is vulnerable to a Cross-Site Request Forgery (CSRF) vulnerability. This flaw arises because the module does not sufficiently protect against malicious links, allowing a remote attacker to forge requests on a user's behalf and t...

CVE-2024-13250 Drupal Symfony Mailer Lite - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2024-014

Cross-Site Request Forgery CSRF vulnerability in Drupal Drupal Symfony Mailer Lite allows Cross Site Request Forgery.This issue affects Drupal Symfony Mailer Lite: from 0.0.0 before 1.0.6...

CVE-2024-13247

The Drupal Coffee module (versions prior to 1.4.0 ) is vulnerable to Cross-Site Scripting (XSS) due to improper neutralization of input during web page generation. Specifically, the module fails to sufficiently escape menu names when displaying them in a shortcut popup , allowing a malicious acto...

CVE-2024-13243 Entity Delete Log - Moderately critical - Access bypass - SA-CONTRIB-2024-007

Missing Authorization vulnerability in Drupal Entity Delete Log allows Forceful Browsing.This issue affects Entity Delete Log: from 0.0.0 before 1.1.1...

CVE-2024-13238 Typogrify - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-002

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Typogrify allows Cross-Site Scripting XSS.This issue affects Typogrify: from 0.0.0 before 1.3.0...

CVE-2024-13237

The Drupal File Entity (fieldable files) module is vulnerable to Cross-Site Scripting (XSS) due to improper neutralization of input during web page generation. The flaw occurs because the module failed to sufficiently validate files during a file replacement scenario, which can lead to multiple e...

Email Contact - Moderately critical - Access bypass - SA-CONTRIB-2024-020

The Email Contact module provides email field display formatters that can display the field as a link to the contact form, or as an inline contact form. The module does not sufficiently handle restricted entity or field access to the mail sending form, when the "Email contact link" formatter is...

Private content - Moderately critical - Access bypass - SA-CONTRIB-2024-012

This module gives each node a 'private' checkbox. If it's set, the node can only be seen by the node author, or users with the 'access private content' permission. The module incorrectly grants access to private nodes under certain specific circumstances. This vulnerability is mitigated by the fa...

Paragraphs admin - Moderately critical - - SA-CONTRIB-2023-049

This module enables you to view all paragraph entities in an admin view. The module contains an access bypass that allows non admin users to access the view. The vulnerability can be mitigated by editing the view to change the permission required to access the page...

Expandable Formatter - Moderately critical - Cross Site Scripting - SA-CONTRIB-2023-028

This module enables you to render a field in an expandable/collapsible region. The module doesn't sufficiently sanitize the field content when displaying it to an end user. This vulnerability is mitigated by the fact that an attacker must have a role capable of creating content that uses the fiel...