Drupal QuickEdit module 跨站请求伪造漏洞

Drupal is an open source content management system developed in PHP by the Drupal community. A cross-site request forgery vulnerability exists in the Drupal QuickEdit module, which allows a remote attacker to trick a victim into visiting a specially crafted web page and performing arbitrary actio...

Drupal 8.9.x < 8.9.19 / 9.1.x < 9.1.13 / 9.2.x < 9.2.6 Multiple Vulnerabilities (drupal-2021-09-15)

According to its self-reported version, the instance of Drupal running on the remote web server is 8.9.x prior to 8.9.19, 9.1.x prior to 9.1.13, or 9.2.x prior to 9.2.6. It is, therefore, affected by multiple vulnerabilities. - Under some circumstances, the Drupal core JSON:API module does not...

Cross-Site Scripting (XSS)

Drupal is susceptible to cross-site scripting XSS attacks. The attacks are possible because the entityLabel and fieldLabel parameters are not properly encoded. When an admin goes to edit the node using quickedit module, the entered script will execute...

QuickEdit Text Editor - Customized SSL, Dangerous filesystem permissions, WebView SSL handling enabled vulnerabilities

HackApp vulnerability scanner discovered that application QuickEdit Text Editor published at the 'play' market has multiple vulnerabilities...