550 matches found
DRUPAL-CONTRIB-2025-117
This module allows uploading a zip file and extracting its content in the public file directory to serve this content from a Drupal website. These zip files may contain arbitrary HTML or SVG content that could allow cross-site scripting vulnerabilities. While this is an expected feature, the modu...
CKEditor 5 Premium Features - Moderately critical - Access bypass - SA-CONTRIB-2025-118
The module provides instant integration of the official CKEditor 5 Premium plugins into the Drupal editor configuration. This module has a path traversal vulnerability, which allows an access bypass to restricted image files in the system. This access bypass is possible for any account with a Vie...
Mini site - Moderately critical - Cross-Site Scripting - SA-CONTRIB-2025-117
This module allows uploading a zip file and extracting its content in the public file directory to serve this content from a Drupal website. These zip files may contain arbitrary HTML or SVG content that could allow cross-site scripting vulnerabilities. While this is an expected feature, the modu...
Entity Share - Moderately critical - Access bypass, Information Disclosure - SA-CONTRIB-2025-123
This module enables you to deploy content from one Drupal website to another. The module provides some default configuration without sufficient access control. This vulnerability is mitigated by the fact that an administrator can add some default access control permission...
Disable Login Page - Critical - Access bypass - SA-CONTRIB-2025-124
This module enables you to disable the standard Drupal login form /user/login so site owners can prevent interactive logins via the UI. The module does not sufficiently block authentication when the REST/HTTP login route is used. An attacker or legitimate user with valid credentials can...
DRUPAL-CONTRIB-2025-116
This module provides the ability to convert any entity form into a simple multi-step form. The module doesn’t sufficiently filter certain user-provided text leading to a cross-site scripting XSS vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with the...
CVE-2025-12466
The Drupal Simple OAuth (OAuth2) & OpenID Connect module is vulnerable to an Authentication Bypass Using an Alternate Path or Channel (CWE-288). This flaw allows an attacker to bypass authentication mechanisms, potentially gaining unauthorized access to the system. The issue affects versions 6.0....
CVE-2025-12082
An Incorrect Authorization vulnerability in the Drupal CivicTheme Design System allows for Forceful Browsing . This issue impacts versions from 0.0.0 before 1.12.0 . The root cause stems from improper authorization, which could lead to unauthorized access to restricted information. Remediation is...
Simple OAuth (OAuth2) & OpenID Connect - Critical - Access bypass - SA-CONTRIB-2025-114
This module introduces an OAuth 2.0 authorization server, which can be configured to protect your Drupal instance with access tokens, or allow clients to request new access tokens and refresh them. The module doesn't sufficiently respect granted scopes, it affects all access checks that are based...
Drupal CivicTheme Design System module < 1.12.0 - Unauthenticated Sensitive Data Exposure vulnerability
Unauthenticated Sensitive Data Exposure vulnerability discovered by Lee Rowlands larowlan in WordPress Module CivicTheme Design System versions 1.12.0...
Drupal CivicTheme Design System module < 1.12.0 - Unauthenticated Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS vulnerability discovered by Adam Bramley acbramley in WordPress Module CivicTheme Design System versions 1.12.0...
EUVD-2010-3421
Malware in sbrugna...
EUVD-2009-3756
Malware in sbrugna...
EUVD-2008-6868
Malware in sbrugna...
EUVD-2009-4037
Malware in sbrugna...
EUVD-2008-2268
Malware in sbrugna...
EUVD-2006-3468
Malware in sbrugna...
EUVD-2008-6796
Malware in sbrugna...