482 matches found
CVE-2025-3900 Colorbox - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-041
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Colorbox allows Cross-Site Scripting XSS.This issue affects Colorbox: from 0.0.0 before 2.1.3...
Drupal Sportsleague module * - Unauthenticated Other Vulnerability Type vulnerability
Unauthenticated Other Vulnerability Type vulnerability discovered by Drupal Security Site in WordPress Module Sportsleague versions...
CVE-2025-3739
Vulnerability in Drupal Drupal 8 Google Optimize Hide Page.This issue affects Drupal 8 Google Optimize Hide Page:...
CVE-2025-3738 Google Optimize - Critical - Unsupported - SA-CONTRIB-2025-039
Vulnerability in Drupal Google Optimize.This issue affects Google Optimize:...
Drupal Simple GTM module * - Authenticated Other Vulnerability Type vulnerability
Authenticated Other Vulnerability Type vulnerability discovered by Drupal Security Site in WordPress Module Simple GTM versions...
Drupal Panelizer module * - Authenticated Other Vulnerability Type vulnerability
Authenticated Other Vulnerability Type vulnerability discovered by Drupal Security Site in WordPress Module Panelizer versions...
Obfuscate - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-029
This module enables you to obfuscate email addresses, to avoid them being easily available to spammers. The module doesn't sufficiently sanitise input when ROT13 encoding is used. This vulnerability is mitigated by the fact that an attacker must have a role with the ability to enter specific HTML...
GHSA-JV6R-MJ9P-9XFF Drupal General Data Protection Regulation Cross-Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery CSRF vulnerability in Drupal General Data Protection Regulation allows Cross Site Request Forgery. This issue affects General Data Protection Regulation: from 0.0.0 before 3.0.1, from 3.1.0 before 3.1.2...
CVE-2025-31697 Formatter Suite - Moderately critical - Cross site scripting - SA-CONTRIB-2025-026
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Formatter Suite allows Cross-Site Scripting XSS.This issue affects Formatter Suite: from 0.0.0 before 2.1.0...
CVE-2025-31691 OAuth2 Server - Moderately critical - Access bypass - SA-CONTRIB-2025-020
Missing Authorization vulnerability in Drupal OAuth2 Server allows Forceful Browsing.This issue affects OAuth2 Server: from 0.0.0 before 2.1.0...
Drupal 10.4.x < 10.4.5 Cross-Site Scripting
According to its self-reported version, the instance of Drupal running on the remote web server is 11.1.x prior to 11.1.5, 11.0.x prior to 11.0.13, 10.4.x prior to 10.4.5 or 8.x prior to 10.3.14. Drupal core Link field attributes are not sufficiently sanitized, which can lead to a Cross-Site...
Drupal Full Path Disclosures
Drupal versions prior to 10.2.9, 10.3.x 10.3.6 and 11.0.x 11.0.5 are affected by Full Path Disclosure even when error logging is None if the value of hashsalt is filegetcontents of a file that does not exist. No source data...
Drupal Drupal Admin LTE theme module * - Authenticated Other Vulnerability Type vulnerability
Authenticated Other Vulnerability Type vulnerability discovered by Drupal Security Site in WordPress Module Drupal Admin LTE theme versions...
Drupal Material Admin module * - Authenticated Other Vulnerability Type vulnerability
Authenticated Other Vulnerability Type vulnerability discovered by Drupal Security Site in WordPress Module Material Admin versions...
CVE-2024-13301
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal OAuth & OpenID Connect Single Sign On – SSO OAuth/OIDC Client allows Cross-Site Scripting XSS.This issue affects OAuth & OpenID Connect Single Sign On – SSO OAuth/OIDC Client: from 3.0.0...
CVE-2024-13305 Entity Form Steps - Moderately critical - Cross site scripting - SA-CONTRIB-2024-071
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Entity Form Steps allows Cross-Site Scripting XSS.This issue affects Entity Form Steps: from 0.0.0 before 1.1.4...
CVE-2024-13299 Megamenu Framework - Critical - Unsupported - SA-CONTRIB-2024-065
Vulnerability in Drupal Megamenu Framework.This issue affects Megamenu Framework:...
CVE-2024-13296
The Drupal Mailjet module (versions before 4.0.1 ) is vulnerable to Object Injection due to a deserialization of untrusted data flaw. Specifically, the module fails to securely pass data to PHP's unserialize() function. This vulnerability can lead to Remote Code Execution (RCE) . While an attack ...