CVE-2025-48923

The Drupal Toc.Js module (versions 0.0.0 through 3.2.1) is vulnerable to a persistent Cross-Site Scripting (XSS) attack due to improper neutralization of input during web page generation. Specifically, the module fails to sufficiently sanitize data attributes , which allows an attacker to execute...

CVE-2025-48914

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal COOKiES Consent Management allows Cross-Site Scripting XSS.This issue affects COOKiES Consent Management: from 0.0.0 before 1.2.15...

CVE-2025-48917

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal EU Cookie Compliance GDPR Compliance allows Cross-Site Scripting XSS.This issue affects EU Cookie Compliance GDPR Compliance: from 0.0.0 before 1.26.0...

CVE-2025-48915

The Drupal COOKiES Consent Management module (versions 0.0.0 through 1.2.14 ) is vulnerable to Cross-Site Scripting (XSS) due to improper input neutralization during web page generation. The flaw exists because the module fails to adequately verify if provided JavaScript code originates from auth...

CVE-2025-48914 COOKiES Consent Management - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-075

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal COOKiES Consent Management allows Cross-Site Scripting XSS.This issue affects COOKiES Consent Management: from 0.0.0 before 1.2.15...

CVE-2025-48914 COOKiES Consent Management - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-075

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal COOKiES Consent Management allows Cross-Site Scripting XSS.This issue affects COOKiES Consent Management: from 0.0.0 before 1.2.15...

CVE-2025-48920

The Drupal etracker web statistics tracking module is vulnerable to Cross-Site Scripting (XSS) due to improper neutralization of input during web page generation. Specifically, the cookies_etracker submodule allows the inclusion of inline JavaScript in consent management without adequately verify...

CVE-2025-48919 Simple Klaro - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-073

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Simple Klaro allows Cross-Site Scripting XSS.This issue affects Simple Klaro: from 0.0.0 before 1.10.0...

GHSA-C424-HGG9-9C4W Drupal Quick Node Block Missing Authorization vulnerability

Missing Authorization vulnerability in Drupal Quick Node Block allows Forceful Browsing. This issue affects Quick Node Block: from 0.0.0 before 2.0.0...

CVE-2025-48013 Quick Node Block - Moderately critical - Access bypass - SA-CONTRIB-2025-065

Missing Authorization vulnerability in Drupal Quick Node Block allows Forceful Browsing.This issue affects Quick Node Block: from 0.0.0 before 2.0.0...

CVE-2025-48444 Quick Node Block - Moderately critical - Access bypass - SA-CONTRIB-2025-064

Missing Authorization vulnerability in Drupal Quick Node Block allows Forceful Browsing.This issue affects Quick Node Block: from 0.0.0 before 2.0.0...

CVE-2014-9152

The userresourcecreate function in the Services module 7.x-3.x before 7.x-3.10 for Drupal uses a password of 1 when creating new user accounts, which makes it easier for remote attackers to guess the password via a brute force attack...

CVE-2010-3092

The upload module in Drupal 5.x before 5.23 and 6.x before 6.18 does not properly support case-insensitive filename handling in a database configuration, which allows remote authenticated users to bypass the intended restrictions on downloading a file by uploading a different file with a similar...

CVE-2010-2471

Drupal versions 5.x and 6.x has open redirection...

CVE-2010-2472

Locale module and dependent contributed modules in Drupal 6.x before 6.16 and 5.x before version 5.22 do not sanitize the display of language codes, native and English language names properly which could allow an attacker to perform a cross-site scripting XSS attack. This vulnerability is mitigat...

CVE-2012-5654

The Nodewords: D6 Meta Tags module before 6.x-1.14 for Drupal, when configured to automatically generate description meta tags from node text, does not properly filter node content when creating tags, which might allow remote attackers to obtain sensitive information by reading the 1 description,...

CVE-2012-5543

The Feeds module 7.x-2.x before 7.x-2.0-alpha6 for Drupal, when a field is mapped to the node's author, does not properly check permissions, which allows remote attackers to create arbitrary nodes via a crafted source feed...

CVE-2012-5587

Cross-site scripting XSS vulnerability in the Email Field module 6.x-1.x before 6.x-1.3 for Drupal allows remote attackers to inject arbitrary web script or HTML via the mailto link...

CVE-2012-2310

Cross-site scripting XSS vulnerability in the cctags module for Drupal 6.x-1.x before 6.x-1.10 and 7.x-1.x before 7.x-1.10 allows remote authenticated users with certain roles to inject arbitrary web script or HTML via unspecified vectors...

CVE-2012-4493

Cross-site scripting XSS vulnerability in the administrative interface in the Better Revisions module 7.x-1.x before 7.x-1.1 for Drupal allows remote authenticated users with the "administer better revisions" permission to inject arbitrary web script or HTML via unspecified vectors...