BIT-DRUPAL-2025-31674 Drupal core - Moderately critical - Gadget Chain - SA-CORE-2025-003

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection.This issue affects Drupal core: from 8.0.0 before 10.3.13, from 10.4.0 before 10.4.3, from 11.0.0 before 11.0.12, from 11.1.0 before 11.1.3...

CVE-2025-3733

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal baguetteBox.Js allows Cross-Site Scripting XSS.This issue affects baguetteBox.Js: from 0.0.0 before 2.0.4, from 3.0.0 before 3.0.1...

CVE-2025-3738

Vulnerability in Drupal Google Optimize.This issue affects Google Optimize:...

📄 Drupal 11.x-dev Path Disclosure

Drupal version 11.x-dev suffers from a path disclosure vulnerability. !/usr/bin/env python Exploit Title: Drupal 11.x-dev - Full Path Disclosure Date: 2025-04-16 Exploit Author: Milad Karimi Ex3ptionaL Contact: [email protected] Zone-H: www.zone-h.org/archive/notifier=Ex3ptionaL MiRROR-H:...

Drupal 11.x-dev - Full Path Disclosure

!/usr/bin/env python Exploit Title: Drupal 11.x-dev - Full Path Disclosure Date: 2025-04-16 Exploit Author: Milad Karimi Ex3ptionaL Contact: [email protected] Zone-H: www.zone-h.org/archive/notifier=Ex3ptionaL MiRROR-H: https://mirror-h.org/search/hacker/49626/ Version: 11.x-dev CVE:...

CVE-2025-3738

Vulnerability in Drupal Google Optimize.This issue affects Google Optimize:...

CVE-2025-3736

Vulnerability in Drupal Simple GTM.This issue affects Simple GTM:...

CVE-2025-3739 Drupal 8 Google Optimize Hide Page - Critical - Unsupported - SA-CONTRIB-2025-040

Vulnerability in Drupal Drupal 8 Google Optimize Hide Page.This issue affects Drupal 8 Google Optimize Hide Page:...

CVE-2025-3733 baguetteBox.js - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-034

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal baguetteBox.Js allows Cross-Site Scripting XSS.This issue affects baguetteBox.Js: from 0.0.0 before 2.0.4, from 3.0.0 before 3.0.1...

Drupal 安全漏洞

Drupal is an open source content management system developed in the PHP language by the Drupal community. A security vulnerability exists in Drupal versions prior to 4.9.0 that stems from a lack of authentication for critical functions, which could lead to improper access control...

CVE-2025-3129

Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Access code allows Brute Force.This issue affects Access code: from 0.0.0 before 2.0.4...

CVE-2025-31687

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal SpamSpan filter allows Cross-Site Scripting XSS.This issue affects SpamSpan filter: from 0.0.0 before 3.2.1...

CVE-2025-31694

Incorrect Authorization vulnerability in Drupal Two-factor Authentication TFA allows Forceful Browsing.This issue affects Two-factor Authentication TFA: from 0.0.0 before 1.10.0...

CVE-2025-3129

Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Access code allows Brute Force.This issue affects Access code: from 0.0.0 before 2.0.4...

CVE-2025-3129

The Drupal Access code module is vulnerable to a Brute Force attack due to an improper restriction of excessive authentication attempts. This issue affects versions prior to 2.0.4 . The module allows users to log in using a short access code instead of a username/password combination; however, it...

CVE-2025-3129 Access code - Moderately critical - Access bypass - SA-CONTRIB-2025-028

Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Access code allows Brute Force.This issue affects Access code: from 0.0.0 before 2.0.4...

GHSA-PWJQ-FX3V-8F9R Drupal AI Vulnerable to OS Command Injection via Optional Automator Types

Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in Drupal AI Artificial Intelligence allows OS Command Injection. This issue affects AI Artificial Intelligence: from 0.0.0 before 1.0.5...

CVE-2025-3059

Vulnerability in Drupal Profile Private.This issue affects Profile Private:...

CVE-2025-3060

A security vulnerability exists in the Drupal Flattern – Multipurpose Bootstrap Business Profile module, affecting all versions (. ). The flaw is categorized as an Authenticated Other Vulnerability Type , where an attack requires administrator privileges and can impact the confidentiality, integr...

CVE-2025-31695

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Link field display mode formatter allows Cross-Site Scripting XSS.This issue affects Link field display mode formatter: from 0.0.0 before 1.6.0...