Drupal Panelizer module * - Authenticated Other Vulnerability Type vulnerability

Authenticated Other Vulnerability Type vulnerability discovered by Drupal Security Site in WordPress Module Panelizer versions...

Drupal Stage File Proxy 安全漏洞

Drupal Stage File Proxy is a Drupal module for the Drupal community. A security vulnerability exists in Drupal Stage File Proxy versions prior to 3.1.5, which stems from an unrestricted resource allocation and could lead to a flood attack...

Drupal Stage File Proxy module < 3.1.5 - Unauthenticated Denial of Service Attack vulnerability

Unauthenticated Denial of Service Attack vulnerability discovered by Ide Braakman idebr in WordPress Module Stage File Proxy versions 3.1.5...

Drupal Google Optimize module * - Authenticated Other Vulnerability Type vulnerability

Authenticated Other Vulnerability Type vulnerability discovered by Drupal Security Site in WordPress Module Google Optimize versions...

Drupal Google Maps: Store Locator module * - Authenticated Other Vulnerability Type vulnerability

Authenticated Other Vulnerability Type vulnerability discovered by Drupal Security Site in WordPress Module Google Maps: Store Locator versions...

PT-2025-16801 · Google · Google Maps: Store Locator

Name of the Vulnerable Software and Affected Versions: Google Maps: Store Locator versions . Description: The issue is related to a problem in the Google Maps: Store Locator module for Drupal. Recommendations: For Google Maps: Store Locator versions ., update to a version that includes the fix fo...

Drupal Simple GTM 安全漏洞

Drupal Simple GTM is a Drupal module for the Drupal community. A security vulnerability exists in Drupal Simple GTM. No information about this vulnerability is available at this time, so please stay tuned to CNNVD or vendor announcements...

Drupal Google Optimize 安全漏洞

Drupal Google Optimize is an online split testing tool for the Drupal community. A security vulnerability exists in Drupal Google Optimize. No information about this vulnerability is available at this time, so stay tuned to CNNVD or the vendor announcement...

Stage File Proxy - Moderately critical - Denial of Service - SA-CONTRIB-2025-035

Stage File Proxy is a general solution for getting production files on a development server on demand. The module doesn't sufficiently validate the existence of remote files prior to attempting to download and create them. An attacker could send many requests and exhaust disk resources. This...

Google Optimize - Critical - Unsupported - SA-CONTRIB-2025-039

The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466s-becoming-owner-maintainer-or-co-mai...

Drupal 8 Google Optimize Hide Page - Critical - Unsupported - SA-CONTRIB-2025-040

The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466s-becoming-owner-maintainer-or-co-mai...

baguetteBox.js - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-034

The baguetteBox.js module provides integration with baguetteBox.js library. The module doesn't sufficiently sanitize user-supplied text values leading to a cross site scripting vulnerability...

Security Bulletin: Multiple vulnerabilities found in IBM ApplinX.

Summary IBM ApplinX has been updated in order to address the multiple vulnerabilities. Vulnerability Details CVEID:CVE-2015-9251 DESCRIPTION: jQuery is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability usin...

Cross-Site Scripting (XSS)

drupal/core is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to improper neutralization of input during web page generation, allowing malicious scripts to be executed in the context of a user's browser...

CVE-2025-3474

Missing Authentication for Critical Function vulnerability in Drupal Panels allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Panels: from 0.0.0 before 4.9.0...

CVE-2025-3131

Cross-Site Request Forgery CSRF vulnerability in Drupal ECA: Event - Condition - Action allows Cross Site Request Forgery.This issue affects ECA: Event - Condition - Action: from 0.0.0 before 1.1.12, from 2.0.0 before 2.0.16, from 2.1.0 before 2.1.7, from 0.0.0 before 1.2...

CVE-2025-3475

Allocation of Resources Without Limits or Throttling, Incorrect Authorization vulnerability in Drupal WEB-T allows Excessive Allocation, Content Spoofing.This issue affects WEB-T: from 0.0.0 before 1.1.0...

Object Injection

drupal/core is vulnerable to Object Injection. The vulnerability is due to improperly controlled modification of dynamically-determined object attributes, which allows attackers to inject and manipulate objects within the application...

Cross-Site Scripting (XSS)

drupal/core is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to improper neutralization of user-supplied input during web page generation, which allows malicious scripts to be executed in the context of a user's browser...

Incorrect Authorization

drupal/core package is vulnerable to Incorrect Authorization. The vulnerability is due to insufficient access controls. This allows forceful browsing in certain core versions, enabling attackers to access restricted resources...