Drupal OAuth2 Server module < 2.1.0 - Unauthenticated Broken Access Control vulnerability

Unauthenticated Broken Access Control vulnerability discovered by Pierre Rudloff prudloff in WordPress Module OAuth2 Server versions 2.1.0...

Cache Utility - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-019

The Cache Utility module provides an ability to view status and flush various caches. The module doesn't sufficiently protect against Cross Site Request Forgery CSRF attacks by validating user identity and intent when flushing a cache...

General Data Protection Regulation - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-018

The GDPR Task submodule enables you to create GDPR tasks. The module doesn't sufficiently protect against Cross Site Request Forgery CSRF attacks by validating user identity and intent when creating tasks...

Drupal 10.4.x < 10.4.3 Multiple Vulnerabilities

According to its self-reported version number, the detected Drupal application is affected by multiple vulnerabilities : - Drupal core doesn't sufficiently filter error messages under certain circumstances, leading to a reflected Cross Site Scripting vulnerability XSS. - Bulk operations allow...

Drupal 8.0.x < 10.3.13 Multiple Vulnerabilities

According to its self-reported version number, the detected Drupal application is affected by multiple vulnerabilities : - Drupal core doesn't sufficiently filter error messages under certain circumstances, leading to a reflected Cross Site Scripting vulnerability XSS. - Bulk operations allow...

Drupal 11.0.x < 11.0.12 Multiple Vulnerabilities

According to its self-reported version number, the detected Drupal application is affected by multiple vulnerabilities : - Drupal core doesn't sufficiently filter error messages under certain circumstances, leading to a reflected Cross Site Scripting vulnerability XSS. - Bulk operations allow...

Drupal 11.1.x < 11.1.3 Multiple Vulnerabilities

According to its self-reported version number, the detected Drupal application is affected by multiple vulnerabilities : - Drupal core doesn't sufficiently filter error messages under certain circumstances, leading to a reflected Cross Site Scripting vulnerability XSS. - Bulk operations allow...

Drupal Multiple Vulnerabilities (SA-CORE-2025-001, SA-CORE-2025-002, SA-CORE-2025-003) - Windows

Drupal is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:drupal:drupal"; ifdescription...

Drupal Multiple Vulnerabilities (SA-CORE-2025-001, SA-CORE-2025-002, SA-CORE-2025-003) - Linux

Drupal is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:drupal:drupal"; ifdescription...

Drupal core 8.0.0-10.3.12,10.4.0-10.4.2,11.0.0-11.0.11,11.1.0-11.1.2 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by ? in WordPress Core Drupal versions 8.0.0-10.3.12,10.4.0-10.4.2,11.0.0-11.0.11,11.1.0-11.1.2...

DRUPAL-CORE-2025-003

Drupal core contains a potential PHP Object Injection vulnerability that if combined with another exploit could lead to Arbitrary File Inclusion. Techniques exist to escalate this attack to Remote Code Execution. It is not directly exploitable. This issue is mitigated by the fact that in order fo...

DRUPAL-CORE-2025-002

Bulk operations allow authorized users to modify several nodes at once from the Content page /admin/content. A site builder can also add bulk operations to other pages using Views. A bug in the core Actions system allows some users to modify some fields using bulk actions that they do not have...

DRUPAL-CORE-2025-001

Drupal core doesn't sufficiently filter error messages under certain circumstances, leading to a reflected Cross Site Scripting vulnerability XSS. Sites are encouraged to update. There are not yet public documented steps to exploit this, but there may be soon given the nature of this issue. This...

Drupal core 8.0.0-10.3.12,10.4.0-10.4.2,11.0.0-11.0.11,11.1.0-11.1.2 - Authenticated Other Vulnerability Type vulnerability

Authenticated Other Vulnerability Type vulnerability discovered by anzuukino in WordPress Core Drupal versions 8.0.0-10.3.12,10.4.0-10.4.2,11.0.0-11.0.11,11.1.0-11.1.2...

Drupal 10.3.x < 10.3.13 / 10.3.x < 10.3.13 / 10.4.x < 10.4.3 / 10.4.x < 10.4.3 / 11.x < 11.0.12 / 11.x < 11.0.12 / 11.1.x < 11.1.3 / 11.1.x < 11.1.3 Multiple Vulnerabilities (drupal-2025-02-19)

According to its self-reported version, the instance of Drupal running on the remote web server is 10.3.x prior to 10.3.13, 10.3.x prior to 10.3.13, 10.4.x prior to 10.4.3, 10.4.x prior to 10.4.3, 11.x prior to 11.0.12, 11.x prior to 11.0.12, 11.1.x prior to 11.1.3, or 11.1.x prior to 11.1.3. It...

Drupal core 8.0.0-10.3.12,10.4.0-10.4.2,11.0.0-11.0.11,11.1.0-11.1.2 - Authenticated Broken Access Control vulnerability

Authenticated Broken Access Control vulnerability discovered by jeff cardwell in WordPress Core Drupal versions 8.0.0-10.3.12,10.4.0-10.4.2,11.0.0-11.0.11,11.1.0-11.1.2...

Drupal core - Critical - Cross site scripting - SA-CORE-2025-001

Drupal core doesn't sufficiently filter error messages under certain circumstances, leading to a reflected Cross Site Scripting vulnerability XSS. Sites are encouraged to update. There are not yet public documented steps to exploit this, but there may be soon given the nature of this issue. This...

Drupal core 8.0.0-10.3.12,10.4.0-10.4.2,11.0.0-11.0.11,11.1.0-11.1.2 - Unauthenticated Reflected Cross Site Scripting (XSS) vulnerability

Unauthenticated Reflected Cross Site Scripting XSS vulnerability discovered by Arne arkepp in WordPress Core Drupal versions 8.0.0-10.3.12,10.4.0-10.4.2,11.0.0-11.0.11,11.1.0-11.1.2...

Drupal core - Moderately critical - Gadget Chain - SA-CORE-2025-003

Drupal core contains a potential PHP Object Injection vulnerability that if combined with another exploit could lead to Arbitrary File Inclusion. Techniques exist to escalate this attack to Remote Code Execution. It is not directly exploitable. This issue is mitigated by the fact that in order fo...

Drupal core - Moderately critical - Access bypass - SA-CORE-2025-002

Bulk operations allow authorized users to modify several nodes at once from the Content page /admin/content. A site builder can also add bulk operations to other pages using Views. A bug in the core Actions system allows some users to modify some fields using bulk actions that they do not have...