The vulnerability of the Drupal CMS system’s Image Sizes module, related to the insertion of confidential information into the transmitted data, allows attackers to circumvent security restrictions and execute a Forceful Browsing attack.

The vulnerability of the Image Sizes module in Drupal systems is related to the insertion of confidential information into the transmitted data. Exploiting this vulnerability allows a malicious actor to bypass security restrictions and execute a Forceful Browsing attack...

The vulnerability of the File Entity module in the Drupal CMS system, which allows attackers to disclose protected information

The vulnerability of the Drupal File Entity CMS system is related to the disclosure of information during data transmission. Exploiting this vulnerability can allow a malicious actor, operating remotely, to disclose the protected information...

DRUPAL-CONTRIB-2025-007

This module enables you to render error pages using the Ignition package. The module disables certain Drupal core code and does not perform sufficient filtering, allowing HTML to be injected in certain situations leading to a Cross Site Scripting XSS vulnerability. This vulnerability is mitigated...

DRUPAL-CONTRIB-2025-006

The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466s-becoming-owner-maintainer-or-co-mai...

DRUPAL-CONTRIB-2025-005

The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466s-becoming-owner-maintainer-or-co-mai...

DRUPAL-CONTRIB-2025-004

The AI logging sub-module enables you to log AI requests and responses for debugging and auditing purposes. The module doesn't sufficiently check for access to view the preview listing of the logs. Full log details are correctly protected, and API keys are never logged. This vulnerability is...

Drupal Flattern – Multipurpose Bootstrap Business Profile module * - Authenticated Other Vulnerability Type vulnerability

Authenticated Other Vulnerability Type vulnerability discovered by Drupal Security Site in WordPress Module Flattern – Multipurpose Bootstrap Business Profile versions...

The vulnerability of the Tooltip module in the Drupal CMS system allows attackers to perform cross-site scripting attacks.

The vulnerability of the Tooltip module in the Drupal CMS system is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks remotely...

Flattern – Multipurpose Bootstrap Business Profile - Critical - Unsupported - SA-CONTRIB-2025-005

The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466s-becoming-owner-maintainer-or-co-mai...

Drupal Material Admin module * - Authenticated Other Vulnerability Type vulnerability

Authenticated Other Vulnerability Type vulnerability discovered by Drupal Security Site in WordPress Module Material Admin versions...

Material Admin - Critical - Unsupported - SA-CONTRIB-2025-006

The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466s-becoming-owner-maintainer-or-co-mai...

Ignition Error Pages - Critical - Cross Site Scripting - SA-CONTRIB-2025-007

This module enables you to render error pages using the Ignition package. The module disables certain Drupal core code and does not perform sufficient filtering, allowing HTML to be injected in certain situations leading to a Cross Site Scripting XSS vulnerability. This vulnerability is mitigated...

Drupal Ignition by Thrive Themes module < 1.0.4 - Unauthenticated Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS vulnerability discovered by Dieter Holvoet in WordPress Theme Ignition by Thrive Themes versions 1.0.4...

The vulnerability of the OAuth and OpenID Connect Single Sign On module in Drupal CMS systems allows attackers to perform cross-site scripting attacks.

The vulnerability of the OAuth and OpenID Connect Single Sign On module in Drupal systems is related to the lack of protective measures for the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks remotely...

Drupal AI (Artificial Intelligence) module < 1.0.3 - Unauthenticated Multiple Vulnerabilities vulnerability

Unauthenticated Multiple Vulnerabilities vulnerability discovered by Mingsong in WordPress Module AI Artificial Intelligence versions 1.0.3...

Drupal Ignition by Thrive Themes module < 1.0.4 - Unauthenticated Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS vulnerability discovered by Dieter Holvoet in WordPress Module Ignition Error Pages versions 1.0.4...

The vulnerability of the Mailjet CMS system’s Drupal module allows a hacker to execute arbitrary code.

The vulnerability of the Mailjet CMS system’s Drupal module is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

AI (Artificial Intelligence) - Moderately critical - Access bypass, Information Disclosure - SA-CONTRIB-2025-004

The AI logging sub-module enables you to log AI requests and responses for debugging and auditing purposes. The module doesn't sufficiently check for access to view the preview listing of the logs. Full log details are correctly protected, and API keys are never logged. This vulnerability is...

The vulnerability of the Print Anything module in the Drupal CMS system, related to insufficient validation of input data, allows a hacker to execute arbitrary code.

The vulnerability of the Print Anything module in the Drupal CMS system is related to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code...

The vulnerability of the Megamenu Framework CMS system’s Drupal module, related to insufficient validation of input data, allows attackers to execute arbitrary code.

The vulnerability of the Megamenu Framework CMS system’s Drupal module is related to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...