CVE-2022-25271

Drupal core's form API has a vulnerability where certain contributed or custom modules' forms may be vulnerable to improper input validation. This could allow an attacker to inject disallowed values or overwrite data. Affected forms are uncommon, but in certain cases an attacker could alter...

PT-2022-1768 · Drupal +2 · Drupal +2

Name of the Vulnerable Software and Affected Versions: Drupal affected versions not specified Description: The issue is related to the Quick Edit module in the Drupal content management system, which does not properly check entity access in some circumstances. This could result in users with the...

PT-2022-1767 · Drupal +1 · Drupal Core +1

Name of the Vulnerable Software and Affected Versions: Drupal core affected versions not specified Description: The issue is related to insufficient input validation in the Drupal core's form API, which may allow an attacker to inject disallowed values or overwrite data. This could potentially...

CVE-2022-25271

Drupal core's form API has a vulnerability where certain contributed or custom modules' forms may be vulnerable to improper input validation. This could allow an attacker to inject disallowed values or overwrite data. Affected forms are uncommon, but in certain cases an attacker could alter...

Drupal core - Moderately critical - Improper input validation - SA-CORE-2022-003

Drupal core's form API has a vulnerability where certain contributed or custom modules' forms may be vulnerable to improper input validation. This could allow an attacker to inject disallowed values or overwrite data. Affected forms are uncommon, but in certain cases an attacker could alter...

Drupal 7.x < 7.88 / 9.2.x < 9.2.13 / 9.3.x < 9.3.6 Multiple Vulnerabilities (drupal-2022-02-16)

According to its self-reported version, the instance of Drupal running on the remote web server is 7.x prior to 7.88, 9.2.x prior to 9.2.13, or 9.3.x prior to 9.3.6. It is, therefore, affected by multiple vulnerabilities. - The Quick Edit module does not properly check entity access in some...

CVE-2022-25271

The provided materials confirm CVE-2022-25271 affects Drupal core via the form API. The root cause is improper input validation in certain contributed or custom modules’ forms, potentially allowing an attacker to inject disallowed values or overwrite data. Affected forms are described as uncommon...

Droopescan - A Plugin-Based Scanner That Aids Security Researchers In Identifying Issues With Several CMSs, Mainly Drupal And Silverstripe

A plugin-based scanner that aids security researchers in identifying issues with several CMS. Usage of droopescan for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability...

Access Restriction Bypass

Drupal is vulnerable to access restriction bypass. The sites with JSON:API module enabled bypass the restriction of access to certain content...

Cross Site Request Forgery

drupal is vulnerable to cross-site request forgery. Lack of secure validation of access to routes allows an attacker to perform cross-site request forgery under some circumstances. It affects the application if the QuickEdit module which comes with the Standard profile is installed...

Information Disclosure

Drupal is vulnerable to information disclosure. File metadata of a permanent private file can be accessed by an attacker who can guess ID of the file...

Cross-site Scripting (XSS)

drupal is vulnerable to cross-site scripting. An attacker is able to inject malicious script via \Drupal\Core\Form\FormBuilder's renderPlaceholderFormAction and/or buildFormAction methods...

GHSA-J586-CJ67-VG4P Cross-Site Request Forgery in Drupal core

The QuickEdit module does not properly validate access to routes, which could allow cross-site request forgery under some circumstances and lead to possible data integrity issues. Sites are only affected if the QuickEdit module which comes with the Standard profile is installed. Removing the...

Drupal core Cross-site Scripting (XSS) vulnerability

Cross-site Scripting XSS vulnerability in Drupal core's sanitization API fails to properly filter cross-site scripting under certain circumstances. This issue affects: Drupal Core 9.1.x versions prior to 9.1.7; 9.0.x versions prior to 9.0.12; 8.9.x versions prior to 8.9.14; 7.x versions prior to...

Drupal core Cross-site Scripting (XSS) vulnerability in ckeditor

Cross-site Scripting XSS vulnerability in ckeditor of Drupal Core allows attacker to inject XSS. This issue affects: Drupal Core 8.8.x versions prior to 8.8.10.; 8.9.x versions prior to 8.9.6; 9.0.x versions prior to 9.0.6...

GHSA-C533-C843-67H8 Drupal core Cross-site Scripting (XSS) vulnerability in ckeditor

Cross-site Scripting XSS vulnerability in ckeditor of Drupal Core allows attacker to inject XSS. This issue affects: Drupal Core 8.8.x versions prior to 8.8.10.; 8.9.x versions prior to 8.9.6; 9.0.x versions prior to 9.0.6...

Cross-Site Request Forgery in Drupal core

The QuickEdit module does not properly validate access to routes, which could allow cross-site request forgery under some circumstances and lead to possible data integrity issues. Sites are only affected if the QuickEdit module which comes with the Standard profile is installed. Removing the...

GHSA-3M36-MJWJ-352C Drupal core Cross-site Scripting (XSS) vulnerability

Cross-site Scripting XSS vulnerability in Drupal core's sanitization API fails to properly filter cross-site scripting under certain circumstances. This issue affects: Drupal Core 9.1.x versions prior to 9.1.7; 9.0.x versions prior to 9.0.12; 8.9.x versions prior to 8.9.14; 7.x versions prior to...

GHSA-MMJR-5Q74-P3M4 Exposure of Resource to Wrong Sphere in Drupal Core

Information Disclosure vulnerability in file module of Drupal Core allows an attacker to gain access to the file metadata of a permanent private file that they do not have access to by guessing the ID of the file. This issue affects: Drupal Core 8.8.x versions prior to 8.8.10; 8.9.x versions prio...

GHSA-M6Q5-WV4X-FV6H Cross-site Scripting in Drupal Core

Access Bypass vulnerability in Drupal Core allows for an attacker to leverage the way that HTML is rendered for affected forms in order to exploit the vulnerability. This issue affects: Drupal Core 8.8.x versions prior to 8.8.10; 8.9.x versions prior to 8.9.6; 9.0.x versions prior to 9.0.6...