CVE-2025-48923

The Drupal Toc.Js module is vulnerable to Cross-site Scripting (XSS) due to improper input neutralization during web page generation. This issue specifically involves the module's failure to sufficiently sanitize data attributes , which could lead to persistent XSS attacks. The vulnerability affe...

Drupal GLightbox 安全漏洞

Drupal GLightbox is a JavaScript image and video displayer for the Drupal community. A security vulnerability exists in Drupal GLightbox versions prior to 1.0.16 that stems from improper input neutralization and could lead to a cross-site scripting attack...

CVE-2025-6675: Authentication Bypass Using an Alternate Path or Channel

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Enterprise MFA - TFA for Drupal allows Authentication Bypass.This issue affects Enterprise MFA - TFA for Drupal: from 0.0.0 before 4.8.0, from 5.2.0 before 5.2.1, from 0.0.0 before 5.0., from 0.0.0 before 5.1...

CVE-2025-6674: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal CKEditor5 Youtube allows Cross-Site Scripting XSS.This issue affects CKEditor5 Youtube: from 0.0.0 before 1.0.3...

CVE-2025-6676: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Simple XML sitemap allows Cross-Site Scripting XSS.This issue affects Simple XML sitemap: from 0.0.0 before 4.2.2...

Drupal Enterprise MFA - TFA for Drupal 安全漏洞

Drupal Enterprise MFA - TFA for Drupal is a module plugin in the Drupal content management system from the Drupal community. A security vulnerability exists in Drupal Enterprise MFA - TFA for Drupal versions prior to 4.8.0, prior to 5.2.1, prior to 5.0., and prior to 5.1. that stems from an...

Drupal CKEditor5 Youtube 安全漏洞

Drupal CKEditor5 Youtube is a video integration plugin for the Drupal community. A security vulnerability exists in Drupal CKEditor5 Youtube versions prior to 1.0.3, which stems from improper input neutralization and could lead to cross-site scripting attacks...

PT-2025-26966 · Drupal · Drupal Paragraphs

Name of the Vulnerable Software and Affected Versions: Drupal Paragraphs table versions 2.0.0 through 2.0.4 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS, in the Drupal Paragraphs table. This allows for...

Drupal Paragraphs table 安全漏洞

Drupal Paragraphs table is a table generation tool for the Drupal community. A security vulnerability exists in Drupal Paragraphs table versions prior to 2.0.5 that stems from improper input neutralization and could lead to a cross-site scripting attack...

Drupal Klaro Cookie & Consent Management 安全漏洞

Drupal Klaro Cookie & Consent Management is a module plugin in the Drupal content management system for the Drupal community. A security vulnerability exists in Drupal Klaro Cookie & Consent Management versions prior to 3.0.7, which stems from improper input neutralization and could lead to a...

Drupal Toc.Js 安全漏洞

Drupal Toc.js is a directory generation plugin for the Drupal community. A security vulnerability exists in Drupal Toc.Js versions prior to 3.2.1 that stems from improper input neutralization and could lead to a cross-site scripting attack...

CVE-2025-6677: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Paragraphs table allows Cross-Site Scripting XSS.This issue affects Paragraphs table: from 2.0.0 before 2.0.5...

CVE-2025-48922: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal GLightbox allows Cross-Site Scripting XSS.This issue affects GLightbox: from 0.0.0 before 1.0.16...

Drupal Simple XML sitemap 安全漏洞

Drupal Simple XML sitemap is an XML sitemap generator for the Drupal community. A security vulnerability exists in Drupal Simple XML sitemap versions prior to 4.2.2 that stems from improper input neutralization and could lead to a cross-site scripting attack...

PT-2025-26964 · Drupal · Enterprise Mfa - Tfa For Drupal

Name of the Vulnerable Software and Affected Versions: Enterprise MFA - TFA for Drupal versions 0.0.0 through 4.8.0 Enterprise MFA - TFA for Drupal versions 5.2.0 through 5.2.0 Enterprise MFA - TFA for Drupal versions 0.0.0 through 5.0. Enterprise MFA - TFA for Drupal versions 0.0.0 through 5.1...

Drupal Open Social 安全漏洞

Drupal Open Social is a Drupal-based social networking platform solution from the Drupal community designed to provide a complete social networking capability for businesses, organizations or communities. A security vulnerability exists in Drupal Open Social versions prior to 12.3.14 and versions...

PT-2025-26965 · Drupal · Drupal Simple Xml Sitemap

Name of the Vulnerable Software and Affected Versions: Drupal Simple XML sitemap versions 0.0.0 through 4.2.1 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows an attacker to perform Cross-Site...

DRUPAL-CONTRIB-2025-084

Project Paragraphs table provides a field for a collection table. The module doesn't sufficiently sanitise certain data attributes allowing Cross Site Scripting XSS attacks. This vulnerability is mitigated by the fact that an attacker must have a role with permission to enter HTML tags containing...

DRUPAL-CONTRIB-2025-083

Simple XML sitemap is a SEO module that allows creating various XML sitemaps of the site's content and submitting them to search engines. The module doesn't sufficiently sanitize input when administering it, which leads to a Cross-site scripting XSS attack vector. This vulnerability is mitigated ...

DRUPAL-CONTRIB-2025-082

The module enables you to add second-factor authentication on top of the default Drupal login. The module does not sufficiently ensure that known authorization routes are protected. This vulnerability is mitigated by the fact that an attacker must obtain the user's username and password...