CVE-2025-48011

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal One Time Password allows Functionality Bypass.This issue affects One Time Password: from 0.0.0 before 1.3.0...

CVE-2025-48012

The Drupal One Time Password module is vulnerable to an Authentication Bypass by Capture-replay vulnerability (CWE-294) in versions 0.0.0 through 1.3.0 . The root cause is that the module does not sufficiently prevent the reuse of the same TFA token within a 30-second window. An attacker who has ...

CVE-2025-48012 One Time Password - Moderately critical - Access bypass - SA-CONTRIB-2025-063

Authentication Bypass by Capture-replay vulnerability in Drupal One Time Password allows Remote Services with Stolen Credentials.This issue affects One Time Password: from 0.0.0 before 1.3.0...

CVE-2025-48011 One Time Password - Moderately critical - Access bypass - SA-CONTRIB-2025-062

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal One Time Password allows Functionality Bypass.This issue affects One Time Password: from 0.0.0 before 1.3.0...

CVE-2025-48011

The Drupal One Time Password module (versions 0.0.0 through 1.3.0) is vulnerable to an Authentication Bypass Using an Alternate Path or Channel (CWE-288). The root cause is that the module fails to sufficiently prevent Two-Factor Authentication (TFA) from being bypassed when utilizing REST login ...

CVE-2025-48011 One Time Password - Moderately critical - Access bypass - SA-CONTRIB-2025-062

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal One Time Password allows Functionality Bypass.This issue affects One Time Password: from 0.0.0 before 1.3.0...

CVE-2025-48010

The Drupal One Time Password module is vulnerable to an Authentication Bypass Using an Alternate Path or Channel vulnerability. This flaw allows for a functionality bypass because the module does not sufficiently prevent one-time login links from bypassing Two-Factor Authentication (TFA). This is...

CVE-2025-48010 One Time Password - Moderately critical - Access bypass - SA-CONTRIB-2025-061

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal One Time Password allows Functionality Bypass.This issue affects One Time Password: from 0.0.0 before 1.3.0...

CVE-2025-48010 One Time Password - Moderately critical - Access bypass - SA-CONTRIB-2025-061

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal One Time Password allows Functionality Bypass.This issue affects One Time Password: from 0.0.0 before 1.3.0...

CVE-2025-48009

The Drupal Single Content Sync module, versions 0.0.0 through 1.4.11 , is vulnerable to a Missing Authorization issue (CWE-862 ) that allows for Functionality Misuse . The vulnerability occurs because the module's export feature, while intentionally bypassing some access controls to allow content...

CVE-2025-48009 Single Content Sync - Moderately critical - Access bypass - SA-CONTRIB-2025-060

Missing Authorization vulnerability in Drupal Single Content Sync allows Functionality Misuse.This issue affects Single Content Sync: from 0.0.0 before 1.4.12...

CVE-2025-48009 Single Content Sync - Moderately critical - Access bypass - SA-CONTRIB-2025-060

Missing Authorization vulnerability in Drupal Single Content Sync allows Functionality Misuse.This issue affects Single Content Sync: from 0.0.0 before 1.4.12...

CVE-2025-48009 Single Content Sync - Moderately critical - Access bypass - SA-CONTRIB-2025-060

Missing Authorization vulnerability in Drupal Single Content Sync allows Functionality Misuse.This issue affects Single Content Sync: from 0.0.0 before 1.4.12...

CVE-2025-4416 Events Log Track - Moderately critical - Denial of Service - SA-CONTRIB-2025-059

Allocation of Resources Without Limits or Throttling vulnerability in Drupal Events Log Track allows Excessive Allocation.This issue affects Events Log Track: from 0.0.0 before 3.1.11, from 4.0.0 before 4.0.2...

CVE-2025-4416

The Drupal Events Log Track module is vulnerable to an Allocation of Resources Without Limits or Throttling (CWE-770) flaw. This issue arises because the module does not sufficiently mitigate resource consumption for certain requests, which can lead to excessive resource allocation and a potentia...

CVE-2025-4416 Events Log Track - Moderately critical - Denial of Service - SA-CONTRIB-2025-059

Allocation of Resources Without Limits or Throttling vulnerability in Drupal Events Log Track allows Excessive Allocation.This issue affects Events Log Track: from 0.0.0 before 3.1.11, from 4.0.0 before 4.0.2...

CVE-2025-4415 Piwik PRO - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-058

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Piwik PRO allows Cross-Site Scripting XSS.This issue affects Piwik PRO: from 0.0.0 before 1.3.2...

CVE-2025-4415 Piwik PRO - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-058

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Piwik PRO allows Cross-Site Scripting XSS.This issue affects Piwik PRO: from 0.0.0 before 1.3.2...

CVE-2025-4415 Piwik PRO - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-058

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Piwik PRO allows Cross-Site Scripting XSS.This issue affects Piwik PRO: from 0.0.0 before 1.3.2...

Drupal Commerce Eurobank (Redirect) module < 2.1.1 - Unauthenticated Broken Access Control vulnerability

Unauthenticated Broken Access Control vulnerability discovered by Marios Tsalkidis silios in WordPress Module Commerce Eurobank Redirect versions 2.1.1...