CVE-2025-31685

The Drupal Open Social platform (specifically the goalgorilla/open_social package) is vulnerable to a Missing Authorization flaw allowing Forceful Browsing . The root cause is a site administration configuration that fails to properly check access permissions when attempting to translate the plat...

CVE-2025-31685 Open Social - Moderately critical - Access bypass - SA-CONTRIB-2025-014

Missing Authorization vulnerability in Drupal Open Social allows Forceful Browsing.This issue affects Open Social: from 0.0.0 before 12.3.11, from 12.4.0 before 12.4.10...

CVE-2025-31684

The Drupal OAuth2 Client module (versions 0.0.0 through 4.1.2 ) is susceptible to a Cross-Site Request Forgery (CSRF) vulnerability. The root cause is that the module fails to use CSRF tokens to protect routes used for enabling a client. This allows an attacker to perform unauthorized actions on ...

CVE-2025-31684 OAuth2 Client - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-013

Cross-Site Request Forgery CSRF vulnerability in Drupal OAuth2 Client allows Cross Site Request Forgery.This issue affects OAuth2 Client: from 0.0.0 before 4.1.3...

CVE-2025-31684 OAuth2 Client - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-013

Cross-Site Request Forgery CSRF vulnerability in Drupal OAuth2 Client allows Cross Site Request Forgery.This issue affects OAuth2 Client: from 0.0.0 before 4.1.3...

CVE-2025-31683 Google Tag - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-012

Cross-Site Request Forgery CSRF vulnerability in Drupal Google Tag allows Cross Site Request Forgery.This issue affects Google Tag: from 0.0.0 before 1.8.0, from 2.0.0 before 2.0.8...

CVE-2025-31683

The Drupal Google Tag module is vulnerable to Cross-Site Request Forgery (CSRF) due to insufficient validation when enabling or disabling tag containers. The affected routes lack proper CSRF protection, potentially allowing an attacker to perform unauthorized actions on behalf of a user. While th...

CVE-2025-31683 Google Tag - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-012

Cross-Site Request Forgery CSRF vulnerability in Drupal Google Tag allows Cross Site Request Forgery.This issue affects Google Tag: from 0.0.0 before 1.8.0, from 2.0.0 before 2.0.8...

CVE-2025-31683 Google Tag - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-012

Cross-Site Request Forgery CSRF vulnerability in Drupal Google Tag allows Cross Site Request Forgery.This issue affects Google Tag: from 0.0.0 before 1.8.0, from 2.0.0 before 2.0.8...

CVE-2025-31682 Google Tag - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-011

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Google Tag allows Cross-Site Scripting XSS.This issue affects Google Tag: from 0.0.0 before 1.8.0, from 2.0.0 before 2.0.8...

CVE-2025-31682

The Drupal Google Tag module is vulnerable to a Cross-Site Scripting (XSS) vulnerability due to improper neutralization of user-supplied input during web page generation. This allows an attacker to inject and execute malicious scripts in a victim's browser via crafted input. The issue affects ver...

CVE-2025-31682 Google Tag - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-011

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Google Tag allows Cross-Site Scripting XSS.This issue affects Google Tag: from 0.0.0 before 1.8.0, from 2.0.0 before 2.0.8...

CVE-2025-31682 Google Tag - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-011

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Google Tag allows Cross-Site Scripting XSS.This issue affects Google Tag: from 0.0.0 before 1.8.0, from 2.0.0 before 2.0.8...

CVE-2025-31681 Authenticator Login - Critical - Access bypass - SA-CONTRIB-2025-009

Missing Authorization vulnerability in Drupal Authenticator Login allows Forceful Browsing.This issue affects Authenticator Login: from 0.0.0 before 2.0.6...

CVE-2025-31681 Authenticator Login - Critical - Access bypass - SA-CONTRIB-2025-009

Missing Authorization vulnerability in Drupal Authenticator Login allows Forceful Browsing.This issue affects Authenticator Login: from 0.0.0 before 2.0.6...

CVE-2025-31681

The Drupal Authenticator Login module (versions 0.0.0 through 2.0.5) is vulnerable to a Missing Authorization flaw (CWE-862). Due to improper authorization checks within the component, an attacker can perform Forceful Browsing to access restricted functionality or resources without proper permiss...

CVE-2025-31679 Ignition Error Pages - Critical - Cross Site Scripting - SA-CONTRIB-2025-007

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Ignition Error Pages allows Cross-Site Scripting XSS.This issue affects Ignition Error Pages: from 0.0.0 before 1.0.4...

CVE-2025-31679 Ignition Error Pages - Critical - Cross Site Scripting - SA-CONTRIB-2025-007

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Ignition Error Pages allows Cross-Site Scripting XSS.This issue affects Ignition Error Pages: from 0.0.0 before 1.0.4...

CVE-2025-31679 Ignition Error Pages - Critical - Cross Site Scripting - SA-CONTRIB-2025-007

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Ignition Error Pages allows Cross-Site Scripting XSS.This issue affects Ignition Error Pages: from 0.0.0 before 1.0.4...

CVE-2025-31679

The Drupal Ignition Error Pages component is vulnerable to Cross-Site Scripting (XSS) due to improper neutralization of user-controlled input during web page generation. This flaw allows an attacker to inject and execute malicious scripts in a user's browser via crafted input. The vulnerability a...