Drupal AI 跨站请求伪造漏洞

Drupal AI is a module or solution from the Drupal community that integrates artificial intelligence capabilities. A cross-site request forgery vulnerability exists in Drupal AI versions prior to 1.0.2 that stems from cross-site request forgery...

PT-2025-13841 · Drupal · Drupal Ai

Name of the Vulnerable Software and Affected Versions: Drupal AI Artificial Intelligence versions 1.0.0 through 1.0.1 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows an attacker to perform actions on a user's behalf without their consent. This is a type of...

Drupal core 跨站脚本漏洞

Drupal core is a free, open source content management system developed in PHP by the Drupal community. A cross-site scripting vulnerability exists in Drupal core that stems from vulnerability to cross-site scripting attacks...

PT-2025-13839 · Drupal · Drupal

Name of the Vulnerable Software and Affected Versions: Drupal core versions 8.0.0 through 10.3.13 Drupal core versions 10.4.0 through 10.4.4 Drupal core versions 11.0.0 through 11.0.12 Drupal core versions 11.1.0 through 11.1.4 Description: The issue affects Drupal core, allowing Cross-Site...

CVE-2025-31696: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal RapiDoc OAS Field Formatter allows Cross-Site Scripting XSS.This issue affects RapiDoc OAS Field Formatter: from 0.0.0 before 1.0.1...

CVE-2025-3061: Improper Authentication

Vulnerability in Drupal Material Admin.This issue affects Material Admin:...

CVE-2025-31694: Authentication Bypass Using an Alternate Path or Channel

Incorrect Authorization vulnerability in Drupal Two-factor Authentication TFA allows Forceful Browsing.This issue affects Two-factor Authentication TFA: from 0.0.0 before 1.10.0...

CVE-2025-31693: Improper Neutralization of Special Elements used in an OS Command

Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in Drupal AI Artificial Intelligence allows OS Command Injection.This issue affects AI Artificial Intelligence: from 0.0.0 before 1.0.5...

PT-2025-13865 · Drupal · Drupal Link Field Display Mode Formatter

Name of the Vulnerable Software and Affected Versions: Drupal Link field display mode formatter versions 0.0.0 through 1.6.0 Description: The issue is related to an Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS, in the Drupal Link field displa...

Drupal core 安全漏洞

Drupal core is a free, open source content management system developed in PHP by the Drupal community. A security vulnerability exists in Drupal core that stems from improper modification of dynamic object properties, which could lead to object injection...

CVE-2025-31675: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Drupal core allows Cross-Site Scripting XSS.This issue affects Drupal core: from 8.0.0 before 10.3.14, from 10.4.0 before 10.4.5, from 11.0.0 before 11.0.13, from 11.1.0 before 11.1.5. It al...

Drupal AI 安全漏洞

Drupal AI is a module or solution for the Drupal community that integrates artificial intelligence capabilities. A security vulnerability exists in Drupal AI versions prior to 1.0.3, which stems from a lack of authorization and could lead to forced browsing...

Drupal Formatter Suite 跨站脚本漏洞

The Drupal Formatter Suite is a collection of modules from the Drupal community designed to provide a flexible set of formatting tools for Drupal. A cross-site scripting vulnerability exists in Drupal Formatter Suite versions prior to 2.1.0 that stems from improper input neutralization and could...

CVE-2025-31687: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal SpamSpan filter allows Cross-Site Scripting XSS.This issue affects SpamSpan filter: from 0.0.0 before 3.2.1...

CVE-2025-31683: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Drupal Google Tag allows Cross Site Request Forgery.This issue affects Google Tag: from 0.0.0 before 1.8.0, from 2.0.0 before 2.0.8...

CVE-2025-31677: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Drupal AI Artificial Intelligence allows Cross Site Request Forgery.This issue affects AI Artificial Intelligence: from 1.0.0 before 1.0.2...

Drupal Configuration Split 跨站请求伪造漏洞

Drupal Configuration Split is a module in the Drupal community. A cross-site request forgery vulnerability exists in Drupal Configuration Split versions prior to 1.10.0 and versions prior to 2.0.0 through 2.0.2, which stems from cross-site request forgery...

PT-2025-13854 · Drupal · Drupal Cache Utility

Name of the Vulnerable Software and Affected Versions: Drupal Cache Utility versions 0.0.0 through 1.2.0 Description: A Cross-Site Request Forgery CSRF issue affects the Drupal Cache Utility, allowing unauthorized actions to be performed on behalf of a user. Recommendations: For versions 0.0.0...

Drupal Link field display mode formatter 跨站脚本漏洞

The Drupal Link field display mode formatter is a Drupal community module used to provide custom display modes for Drupal link fields. A cross-site scripting vulnerability exists in Drupal Link field display mode formatter versions prior to 1.6.0, which stems from improper input neutralization an...

Drupal Open Social 安全漏洞

Drupal Open Social is a Drupal-based social networking platform solution from the Drupal community designed to provide a complete social networking capability for businesses, organizations or communities. A security vulnerability exists in Drupal Open Social versions prior to 12.3.11 and 12.4.0...