CVE-2025-3057: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Drupal core allows Cross-Site Scripting XSS.This issue affects Drupal core: from 8.0.0 before 10.3.13, from 10.4.0 before 10.4.3, from 11.0.0 before 11.0.12, from 11.1.0 before 11.1.3...

Drupal SpamSpan filter 跨站脚本漏洞

Drupal SpamSpan filter is a Drupal community module for spam prevention. A cross-site scripting vulnerability exists in Drupal SpamSpan filter versions prior to 3.2.1, which stems from improper input neutralization and could lead to cross-site scripting attacks...

PT-2025-13851 · Drupal · Drupal Spamspan Filter

Name of the Vulnerable Software and Affected Versions: Drupal SpamSpan filter versions 0.0.0 through 3.2.0 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS, in the Drupal SpamSpan filter. This allows for...

PT-2025-13863 · Drupal · Drupal Ai

Name of the Vulnerable Software and Affected Versions: Drupal AI Artificial Intelligence versions 0.0.0 through 1.0.4 Description: The issue is related to an OS Command Injection vulnerability due to improper neutralization of special elements used in an OS command. This allows for OS Command...

CVE-2025-3062: Improper Authentication

Vulnerability in Drupal Drupal Admin LTE theme.This issue affects Drupal Admin LTE theme:...

CVE-2025-31678: Missing Authorization

Missing Authorization vulnerability in Drupal AI Artificial Intelligence allows Forceful Browsing.This issue affects AI Artificial Intelligence: from 0.0.0 before 1.0.3...

PT-2025-13855 · Drupal · Drupal Oauth2 Server

Name of the Vulnerable Software and Affected Versions: Drupal OAuth2 Server versions 0.0.0 through 2.0.x Description: The issue is related to a Missing Authorization vulnerability in the Drupal OAuth2 Server, which allows Forceful Browsing. Recommendations: For versions 0.0.0 through 2.0.x, updat...

Drupal Material Admin 安全漏洞

Drupal Material Admin is a Drupal community admin theme for the Drupal backend based on the Google Material Design style, providing a modern and intuitive user interface. A security vulnerability exists in Drupal Material Admin. The vulnerability stems from a known security issue where an attack...

CVE-2025-31684: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Drupal OAuth2 Client allows Cross Site Request Forgery.This issue affects OAuth2 Client: from 0.0.0 before 4.1.3...

CVE-2025-31692: Improper Neutralization of Special Elements used in an OS Command

Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in Drupal AI Artificial Intelligence allows OS Command Injection.This issue affects AI Artificial Intelligence: from 0.0.0 before 1.0.5...

CVE-2025-31691: Missing Authorization

Missing Authorization vulnerability in Drupal OAuth2 Server allows Forceful Browsing.This issue affects OAuth2 Server: from 0.0.0 before 2.1.0...

Drupal Profile Private 安全漏洞

Drupal Profile Private is a feature or module in the Drupal community for creating private user profiles in Drupal. A security vulnerability exists in Drupal Profile Private, which stems from a known security issue, where an attack requires administrator privileges and affects the confidentiality...

Drupal Email TFA 安全漏洞

Drupal Email TFA is a Drupal community module that provides email-based two-factor authentication functionality for Drupal. A security vulnerability exists in Drupal Email TFA versions prior to 2.0.3, which stems from weak authentication and could lead to brute force exploits...

CVE-2025-31688: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Drupal Configuration Split allows Cross Site Request Forgery.This issue affects Configuration Split: from 0.0.0 before 1.10.0, from 2.0.0 before 2.0.2...

Drupal Ignition Error Pages 跨站脚本漏洞

Drupal Ignition Error Pages is a module of the Drupal community that provides custom error pages e.g. 404, 500, etc. to improve the user experience. A cross-site scripting vulnerability exists in Drupal Ignition Error Pages versions prior to 1.0.4, which stems from improper input neutralization a...

Drupal General Data Protection Regulation 跨站请求伪造漏洞

Drupal General Data Protection Regulation is a module of the Drupal community. A cross-site request forgery vulnerability exists in Drupal General Data Protection Regulation versions prior to 3.0.1 and versions prior to 3.1.0 through 3.1.2, which stems from cross-site request forgery...

CVE-2025-31697: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Formatter Suite allows Cross-Site Scripting XSS.This issue affects Formatter Suite: from 0.0.0 before 2.1.0...

CVE-2025-31681: Missing Authorization

Missing Authorization vulnerability in Drupal Authenticator Login allows Forceful Browsing.This issue affects Authenticator Login: from 0.0.0 before 2.0.6...

CVE-2025-31690: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Drupal Cache Utility allows Cross Site Request Forgery.This issue affects Cache Utility: from 0.0.0 before 1.2.1...

CVE-2025-31682: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Google Tag allows Cross-Site Scripting XSS.This issue affects Google Tag: from 0.0.0 before 1.8.0, from 2.0.0 before 2.0.8...