CVE-2025-31682: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Google Tag allows Cross-Site Scripting XSS.This issue affects Google Tag: from 0.0.0 before 1.8.0, from 2.0.0 before 2.0.8...

CVE-2025-31676: Weak Authentication

Weak Authentication vulnerability in Drupal Email TFA allows Brute Force.This issue affects Email TFA: from 0.0.0 before 2.0.3...

PT-2025-13836 · Drupal · Drupal

Name of the Vulnerable Software and Affected Versions: Drupal core versions 8.0.0 through 10.3.12 Drupal core versions 10.4.0 through 10.4.2 Drupal core versions 11.0.0 through 11.0.11 Drupal core versions 11.1.0 through 11.1.2 Description: The issue affects Drupal core, allowing Cross-Site...

Drupal Matomo Analytics 跨站请求伪造漏洞

Drupal Matomo Analytics is a Drupal community module for integrating Matomo an open source web analytics platform into Drupal websites to track and analyze user behavior. A cross-site request forgery vulnerability exists in Drupal Matomo Analytics versions prior to 1.24.0, which stems from...

Drupal Two-factor Authentication 安全漏洞

Drupal Two-factor Authentication is a module for the Drupal community. A security vulnerability exists in Drupal Two-factor Authentication versions prior to 1.10.0, which stems from incorrect authorization and could lead to forced browsing...

Drupal Authenticator Login 安全漏洞

Drupal Authenticator Login is a Drupal community authentication login module or feature for Drupal. A security vulnerability exists in Drupal Authenticator Login versions prior to 2.0.6, which stems from a lack of authorization and could lead to forced browsing...

CVE-2025-31673: Incorrect Authorization

Incorrect Authorization vulnerability in Drupal Drupal core allows Forceful Browsing.This issue affects Drupal core: from 8.0.0 before 10.3.13, from 10.4.0 before 10.4.3, from 11.0.0 before 11.0.12, from 11.1.0 before 11.1.3...

Drupal OAuth2 Server 安全漏洞

Drupal OAuth2 Server is an authentication module for the Drupal community. A security vulnerability exists in Drupal OAuth2 Server versions prior to 2.1.0 that stems from a lack of authorization and could lead to forced browsing...

PT-2025-13853 · Drupal · Drupal General Data Protection Regulation

Name of the Vulnerable Software and Affected Versions: Drupal General Data Protection Regulation versions 0.0.0 through 3.0.1, versions 3.1.0 through 3.1.2 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows for Cross Site Request Forgery. This is a type of...

PT-2025-13841 · Drupal · Drupal Ai

Name of the Vulnerable Software and Affected Versions: Drupal AI Artificial Intelligence versions 1.0.0 through 1.0.1 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows an attacker to perform actions on a user's behalf without their consent. This is a type of...

Drupal 11.1.x < 11.1.5 Cross-Site Scripting

According to its self-reported version, the instance of Drupal running on the remote web server is 11.1.x prior to 11.1.5, 11.0.x prior to 11.0.13, 10.4.x prior to 10.4.5 or 8.x prior to 10.3.14. Drupal core Link field attributes are not sufficiently sanitized, which can lead to a Cross-Site...

Drupal 8.0.x < 10.3.14 Cross-Site Scripting

According to its self-reported version, the instance of Drupal running on the remote web server is 11.1.x prior to 11.1.5, 11.0.x prior to 11.0.13, 10.4.x prior to 10.4.5 or 8.x prior to 10.3.14. Drupal core Link field attributes are not sufficiently sanitized, which can lead to a Cross-Site...

Drupal 10.4.x < 10.4.5 Cross-Site Scripting

According to its self-reported version, the instance of Drupal running on the remote web server is 11.1.x prior to 11.1.5, 11.0.x prior to 11.0.13, 10.4.x prior to 10.4.5 or 8.x prior to 10.3.14. Drupal core Link field attributes are not sufficiently sanitized, which can lead to a Cross-Site...

Drupal 11.0.x < 11.0.13 Cross-Site Scripting

According to its self-reported version, the instance of Drupal running on the remote web server is 11.1.x prior to 11.1.5, 11.0.x prior to 11.0.13, 10.4.x prior to 10.4.5 or 8.x prior to 10.3.14. Drupal core Link field attributes are not sufficiently sanitized, which can lead to a Cross-Site...

Drupal 10.3.x < 10.3.14 / 10.4.x < 10.4.5 / 11.x < 11.0.13 / 11.1.x < 11.1.5 Drupal Vulnerability (SA-CORE-2025-004)

According to its self-reported version, the instance of Drupal running on the remote web server is 10.3.x prior to 10.3.14, 10.4.x prior to 10.4.5, 11.x prior to 11.0.13, or 11.1.x prior to 11.1.5. It is, therefore, affected by a vulnerability. - Improper Neutralization of Input During Web Page...

Drupal XSS Vulnerability (SA-CORE-2025-004) - Windows

Drupal is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:drupal:drupal";...

Drupal XSS Vulnerability (SA-CORE-2025-004) - Linux

Drupal is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:drupal:drupal";...

DRUPAL-CORE-2025-004

Drupal core Link field attributes are not sufficiently sanitized, which can lead to a Cross Site Scripting vulnerability XSS. This vulnerability is mitigated by that fact that an attacker would need to have the ability to add specific attributes to a Link field, which typically requires edit acce...

DRUPAL-CONTRIB-2025-026

Formatter Suite provides a suite of field formatters to help present numbers, dates, times, text, links, entity references, files, and images. The module provides a custom formatter for link fields. Drupal core does not sufficiently sanitize link element attributes, which can lead to a Cross Site...

DRUPAL-CONTRIB-2025-025

This module can be used to render Open API Documentation using the RapiDoc library. The module provides a custom formatter for link fields. Drupal core does not sufficiently sanitize link element attributes, which can lead to a Cross Site Scripting vulnerability XSS. A separate fix for Drupal cor...