Drupal Two-factor Authentication (TFA) module < 1.11.0 - Authenticated Broken Access Control vulnerability

Authenticated Broken Access Control vulnerability discovered by Conrad Lara cmlara in WordPress Module Two-factor Authentication TFA versions 1.11.0...

CVE-2025-6675

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Enterprise MFA - TFA for Drupal allows Authentication Bypass.This issue affects Enterprise MFA - TFA for Drupal: from 0.0.0 before 4.8.0, from 5.2.0 before 5.2.1, from 0.0.0 before 5.0., from 0.0.0 before 5.1...

CVE-2025-6676

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Simple XML sitemap allows Cross-Site Scripting XSS.This issue affects Simple XML sitemap: from 0.0.0 before 4.2.2...

CVE-2025-6677

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Paragraphs table allows Cross-Site Scripting XSS.This issue affects Paragraphs table: from 2.0.0 before 2.0.5...

CVE-2025-5682

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Klaro Cookie & Consent Management allows Cross-Site Scripting XSS.This issue affects Klaro Cookie & Consent Management: from 0.0.0 before 3.0.7...

CVE-2025-48922

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal GLightbox allows Cross-Site Scripting XSS.This issue affects GLightbox: from 0.0.0 before 1.0.16...

CVE-2025-48921

Cross-Site Request Forgery CSRF vulnerability in Drupal Open Social allows Cross Site Request Forgery.This issue affects Open Social: from 0.0.0 before 12.3.14, from 12.4.0 before 12.4.13...

CVE-2025-6674

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal CKEditor5 Youtube allows Cross-Site Scripting XSS.This issue affects CKEditor5 Youtube: from 0.0.0 before 1.0.3...

CVE-2025-48923

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Toc.Js allows Cross-Site Scripting XSS.This issue affects Toc.Js: from 0.0.0 before 3.2.1...

CVE-2025-6675

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Enterprise MFA - TFA for Drupal allows Authentication Bypass.This issue affects Enterprise MFA - TFA for Drupal: from 0.0.0 before 4.8.0, from 5.2.0 before 5.2.1, from 0.0.0 before 5.0., from 0.0.0 before 5.1...

CVE-2025-6674

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal CKEditor5 Youtube allows Cross-Site Scripting XSS.This issue affects CKEditor5 Youtube: from 0.0.0 before 1.0.3...

CVE-2025-6676

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Simple XML sitemap allows Cross-Site Scripting XSS.This issue affects Simple XML sitemap: from 0.0.0 before 4.2.2...

CVE-2025-6677

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Paragraphs table allows Cross-Site Scripting XSS.This issue affects Paragraphs table: from 2.0.0 before 2.0.5...

CVE-2025-5682

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Klaro Cookie & Consent Management allows Cross-Site Scripting XSS.This issue affects Klaro Cookie & Consent Management: from 0.0.0 before 3.0.7...

CVE-2025-48922

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal GLightbox allows Cross-Site Scripting XSS.This issue affects GLightbox: from 0.0.0 before 1.0.16...

CVE-2025-48923

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Toc.Js allows Cross-Site Scripting XSS.This issue affects Toc.Js: from 0.0.0 before 3.2.1...

CVE-2025-48921

Cross-Site Request Forgery CSRF vulnerability in Drupal Open Social allows Cross Site Request Forgery.This issue affects Open Social: from 0.0.0 before 12.3.14, from 12.4.0 before 12.4.13...

CVE-2025-6677 Paragraphs table - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-084

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Paragraphs table allows Cross-Site Scripting XSS.This issue affects Paragraphs table: from 2.0.0 before 2.0.5...

CVE-2025-6677

CVE-2025-6677 describes an XSS vulnerability in Drupal Paragraphs table versions 2.0.0–2.0.4 due to improper input neutralization during web page generation. The issue affects the Drupal Paragraphs table module before 2.0.5. The root cause is insufficient sanitization of certain data attributes, ...

CVE-2025-6677 Paragraphs table - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-084

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Paragraphs table allows Cross-Site Scripting XSS.This issue affects Paragraphs table: from 2.0.0 before 2.0.5...