CVE-2025-8092

The Drupal COOKiES Consent Management module is vulnerable to Cross-Site Scripting (XSS) in versions prior to 1.2.16 . The root cause is the insufficient neutralization of input during web page generation, specifically regarding the conversion of "data-src" attributes to "src" when module-specifi...

CVE-2025-8092 COOKiES Consent Management - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-092

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal COOKiES Consent Management allows Cross-Site Scripting XSS.This issue affects COOKiES Consent Management: from 0.0.0 before 1.2.16...

CVE-2025-8092 COOKiES Consent Management - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-092

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal COOKiES Consent Management allows Cross-Site Scripting XSS.This issue affects COOKiES Consent Management: from 0.0.0 before 1.2.16...

PT-2025-33499 · Drupal · Drupal Googletag Manager

Name of the Vulnerable Software and Affected Versions: Drupal GoogleTag Manager versions 0.0.0 through 1.9.9 Description: Improper neutralization of input during web page generation allows for Cross-Site Scripting XSS. Recommendations: Update Drupal GoogleTag Manager to version 1.10.0 or later...

Drupal AI SEO Link Advisor 安全漏洞

Drupal AI SEO Link Advisor is an AI model calling plugin for the Drupal community. A security vulnerability exists in Drupal AI SEO Link Advisor versions prior to 1.0.6 that stems from the presence of a server-side request forgery vulnerability...

Drupal Config Pages 安全漏洞

Drupal Config Pages is a configuration page plugin for the Drupal community. A security vulnerability exists in Drupal Config Pages versions prior to 2.18.0, which stems from a lack of authorization and could lead to forced browsing...

Drupal Authenticator Login 访问控制错误漏洞

Drupal Authenticator Login is a Drupal community authentication login module or feature for Drupal. A security vulnerability exists in Drupal Authenticator Login versions prior to 2.1.4 that stems from bypassing authentication using an alternate path or channel...

Drupal GoogleTag Manager 安全漏洞

Drupal GoogleTag Manager is an administrative plugin for the Drupal community. A security vulnerability exists in Drupal GoogleTag Manager versions prior to 1.10.0 that stems from improper input neutralization and could lead to a cross-site scripting attack...

Linux Distros Unpatched Vulnerability : CVE-2019-6339

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Drupal Core versions 7.x prior to 7.62, 8.6.x prior to 8.6.6 and 8.5.x prior to 8.5.9; A remote code execution vulnerability exists in PHP's built-in phar...

Linux Distros Unpatched Vulnerability : CVE-2024-55634

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability in Drupal Core allows Privilege Escalation.This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0...

Linux Distros Unpatched Vulnerability : CVE-2024-34481

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drupal-wiki.com Drupal Wiki before 8.31.1 allows XSS via comments, captions, and image titles of a Wiki page. CVE-2024-34481 Note that Nessus relies on the...

Linux Distros Unpatched Vulnerability : CVE-2024-55638

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Deserialization of Untrusted Data vulnerability in Drupal Core allows Object Injection.This issue affects Drupal Core: from 7.0 before 7.102, from 8.0.0 before...

Drupal Layout Builder Advanced Permissions 安全漏洞

Drupal Layout Builder Advanced Permissions is a permission control extension for the Drupal community. A security vulnerability exists in Drupal Layout Builder Advanced Permissions versions prior to 2.2.0, which stems from a lack of authorization and could lead to forced browsing...

CVE-2025-8092: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal COOKiES Consent Management allows Cross-Site Scripting XSS.This issue affects COOKiES Consent Management: from 0.0.0 before 1.2.16...

PT-2025-33500 · Drupal · Drupal Authenticator Login

Name of the Vulnerable Software and Affected Versions: Drupal Authenticator Login versions 0.0.0 through 2.1.3 Description: An Authentication Bypass Using an Alternate Path or Channel issue exists in Drupal Authenticator Login, allowing for Authentication Bypass. Recommendations: Update to versio...

CVE-2025-8362: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal GoogleTag Manager allows Cross-Site Scripting XSS.This issue affects GoogleTag Manager: from 0.0.0 before 1.10.0...

PT-2025-33498 · Drupal · Drupal Config Pages

Name of the Vulnerable Software and Affected Versions: Drupal Config Pages versions 0.0.0 through 2.17.9 Description: Missing authorization allows forceful browsing of Config Pages. Recommendations: Update to version 2.18.0 or later...

CVE-2025-8675: Server-Side Request Forgery (SSRF)

Server-Side Request Forgery SSRF vulnerability in Drupal AI SEO Link Advisor allows Server Side Request Forgery.This issue affects AI SEO Link Advisor: from 0.0.0 before 1.0.6...

Linux Distros Unpatched Vulnerability : CVE-2016-6211

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The User module in Drupal 7.x before 7.44 allows remote authenticated users to gain privileges via vectors involving contributed or custom code that triggers a...

Linux Distros Unpatched Vulnerability : CVE-2014-2983

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Drupal 6.x before 6.31 and 7.x before 7.27 does not properly isolate the cached data of different anonymous users, which allows remote anonymous users to obtain...