CVE-2025-3131 ECA: Event - Condition - Action - Critical - Cross site request forgery - SA-CONTRIB-2025-031

Cross-Site Request Forgery CSRF vulnerability in Drupal ECA: Event - Condition - Action allows Cross Site Request Forgery.This issue affects ECA: Event - Condition - Action: from 0.0.0 before 1.1.12, from 2.0.0 before 2.0.16, from 2.1.0 before 2.1.7, from 0.0.0 before 1.2...

CVE-2025-3131 ECA: Event - Condition - Action - Critical - Cross site request forgery - SA-CONTRIB-2025-031

Cross-Site Request Forgery CSRF vulnerability in Drupal ECA: Event - Condition - Action allows Cross Site Request Forgery.This issue affects ECA: Event - Condition - Action: from 0.0.0 before 1.1.12, from 2.0.0 before 2.0.16, from 2.1.0 before 2.1.7, from 0.0.0 before 1.2...

CVE-2025-3475

CVE-2025-3475 concerns the Drupal WEB-T module with an issue described as Allocation of Resources Without Limits or Throttling and Incorrect Authorization, enabling Excessive Allocation and Content Spoofing. Affected are WEB-T versions 0.0.0 through 1.1.0, where the root cause is unbounded resour...

CVE-2025-3475 WEB-T - Moderately critical - Access bypass, Denial of service - SA-CONTRIB-2025-030

Allocation of Resources Without Limits or Throttling, Incorrect Authorization vulnerability in Drupal WEB-T allows Excessive Allocation, Content Spoofing.This issue affects WEB-T: from 0.0.0 before 1.1.0...

CVE-2025-3475 WEB-T - Moderately critical - Access bypass, Denial of service - SA-CONTRIB-2025-030

Allocation of Resources Without Limits or Throttling, Incorrect Authorization vulnerability in Drupal WEB-T allows Excessive Allocation, Content Spoofing.This issue affects WEB-T: from 0.0.0 before 1.1.0...

CVE-2025-3475 WEB-T - Moderately critical - Access bypass, Denial of service - SA-CONTRIB-2025-030

Allocation of Resources Without Limits or Throttling, Incorrect Authorization vulnerability in Drupal WEB-T allows Excessive Allocation, Content Spoofing.This issue affects WEB-T: from 0.0.0 before 1.1.0...

DRUPAL-CONTRIB-2025-033

Panels enables administrators to add page variants within page manager, panelizer, etc to create custom pages. The module doesn't sufficiently protect sensitive routes, allowing an attacker to view and modify blocks within variants without requiring appropriate permission. This vulnerability is...

DRUPAL-CONTRIB-2025-032

Gif Player Field creates a simple file field types that allows you to upload the GIF files and configure the output for this using the Field Formatters. The module uses GifPlayer jQuery library to render the GIF according to configured setups for the Field Formatter. The external Gif Player Libra...

DRUPAL-CONTRIB-2025-031

This module enables you to define automations on your Drupal site. The module doesn't sufficiently protect certain routes from CSRF attacks. This vulnerability can be mitigated by disabling the "eca\ui" submodule, which leaves ECA functionality intact, but the vulnerable routes will no longer be...

ECA: Event - Condition - Action - Critical - Cross site request forgery - SA-CONTRIB-2025-031

This module enables you to define automations on your Drupal site. The module doesn't sufficiently protect certain routes from CSRF attacks. This vulnerability can be mitigated by disabling the "ecaui" submodule, which leaves ECA functionality intact, but the vulnerable routes will no longer be...

Gif Player Field - Moderately critical - Cross site scripting - SA-CONTRIB-2025-032

Gif Player Field creates a simple file field types that allows you to upload the GIF files and configure the output for this using the Field Formatters. The module uses GifPlayer jQuery library to render the GIF according to configured setups for the Field Formatter. The external Gif Player Libra...

Drupal Gif Player Field module < 1.5.0,2.0.0-2.0.3 - Authenticated Cross Site Scripting (XSS) vulnerability

Authenticated Cross Site Scripting XSS vulnerability discovered by Pierre Rudloff prudloff in WordPress Module Gif Player Field versions 1.5.0,2.0.0-2.0.3...

Drupal 安全漏洞

Drupal is an open source content management system developed in the PHP language by the Drupal community. A security vulnerability exists in Drupal versions prior to 4.9.0 that stems from a lack of authentication for critical functions, which could lead to improper access control...

Drupal 安全漏洞

Drupal is an open source content management system developed in the PHP language by the Drupal community. A security vulnerability exists in Drupal that stems from vulnerability to cross-site request forgery attacks...

Drupal ECA: Event - Condition - Action module < 1.1.12,2.0.0-2.0.15,2.1.0-2.1.6,1.2 - Unauthenticated Cross Site Request Forgery (CSRF) vulnerability

Drupal ECA: Event - Condition - Action module 1.1.12,2.0.0-2.0.15,2.1.0-2.1.6,1.2 - Unauthenticated Cross Site Request Forgery CSRF vulnerability discovered by Juraj Nemec poker10 in WordPress Module ECA: Event - Condition - Action versions 1.1.12,2.0.0-2.0.15,2.1.0-2.1.6,1.2...

PT-2025-15837 · Drupal · Drupal Web-T

Name of the Vulnerable Software and Affected Versions: Drupal WEB-T versions 0.0.0 through 1.1.0 Description: The issue affects Drupal WEB-T, allowing excessive allocation and content spoofing due to allocation of resources without limits or throttling and incorrect authorization. Recommendations...

PT-2025-15836 · Drupal · Drupal Panels

Name of the Vulnerable Software and Affected Versions: Drupal Panels versions 0.0.0 through 4.9.0 Description: The issue affects Drupal Panels due to missing authentication for a critical function, allowing exploitation of incorrectly configured access control security levels. Recommendations: Fo...

CVE-2025-3129

Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Access code allows Brute Force.This issue affects Access code: from 0.0.0 before 2.0.4...

CVE-2025-3130

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Obfuscate allows Stored XSS.This issue affects Obfuscate: from 0.0.0 before 2.0.1...

GHSA-HPHM-3X7F-G875 Drupal Obfuscate Vulnerable to Stored Cross-Site Scripting (XSS)

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Obfuscate allows Stored XSS. This issue affects Obfuscate: from 0.0.0 before 2.0.1...