CVE-2025-3907

The Drupal Search API Solr module (versions 0.0.0 through 4.3.8 ) is vulnerable to an unauthenticated Cross-Site Request Forgery (CSRF) . The root cause is the module's failure to sufficiently protect certain routes, potentially allowing unauthorized actions to be performed on behalf of a user wi...

CVE-2025-3904

A vulnerability exists in the Sportsleague module for the Drupal content management system. The issue affects all versions of the module (. ). According to reports, the vulnerability stems from a problem with the project file that impacts usability, and it has been classified as an unauthenticate...

CVE-2025-3904 Sportsleague - Critical - Unsupported - SA-CONTRIB-2025-045

Vulnerability in Drupal Sportsleague.This issue affects Sportsleague:...

CVE-2025-3903

The Drupal UEditor - 百度编辑器 module (all versions) is affected by a vulnerability categorized as an Unauthenticated Other Vulnerability Type . The security team has marked this project as unsupported because a known security issue exists that has not been fixed by the maintainer. No specific workar...

CVE-2025-3903 UEditor - 百度编辑器 - Critical - Unsupported - SA-CONTRIB-2025-044

Vulnerability in Drupal UEditor - 百度编辑器.This issue affects UEditor - 百度编辑器:...

CVE-2025-3903 UEditor - 百度编辑器 - Critical - Unsupported - SA-CONTRIB-2025-044

Vulnerability in Drupal UEditor - 百度编辑器.This issue affects UEditor - 百度编辑器:...

CVE-2025-3902 Block Class - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-043

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Block Class allows Cross-Site Scripting XSS.This issue affects Block Class: from 4.0.0 before 4.0.1...

CVE-2025-3902 Block Class - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-043

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Block Class allows Cross-Site Scripting XSS.This issue affects Block Class: from 4.0.0 before 4.0.1...

CVE-2025-3902 Block Class - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-043

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Block Class allows Cross-Site Scripting XSS.This issue affects Block Class: from 4.0.0 before 4.0.1...

CVE-2025-3902

The Drupal Block Class module (version 4.0.0 ) is vulnerable to Cross-Site Scripting (XSS) due to the improper neutralization of input during web page generation. Specifically, the module fails to sufficiently sanitize custom attribute input , which can allow an attacker to inject malicious JavaS...

CVE-2025-3901 Bootstrap Site Alert - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-042

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Bootstrap Site Alert allows Cross-Site Scripting XSS.This issue affects Bootstrap Site Alert: from 0.0.0 before 1.13.0, from 3.0.0 before 3.0.4...

CVE-2025-3901 Bootstrap Site Alert - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-042

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Bootstrap Site Alert allows Cross-Site Scripting XSS.This issue affects Bootstrap Site Alert: from 0.0.0 before 1.13.0, from 3.0.0 before 3.0.4...

CVE-2025-3901

The Drupal Bootstrap Site Alert module is vulnerable to a Cross-Site Scripting (XSS) attack due to insufficient filtering of text input. This vulnerability affects versions before 1.13.0 and 3.0.0 before 3.0.4 . Impacting the web page generation, the flaw allows an attacker to execute malicious s...

CVE-2025-3900 Colorbox - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-041

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Colorbox allows Cross-Site Scripting XSS.This issue affects Colorbox: from 0.0.0 before 2.1.3...

CVE-2025-3900 Colorbox - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-041

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Colorbox allows Cross-Site Scripting XSS.This issue affects Colorbox: from 0.0.0 before 2.1.3...

CVE-2025-3900

The Drupal Colorbox module (versions before 2.1.3 ) is vulnerable to a Cross-Site Scripting (XSS) flaw caused by the insufficient sanitization of data attributes before opening modals. An attacker can exploit this to execute malicious scripts in a user's browser. The risk is mitigated by the requ...

CVE-2025-3900 Colorbox - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-041

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Colorbox allows Cross-Site Scripting XSS.This issue affects Colorbox: from 0.0.0 before 2.1.3...

DRUPAL-CONTRIB-2025-046

This module provides support for creating searches using the Apache Solr search engine and the Search API Drupal module. The module doesn't sufficiently protect certain routes from CSRF attacks. This vulnerability is mitigated by the fact that a site admin would have to perform further steps afte...

DRUPAL-CONTRIB-2025-045

The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466s-becoming-owner-maintainer-or-co-mai...

DRUPAL-CONTRIB-2025-044

The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466s-becoming-owner-maintainer-or-co-mai...