Drupal Two-factor Authentication 安全漏洞

Drupal Two-factor Authentication is a module for the Drupal community. A security vulnerability exists in Drupal Two-factor Authentication versions prior to 1.10.0, which stems from incorrect authorization and could lead to forced browsing...

Drupal Authenticator Login 安全漏洞

Drupal Authenticator Login is a Drupal community authentication login module or feature for Drupal. A security vulnerability exists in Drupal Authenticator Login versions prior to 2.0.6, which stems from a lack of authorization and could lead to forced browsing...

CVE-2025-31673: Incorrect Authorization

Incorrect Authorization vulnerability in Drupal Drupal core allows Forceful Browsing.This issue affects Drupal core: from 8.0.0 before 10.3.13, from 10.4.0 before 10.4.3, from 11.0.0 before 11.0.12, from 11.1.0 before 11.1.3...

Drupal Formatter Suite 跨站脚本漏洞

The Drupal Formatter Suite is a collection of modules from the Drupal community designed to provide a flexible set of formatting tools for Drupal. A cross-site scripting vulnerability exists in Drupal Formatter Suite versions prior to 2.1.0 that stems from improper input neutralization and could...

PT-2025-13864 · Drupal · Drupal Two-Factor Authentication

Name of the Vulnerable Software and Affected Versions: Drupal Two-factor Authentication TFA versions 0.0.0 through 1.10.0 Description: The issue is related to an Incorrect Authorization vulnerability in the Drupal Two-factor Authentication TFA module, allowing Forceful Browsing. Recommendations:...

CVE-2025-31694: Authentication Bypass Using an Alternate Path or Channel

Incorrect Authorization vulnerability in Drupal Two-factor Authentication TFA allows Forceful Browsing.This issue affects Two-factor Authentication TFA: from 0.0.0 before 1.10.0...

PT-2025-13854 · Drupal · Drupal Cache Utility

Name of the Vulnerable Software and Affected Versions: Drupal Cache Utility versions 0.0.0 through 1.2.0 Description: A Cross-Site Request Forgery CSRF issue affects the Drupal Cache Utility, allowing unauthorized actions to be performed on behalf of a user. Recommendations: For versions 0.0.0...

Drupal AI 跨站请求伪造漏洞

Drupal AI is a module or solution from the Drupal community that integrates artificial intelligence capabilities. A cross-site request forgery vulnerability exists in Drupal AI versions prior to 1.0.2 that stems from cross-site request forgery...

Drupal AI 安全漏洞

Drupal AI is a module or solution for the Drupal community that integrates artificial intelligence capabilities. A security vulnerability exists in Drupal AI versions prior to 1.0.3, which stems from a lack of authorization and could lead to forced browsing...

PT-2025-13848 · Drupal · Drupal Oauth2 Client

Name of the Vulnerable Software and Affected Versions: Drupal OAuth2 Client versions 0.0.0 through 4.1.2 Description: A Cross-Site Request Forgery CSRF issue affects the Drupal OAuth2 Client, allowing unauthorized actions to be performed on behalf of the user. This issue may be exploited by an...

Drupal 11.1.x < 11.1.5 Cross-Site Scripting

According to its self-reported version, the instance of Drupal running on the remote web server is 11.1.x prior to 11.1.5, 11.0.x prior to 11.0.13, 10.4.x prior to 10.4.5 or 8.x prior to 10.3.14. Drupal core Link field attributes are not sufficiently sanitized, which can lead to a Cross-Site...

Drupal 8.0.x < 10.3.14 Cross-Site Scripting

According to its self-reported version, the instance of Drupal running on the remote web server is 11.1.x prior to 11.1.5, 11.0.x prior to 11.0.13, 10.4.x prior to 10.4.5 or 8.x prior to 10.3.14. Drupal core Link field attributes are not sufficiently sanitized, which can lead to a Cross-Site...

Drupal 11.0.x < 11.0.13 Cross-Site Scripting

According to its self-reported version, the instance of Drupal running on the remote web server is 11.1.x prior to 11.1.5, 11.0.x prior to 11.0.13, 10.4.x prior to 10.4.5 or 8.x prior to 10.3.14. Drupal core Link field attributes are not sufficiently sanitized, which can lead to a Cross-Site...

Drupal 10.4.x < 10.4.5 Cross-Site Scripting

According to its self-reported version, the instance of Drupal running on the remote web server is 11.1.x prior to 11.1.5, 11.0.x prior to 11.0.13, 10.4.x prior to 10.4.5 or 8.x prior to 10.3.14. Drupal core Link field attributes are not sufficiently sanitized, which can lead to a Cross-Site...

Drupal XSS Vulnerability (SA-CORE-2025-004) - Linux

Drupal is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:drupal:drupal";...

Drupal XSS Vulnerability (SA-CORE-2025-004) - Windows

Drupal is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:drupal:drupal";...

Drupal 10.3.x < 10.3.14 / 10.4.x < 10.4.5 / 11.x < 11.0.13 / 11.1.x < 11.1.5 Drupal Vulnerability (SA-CORE-2025-004)

According to its self-reported version, the instance of Drupal running on the remote web server is 10.3.x prior to 10.3.14, 10.4.x prior to 10.4.5, 11.x prior to 11.0.13, or 11.1.x prior to 11.1.5. It is, therefore, affected by a vulnerability. - Improper Neutralization of Input During Web Page...

DRUPAL-CORE-2025-004

Drupal core Link field attributes are not sufficiently sanitized, which can lead to a Cross Site Scripting vulnerability XSS. This vulnerability is mitigated by that fact that an attacker would need to have the ability to add specific attributes to a Link field, which typically requires edit acce...

DRUPAL-CONTRIB-2025-026

Formatter Suite provides a suite of field formatters to help present numbers, dates, times, text, links, entity references, files, and images. The module provides a custom formatter for link fields. Drupal core does not sufficiently sanitize link element attributes, which can lead to a Cross Site...

DRUPAL-CONTRIB-2025-025

This module can be used to render Open API Documentation using the RapiDoc library. The module provides a custom formatter for link fields. Drupal core does not sufficiently sanitize link element attributes, which can lead to a Cross Site Scripting vulnerability XSS. A separate fix for Drupal cor...