PT-2025-2095 · Drupal · Drupal Persistent Login

Name of the Vulnerable Software and Affected Versions: Drupal Persistent Login versions 0.0.0 through 1.8.0 Drupal Persistent Login versions 2.0. through 2.2.2 Description: The issue is related to insufficient session expiration in the Drupal Persistent Login module, allowing for forceful browsin...

VulnCheck KEV: CVE-2014-8379

Multiple cross-site scripting XSS vulnerabilities in the Marketo MA module before 7.x-1.5 for Drupal allow remote authenticated users with certain permissions to inject arbitrary web script or HTML via vectors related to field titles to the 1 Webform or 2 User sub-modules...

Drupal Smart IP Ban module < 7.x-1.1 - Unauthenticated Broken Access Control vulnerability

Unauthenticated Broken Access Control vulnerability discovered by Shawn Gants in WordPress Module Smart IP Ban versions 7.x-1.1...

PT-2025-2092 · Drupal · Drupal Cms +1

Name of the Vulnerable Software and Affected Versions: Drupal Smart IP Ban versions 7.X-1.0 through 7.X-1.0 Description: The issue is related to insufficient authorization mechanisms in the Smart IP Ban module for the Drupal CMS, allowing a remote attacker to view and modify settings. This can le...

Drupal Security Kit module < 2.0.3 - Unauthenticated Denial of Service Attack vulnerability

Unauthenticated Denial of Service Attack vulnerability discovered by b0lli in WordPress Module Security Kit versions 2.0.3...

Drupal File Entity (fieldable files) module < 7.x-2.39 - Authenticated Sensitive Data Exposure vulnerability

Authenticated Sensitive Data Exposure vulnerability discovered by Devin Zuczek in WordPress Module File Entity fieldable files versions 7.x-2.39...

Security Kit - Less critical - Denial of Service - SA-CONTRIB-2024-039

This module provides Drupal with various security-hardening options, for example by emitting various configurable HTTP response headers. The module doesn't sufficiently validate input in Content Security Policy CSP violation reports. This can cause errors when a logging module e.g. dblog or syslo...

CVE-2019-11358

...

DRUPAL-CONTRIB-2024-038

Open Social is a Drupal distribution for online communities. The distribution didn't validate the flood control limits on the password reset form correctly resulting in a potential attacker flooding the password reset which could result in a Denial of Service. Fortunately the message does not...

DRUPAL-CONTRIB-2024-037

Open Social is a Drupal distribution for online communities, which ships with an optional module called Social Embed. This module allows a website to display embedded content such as photos or videos when a user posts a link to that resource, without having to parse the resource directly. Added...

DRUPAL-CONTRIB-2024-036

This module enables field collections to be displayed as tables. It supports display suite and field permissions and provides operations modify, delete, duplicate. This module has multiple vulnerabilities due to the requirements on the routes it provides not being restrictive enough. Information...

DRUPAL-CONTRIB-2024-035

This module enables you to "clone" a content entity, i.e. to create a new content pre-filled with data from another entity of the same type and bundle. The module doesn't properly check the user access to the original entity, allowing users to create a new entity they have permission to create...

DRUPAL-CONTRIB-2024-034

This module enables you to configure a wiki-like input filter that allows users to create links to site and external content. The module doesn't sufficiently check if a user has access to some URLs before rendering them as links. This vulnerability is mitigated by the fact that an attacker must...

Drupal Content Entity Clone module < 1.0.4 - Authenticated Sensitive Data Exposure vulnerability

Authenticated Sensitive Data Exposure vulnerability discovered by Vojislav Jovanovic in WordPress Module Content Entity Clone versions 1.0.4...

PT-2025-2090

Name of the Vulnerable Software and Affected Versions Open Social versions 0.0.0 through 12.3.8 Open Social versions 12.4.0 through 12.4.5 Description The issue is related to insufficient control over interaction frequency in the Open Social module of the Drupal CMS system. This can be exploited ...

Drupal Open Social module < 12.3.8,12.4.0-12.4.4,13.0.0-13.0.0-alpha10 - Authenticated Multiple Vulnerabilities

Authenticated Multiple Vulnerabilities discovered by Thiago Régis in WordPress Module Open Social versions 12.3.8,12.4.0-12.4.4,13.0.0-13.0.0-alpha10...

PT-2025-2089

Name of the Vulnerable Software and Affected Versions Content Entity Clone versions 0.0.0 through 1.0.4 Description The issue is related to incorrect authorization in the Content Entity Clone module for Drupal, allowing forceful browsing. This can enable a remote attacker to disclose protected...

Drupal Open Social module < 12.3.8,12.4.0-12.4.4,13.0.0-13.0.0-alpha10 - Unauthenticated Denial of Service Attack vulnerability

Unauthenticated Denial of Service Attack vulnerability discovered by vnech in WordPress Module Open Social versions 12.3.8,12.4.0-12.4.4,13.0.0-13.0.0-alpha10...

PT-2024-10356

Name of the Vulnerable Software and Affected Versions Drupal Paragraphs table versions 0.0.0 through 1.22.0 Drupal Paragraphs table versions 2.0.0 through 2.0.1 Description The issue is related to insufficient granularity of access control in Drupal Paragraphs table, which allows content spoofing...

PT-2025-2088

Name of the Vulnerable Software and Affected Versions Drupal Freelinking versions 0.0.0 through 4.0.0 Description The issue is related to an Incorrect Authorization vulnerability in Drupal Freelinking, which allows Forceful Browsing. This vulnerability can be exploited by a remote attacker to...