CVE-2025-31673 Drupal core - Moderately critical - Access bypass - SA-CORE-2025-002

Incorrect Authorization vulnerability in Drupal Drupal core allows Forceful Browsing.This issue affects Drupal core: from 8.0.0 before 10.3.13, from 10.4.0 before 10.4.3, from 11.0.0 before 11.0.12, from 11.1.0 before 11.1.3...

PT-2025-13845 · Drupal · Drupal Authenticator Login

Name of the Vulnerable Software and Affected Versions: Drupal Authenticator Login versions 0.0.0 through 2.0.5 Description: The issue is related to a Missing Authorization vulnerability in Drupal Authenticator Login, which allows Forceful Browsing. Recommendations: For versions 0.0.0 through 2.0....

PT-2025-13842 · Drupal · Drupal Ai

Name of the Vulnerable Software and Affected Versions: Drupal AI Artificial Intelligence versions 0.0.0 through 1.0.2 Description: The issue is related to a Missing Authorization vulnerability, which allows Forceful Browsing in Drupal AI Artificial Intelligence. Recommendations: For versions 0.0....

PT-2025-13849 · Drupal · Open Social

Name of the Vulnerable Software and Affected Versions: Open Social versions 0.0.0 through 12.3.10 Open Social versions 12.4.0 through 12.4.9 Description: The issue is related to a Missing Authorization vulnerability in Drupal Open Social, which allows Forceful Browsing. Recommendations: For Open...

PT-2025-13864 · Drupal · Drupal Two-Factor Authentication

Name of the Vulnerable Software and Affected Versions: Drupal Two-factor Authentication TFA versions 0.0.0 through 1.10.0 Description: The issue is related to an Incorrect Authorization vulnerability in the Drupal Two-factor Authentication TFA module, allowing Forceful Browsing. Recommendations:...

CVE-2025-31694: Authentication Bypass Using an Alternate Path or Channel

Incorrect Authorization vulnerability in Drupal Two-factor Authentication TFA allows Forceful Browsing.This issue affects Two-factor Authentication TFA: from 0.0.0 before 1.10.0...

CVE-2025-31685: Missing Authorization

Missing Authorization vulnerability in Drupal Open Social allows Forceful Browsing.This issue affects Open Social: from 0.0.0 before 12.3.11, from 12.4.0 before 12.4.10...

CVE-2025-31686: Missing Authorization

Missing Authorization vulnerability in Drupal Open Social allows Forceful Browsing.This issue affects Open Social: from 0.0.0 before 12.3.11, from 12.4.0 before 12.4.10...

CVE-2025-31678: Missing Authorization

Missing Authorization vulnerability in Drupal AI Artificial Intelligence allows Forceful Browsing.This issue affects AI Artificial Intelligence: from 0.0.0 before 1.0.3...

PT-2025-13855 · Drupal · Drupal Oauth2 Server

Name of the Vulnerable Software and Affected Versions: Drupal OAuth2 Server versions 0.0.0 through 2.0.x Description: The issue is related to a Missing Authorization vulnerability in the Drupal OAuth2 Server, which allows Forceful Browsing. Recommendations: For versions 0.0.0 through 2.0.x, updat...

CVE-2025-31691: Missing Authorization

Missing Authorization vulnerability in Drupal OAuth2 Server allows Forceful Browsing.This issue affects OAuth2 Server: from 0.0.0 before 2.1.0...

PT-2025-13837 · Drupal · Drupal

Name of the Vulnerable Software and Affected Versions: Drupal core versions 8.0.0 through 10.3.12 Drupal core versions 10.4.0 through 10.4.2 Drupal core versions 11.0.0 through 11.0.11 Drupal core versions 11.1.0 through 11.1.2 Description: The issue is related to an Incorrect Authorization...

CVE-2025-31681: Missing Authorization

Missing Authorization vulnerability in Drupal Authenticator Login allows Forceful Browsing.This issue affects Authenticator Login: from 0.0.0 before 2.0.6...

CVE-2025-31673: Incorrect Authorization

Incorrect Authorization vulnerability in Drupal Drupal core allows Forceful Browsing.This issue affects Drupal core: from 8.0.0 before 10.3.13, from 10.4.0 before 10.4.3, from 11.0.0 before 11.0.12, from 11.1.0 before 11.1.3...

PT-2025-13850

Name of the Vulnerable Software and Affected Versions Open Social versions 0.0.0 through 12.3.10 Open Social versions 12.4.0 through 12.4.9 Description The issue is related to a Missing Authorization vulnerability in Drupal Open Social, which allows Forceful Browsing. Recommendations For Open...

The vulnerability of the Advanced Varnish CMS system’s Drupal module, related to insufficient protection of operational data, allows attackers to bypass security restrictions and execute a Forceful Browsing attack.

The vulnerability of the Advanced Varnish CMS system, Drupal, is related to insufficient protection of operational data. Exploiting this vulnerability allows a malicious actor to bypass security restrictions and execute a Forceful Browsing attack...

The vulnerability of the Freelinking module in Drupal CMS systems, related to improper authentication, allows attackers to expose protected information and execute a Forceful Browsing attack.

The vulnerability of the Freelinking module in the Drupal CMS system is related to improper authentication. Exploiting this vulnerability allows a malicious actor to disclose protected information and execute a Forceful Browsing attack...

The vulnerability of the Content Entity Clone module in the Drupal CMS system, related to improper authentication, allows attackers to disclose protected information and execute a Forceful Browsing attack.

The vulnerability of the Content Entity Clone module in the Drupal CMS system is related to improper authentication. Exploiting this vulnerability can allow a malicious actor to disclose protected information and execute a Forceful Browsing attack...

The vulnerability of the Entity Delete Log module in the Drupal CMS system, related to improper authentication, allows attackers to bypass security restrictions and execute a forced browsing attack.

The vulnerability of the Entity Delete Log module in the Drupal CMS system is related to improper authentication. Exploiting this vulnerability allows a malicious actor to bypass security restrictions and execute a Forceful Browsing attack...

The vulnerability of the Email Contact module in the Drupal CMS system allows attackers to bypass security restrictions and execute a forced browsing attack.

The vulnerability of the Email Contact module in the Drupal CMS system is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to bypass security restrictions and execute a Forceful Browsing attack...