CVE-2025-31696

CVE-2025-31696 affects the Drupal RapiDoc OAS Field Formatter. The issue is an improper input neutralization during web page generation, leading to Cross-Site Scripting (XSS). Affected versions are 0.0.0 through before 1.0.1; the fixed version is 1.0.1 or later. CVSS 3.1 base score 6.1 (MEDIUM) w...

CVE-2025-31695 Link field display mode formatter - Moderately critical - Cross site scripting - SA-CONTRIB-2025-024

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Link field display mode formatter allows Cross-Site Scripting XSS.This issue affects Link field display mode formatter: from 0.0.0 before 1.6.0...

CVE-2025-31695 Link field display mode formatter - Moderately critical - Cross site scripting - SA-CONTRIB-2025-024

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Link field display mode formatter allows Cross-Site Scripting XSS.This issue affects Link field display mode formatter: from 0.0.0 before 1.6.0...

PT-2025-13867 · Drupal · Drupal Formatter Suite

Name of the Vulnerable Software and Affected Versions: Drupal Formatter Suite versions 0.0.0 through 2.0.x Description: The issue is related to improper neutralization of input during web page generation, which allows Cross-Site Scripting XSS. This can lead to the execution of malicious scripts o...

PT-2025-13866 · Unknown · Rapidoc Oas Field Formatter

Name of the Vulnerable Software and Affected Versions: RapiDoc OAS Field Formatter versions 0.0.0 through 1.0.0 Description: The issue affects the RapiDoc OAS Field Formatter, allowing Cross-Site Scripting XSS due to improper neutralization of input during web page generation. Recommendations: Fo...

Drupal Formatter Suite 跨站脚本漏洞

The Drupal Formatter Suite is a collection of modules from the Drupal community designed to provide a flexible set of formatting tools for Drupal. A cross-site scripting vulnerability exists in Drupal Formatter Suite versions prior to 2.1.0 that stems from improper input neutralization and could...

Drupal Link field display mode formatter 跨站脚本漏洞

The Drupal Link field display mode formatter is a Drupal community module used to provide custom display modes for Drupal link fields. A cross-site scripting vulnerability exists in Drupal Link field display mode formatter versions prior to 1.6.0, which stems from improper input neutralization an...

Drupal RapiDoc OAS Field Formatter 跨站脚本漏洞

Drupal RapiDoc OAS Field Formatter is a Drupal community field formatter for Drupal. A cross-site scripting vulnerability exists in Drupal RapiDoc OAS Field Formatter versions prior to 1.0.1, which stems from improper input neutralization and could lead to a cross-site scripting attack...

DRUPAL-CONTRIB-2025-026

Formatter Suite provides a suite of field formatters to help present numbers, dates, times, text, links, entity references, files, and images. The module provides a custom formatter for link fields. Drupal core does not sufficiently sanitize link element attributes, which can lead to a Cross Site...

DRUPAL-CONTRIB-2025-025

This module can be used to render Open API Documentation using the RapiDoc library. The module provides a custom formatter for link fields. Drupal core does not sufficiently sanitize link element attributes, which can lead to a Cross Site Scripting vulnerability XSS. A separate fix for Drupal cor...

DRUPAL-CONTRIB-2025-024

This module adds a formatter for link fields that displays the current entity with another view mode inside the link. Drupal core does not sufficiently sanitize link element attributes, which can lead to a Cross Site Scripting vulnerability XSS. A separate fix for Drupal core has been released bu...

Drupal RapiDoc OAS Field Formatter module < 1.0.1 - Unauthenticated Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS vulnerability discovered by Joseph Zhao pandaski in WordPress Module RapiDoc OAS Field Formatter versions 1.0.1...

Formatter Suite - Moderately critical - Cross site scripting - SA-CONTRIB-2025-026

Formatter Suite provides a suite of field formatters to help present numbers, dates, times, text, links, entity references, files, and images. The module provides a custom formatter for link fields. Drupal core does not sufficiently sanitize link element attributes, which can lead to a Cross Site...

Drupal Formatter Suite module < 2.1.0 - Unauthenticated Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS vulnerability discovered by Daniel Wehner dawehner in WordPress Module Formatter Suite versions 2.1.0...

Drupal Link field display mode formatter module < 1.6.0 - Unauthenticated Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS vulnerability discovered by Daniel Wehner dawehner in WordPress Module Link field display mode formatter versions 1.6.0...

SUSE CVE-2025-25294

Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. In all Envoy Gateway versions prior to 1.2.7 and 1.3.1 a default Envoy Proxy access log configuration is used. This format is vulnerable to log injection attacks. If the...

CVE-2025-27824

An XSS issue was discovered in the Link iframe formatter module before 1.x-1.1.1 for Backdrop CMS. It doesn't sufficiently sanitize input before displaying results to the screen. This vulnerability is mitigated by the fact that an attacker must have the ability to create content containing an...

CVE-2025-27824

An XSS issue was discovered in the Link iframe formatter module before 1.x-1.1.1 for Backdrop CMS. It doesn't sufficiently sanitize input before displaying results to the screen. This vulnerability is mitigated by the fact that an attacker must have the ability to create content containing an...

CVE-2025-27824

An XSS issue was discovered in the Link iframe formatter module before 1.x-1.1.1 for Backdrop CMS. It doesn't sufficiently sanitize input before displaying results to the screen. This vulnerability is mitigated by the fact that an attacker must have the ability to create content containing an...

CVE-2025-27824

An XSS issue was discovered in the Link iframe formatter module before 1.x-1.1.1 for Backdrop CMS. It doesn't sufficiently sanitize input before displaying results to the screen. This vulnerability is mitigated by the fact that an attacker must have the ability to create content containing an...