Lucene search
+L
DrupalMost viewed

1966 matches found

Drupal
Drupal
•added 2014/04/16 12:00 a.m.•21 views

SA-CONTRIB-2014-041 - Block Search - SQL Injection

Block Search module provides an alternative way of managing blocks. The module doesn't properly use Drupal's database API resulting in user-provided strings being passed directly to the database allowing SQL Injection. This vulnerability is mitigated by the fact that an attacker must either use a...

7.8AI score
SaveExploits0References9
Drupal
Drupal
•added 2014/02/12 12:00 a.m.•21 views

SA-CONTRIB-2014-019 - Easy Social - Cross Site Scripting (XSS)

This module enables you to add social sharing widgets to your content and pages. The module doesn't sufficiently validate block titles when a user creates a custom block from within the module's admin interface. This vulnerability is mitigated by the fact that an attacker must have a role with th...

3.5CVSS6.3AI score0.01046EPSS
SaveExploits0References10
Drupal
Drupal
•added 2014/01/29 12:00 a.m.•21 views

SA-CONTRIB-2014-007 - Services - Multiple access bypass vulnerabilities

This module enables you to expose an API to third party systems using REST, XML-RPC or other protocols. The form API provides a method for developers to submit forms programmatically using the function drupalformsubmit. During programmatic form submissions, all access checks are deliberately...

7.1AI score
SaveExploits0References16
Drupal
Drupal
•added 2013/09/11 12:00 a.m.•21 views

SA-CONTRIB-2013-074 - MediaFront - Cross Site Scripting (XSS)

The MediaFront module provides a front-end media presentation layer for Drupal The module doesn't sufficiently filter user input from MediaFront preset settings. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer mediafront" to exploit th...

2.1CVSS6.3AI score0.00941EPSS
SaveExploits0References12
Drupal
Drupal
•added 2013/04/03 12:00 a.m.•21 views

SA-CONTRIB-2013-041 - Chaos tool suite (ctools) - Access bypass

This CTools module provides a set of APIs and tools to improve the developer experience. The module doesn't sufficiently enforce node access when providing an autocomplete list of suggested node titles, allowing users with the "access content" permission to see the titles of nodes which they shou...

3.5CVSS6.3AI score0.01772EPSS
SaveExploits0References12
Drupal
Drupal
•added 2013/02/27 12:00 a.m.•21 views

SA-CONTRIB-2013-033 - Simple Corporate theme - Cross Site Scripting (XSS)

This third-party contributed theme change Drupal's interface. The theme doesn't properly sanitize user-entered content in the 3 slide gallery on the homepage leading to a Cross Site Scripting XSS vulnerability. This vulnerability is mitigated by the fact that an attacker would have to have the...

2.1CVSS5.6AI score0.00941EPSS
SaveExploits0References10
Drupal
Drupal
•added 2013/02/27 12:00 a.m.•21 views

SA-CONTRIB-2013-029 - Business theme - Cross Site Scripting (XSS)

This third-party contributed theme change Drupal's interface. The theme doesn't properly sanitize user-entered content in the 3 slide gallery on the homepage leading to a Cross Site Scripting XSS vulnerability. This vulnerability is mitigated by the fact that an attacker would have to have the...

2.1CVSS5.6AI score0.01089EPSS
SaveExploits0References10
Drupal
Drupal
•added 2013/02/20 12:00 a.m.•21 views

SA-CONTRIB-2013-019 - Ubercart Views - Cross site scripting (XSS)

Ubercart Views provides Views integration for the Ubercart shopping cart module. The "full name" field in Views is not properly sanitized on output. The vulnerability is mitigated by the fact that an attacker must get far enough in the checkout process to store their name with an order. CVE...

4.3CVSS6.4AI score0.01161EPSS
SaveExploits0References10
Drupal
Drupal
•added 2013/02/20 12:00 a.m.•21 views

SA-CONTRIB-2013-017 - Yandex.Metrics - Cross site scripting (XSS)

The Yandex.Metrics module enables you to install Yandex.Metrica tracking code and watch reports by key indicators of user activity. The module doesn't sufficiently escape Yandex.Metrica service data when being displayed. This vulnerability is mitigated by the fact that it only impacts sites with...

4.3CVSS6.6AI score0.01284EPSS
SaveExploits0References9
Drupal
Drupal
•added 2012/11/14 12:00 a.m.•21 views

SA-CONTRIB-2012-165 - Chaos tool suite (ctools) - Cross Site Scripting (XSS)

The Chaos tool suite is primarily a set of APIs and tools to improve the developer experience. The page manager node view task does not sufficiently escape node titles when setting the page title, allowing XSS. This vulnerability is partially mitigate by the node task being disabled by default an...

2.6CVSS6AI score0.01783EPSS
SaveExploits0References11
Drupal
Drupal
•added 2012/10/10 12:00 a.m.•21 views

SA-CONTRIB-2012-153 - Mandrill - Information Disclosure

This module enables you to send emails using an external gateway and by default logs the contents of the messages. An attacker who gains access to the Mandrill dashboard can trigger password reset emails from the Drupal site, get the reset links from the Mandrill logs, and take over an account...

4CVSS6.6AI score0.01082EPSS
SaveExploits0References12
Drupal
Drupal
•added 2012/09/19 12:00 a.m.•21 views

SA-CONTRIB-2012-144 Fonecta verify - Cross Site Scripting (XSS)

Fonecta verify provides an interface to retrieve information from the Finnish Fonecta company information database. The module contains an arbitrary script injection vulnerability XSS due to the fact that it fails to sanitize data retrieved from an untrusted third party source. This vulnerability...

4.3CVSS6.2AI score0.01161EPSS
SaveExploits0References9
Drupal
Drupal
•added 2012/09/19 12:00 a.m.•21 views

SA-CONTRIB-2012-145 - Imagemenu - Cross Site Scripting (XSS)

Imagemenu module allows you to create Drupal menus from images files. The module doesn't sufficiently escape image file names when rendering menus, allowing a potential XSS attack. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer...

2.1CVSS5.7AI score0.01041EPSS
SaveExploits0References13
Drupal
Drupal
•added 2012/08/29 12:00 a.m.•21 views

SA-CONTRIB-2012-135 - CAPTCHA - Insufficient anti-automation prevention

This module enables you to protect website forms using a CAPTCHA. A CAPTCHA is a test which attempts to differentiate between a human and an automated bot or script. The module doesn't ensure that test submissions have a single-use unique token. This means that web robots could reuse a single...

7.1AI score
SaveExploits0References11
Drupal
Drupal
•added 2012/05/23 12:00 a.m.•21 views

SA-CONTRIB-2012-085 - BrowserID - Multiple Vulnerabilities

CSRF Issue: CVE: CVE-2012-2713 BrowserID login theft: CVE: CVE-2012-2714 The BrowserID module provides integration with BrowserID also known as Mozilla Persona -- a Mozilla project that lets users of your site quickly and easily log in without needing to remember a password specific to your site...

9.8CVSS9.9AI score0.03294EPSS
SaveExploits1References12
Drupal
Drupal
•added 2012/03/14 12:00 a.m.•21 views

SA-CONTRIB-2012-037 - Slidebox - access bypass

CVE: CVE-2012-2063 The Slidebox module allows webmasters do display a link to the next node in a jQuery box that slides in from the right side of the page after a user scrolls past a certain point. While the module checks for "published" status, the module does not contain sufficient usage of...

5CVSS6.5AI score0.02329EPSS
SaveExploits0References11
Drupal
Drupal
•added 2012/03/14 12:00 a.m.•21 views

SA-CONTRIB-2012-041 - Fancy Slide - Cross Site Scripting (XSS)

CVE: CVE-2012-2068 This module enables you to create slideshow blocks to embed into templates. The module doesn't sufficiently filter user supplied text. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer fancyslide". Versions affected...

2.1CVSS6.3AI score0.01607EPSS
SaveExploits0References10
Drupal
Drupal
•added 2012/02/08 12:00 a.m.•21 views

SA-CONTRIB-2012-017 - Finder - Multiple vulnerabilities

CVE: CVE-2012-1641 Finder is a Drupal module that allows users to create faceted search forms. The module's autocomplete, checkbox, and radio button functionalities previously did not sanitize the output of fields and raw database values. In addition, users with the "administer finder" permission...

6CVSS7.5AI score0.02292EPSS
SaveExploits1References12
Drupal
Drupal
•added 2012/01/11 12:00 a.m.•21 views

SA-CONTRIB-2012-008 - Video Filter - Cross Site Scripting

CVE: CVE-2012-1634 The Video Filter module lets you display videos from various third party sources. When videos from Blip.tv are shown, the module fails to sanitize source data before display. This vulnerability is mitigated by the fact that the attacker has to be able to either control the sour...

4.3CVSS6.4AI score0.01393EPSS
SaveExploits1References11
Drupal
Drupal
•added 2012/01/11 12:00 a.m.•21 views

SA-CONTRIB-2012-007 - Password Policy - Multiple vulnerabilities

This module enables you to specify a certain level of password complexity aka. "password hardening" for user passwords on a system by defining a policy. Cross Site Request Forgery CSRF CVE: CVE-2012-1633 Unblocking a user does not require sufficient confirmation by administrative users and can be...

6.8CVSS6.1AI score0.00941EPSS
SaveExploits2References10
Drupal
Drupal
•added 2012/01/04 12:00 a.m.•21 views

SA-CONTRIB-2012-002 - Lingotek - Cross Site Scripting

CVE: CVE-2012-1624 This module enables you to translate a website's content using tools provided by the Lingotek Collaborative Translation Network. The module doesn't sufficiently sanitize user input when creating or editing page content. This allows a malicious content editor to potentially inpu...

3.5CVSS5.8AI score0.0107EPSS
SaveExploits0References10
Drupal
Drupal
•added 2011/08/03 12:00 a.m.•21 views

SA-CONTRIB-2011-032 - Mail Logger - Cross Site Scripting

The Mail Logger module logs all outgoing e-mails and provides users with the "access mail logger" permission to view logged e-mails. The module does not sanitize the log output of addressee information, subject, and body, leading to a Cross-Site Scripting XSS vulnerability that may lead to a...

5.8AI score
SaveExploits0References12
Drupal
Drupal
•added 2011/02/02 12:00 a.m.•21 views

SA-CONTRIB-2011-005 - AES encryption - Information disclosure

Due to a piece of code used for debugging mistakenly left in the release, the plain text password of the user who last logged in is written to a text file in the Drupal root directory. This file is remotely accessible, thus an attacker with the knowledge of which user last logged in may access th...

7.4AI score
SaveExploits0References8
Drupal
Drupal
•added 2010/12/08 12:00 a.m.•21 views

SA-CONTRIB-2010-109 - Embedded Media Field, Media: Video Flotsam, Media: Audio Flotsam - Multiple Vulnerabilities

1 - Arbitrary File Upload/Code Execution Vulnerability The Embedded Thumbnail module packaged with the project allows users who upload videos to upload their own thumbnails to replace The Drupal Embedded Media Field module. Unfortunately, the Embedded Thumbnail Module contains a vulnerability tha...

7.3AI score
SaveExploits0References12
Drupal
Drupal
•added 2010/11/10 12:00 a.m.•21 views

SA-CONTRIB-2010-102 - Category tokens - Cross Site Scripting

The Category tokens module exposes additional tokens for the first and last terms related to a node for each vocabulary. The module does not sanitize the vocabulary names when displayed in token help, leading to a Cross-Site Scripting XSS vulnerability that may lead to a malicious user gaining fu...

5.9AI score
SaveExploits0References7
Drupal
Drupal
•added 2010/08/18 12:00 a.m.•21 views

SA-CONTRIB-2010-089 - Simplenews Content Selection - Cross Site Scripting

This module allows you to select content from your website and send a newsletter with the selected content. The module does not sanitize some of the user-supplied data before displaying it, leading to a Cross Site Scripting XSS vulnerability that may lead to a malicious user gaining full...

6.1AI score
SaveExploits0References7
Drupal
Drupal
•added 2010/06/23 12:00 a.m.•21 views

SA-CONTRIB-2010-069 - Case Tracker - Multiple Vulnerabilities

The Case Tracker module enables teams to track outstanding cases which need resolution by attaching a status, priority and type. Cross Site Scripting XSS The module does not sanitize some of the user-supplied data before displaying it, leading to a cross site scripting XSS vulnerability that may...

5.8AI score
SaveExploits0References9
Drupal
Drupal
•added 2010/05/19 12:00 a.m.•21 views

SA-CONTRIB-2010-049 - Wordpress Import - Access bypass

The Wordpress Import module provides the ability to import nodes from a Wordpress WXR export file. The form to import a WXR file does not use the correct access permission and allows any user to upload arbitrary files and import data from a remote WRX file. Versions affected Wordpress Import for...

7.2AI score
SaveExploits0References7
Drupal
Drupal
•added 2010/04/07 12:00 a.m.•21 views

SA-CONTRIB-2010-034 - Internationalization - Cross Site Scripting

The Internationalization module enables translation of user defined strings using Drupal's locale interface. Some of these user defined strings have Input formats associated with them and some of the strings used for translating blocks were not properly filtered before display. Additionally all...

6.2AI score
SaveExploits0References5
Drupal
Drupal
•added 2010/04/07 12:00 a.m.•21 views

SA-CONTRIB-2010-036 - Views - multiple vulnerabilities

The Views module provides a flexible method for Drupal site designers to control how lists of content are presented. Views accepts parameters in the URL and uses them in an AJAX callback. The values were not filtered, thus allowing injection of JavaScript code via the AJAX response. A user tricke...

6AI score
SaveExploits0References9
Drupal
Drupal
•added 2010/03/24 12:00 a.m.•21 views

SA-CONTRIB-2010-031 - Menu Block - Cross Site Scripting (XSS)

The Menu Block module generates full or partial menu trees that are presented in configurable blocks. When partial menu trees are displayed, the block title uses the text from the partial menu tree's parent menu item. However, that text is not properly sanitized, leading to a Cross Site Scripting...

5.4AI score
SaveExploits0References6
Drupal
Drupal
•added 2010/01/27 12:00 a.m.•21 views

SA-CONTRIB-2010-010 - Author Contact - Cross site scripting

The Author Contact module provides a form to contact the author of the current post. The module does not properly sanitize parts of the provided block, leading to a cross-site scripting XSS vulnerability. Such an attack may lead to a malicious user gaining full administrative access. A user must...

6AI score
SaveExploits0References8
Drupal
Drupal
•added 2009/08/26 12:00 a.m.•21 views

SA-CONTRIB-2009-053 - Ajax Table - Multiple vulnerabilities

The Ajax Table module allows one to create AJAX-refreshable tables by supplying a few parameters. Access bypass The module lacks access checks, which makes it possible for any user to delete arbitrary users and nodes. The module contains a number of security issues. Cross site scripting The modul...

6.3AI score
SaveExploits0References3
Drupal
Drupal
•added 2008/07/02 12:00 a.m.•21 views

SA-2008-040 - Organic Groups - Cross site scripting and information disclosure

Organic groups enables users to create and manage their own 'groups'. Each group can be subscribed to, and includes a group home page where subscribers can communicate amongst themselves. Two vulnerabilities were found in the module. Cross site scripting The module displays certain values without...

6.1AI score
SaveExploits0References7
Drupal
Drupal
•added 2008/02/13 12:00 a.m.•21 views

SA-2008-017 - Header image - Access bypass

The Header image module allows sites to display an image on selected pages based on the node id, path, taxonomy, node type, containing book or the result of PHP code. The module contains a vulnerability where access to the module's administration pages is granted to any user, including the...

7.1AI score
SaveExploits0References4
Drupal
Drupal
•added 2007/10/17 12:00 a.m.•21 views

SA-2007-030 - Drupal Core - API handling of unpublished comment.

The publication status of comments is not passed during the hookcomments API operation, causing various modules that rely on the publication status such as Organic groups, or Subscriptions to mail out unpublished comments. Versions affected Drupal 4.7.x before version 4.7.8 Drupal 5.x before...

7.1AI score
SaveExploits0References5
Drupal
Drupal
•added 2007/10/17 12:00 a.m.•21 views

SA-2007-029 - Drupal core - User deletion cross site request forgery

The Drupal Forms API protects against cross site request forgeries CSRF, where a malicous site can cause a user to unintentionally submit a form to a site where he is authenticated. The user deletion form does not follow the standard Forms API submission model and is therefore not protected again...

6.7AI score
SaveExploits0References3
Drupal
Drupal
•added 2007/01/29 12:00 a.m.•21 views

DRUPAL-SA-2007-005 - Drupal core - Arbitrary code execution

Previews on comments were not passed through normal form validation routines, enabling users with the 'post comments' permission and access to more than one input filter to execute arbitrary code. By default, anonymous and authenticated users have access to only one input format. Immediate...

7.9AI score
SaveExploits0References5
Drupal
Drupal
•added 2006/08/02 12:00 a.m.•21 views

DRUPAL-SA-2006-011 XSS Vulnerability in user module

A malicious user can execute a cross site scripting attack by enticing someone to visit a Drupal site via a specially crafted link. Versions affected Drupal 4.6.x versions before Drupal 4.6.9 Drupal 4.7.x versions before Drupal 4.7.3 Solution If you are running Drupal 4.6.x then upgrade to Drupal...

6.3AI score
SaveExploits0References3
Drupal
Drupal
•added 2006/03/13 12:00 a.m.•21 views

DRUPAL-SA-2006-001 Security bypass in menu.module

If you use menu.module to create a menu item, the page you point to will be accessible to all, even if it is an admin page. Versions affected All Drupal versions before 4.6.6. Solution If you are running Drupal 4.5.x then upgrade to Drupal 4.5.8. If you are running Drupal 4.6.x then upgrade to...

7AI score
SaveExploits0References3
Drupal
Drupal
•added 2026/08/05 12:00 a.m.•20 views

Entity Browser - Moderately critical - Cross site scripting - SA-CONTRIB-2026-094

The Entity Browser module allows you to select entities from entity reference fields using a custom entity browser widget. The module doesn't sufficiently sanitize the the tab titles, resulting in a stored cross-site scripting XSS vulnerability. The vulnerability is mitigated by the fact an...

5.2AI score
SaveExploits0References2
Drupal
Drupal
•added 2026/06/24 12:00 a.m.•20 views

Advanced Content Feedback (aka admin_feedback) - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-051

This module enables you to collect feedback from your site visitors on content pages, presenting Yes/No buttons and providing dashboards for administrators to review the responses. The module doesn't sufficiently sanitize several administrator-configured response messages the "Yes response", "No...

6.1CVSS5.8AI score0.00253EPSS
SaveExploits0References2
Drupal
Drupal
•added 2026/06/24 12:00 a.m.•20 views

OpenAI Provider - Moderately critical - Server-side Request Forgery - SA-CONTRIB-2026-053

This module enables you to use OpenAI as a provider for the AI module. The module doesn't sufficiently sanitize user-supplied URLs, leading to a Server-side request forgery SSRF vulnerability. This vulnerability is mitigated by the fact that an attacker must have the access to change the host url...

3.3CVSS5.9AI score0.00208EPSS
SaveExploits1References3
Drupal
Drupal
•added 2026/06/24 12:00 a.m.•20 views

Salesforce Suite - Moderately critical - Cross-site request forgery - SA-CONTRIB-2026-063

The Salesforce Suite of modules integrates Drupal with Salesforce. The Salesforce module does not properly validate the OAuth handshake during interactive authentication, allowing an attacker to hijack the authorization token and bind the site to an attacker's Salesforce account. This vulnerabili...

4.8CVSS5.7AI score0.00122EPSS
SaveExploits0References2
Drupal
Drupal
•added 2026/06/10 12:00 a.m.•20 views

Brute force attack protection - Critical - Unsupported - SA-CONTRIB-2026-047

The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466s-becoming-owner-maintainer-or-co-mai...

5.9CVSS5.2AI score0.00309EPSS
SaveExploits0References2
Drupal
Drupal
•added 2026/06/03 12:00 a.m.•20 views

LocalGov Workflows - Moderately critical - Information disclosure - SA-CONTRIB-2026-039

This module configures default editorial workflows for LocalGov Drupal content types. It provides a Drupal content moderation workflow, a content approvals dashboard, content scheduling and content preview. The module doesn't sufficiently restrict access to a view of Service Contacts at which...

9.8CVSS5.8AI score0.01873EPSS
SaveExploits0References2
Drupal
Drupal
•added 2026/05/13 12:00 a.m.•20 views

Colorbox Inline - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-036

This module enables you to open content already on the page within a colorbox. The module doesn't sufficiently sanitize the data-colorbox-inline attribute value before passing it to jQuery, leading to a Cross-Site Scripting XSS vulnerability. This vulnerability is mitigated by the fact that an...

5.4CVSS5.8AI score0.00177EPSS
SaveExploits0References2
Drupal
Drupal
•added 2026/03/11 12:00 a.m.•20 views

AI (Artificial Intelligence) - Moderately critical - Information Disclosure - SA-CONTRIB-2026-028

The module and certain submodules AI Automators, AI Translate, AI API Explorer, AI Content Suggestions provide the ability to use an LLM to generate HTML or Markdown and preview it in a browser. Under certain circumstances, rendering of this HTML can lead to exposing secret communications in the...

7.5CVSS5.8AI score0.00232EPSS
SaveExploits0References1
Drupal
Drupal
•added 2026/02/11 12:00 a.m.•20 views

Quick Edit - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-009

This module allows content to be edited in-place. The module doesn't sufficiently sanitize certain image-related values during the editing process leading to a persistent Cross-site Scripting XSS vulnerability. This vulnerability is mitigated by the fact that an attacker must have permission to...

5.4CVSS5.6AI score0.00136EPSS
SaveExploits0References3
Drupal
Drupal
•added 2026/02/11 12:00 a.m.•20 views

UI Icons - Critical - Cross-site Scripting - SA-CONTRIB-2026-010

This module enables you to integrate and manage icons with Drupal. The module doesn't sufficiently sanitize user input leading to a reflected Cross-site Scripting XSS vulnerability. The vulnerability is mitigated by the fact that in order to be vulnerable, the "UI Icons for CKEditor 5" submodule...

6.1CVSS5.4AI score0.00149EPSS
SaveExploits0References1
Total number of security vulnerabilities1966