Lucene search
+L
DrupalMost viewed

1956 matches found

Drupal
Drupal
•added 2009/07/29 12:0 a.m.•14 views

SA-CONTRIB-2009-049 - Live - Privilege escalation, Impersonation

The Live module provides dynamic previews of content. When editing certain content nodes, the current user becomes logged in as the content's original author. Versions affected Live for Drupal 6.x prior to 6.x-1.2 Drupal core is not affected. If you do not use the contributed Live module, there i...

7AI score
SaveExploits0References5
Drupal
Drupal
•added 2009/07/01 12:0 a.m.•14 views

SA-CONTRIB-2009-040 - Advanced Forum - Multiple vulnerabilities

Cross-site scripting The Advanced Forum module does not correctly handle certain arguments obtained from the URL. By enticing a suitably privileged user to visit a specially crafted URL, a malicious user is able to insert arbitrary HTML and script code into forum pages. Such a cross-site scriptin...

6.5AI score
SaveExploits0References5
Drupal
Drupal
•added 2009/06/10 12:0 a.m.•14 views

SA-CONTRIB-2009-035 - Booktree - Cross site scripting

Booktree takes as input a series of Book nodes and create a tree-like structure using Book node relationships.The Booktree module does not properly escape node title and node body on tree root pages. A user with privileges to create book pages could attempt a cross site scripting XSS attack which...

6.1AI score
SaveExploits0References8
Drupal
Drupal
•added 2009/04/29 12:0 a.m.•14 views

SA-CONTRIB-2009-022 - Exif - Cross Site Scripting

The Exif module enables users to display EXIF tags in images on the site. EXIF tags are not properly filtered for HTML input, allowing users with permission to upload images to inject arbitrary code into the site using a specially crafted image. Such a cross site scripting XSS attack may lead to ...

6.3AI score
SaveExploits0References9
Drupal
Drupal
•added 2009/04/29 12:0 a.m.•14 views

SA-CONTRIB-2009-023 - News Page - SQL injection

The News Page module provides a node content type which displays feed items from an aggregator category, filtered by keywords entered into the 'Include Words' field of the node. Unfortunately the News Page module uses keywords directly in SQL queries without being sanitized, allowing SQL injectio...

8.1AI score
SaveExploits0References5
Drupal
Drupal
•added 2009/04/15 12:0 a.m.•14 views

SA-CONTRIB-2009-021 CCK comment reference - Cross site scripting

CCK comment reference project, lets administrators define node fields that are references to comments. When displaying a node edit form, the titles of candidate referenced comments are not properly filtered, allowing malicious users to inject arbitrary code on those pages. Such a cross site...

6.4AI score
SaveExploits0References5
Drupal
Drupal
•added 2009/03/18 12:0 a.m.•14 views

SA-CONTRIB-2009-012 - Printer, e-mail and PDF versions - Unrestricted e-mailing (spam)

The "Send by e-mail" module, part of the "Printer, e-mail and PDF versions" project, allows users to send e-mail messages while viewing content on the site. This module was found to have multiple vulnerabilities. Unrestricted e-mailing spam Due to improper use of Drupal's flood control API, it is...

7.2AI score
SaveExploits0References4
Drupal
Drupal
•added 2009/03/18 12:0 a.m.•14 views

SA-CONTRIB-2009-011 Tasklist - SQL injection and Cross site scripting

Tasklist does not properly use the Drupal database API and inserts values from the URL directly into queries. This can be exploited to perform SQL Injection attacks. These attacks may lead to a malicious user gaining full administrator access. In addition, Tasklist allows users to add CSS to page...

7AI score
SaveExploits0References7
Drupal
Drupal
•added 2008/12/16 12:0 a.m.•14 views

SA-2008-075 - Views - SQL Injection

The Views module provides a flexible method for Drupal site designers to control how lists of content are presented. When using an exposed filter on CCK text fields with allowed values, Views does not filter the data correctly. This may allow malicious users to conduct SQL injection attacks again...

8AI score
SaveExploits0References7
Drupal
Drupal
•added 2008/09/24 12:0 a.m.•14 views

SA-2008-055 - Stock - Cross site scripting

The stock module provides the ability to query price quotes and trading volumes from various stock markets. An oversight in the menu permissions code allows any user to change the text of the heading at the top of the stock quotes page. As this text is not escaped, it is safe only for an...

6AI score
SaveExploits0References5
Drupal
Drupal
•added 2008/09/18 12:0 a.m.•14 views

SA-2008-053 - Answers - Cross site scripting

The Answers module allows a site owner to add a Questions & Answer section to the site. Unfortunately, the module does not properly escape text, which allows malicious users who are able to post answers to insert arbitrary HTML and scripts into a page. Wikipedia has more information about such...

5.8AI score
SaveExploits0References2
Drupal
Drupal
•added 2008/06/11 12:0 a.m.•14 views

SA-2008-034 - Node Hierarchy - Access bypass

The contributed module Node Hierarchy allows nodes to be children of other nodes creating a tree-like hierarchy of content. Due to incorrectly implemented access checks, any user with the "access content" permission is able to rearrange the hierarchy. No private data is exposed, and no content ca...

6.9AI score
SaveExploits0References5
Drupal
Drupal
•added 2008/04/02 12:0 a.m.•14 views

SA-2008-023 - Ubercart - Cross site scripting

During checkout in Ubercart enabled stores, customers have text fields in which to enter their address and order information. Some stores will have modules enabled that restrict what sort of values are accepted in these fields, but this is not the case for everyone. This provides an opportunity f...

6.5AI score
SaveExploits0References4
Drupal
Drupal
•added 2008/04/02 12:0 a.m.•14 views

SA-2008-022 - Flickr - Cross site scripting

The Flickr module allows one to access photos on one's site via the Flickr API. The module provides a filter for inserting photos and photosets and blocks for a user's recent photos and photosets. Several values are displayed without being escaped, which enables users to inject arbitrary HTML and...

7AI score
SaveExploits0References5
Drupal
Drupal
•added 2008/03/12 12:0 a.m.•14 views

SA-2008-020 - Ubercart - Cross site scripting

The attribute module allows customers to enter a text value as an attribute for a product, like a name to stitch into a hat. However, when these text values were displayed in the shopping cart or on order pages, there was a possibility for a malicious user to perform a cross site scripting attack...

6.5AI score
SaveExploits0References4
Drupal
Drupal
•added 2008/01/10 12:0 a.m.•14 views

SA-2008-001 - Devel - Cross site scripting

The devel module contains many useful developer functions, such as a query log and the display of variables. The contents of the variable table is not escaped prior to display. Should an unprivileged user be able to control the contents of a site variable, it would be possible to inject arbitrary...

6.3AI score
SaveExploits0References5
Drupal
Drupal
•added 2007/12/05 12:0 a.m.•14 views

SA-2007-033 - Feature - CSRF

Feature is a contributed module that lets you organize and maintain a feature list by category. The Drupal Forms API protects against cross site request forgeries CSRF, where a malicous site can cause a user to unintentionally submit a form to a site where he is authenticated. The feature deletio...

6.6AI score
SaveExploits0References4
Drupal
Drupal
•added 2007/12/05 12:0 a.m.•14 views

SA-2007-032 - Shoutbox - Cross site scripting

Message sent from the Shoutbox block, where visitors can quickly post short messages, are not properly sanitized in a number of cases. This allows malicious users to inject arbitrary HTML and script code into the block. Learn more about cross site scripting on Wikipedia. Versions affected Shoutbo...

6.4AI score
SaveExploits0References5
Drupal
Drupal
•added 2007/08/13 12:0 a.m.•14 views

Content Construction Kit - Cross site scripting

The Content Construction Kit CCK allows site admins to create and customize node fields. The Nodereference module included in the CCK bundle defines fields referencing other nodes. Two cross-site scripting XSS vulnerabilities were discovered : when a nodereference field is displayed using the...

6.2AI score
SaveExploits0References5
Drupal
Drupal
•added 2006/12/11 12:0 a.m.•14 views

Chatroom - Security bypass

The contributed module Chatroom broadcasts session ids of chatroom visitors to all participants in a room. Using those IDs, an attacker is able to hijack the session of those participants and gain their privileges on the site. Additionally, messages supposed to be private are displayed in the las...

7.2AI score
SaveExploits0References2
Drupal
Drupal
•added 2006/12/11 12:0 a.m.•14 views

Help Tip - Multiple vulnerabilities

The contributed module Help Tip bypasses Drupal's database API and uses user-supplied data unescaped in queries, allowing malicious users to execute SQL injection attacks. These attacks may lead to administrator access. Node titles are not properly sanitised before being used in block titles. Thi...

7.6AI score
SaveExploits0References4
Drupal
Drupal
•added 2006/09/20 12:0 a.m.•14 views

Search Keywords cross site scripting vulnerability

It is possible for a malicious user to insert and execute XSS Cross Site Scripting, due to lack of validation on output. This may lead to administrator access if certain conditions are met. Learn more about XSS on Wikipedia. Versions affected Drupal core is not affected. If you do not use the...

6.3AI score
SaveExploits0References4
Drupal
Drupal
•added 2006/06/01 12:0 a.m.•14 views

DRUPAL-SA-2006-008 XSS Vulnerability in taxonomy module

It is possible for a malicious user to insert and execute XSS into terms, due to lack of validation on output of the page title. The fix wraps the display of terms in checkplain. Versions affected - Drupal 4.6.x versions before Drupal 4.6.8. - Drupal 4.7.x versions before Drupal 4.7.2. Solution...

6.3AI score
SaveExploits0References3
Drupal
Drupal
•added 2026/07/08 12:0 a.m.•13 views

Ray Enterprise Translation - Moderately critical - Cross site request forgery - SA-CONTRIB-2026-071

The Lingotek Ray Enterprise Translation module provides multilingual site management. The module fails to protect several state-changing administrative routes against Cross Site Request Forgery attacks. An attacker could trick a privileged user into visiting a crafted page that triggers actions...

4.3CVSS5.1AI score0.00118EPSS
SaveExploits0References3
Drupal
Drupal
•added 2026/07/08 12:0 a.m.•13 views

Location Selector - Critical - SQL Injection - SA-CONTRIB-2026-072

The Location Selector module provides a Views filter for selecting location values. One of the provided Views filters does not sufficiently sanitize values that may come from user input, resulting in a SQL injection vulnerability. This vulnerability is mitigated by the fact that a View must exist...

7.4CVSS6AI score0.00257EPSS
SaveExploits0References1
Drupal
Drupal
•added 2026/07/08 12:0 a.m.•13 views

UI Patterns (SDC in Drupal UI) - Moderately critical - Cross site scripting - SA-CONTRIB-2026-075

This module enables you to use Single Directory Components in site building views, field formatters, blocks, layouts and it improves the Developer Experience DX with SDC. The module doesn't sufficiently sanitize the markup passed to components under certain scenarios. This vulnerability is...

5.4CVSS5.8AI score0.00161EPSS
SaveExploits0References2
Drupal
Drupal
•added 2026/07/01 12:0 a.m.•13 views

Drupal Canvas - Moderately critical - Improper validation - SA-CONTRIB-2026-066

The Canvas module allow you to upload image files via a custom API. The validation rules check the file extension of the uploaded file but not the file MIME type. This may allow a malicious user to upload a file that is not an image. Certain web-server configurations may serve the uploaded file...

6.1CVSS5.8AI score0.00152EPSS
SaveExploits0References5
Drupal
Drupal
•added 2026/07/01 12:0 a.m.•13 views

FlowDrop - Moderately critical - Access bypass - SA-CONTRIB-2026-067

This module enables you to test and run AI-driven workflows interactively through a chat interface. The module doesn't sufficiently enforce permissions on certain endpoints. Attackers may be able to trigger workflow execution incurring LLM spend and tool side effects or send messages into other...

5.4CVSS6.1AI score0.00141EPSS
SaveExploits0References2
Drupal
Drupal
•added 2026/06/24 12:0 a.m.•13 views

AI (Artificial Intelligence) - Moderately critical - Access bypass - SA-CONTRIB-2026-055

This module enables you to utilize an agent to use Drupal core actions tools with bypassed access. Certain Drupal core actions, exposed as agent tools did not have correct access validation, and some core actions were missing associated access-level definitions. This vulnerability is mitigated by...

3.3CVSS5.8AI score0.00161EPSS
SaveExploits0References4
Drupal
Drupal
•added 2026/06/24 12:0 a.m.•13 views

Commerce Realex / Global Payments - Moderately critical - Access Bypass - SA-CONTRIB-2026-058

This module enables you to take payments through the Global Payments / Realex Hosted Payment Page HPP, either via a lightbox iframe or via a full-page redirect. When the gateway is configured with the redirect payment method, the module doesn't sufficiently verify the authenticity of the payment...

4.8CVSS5.9AI score0.00138EPSS
SaveExploits0References2
Drupal
Drupal
•added 2026/06/24 12:0 a.m.•13 views

Paragraphs - Moderately critical - Access bypass - SA-CONTRIB-2026-061

The optional Paragraphs Library module allows the reuse of paragraphs in multiple places. The module doesn't sufficiently restrict access to direct child paragraphs of library items through API endpoints. This vulnerability is mitigated by the fact the paragraphslibrary module must be in use and...

6.5CVSS5.8AI score0.00159EPSS
SaveExploits0References2
Drupal
Drupal
•added 2026/06/17 12:0 a.m.•13 views

Drupal core - Moderately critical - Gadget chain - SA-CORE-2026-006

Drupal core contains a chain of methods that could be exploitable when an insecure deserialization vulnerability exists on the site. This so-called "gadget chain" presents no direct threat, but is a vector that can be used to achieve remote code execution or SQL injection if the application...

5.9CVSS6.6AI score0.00215EPSS
SaveExploits0References7
Drupal
Drupal
•added 2026/01/14 12:0 a.m.•13 views

AT Internet SmartTag - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-003

This module integrates the AT Internet SmartTag service. The module does not filter administrator-entered text leading to a persistent Cross-site Scripting XSS vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer atsmarttag"...

6.1CVSS5.6AI score0.00149EPSS
SaveExploits0References2
Drupal
Drupal
•added 2025/12/03 12:0 a.m.•13 views

Tagify - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-121

This module enables you to use the Tagify library to enhance text input fields with tag-style UI elements. The module does not sufficiently sanitize the infoLabel value under certain configurations, which can result in a cross-site scripting XSS vulnerability. This vulnerability is mitigated by t...

5.4CVSS5.2AI score0.00136EPSS
SaveExploits0References2
Drupal
Drupal
•added 2025/11/05 12:0 a.m.•13 views

Email TFA - Moderately critical - Access bypass - SA-CONTRIB-2025-115

The Email TFA module provides additional email-based two-factor authentication for Drupal logins. In certain scenarios, the module does not fully protect all login mechanisms as expected. This issue is mitigated by the fact that an attacker must already have valid user credentials username and...

5.4CVSS5.5AI score0.002EPSS
SaveExploits0References2
Drupal
Drupal
•added 2025/09/24 12:0 a.m.•13 views

Plausible tracking - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-107

This module integrates Plausible Analytics on a site. The module did not properly filter output in certain cases. This vulnerability is mitigated by the fact that an attacker must have permission to add raw HTML to the website, such as an unfiltered WYSIWYG field on a public-facing comment...

6.1CVSS5.5AI score0.00181EPSS
SaveExploits0References2
Drupal
Drupal
•added 2025/08/27 12:0 a.m.•13 views

Authenticator Login - Moderately critical - Access bypass - SA-CONTRIB-2025-098

This module allows users to setup two-factor authentication 2FA using authenticator apps for enhanced login security. The module did not protect all possible login paths provided by core modules. CVSS risk score experimental 6.3 / Medium...

8.8CVSS5.4AI score0.00326EPSS
SaveExploits0References4
Drupal
Drupal
•added 2025/05/07 12:0 a.m.•13 views

Enterprise MFA - TFA for Drupal - Moderately critical - Access bypass - SA-CONTRIB-2025-052

The module enables you to add second-factor authentication in addition to the default Drupal login. The module doesn't sufficiently check whether the TOTP token is already used or not for authenticator-based second-factor methods. This vulnerability is mitigated by the fact that an attacker must...

4.8CVSS5.7AI score0.00235EPSS
SaveExploits0References3
Drupal
Drupal
•added 2025/05/07 12:0 a.m.•13 views

Enterprise MFA - TFA for Drupal - Moderately critical - Access bypass - SA-CONTRIB-2025-053

The module enables you to add second-factor authentication in addition to the default Drupal login. The module doesn't invoke two factor authentication 2FA for the password reset option. This vulnerability is mitigated by the fact that an attacker must have access to the password reset link...

7.5CVSS5.7AI score0.00356EPSS
SaveExploits0References3
Drupal
Drupal
•added 2025/01/08 12:0 a.m.•13 views

Profile Private - Critical - Unsupported - SA-CONTRIB-2025-002

The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466s-becoming-owner-maintainer-or-co-mai...

5.3CVSS7.1AI score0.00427EPSS
SaveExploits0References6
Drupal
Drupal
•added 2024/12/04 12:0 a.m.•13 views

Megamenu Framework - Critical - Unsupported - SA-CONTRIB-2024-065

The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466s-becoming-owner-maintainer-or-co-mai...

6.6CVSS7.1AI score0.00361EPSS
SaveExploits0References3
Drupal
Drupal
•added 2024/12/04 12:0 a.m.•13 views

Minify JS - Moderately critical - Cross site request forgery - SA-CONTRIB-2024-070

The Minify JS module allows a site administrator to minify all javascript files that exist in the site's code base and use those minified files on the front end of the website. Several administrator routes are unprotected against Cross-Site Request Forgery CRSF attacks...

4.5CVSS7.1AI score0.0017EPSS
SaveExploits0References4
Drupal
Drupal
•added 2024/11/06 12:0 a.m.•13 views

Basic HTTP Authentication - Critical - Access bypass - SA-CONTRIB-2024-057

The module provides a possibility to restrict access to specific paths using basic HTTP authentication, in addition to standard Drupal access checks. In some cases, the module removes existing access checks from some paths, resulting in an access bypass vulnerability...

7.3CVSS7.1AI score0.00316EPSS
SaveExploits0References4
Drupal
Drupal
•added 2024/10/30 12:0 a.m.•13 views

Cookiebot + GTM - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-055

This module makes it possible for you to integrate Cookiebot and Google Tag Manager in a fast and simple way. The module doesn't sufficiently filter for malicious script leading to a persistent cross site scripting XSS vulnerability...

5.4CVSS5.9AI score0.00276EPSS
SaveExploits0References7
Drupal
Drupal
•added 2024/10/23 12:0 a.m.•13 views

Views SVG Animation - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-051

This module enables you to animate an SVG graphic by selecting certain rows in a view. The module doesn't sufficiently sanitize the SVG file before embedding it into the html. This vulnerability is mitigated by the fact that an attacker must have a role with the permission to upload SVG files...

5.4CVSS7AI score0.00213EPSS
SaveExploits0References5
Drupal
Drupal
•added 2024/10/23 12:0 a.m.•13 views

Monster Menus - Critical - Arbitrary PHP code execution - SA-CONTRIB-2024-052

This module enables you to group nodes within pages that have a highly-granular, distributed permissions structure. In certain cases the module doesn't sufficiently sanitize data before passing it to PHP's unserialize function, which can result in arbitrary code execution...

4.3CVSS7.5AI score0.00339EPSS
SaveExploits0References7
Drupal
Drupal
•added 2024/10/09 12:0 a.m.•13 views

Monster Menus - Moderately critical - Access bypass, Information Disclosure - SA-CONTRIB-2024-045

This module enables you to group nodes within pages that have a highly-granular, distributed permissions structure. A function which can be used by third-party code does not return valid data under certain rare circumstances. If the third-party code relies on this data to decide whether to grant...

9.1CVSS7.1AI score0.00347EPSS
SaveExploits0References6
Drupal
Drupal
•added 2024/09/04 12:0 a.m.•13 views

Open Social - Moderately critical - Denial of Service - SA-CONTRIB-2024-038

Open Social is a Drupal distribution for online communities. The distribution didn't validate the flood control limits on the password reset form correctly resulting in a potential attacker flooding the password reset which could result in a Denial of Service. Fortunately the message does not...

5.3CVSS7AI score0.00355EPSS
SaveExploits0References8
Drupal
Drupal
•added 2024/07/31 12:0 a.m.•13 views

View Password - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-026

The View Password module enables you to add a help icon button next to the password input field to toggle the password visibility. The administrative user is allowed to add classes to this icon for styling purposes. The module doesn't validate the content of classes. A malicious user with access ...

4.8CVSS7.2AI score0.00266EPSS
SaveExploits0References6
Drupal
Drupal
•added 2023/06/28 12:0 a.m.•13 views

Libraries UI - Moderately critical - Access bypass - SA-CONTRIB-2023-027

This module enables a UI to display all libraries provided by modules and themes on the Drupal site. The module doesn't sufficiently protect the libraries reporting page. It curently is using the 'access content' permission and not a proper administrative/access permission. The...

6.5AI score
SaveExploits0References6
Total number of security vulnerabilities1956