Select (or other) - Moderately critical - Cross Site Scripting - SA-CONTRIB-2018-054

This module enables users to select 'other' on certain form elements and a textfield appears for the user to provide a custom value. The module doesn't sufficiently escape values of a text field the under the scenario when "Select or other" formatter is used. This vulnerability is mitigated by th...

Corporate Site - Critical - Unsupported - SA-CONTRIB-2018-032

The security team is marking this theme unsupported. There is a known security issue with the theme that has not been fixed by the maintainer. If you would like to maintain this theme, please read: https://www.drupal.org/node/251466. The security team marks all unsupported themes and modules...

ComScore direct tag - Less critical - Cross site scripting - SA-CONTRIB-2017-095

This module enables you to use the comScore Direct analytics system on a site. The module doesn't sufficiently sanitize one of the configuration variables prior to rendering it. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "Administer comScore...

me aliases - Highly critical - Arbitrary code execution - SA-CONTRIB-2017-097

'me' module provides shortcut paths to current user's pages, eg user/me, blog/me, user/me/edit, tracker/me etc. The way 'me' module handles URL arguments allows an attacker to execute arbitrary code strings...

bootstrap_carousel - Moderately critical - Cross Site Scripting - SA-CONTRIB-2017-088

This module provides a way to make carousels, based on bootstrap-carousel.js. The module doesn't sufficiently handle output of img HTML tag's alt property. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "Carousel: Create new content" or any simil...

Services single sign-on client - Critical - Cross-site scripting - SA-CONTRIB-2017-087

This module allows users of a remote Services-enabled Drupal site to sign on to a second site with their credentials. The module does not sanitize information from the request before displaying it, thereby exposing a cross-site scripting vulnerability...

ajax_facets - Unsupported - SA-CONTRIB-2017-061

Updates The maintainer has resolved this issue, please read the release notes for more information. This module allows you to create facet filters which working by AJAX. Filters and search results will be updated by AJAX. The security team is marking this module unsupported. There is a known...

Search API - Moderately Critical - Multiple Vulnerabilities - SA-CONTRIB-2016-022

This module enables you to build searches using a wide range of features, data sources and backends. Search index not updated by node access changes The module doesn't sufficiently re-index nodes when using the "Node access" or "Access check" data alterations and non-standard ways of changing nod...

SA-CONTRIB-2014-064 -Course - Access bypass

This module enables you to create e-learning courses with any number of requirements for completion. A "Course object" is a relationship entity between a Course and a learning object, such as a Node. The module doesn't sufficiently check access on Course object edit forms. The configuration optio...

SA-CONTRIB-2012-131 - Email Field - Access Bypass

The email module provides a field type CCK / FieldAPI for storing email addresses. Furthermore, it provides a formatter to output the email address as a link to a contact form. The contact form formatter allows a site visitor to email the stored address without letting them see what that e-mail...

SA-CONTRIB-2010-073 - Multiple Vulnerabilities In Multiple Contributed Modules

Versions affected and proposed solutions Simple Gallery for Drupal 6.x This module creates a simple gallery using taxonomy and CCK imagefields. The module is vulnerable to a Cross Site Scripting XSS attack. This can be exploited by users with the ability to add taxonomy terms or tag content...

SA-CONTRIB-2010-052 - Multiple vulnerabilities in multiple contributed modules

Versions affected and proposed solutions Private Message versions for the 5.x versions of Drupal The Privatemsg also known as Private Message module enables messages to be sent internally on a site. The module is vulnerable to cross-site request forgeries CSRF via it's message delete form. This...

SA-2008-019 - Refine by Taxonomy - Cross site scripting

Refine by Taxonomy is a module that provides a taxonomy browsing user interface. Taxonomy terms are not escaped before display, making it possible to inject arbitrary HTML and script code into pages which contain the Refine by Taxonomy feature. This may lead to administrator access if certain...

Gin Admin Theme - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-219

Gin is an administration theme that provides a modern, clean, and customizable backend UI for editors and site administrators. The module doesn't sufficiently sanitize certain attributes, which can lead to a cross-site scripting XSS vulnerability. This vulnerability is mitigated by the fact that ...

DKAN - Moderately critical - Access bypass - SA-CONTRIB-2026-208

The DKAN module enables organizations and individuals to build open data portals in Drupal. The DKAN datastore imports tabular data files into database tables and exposes them for querying with a JSON API. The module does not correctly check access for all of its endpoints, leading to a potential...

Orphans Media - Critical - Unsupported - SA-CONTRIB-2026-196

The Drupal Security Team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, read the documentation on becoming the maintainer of a project that is unsupported for security...

Entity Reference Manager (Merge entities) - Critical - Access bypass - SA-CONTRIB-2026-194

Entity Reference Manager is an advanced administrative module for Drupal that allows site administrators to identify, analyze, and replace entity references across the system. The module does not sufficiently restrict access to all entity management operations. Users who can view content can acce...

Authenticator Login Plus (2FA) - Critical - Improper authentication - SA-CONTRIB-2026-197

This module provides TOTP-based two-factor authentication 2FA for Drupal. The module doesn't enforce the second factor when a user logs in with Drupal core's one-time login link. This vulnerability is mitigated by the fact that an attacker must have access to a valid one-time login link for a...

Menu Link Attributes - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-209

This module enables you to add HTML attributes to menu links and their container elements . The module doesn't sufficiently sanitize the attributes it applies to menu link container elements. This vulnerability is mitigated by the fact that an attacker must have a role with the permissions...

AI (Artificial Intelligence) - Moderately critical - Cross site scripting - SA-CONTRIB-2026-119

This AI Chatbot module enables you to have a Chatbot using assistants to help you with your Drupal website. The module doesn't sufficiently sanitize for cross site scripting XSS when using the structured results using legacy agent setups. This vulnerability is mitigated by the fact that an attack...

Webform Submissions Delete - Moderately critical - Access bypass - SA-CONTRIB-2026-133

This module enables you to delete Webform submissions in bulk using a specified date range. The module doesn't sufficiently restrict access to the delete form. A separate PHP fatal error issue may prevent exploitation in practice on Drupal 10+...

Calculate Working Days - Critical - Access bypass - SA-CONTRIB-2026-122

Calculate Working Days allows you to calculate working days between 2 dates. This module doesn't sufficiently restrict access to its settings form...

Flexi Access - Critical - Arbitrary PHP code execution - SA-CONTRIB-2023-036

The Flexi Access module will provide a simple and flexible interface to the ACL Access Control List module. It will let you set up and mange ACLs naming individual users that are allowed access to a particular node. The module processes user input in a way that could be unsafe. This can lead to...

Context - Moderately critical - Cross Site Scripting - SA-CONTRIB-2022-049

This module enables you to conditionally display blocks in particular theme regions. The module doesn't sufficiently sanitize the title of a block as displayed in the admin UI when a site administrator edits a context block reaction. This vulnerability is mitigated by the fact that an attacker mu...

Examples for Developers - Critical - Remote Code Execution - SA-CONTRIB-2020-035

The File Example submodule within the Examples project does not properly sanitize certain filenames as described in SA-CORE-2020-012, along with other related vulnerabilities. Therefore, File Example so is being removed from Examples until a version demonstrating file security best practices can...

Hostmaster (Aegir) - Moderately critical - Access bypass, Arbitrary code execution - SA-CONTRIB-2020-031

Aegir is a powerful hosting system that sits alongside a LAMP or LEMP server to create, deploy and manage Drupal sites. Given that Aegir can use both Apache and Nginx Web servers, Apache allows configuration-writing users to escalate their privileges to the superuser root, and Aegir's operations...

Webform Report - Critical - Unsupported - SA-CONTRIB-2019-086

The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466procedure---own-project---unsupported...

Context - Moderately critical - Cross site scripting - SA-CONTRIB-2019-028

This module enables you to manage contextual conditions and reactions for different portions of your site. The module doesn't sufficiently sanitize user output when displayed leading to a Cross Site Scripting XSS vulnerability. This vulnerability is mitigated by the fact that an attacker must hav...

Webform Table Element - Critical - Unsupported - SA-CONTRIB-2019-005

The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466...

Taxonomy File Tree - Moderately critical - Access bypass - SA-CONTRIB-2018-061

Taxonomy File Tree allows site managers to create file trees. For files managed as Drupal files, the module does not properly check that a user has access to a file before letting the user download the file. This vulnerability only affects sites that use private files...

XML sitemap - Moderately critical - Information Disclosure - SA-CONTRIB-2018-053

This module enables you to generate XML sitemaps and it helps search engines to more intelligently crawl a website and keep their results up to date. The module doesn't sufficiently handle access rights under the scenario of updating contents from cron execution...

TB Nucleus - Critical - Unsupported - SA-CONTRIB-2018-031

Update - 2018-09-26 This maintainer has fixed this security issue. Please install https://www.drupal.org/project/nucleus/releases/7.x-1.6 to fix the security issue The security team is marking this theme unsupported. There is a known security issue with the theme that has not been fixed by the...

Baidu Analytics - Critical - Unsupported - SA-CONTRIB-2018-029

The security team is marking this module unsupported. There is a known security issue with the module that has not been fixed by the maintainer. If you would like to maintain this module, please read: https://www.drupal.org/node/251466. The security team marks all unsupported modules critical by...

Simple Taxonomy Revision - Critical - Unsupported - SA-CONTRIB-2018-025

Simple Taxonomy Revision module enables revisions for taxonomy terms for Drupal 8. The security team is marking this module unsupported. There is a known security issue with the module that has not been fixed by the maintainer. If you would like to maintain this module, please read:...

Scrollable Content - Critical - Unsupported - SA-CONTRIB-2018-026

Scrollable Content provides a scrolling functionality for your content. Scrollable Content will give you a nice content slider preview of your site's nodes, and provides some display options. The security team is marking this module unsupported. There is a known security issue with the module tha...

services_views - Unsupported - SA-CONTRIB-2017-062

Update A new maintainer has resolved this issue, please read The release notes for more information This module provides views support for the Services module. The security team is marking this module unsupported. There is a known security issue with the module that has not been fixed by the...

@Base - Critical - Unsupported - SA-CONTRIB-2017-040

Provide some more API for developer to work with Drupal 7. The security team is marking this module unsupported. There is a known security issue with the module that has not been fixed by the maintainer. If you would like to maintain this module, please read: https://www.drupal.org/node/251466...

Remember Me - Critical - Unsupported - SA-CONTRIB-2017-025

Updates 2017-04-23 — This issue has been resolved with the release of rememberme 7.x-1.1 Remember me is a module that allows users to check "Remember me" when logging in. The security team is marking this module unsupported. There is a known security issue with the module that has not been fixed ...

Panels - Critical - Multiple Vulnerabilities - SA-CONTRIB-2016-047

Panels does not check access on some routes Critical Panels allows users with certain permissions to modify the layout and panel panes on pages or entities utilizing panels. Much of the functionality to modify these panels rely on backend routes that call administrative forms. These forms did not...

SA-CONTRIB-2013-058 - MRBS - Abandoned - Mutliple vulnerabilities

MRBS is a free, GPL, web application using PHP and MySQL/pgsql for booking meeting rooms or other resources. The module doesn't sufficiently filter user supplied data when creating queries which leads to a SQL injection vulnerability. CVE identifiers issued ACVE identifier will be requested, and...

SA-CONTRIB-2012-114 - Campaign Monitor - Cross Site Scripting (XSS)

This module enables you to integrate Campaign Monitor into Drupal so you can give users the ability to subscribe and unsubscribe for your Campaign Monitor lists. The module doesn't sufficiently validate strings entered in the administration interface. This vulnerability is mitigated by the fact...

SA-CONTRIB-2011-043 - Petition Node - Cross Site Scripting

Petition node module allows the creation of petition nodes to collect signatures to show support for a cause. The module contains a cross site scripting XSS vulnerability that can be exploited when signing a petition. This vulnerability is mitigated by the fact that it normally requires the 'sign...

SA-CONTRIB-2011-028 - Simple Clean - Cross Site Scripting

Simple Clean is a simple and stripped clean theme for Drupal. The theme contains a cross site scripting XSS vulnerability that can be exploited when posting comments. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "post comments". Versions affect...

SA-2008-031 - Pblog - Incorrect vulnerability report

Exploitable from: Remote Subject: Incorrect vulnerability report Several 'security'-related sources claim - with SecurityFocus as source http://www.securityfocus.com/bid/29495/info - that the third-party Drupal module Pblog is vulnerable to SQL injection attacks. The Drupal security team has...

Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-016

The Navigation module doesn't sufficiently sanitize certain attributes, which can lead to a cross-site scripting XSS vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with permission to enter HTML tags containing specific data attributes, or the administ...

SmartLinker AI - Moderately critical - Information disclosure - SA-CONTRIB-2026-210

This module adds a "Generate internal links" action to the AI CKEditor toolbar, letting editors select text and have the module search the site's content for relevant pages to link to. The module's search query did not respect entity access when returning results to the browser. This vulnerabilit...

Actstream - Critical - Access bypass - SA-CONTRIB-2026-198

Actstream short for Activity Stream aggregates a user's activity from external services RSS feeds, etc. into per-user activity stream entities. The configuration route does not sufficiently check that the user editing it is the account owner or a user administrator leading to an access bypass...

Views Share - Moderately critical - Access bypass - SA-CONTRIB-2026-205

This module enables you to "share" a view display within another website via an iframe. The module doesn't sufficiently block access to view displays. Although the views data is not displayed, resource-intensive views could still be executed which could affect site performance. This vulnerability...

Authenticator Login Plus (2FA) - Moderately critical - Improper authentication - SA-CONTRIB-2026-201

This module provides TOTP-based two-factor authentication 2FA for Drupal, with an optional setting to enforce 2FA for all users site-wide. The module may allow a user log in with only a password even when site-wide enforcement of 2FA is turned on...

Permissions by Term - Moderately critical - Information disclosure - SA-CONTRIB-2026-214

This module enables you to restrict view access to single nodes via taxonomy terms. The module doesn't sufficiently check access rights when in "Permission mode" and a node referencing a deleted taxonomy term is accessed via JSON:API. This vulnerability is mitigated by the fact that it requires a...