2119 matches found
services_views - Unsupported - SA-CONTRIB-2017-062
Update A new maintainer has resolved this issue, please read The release notes for more information This module provides views support for the Services module. The security team is marking this module unsupported. There is a known security issue with the module that has not been fixed by the...
@Base - Critical - Unsupported - SA-CONTRIB-2017-040
Provide some more API for developer to work with Drupal 7. The security team is marking this module unsupported. There is a known security issue with the module that has not been fixed by the maintainer. If you would like to maintain this module, please read: https://www.drupal.org/node/251466...
Remember Me - Critical - Unsupported - SA-CONTRIB-2017-025
Updates 2017-04-23 — This issue has been resolved with the release of rememberme 7.x-1.1 Remember me is a module that allows users to check "Remember me" when logging in. The security team is marking this module unsupported. There is a known security issue with the module that has not been fixed ...
Login one time - Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2016-017
The Login one time module provides the ability to email one-time login links to users. The module doesn't sufficiently sanitize user input supplied to an ajax callback function. CVE identifiers issued ACVE identifier will be requested, and added upon issuance, in accordance with Drupal Security...
SA-CONTRIB-2014-064 -Course - Access bypass
This module enables you to create e-learning courses with any number of requirements for completion. A "Course object" is a relationship entity between a Course and a learning object, such as a Node. The module doesn't sufficiently check access on Course object edit forms. The configuration optio...
SA-CONTRIB-2013-058 - MRBS - Abandoned - Mutliple vulnerabilities
MRBS is a free, GPL, web application using PHP and MySQL/pgsql for booking meeting rooms or other resources. The module doesn't sufficiently filter user supplied data when creating queries which leads to a SQL injection vulnerability. CVE identifiers issued ACVE identifier will be requested, and...
SA-CONTRIB-2012-114 - Campaign Monitor - Cross Site Scripting (XSS)
This module enables you to integrate Campaign Monitor into Drupal so you can give users the ability to subscribe and unsubscribe for your Campaign Monitor lists. The module doesn't sufficiently validate strings entered in the administration interface. This vulnerability is mitigated by the fact...
SA-CONTRIB-2011-028 - Simple Clean - Cross Site Scripting
Simple Clean is a simple and stripped clean theme for Drupal. The theme contains a cross site scripting XSS vulnerability that can be exploited when posting comments. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "post comments". Versions affect...
SA-CONTRIB-2011-004 - Multiple Vulnerabilities In Multiple Contributed Modules
Versions affected and proposed solutions OG Forum for Drupal 6.x OG Forum creates a forum per organic group and restricts viewing forum nodes by group membership. OG Forum does not properly implement access controls on private forums it creates, which can lead to a private group's forums becoming...
Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-016
The Navigation module doesn't sufficiently sanitize certain attributes, which can lead to a cross-site scripting XSS vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with permission to enter HTML tags containing specific data attributes, or the administ...
Gin Admin Theme - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-219
Gin is an administration theme that provides a modern, clean, and customizable backend UI for editors and site administrators. The module doesn't sufficiently sanitize certain attributes, which can lead to a cross-site scripting XSS vulnerability. This vulnerability is mitigated by the fact that ...
Views Share - Moderately critical - Access bypass - SA-CONTRIB-2026-205
This module enables you to "share" a view display within another website via an iframe. The module doesn't sufficiently block access to view displays. Although the views data is not displayed, resource-intensive views could still be executed which could affect site performance. This vulnerability...
Authenticator Login Plus (2FA) - Moderately critical - Improper authentication - SA-CONTRIB-2026-201
This module provides TOTP-based two-factor authentication 2FA for Drupal, with an optional setting to enforce 2FA for all users site-wide. The module may allow a user log in with only a password even when site-wide enforcement of 2FA is turned on...
Actstream - Critical - Access bypass - SA-CONTRIB-2026-198
Actstream short for Activity Stream aggregates a user's activity from external services RSS feeds, etc. into per-user activity stream entities. The configuration route does not sufficiently check that the user editing it is the account owner or a user administrator leading to an access bypass...
Examples for Developers - Less critical - Allocation of resources without limits or throttling - SA-CONTRIB-2026-215
The Examples for Developers project aims to provide high-quality, well-documented API examples for a broad range of Drupal core functionality. The "Email Example" feature implemented by the emailexample submodule can be used to send illegitimate emails to arbitrary email addresses. Therefore, the...
Expandable Formatter - Moderately critical - Cross Site Scripting - SA-CONTRIB-2023-028
This module enables you to render a field in an expandable/collapsible region. The module doesn't sufficiently sanitize the field content when displaying it to an end user. This vulnerability is mitigated by the fact that an attacker must have a role capable of creating content that uses the fiel...
reCAPTCHA v3 - Critical - Access bypass - SA-CONTRIB-2020-019
The reCaptcha v3 module enables you to protect your forms using the Google reCaptcha V3. If the reCaptcha v3 challenge succeeds, all the other form validations are bypassed. This makes it possible for attackers to submit invalid or incomplete forms. This vulnerability only affects forms that are...
Radix - Moderately critical - Cross site scripting - SA-CONTRIB-2020-001
Radix is a base theme for Drupal, with Bootstrap 4, Sass, ES6 and BrowserSync built-in. The module doesn't sufficiently filter menu titles when used in a dropdown in the main menu. This vulnerability is mitigated by the fact that an attacker must have permission to edit a menu title used in the...
MaxLength - Moderately critical - Cross Site Scripting - SA-CONTRIB-2019-073
This module enables you to set a maximum length allowed on text fields and indicate how many characters are left. The module doesn't sufficiently filter strings leading to a Cross Site Scripting XSS vulnerability. This vulnerability is mitigated by the fact the malicious script will not be...
JSON:API - Highly critical - Remote code execution - SA-CONTRIB-2019-019
This resolves issues described in SA-CORE-2019-003 for this module...
Mollom - Critical - Unsupported - SA-CONTRIB-2018-038
The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466. The security team marks all unsupported projects critical...
TB Sirate - Critical - Unsupported - SA-CONTRIB-2018-035
The security team is marking this theme unsupported. There is a known security issue with the theme that has not been fixed by the maintainer. If you would like to maintain this theme, please read: https://www.drupal.org/node/251466. The security team marks all unsupported themes and modules...
Education - Critical - Unsupported - SA-CONTRIB-2018-036
The security team is marking this theme unsupported. There is a known security issue with the theme that has not been fixed by the maintainer. If you would like to maintain this theme, please read: https://www.drupal.org/node/251466. The security team marks all unsupported themes and modules...
Yandex.Metrics - Moderately critical - Cross site scripting - SA-CONTRIB-2017-078
The Yandex.Metrics module allows you to look for key indicators of your site effectiveness. The module doesn't sufficiently let users know a setting page should not be given to untrusted users. This vulnerability is mitigated by the fact that an attacker must have a role with the permission...
Country - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-211
The module Country provides a dedicated field type for Drupal core's official country list. The module does not sufficiently escape user input in its autocomplete widget, which can lead to a cross site scripting vulnerability. This vulnerability is mitigated by the fact that it can not occur out ...
Gridstack field - Critical - Unsupported - SA-CONTRIB-2019-008
The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466...
AdTego SiteIntel - AdBlocker Detect - Critical - Unsupported - SA-CONTRIB-2018-039
The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466...
Entity Delete - Critical - Multiple Vulnerabilities - SA-CONTRIB-2018-040
This module enables you to delete any types of entities in bulk. The module doesn't sufficiently verify access permissions under its use cases, leading to access bypass. The module also does not protect against Cross Site Request Forgeries on its delete process. The access bypass vulnerability is...
Commerce Authorize.Net SIM/DPM Payment Methods - Access Bypass - DRUPAL-SA-CONTRIB-2016-006
This module enables you to make credit card payments for Drupal Commerce orders via the Authorize.Net payment gateway using either their SIM hosted payment page or DPM direct post method mechanisms. The module doesn't sufficiently protect against the premature triggering of order completion witho...
Zircon - Critical - Unsupported - SA-CONTRIB-2018-037
Update - 2018-09-26 This maintainer has fixed this security issue. Please install https://www.drupal.org/project/zircon/releases/7.x-1.2 to resolve the issue. The security team is marking this theme unsupported. There is a known security issue with the theme that has not been fixed by the...
VChess - Critical - Module Unsupported - SA-CONTRIB-2018-009
The Drupal VChess module allows users to play a chess game. The security team is marking this module unsupported. There is a known security issue with the module that has not been fixed by the maintainer. If you would like to maintain this module, please read: https://www.drupal.org/node/251466...
Auto Login URL - Less Critical - Access Bypass - DRUPAL-SA-CONTRIB-2017-034
This module lets you create auto login URLs programmatically on demand and through tokens. The module does not provide sufficient protection when generating login URLs. An attacker could rebuild login URLs independently thereby logging in as another user. This vulnerability is mitigated by the fa...
Lightbox2 - Critical - Cross Site Scripting - SA-CONTRIB-2018-064
The Lightbox2 module enables you to overlay images on the current page. The module did not sanitize some inputs when used in combination with a custom view leading to potential Cross Site Scripting XSS...
Taxonomy Entity Queue - Critical - SQL Injection - SA-CONTRIB-2018-052
This module enables you to create an entityqueue based on a taxonomy. The module did not properly use Drupal's database API when querying the database with user supplied values, allowing an attacker to send a specially crafted request to modify the query or potentially perform additional queries...
Login Alert - Moderately critical - Access bypass - SA-CONTRIB-2019-013
This module provides a field on user profiles which allows users to get a notification when their account logs in to the site. The notification e-mail includes a link which will terminate all sessions for that user. This is useful in the case of unauthorised access to the account. The module...
Ffmpeg Image Toolkit - Highly critical - Remote Code Execution - SA-CONTRIB-2026-220
This module enables you to use ffmpeg for image conversion The module doesn't sufficiently sanitize file names passed to the ffmpeg cli tool. This vulnerability is mitigated by the fact that an attacker must be able to upload images on the site...
Simple User Management - Moderately critical - Access bypass - SA-CONTRIB-2026-239
This module lets non-administrators approve, deactivate and delete users, limited by the roles they can delegate through Role Delegation. The module doesn't sufficiently check role delegation when approving users, and offers an Activate link for blocked administrators. It also doesn't protect use...
Simple OAuth (OAuth2) & OpenID Connect - Moderately critical - Access bypass - SA-CONTRIB-2026-242
This module introduces an OAuth 2.0 authorization server, which can be configured to protect your Drupal instance with access tokens, or allow clients to request new access tokens and refresh them. Since version 6.1.0, the module could cache a token's permissions in a way that let them be reused...
Monster Menus - Critical - PHP object injection - SA-CONTRIB-2026-253
This module enables you to create one or more multisites with highly granular page permissions. The included RSS Page submodule allows you to create nodes which aggregate one or more RSS feeds. When the input of the node creation form is processed, it makes use of PHP's unserialize function. This...
Data field - Moderately critical - Cross site scripting - SA-CONTRIB-2026-250
Data Field allows you to create custom fields with multiple values under the default table form. The fileuri formatter does not properly escape filenames when rendering links to uploaded files. This vulnerability is mitigated by the fact that an attacker must have a role with the permission to...
AI File to Text - Moderately critical - Access bypass - SA-CONTRIB-2026-251
The AI File to Text module extracts text from uploaded documents, including Word, PDF, OpenDocument, CSV, Markdown and plain text files, and exposes that extraction to AI agents and automators as a tool. The module does not sufficiently check whether the current user is permitted to view a file...
Swiper formatter - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-228
The module provides integration with third party JS library SwiperJs. User-entered text is used as part of the slide without appropriate filtering leading to a cross-site scripting XSS vulnerability. This vulnerability is mitigated by the fact that an attacker would need a role with permission to...
UI Icons - Critical - Cross site scripting - SA-CONTRIB-2026-221
This module provides a user interface to select and configure icons, including a form element, a text format filter and several integrations. The module doesn't sufficiently validate icon settings provided by users before they are rendered...
ABC - Critical - Cross-site scripting - SA-CONTRIB-2026-224
The ABC theme provides configurable layouts and visual styling for Drupal websites, including support for Font Awesome icons in navigation menus. The theme does not sufficiently sanitize menu link titles before inserting them into HTML class attributes. This vulnerability is mitigated by the...
DocCheck Basic - Moderately critical - Access bypass - SA-CONTRIB-2026-237
This module allows healthcare professionals to log in to a shared account on the Drupal website using their DocCheck credentials. The module doesn't sufficiently verify the authentication data with DocCheck API in some cases...
CSV Field - Moderately critical - Cross site Scripting - SA-CONTRIB-2026-226
This module enables you to upload CSV files to a field and display them as an interactive, sortable and searchable table. The module doesn't sufficiently escape CSV cell and header values before passing them to the DataTables library, leading to a potential cross-site scripting vulnerability. Thi...
Block Attributes - Moderately critical - Cross site Scripting - SA-CONTRIB-2026-232
This module allows you to define custom attributes for a block. You can specify an attribute name to be added to the block in a predefined format. The module does not sufficiently sanitize attributes against cross site scripting. This issue is mitigated by the fact that the attacker must have the...
USWDS Paragraph Components - Moderately critical - Cross site scripting - SA-CONTRIB-2026-234
This module provides a suite of Paragraphs bundles that works within the USWDS framework. The module's twig templates do not sufficiently sanitize values passed to its markup. This vulnerability is mitigated by the fact that an attacker must have a role to edit content that uses the paragraph...
UI Icons - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-230
This module provides a user interface to select and configure icons, including a CKEditor 5 button and widget that embed an icon in formatted text. Under uncommon situations, the CKEditor 5 widget displays admin-controlled text with appropriate filtering leading to a Cross-site scripting XSS...
Swiper formatter - Moderately critical - Information disclosure - SA-CONTRIB-2026-233
Swiper is mobile first, layout and gestures wise, it provides great amount of options for designing your own widget and related events. This module provides a route for displaying published content entities in a dialog. The route does not sufficiently verify the current user's access to the...