Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools

Drupal.org

#2c85b837-eb8b-40ed-9d74-228c62987387
PolicyEmail

Short Name

drupal

Program Role

CNA

Top Level Root

MITRE Corporation

Security Advisories

View Advisories

Domain

drupal.org

Country

USA

Scope

All projects hosted under drupal.org, including End of Life (EOL) code.
Reported CVEsVendorsProductsReports
364Vulnerabilities found
CVE-2025-48923
Assigner-Drupal.org
ShareView Details
Assigner-Drupal.org
CVSS Score-6.1||MEDIUM
EPSS-0.19% / 8.44%
||
7 Day CHG~0.00%
Published-26 Jun, 2025 | 13:31
Updated-09 Jul, 2025 | 18:57
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Toc.js - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-077

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Toc.Js allows Cross-Site Scripting (XSS).This issue affects Toc.Js: from 0.0.0 before 3.2.1.

Action-Not Available
Vendor-toc.js_projectThe Drupal Association
Product-toc.jsToc.js
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-48915
Assigner-Drupal.org
ShareView Details
Assigner-Drupal.org
CVSS Score-8.6||HIGH
EPSS-0.28% / 19.98%
||
7 Day CHG~0.00%
Published-13 Jun, 2025 | 15:41
Updated-18 Jun, 2025 | 15:57
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
COOKiES Consent Management - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-076

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal COOKiES Consent Management allows Cross-Site Scripting (XSS).This issue affects COOKiES Consent Management: from 0.0.0 before 1.2.15.

Action-Not Available
Vendor-The Drupal Association
Product-cookies_consent_managementCOOKiES Consent Management
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-48914
Assigner-Drupal.org
ShareView Details
Assigner-Drupal.org
CVSS Score-8.6||HIGH
EPSS-0.28% / 19.98%
||
7 Day CHG~0.00%
Published-13 Jun, 2025 | 15:41
Updated-18 Jun, 2025 | 15:57
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
COOKiES Consent Management - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-075

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal COOKiES Consent Management allows Cross-Site Scripting (XSS).This issue affects COOKiES Consent Management: from 0.0.0 before 1.2.15.

Action-Not Available
Vendor-The Drupal Association
Product-cookies_consent_managementCOOKiES Consent Management
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-48920
Assigner-Drupal.org
ShareView Details
Assigner-Drupal.org
CVSS Score-7.3||HIGH
EPSS-0.23% / 14.33%
||
7 Day CHG~0.00%
Published-13 Jun, 2025 | 15:40
Updated-08 Jul, 2025 | 20:35
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
etracker - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-074

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal etracker allows Cross-Site Scripting (XSS).This issue affects etracker: from 0.0.0 before 3.1.0.

Action-Not Available
Vendor-etrackerThe Drupal Association
Product-etrackeretracker
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-48919
Assigner-Drupal.org
ShareView Details
Assigner-Drupal.org
CVSS Score-5||MEDIUM
EPSS-0.19% / 8.49%
||
7 Day CHG~0.00%
Published-13 Jun, 2025 | 15:39
Updated-17 Jul, 2025 | 16:04
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Simple Klaro - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-073

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Simple Klaro allows Cross-Site Scripting (XSS).This issue affects Simple Klaro: from 0.0.0 before 1.10.0.

Action-Not Available
Vendor-1xinternetThe Drupal Association
Product-simple_klaroSimple Klaro
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-48917
Assigner-Drupal.org
ShareView Details
Assigner-Drupal.org
CVSS Score-5||MEDIUM
EPSS-0.19% / 8.49%
||
7 Day CHG~0.00%
Published-13 Jun, 2025 | 15:38
Updated-08 Jul, 2025 | 20:35
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
EU Cookie Compliance (GDPR Compliance) - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-072

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal EU Cookie Compliance (GDPR Compliance) allows Cross-Site Scripting (XSS).This issue affects EU Cookie Compliance (GDPR Compliance): from 0.0.0 before 1.26.0.

Action-Not Available
Vendor-freelance-it-consultantThe Drupal Association
Product-eu_cookie_complianceEU Cookie Compliance (GDPR Compliance)
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-48918
Assigner-Drupal.org
ShareView Details
Assigner-Drupal.org
CVSS Score-8.8||HIGH
EPSS-0.22% / 13.29%
||
7 Day CHG~0.00%
Published-13 Jun, 2025 | 15:38
Updated-17 Jul, 2025 | 16:10
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Simple Klaro - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-071

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Simple Klaro allows Cross-Site Scripting (XSS).This issue affects Simple Klaro: from 0.0.0 before 1.10.0.

Action-Not Available
Vendor-1xinternetThe Drupal Association
Product-simple_klaroSimple Klaro
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-48916
Assigner-Drupal.org
ShareView Details
Assigner-Drupal.org
CVSS Score-6.5||MEDIUM
EPSS-0.19% / 9.42%
||
7 Day CHG~0.00%
Published-13 Jun, 2025 | 15:35
Updated-10 Jul, 2025 | 12:16
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Bookable Calendar - Less critical - Access bypass - SA-CONTRIB-2025-070

Missing Authorization vulnerability in Drupal Bookable Calendar allows Forceful Browsing.This issue affects Bookable Calendar: from 0.0.0 before 2.2.13.

Action-Not Available
Vendor-joshfabeanThe Drupal Association
Product-bookable_calendarBookable Calendar
CWE ID-CWE-862
Missing Authorization
CVE-2025-48447
Assigner-Drupal.org
ShareView Details
Assigner-Drupal.org
CVSS Score-7.1||HIGH
EPSS-0.28% / 19.94%
||
7 Day CHG~0.00%
Published-11 Jun, 2025 | 14:37
Updated-20 Jun, 2025 | 14:41
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Lightgallery - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-069

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Lightgallery allows Cross-Site Scripting (XSS).This issue affects Lightgallery: from 0.0.0 before 1.6.0.

Action-Not Available
Vendor-lightgallery_projectThe Drupal Association
Product-lightgalleryLightgallery
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-48448
Assigner-Drupal.org
ShareView Details
Assigner-Drupal.org
CVSS Score-6.5||MEDIUM
EPSS-0.27% / 18.64%
||
7 Day CHG~0.00%
Published-11 Jun, 2025 | 14:36
Updated-20 Jun, 2025 | 13:06
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Admin Audit Trail - Less critical - Denial of Service - SA-CONTRIB-2025-068

Allocation of Resources Without Limits or Throttling vulnerability in Drupal Admin Audit Trail allows Excessive Allocation.This issue affects Admin Audit Trail: from 0.0.0 before 1.0.5.

Action-Not Available
Vendor-admin_audit_trail_projectThe Drupal Association
Product-admin_audit_trailAdmin Audit Trail
CWE ID-CWE-770
Allocation of Resources Without Limits or Throttling
CVE-2025-48446
Assigner-Drupal.org
ShareView Details
Assigner-Drupal.org
CVSS Score-8.8||HIGH
EPSS-0.28% / 20.20%
||
7 Day CHG+0.01%
Published-11 Jun, 2025 | 14:34
Updated-16 Jun, 2025 | 16:38
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Commerce Alphabank Redirect - Moderately critical - Access bypass - SA-CONTRIB-2025-067

Incorrect Authorization vulnerability in Drupal Commerce Alphabank Redirect allows Functionality Misuse.This issue affects Commerce Alphabank Redirect: from 0.0.0 before 1.0.3.

Action-Not Available
Vendor-commerce_alphabank_redirect_projectThe Drupal Association
Product-commerce_alphabank_redirectCommerce Alphabank Redirect
CWE ID-CWE-863
Incorrect Authorization
CVE-2025-48445
Assigner-Drupal.org
ShareView Details
Assigner-Drupal.org
CVSS Score-8.8||HIGH
EPSS-0.27% / 19.01%
||
7 Day CHG~0.00%
Published-11 Jun, 2025 | 14:31
Updated-16 Jun, 2025 | 16:39
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Commerce Eurobank (Redirect) - Moderately critical - Access bypass - SA-CONTRIB-2025-066

Incorrect Authorization vulnerability in Drupal Commerce Eurobank (Redirect) allows Functionality Misuse.This issue affects Commerce Eurobank (Redirect): from 0.0.0 before 2.1.1.

Action-Not Available
Vendor-commerce_eurobank_\(redirect\)_projectThe Drupal Association
Product-commerce_eurobank_\(redirect\)Commerce Eurobank (Redirect)
CWE ID-CWE-863
Incorrect Authorization
CVE-2025-48013
Assigner-Drupal.org
ShareView Details
Assigner-Drupal.org
CVSS Score-5.3||MEDIUM
EPSS-0.23% / 13.72%
||
7 Day CHG~0.00%
Published-11 Jun, 2025 | 14:20
Updated-20 Jun, 2025 | 14:46
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Quick Node Block - Moderately critical - Access bypass - SA-CONTRIB-2025-065

Missing Authorization vulnerability in Drupal Quick Node Block allows Forceful Browsing.This issue affects Quick Node Block: from 0.0.0 before 2.0.0.

Action-Not Available
Vendor-quick_node_block_projectThe Drupal Association
Product-quick_node_blockQuick Node Block
CWE ID-CWE-862
Missing Authorization
CVE-2025-48444
Assigner-Drupal.org
ShareView Details
Assigner-Drupal.org
CVSS Score-5.3||MEDIUM
EPSS-0.23% / 13.72%
||
7 Day CHG~0.00%
Published-11 Jun, 2025 | 14:19
Updated-20 Jun, 2025 | 14:45
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Quick Node Block - Moderately critical - Access bypass - SA-CONTRIB-2025-064

Missing Authorization vulnerability in Drupal Quick Node Block allows Forceful Browsing.This issue affects Quick Node Block: from 0.0.0 before 2.0.0.

Action-Not Available
Vendor-quick_node_block_projectThe Drupal Association
Product-quick_node_blockQuick Node Block
CWE ID-CWE-862
Missing Authorization
CVE-2025-48012
Assigner-Drupal.org
ShareView Details
Assigner-Drupal.org
CVSS Score-4.8||MEDIUM
EPSS-0.22% / 12.19%
||
7 Day CHG~0.00%
Published-21 May, 2025 | 16:24
Updated-10 Jun, 2025 | 14:28
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
One Time Password - Moderately critical - Access bypass - SA-CONTRIB-2025-063

Authentication Bypass by Capture-replay vulnerability in Drupal One Time Password allows Remote Services with Stolen Credentials.This issue affects One Time Password: from 0.0.0 before 1.3.0.

Action-Not Available
Vendor-one_time_password_projectThe Drupal Association
Product-one_time_passwordOne Time Password
CWE ID-CWE-294
Authentication Bypass by Capture-replay
CVE-2025-48011
Assigner-Drupal.org
ShareView Details
Assigner-Drupal.org
CVSS Score-4.8||MEDIUM
EPSS-0.27% / 18.63%
||
7 Day CHG~0.00%
Published-21 May, 2025 | 16:23
Updated-10 Jun, 2025 | 14:28
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
One Time Password - Moderately critical - Access bypass - SA-CONTRIB-2025-062

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal One Time Password allows Functionality Bypass.This issue affects One Time Password: from 0.0.0 before 1.3.0.

Action-Not Available
Vendor-one_time_password_projectThe Drupal Association
Product-one_time_passwordOne Time Password
CWE ID-CWE-288
Authentication Bypass Using an Alternate Path or Channel
CVE-2025-48010
Assigner-Drupal.org
ShareView Details
Assigner-Drupal.org
CVSS Score-4.8||MEDIUM
EPSS-0.22% / 12.19%
||
7 Day CHG~0.00%
Published-21 May, 2025 | 16:23
Updated-10 Jun, 2025 | 14:13
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
One Time Password - Moderately critical - Access bypass - SA-CONTRIB-2025-061

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal One Time Password allows Functionality Bypass.This issue affects One Time Password: from 0.0.0 before 1.3.0.

Action-Not Available
Vendor-one_time_password_projectThe Drupal Association
Product-one_time_passwordOne Time Password
CWE ID-CWE-288
Authentication Bypass Using an Alternate Path or Channel
CVE-2025-48009
Assigner-Drupal.org
ShareView Details
Assigner-Drupal.org
CVSS Score-3.1||LOW
EPSS-0.19% / 8.38%
||
7 Day CHG~0.00%
Published-21 May, 2025 | 16:22
Updated-10 Jun, 2025 | 15:29
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Single Content Sync - Moderately critical - Access bypass - SA-CONTRIB-2025-060

Missing Authorization vulnerability in Drupal Single Content Sync allows Functionality Misuse.This issue affects Single Content Sync: from 0.0.0 before 1.4.12.

Action-Not Available
Vendor-single_content_sync_projectThe Drupal Association
Product-single_content_syncSingle Content Sync
CWE ID-CWE-862
Missing Authorization
CVE-2025-4416
Assigner-Drupal.org
ShareView Details
Assigner-Drupal.org
CVSS Score-7.5||HIGH
EPSS-0.34% / 26.45%
||
7 Day CHG~0.00%
Published-21 May, 2025 | 16:21
Updated-21 May, 2025 | 20:24
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Events Log Track - Moderately critical - Denial of Service - SA-CONTRIB-2025-059

Allocation of Resources Without Limits or Throttling vulnerability in Drupal Events Log Track allows Excessive Allocation.This issue affects Events Log Track: from 0.0.0 before 3.1.11, from 4.0.0 before 4.0.2.

Action-Not Available
Vendor-The Drupal Association
Product-Events Log Track
CWE ID-CWE-770
Allocation of Resources Without Limits or Throttling
CVE-2025-4415
Assigner-Drupal.org
ShareView Details
Assigner-Drupal.org
CVSS Score-4.8||MEDIUM
EPSS-0.19% / 8.76%
||
7 Day CHG~0.00%
Published-21 May, 2025 | 16:21
Updated-21 May, 2025 | 20:24
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Piwik PRO - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-058

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Piwik PRO allows Cross-Site Scripting (XSS).This issue affects Piwik PRO: from 0.0.0 before 1.3.2.

Action-Not Available
Vendor-The Drupal Association
Product-Piwik PRO
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-47710
Assigner-Drupal.org
ShareView Details
Assigner-Drupal.org
CVSS Score-7.4||HIGH
EPSS-0.32% / 24.68%
||
7 Day CHG~0.00%
Published-14 May, 2025 | 17:03
Updated-10 Jun, 2025 | 15:24
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Enterprise MFA - TFA for Drupal - Critical - Access bypass - SA-CONTRIB-2025-056

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Enterprise MFA - TFA for Drupal allows Authentication Bypass.This issue affects Enterprise MFA - TFA for Drupal: from 0.0.0 before 4.7.0, from 5.0.0 before 5.2.0.

Action-Not Available
Vendor-miniorangeThe Drupal Association
Product-miniorange_2faEnterprise MFA - TFA for Drupal
CWE ID-CWE-288
Authentication Bypass Using an Alternate Path or Channel
CVE-2025-47709
Assigner-Drupal.org
ShareView Details
Assigner-Drupal.org
CVSS Score-6.5||MEDIUM
EPSS-0.21% / 10.85%
||
7 Day CHG~0.00%
Published-14 May, 2025 | 17:03
Updated-10 Jun, 2025 | 15:25
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Enterprise MFA - TFA for Drupal - Critical - Access bypass - SA-CONTRIB-2025-055

Missing Authorization vulnerability in Drupal Enterprise MFA - TFA for Drupal allows Forceful Browsing.This issue affects Enterprise MFA - TFA for Drupal: from 0.0.0 before 4.7.0, from 5.0.0 before 5.2.0.

Action-Not Available
Vendor-miniorangeThe Drupal Association
Product-miniorange_2faEnterprise MFA - TFA for Drupal
CWE ID-CWE-862
Missing Authorization
CVE-2025-47708
Assigner-Drupal.org
ShareView Details
Assigner-Drupal.org
CVSS Score-8.8||HIGH
EPSS-0.17% / 6.70%
||
7 Day CHG~0.00%
Published-14 May, 2025 | 17:03
Updated-10 Jun, 2025 | 15:25
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Enterprise MFA - TFA for Drupal - Critical - Cross Site Request Forgery - SA-CONTRIB-2025-054

Cross-Site Request Forgery (CSRF) vulnerability in Drupal Enterprise MFA - TFA for Drupal allows Cross Site Request Forgery.This issue affects Enterprise MFA - TFA for Drupal: from 0.0.0 before 4.7.0, from 5.0.0 before 5.2.0.

Action-Not Available
Vendor-miniorangeThe Drupal Association
Product-miniorange_2faEnterprise MFA - TFA for Drupal
CWE ID-CWE-352
Cross-Site Request Forgery (CSRF)
CVE-2025-47707
Assigner-Drupal.org
ShareView Details
Assigner-Drupal.org
CVSS Score-7.5||HIGH
EPSS-0.36% / 28.08%
||
7 Day CHG~0.00%
Published-14 May, 2025 | 17:03
Updated-10 Jun, 2025 | 15:25
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Enterprise MFA - TFA for Drupal - Moderately critical - Access bypass - SA-CONTRIB-2025-053

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Enterprise MFA - TFA for Drupal allows Authentication Bypass.This issue affects Enterprise MFA - TFA for Drupal: from 0.0.0 before 4.7.0, from 5.0.0 before 5.2.0.

Action-Not Available
Vendor-miniorangeThe Drupal Association
Product-miniorange_2faEnterprise MFA - TFA for Drupal
CWE ID-CWE-288
Authentication Bypass Using an Alternate Path or Channel
CVE-2025-47706
Assigner-Drupal.org
ShareView Details
Assigner-Drupal.org
CVSS Score-4.8||MEDIUM
EPSS-0.24% / 14.47%
||
7 Day CHG~0.00%
Published-14 May, 2025 | 17:02
Updated-10 Jun, 2025 | 15:26
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Enterprise MFA - TFA for Drupal - Moderately critical - Access bypass - SA-CONTRIB-2025-052

Authentication Bypass by Capture-replay vulnerability in Drupal Enterprise MFA - TFA for Drupal allows Remote Services with Stolen Credentials.This issue affects Enterprise MFA - TFA for Drupal: from 0.0.0 before 4.7.0, from 5.0.0 before 5.2.0.

Action-Not Available
Vendor-miniorangeThe Drupal Association
Product-miniorange_2faEnterprise MFA - TFA for Drupal
CWE ID-CWE-294
Authentication Bypass by Capture-replay
CVE-2025-47705
Assigner-Drupal.org
ShareView Details
Assigner-Drupal.org
CVSS Score-6.1||MEDIUM
EPSS-0.24% / 14.97%
||
7 Day CHG~0.00%
Published-14 May, 2025 | 17:02
Updated-10 Feb, 2026 | 21:08
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
IFrame Remove Filter - Moderately critical - Cross site scripting - SA-CONTRIB-2025-051

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal IFrame Remove Filter allows Cross-Site Scripting (XSS).This issue affects IFrame Remove Filter: from 2.0.0 before 2.0.5, from 7.X-1.0 through 7.X-1.5, from 1.0 through 1.2.

Action-Not Available
Vendor-iframe_remove_filter_projectThe Drupal Association
Product-iframe_remove_filterIFrame Remove Filter
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-47704
Assigner-Drupal.org
ShareView Details
Assigner-Drupal.org
CVSS Score-6.1||MEDIUM
EPSS-0.19% / 9.42%
||
7 Day CHG~0.00%
Published-14 May, 2025 | 17:02
Updated-10 Jun, 2025 | 15:32
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Klaro Cookie & Consent Management - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-050

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Klaro Cookie & Consent Management allows Cross-Site Scripting (XSS).This issue affects Klaro Cookie & Consent Management: from 0.0.0 before 3.0.5.

Action-Not Available
Vendor-klaro_cookie_\&_consent_management_projectThe Drupal Association
Product-klaro_cookie_\&_consent_managementKlaro Cookie & Consent Management
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-47703
Assigner-Drupal.org
ShareView Details
Assigner-Drupal.org
CVSS Score-6.1||MEDIUM
EPSS-0.19% / 9.42%
||
7 Day CHG~0.00%
Published-14 May, 2025 | 17:01
Updated-10 Jun, 2025 | 15:39
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
COOKiES Consent Management - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-049

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal COOKiES Consent Management allows Cross-Site Scripting (XSS).This issue affects COOKiES Consent Management: from 0.0.0 before 1.2.14.

Action-Not Available
Vendor-cookies_consent_manager_projectThe Drupal Association
Product-cookies_coonsent_managerCOOKiES Consent Management
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-47702
Assigner-Drupal.org
ShareView Details
Assigner-Drupal.org
CVSS Score-6.1||MEDIUM
EPSS-0.19% / 9.42%
||
7 Day CHG~0.00%
Published-14 May, 2025 | 17:01
Updated-10 Jun, 2025 | 15:40
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
oEmbed Providers - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-048

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal oEmbed Providers allows Cross-Site Scripting (XSS).This issue affects oEmbed Providers: from 0.0.0 before 2.2.2.

Action-Not Available
Vendor-oembed_providers_projectThe Drupal Association
Product-oembed_providersoEmbed Providers
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-47701
Assigner-Drupal.org
ShareView Details
Assigner-Drupal.org
CVSS Score-8.8||HIGH
EPSS-0.17% / 6.70%
||
7 Day CHG~0.00%
Published-14 May, 2025 | 17:01
Updated-20 May, 2025 | 17:15
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Restrict route by IP - Critical - Cross Site Request Forgery - SA-CONTRIB-2025-047

Cross-Site Request Forgery (CSRF) vulnerability in Drupal Restrict route by IP allows Cross Site Request Forgery.This issue affects Restrict route by IP: from 0.0.0 before 1.3.0.

Action-Not Available
Vendor-The Drupal Association
Product-Restrict route by IP
CWE ID-CWE-352
Cross-Site Request Forgery (CSRF)
CVE-2025-3907
Assigner-Drupal.org
ShareView Details
Assigner-Drupal.org
CVSS Score-4.3||MEDIUM
EPSS-0.14% / 3.78%
||
7 Day CHG~0.00%
Published-23 Apr, 2025 | 17:08
Updated-02 Sep, 2025 | 18:37
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Search API Solr - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-046

Cross-Site Request Forgery (CSRF) vulnerability in Drupal Search API Solr allows Cross Site Request Forgery.This issue affects Search API Solr: from 0.0.0 before 4.3.9.

Action-Not Available
Vendor-drunkenmonkeyThe Drupal Association
Product-search_api_solrSearch API Solr
CWE ID-CWE-352
Cross-Site Request Forgery (CSRF)
CVE-2025-3904
Assigner-Drupal.org
ShareView Details
Assigner-Drupal.org
CVSS Score-7.3||HIGH
EPSS-0.27% / 18.24%
||
7 Day CHG~0.00%
Published-23 Apr, 2025 | 17:08
Updated-02 Sep, 2025 | 18:37
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Sportsleague - Critical - Unsupported - SA-CONTRIB-2025-045

Vulnerability in Drupal Sportsleague.This issue affects Sportsleague: *.*.

Action-Not Available
Vendor-sportsleague_projectThe Drupal Association
Product-sportsleagueSportsleague
CVE-2025-3903
Assigner-Drupal.org
ShareView Details
Assigner-Drupal.org
CVSS Score-7.3||HIGH
EPSS-0.35% / 27.18%
||
7 Day CHG~0.00%
Published-23 Apr, 2025 | 17:08
Updated-02 Sep, 2025 | 18:37
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
UEditor - 百度编辑器 - Critical - Unsupported - SA-CONTRIB-2025-044

Vulnerability in Drupal UEditor - 百度编辑器.This issue affects UEditor - 百度编辑器: *.*.

Action-Not Available
Vendor-ueditor_projectThe Drupal Association
Product-ueditorUEditor - 百度编辑器
CVE-2025-3902
Assigner-Drupal.org
ShareView Details
Assigner-Drupal.org
CVSS Score-6.1||MEDIUM
EPSS-0.22% / 12.12%
||
7 Day CHG~0.00%
Published-23 Apr, 2025 | 17:08
Updated-17 Jun, 2025 | 00:54
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Block Class - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-043

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Block Class allows Cross-Site Scripting (XSS).This issue affects Block Class: from 4.0.0 before 4.0.1.

Action-Not Available
Vendor-four_kitchensThe Drupal Association
Product-block_classBlock Class
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-3901
Assigner-Drupal.org
ShareView Details
Assigner-Drupal.org
CVSS Score-6.1||MEDIUM
EPSS-0.22% / 12.12%
||
7 Day CHG~0.00%
Published-23 Apr, 2025 | 17:07
Updated-18 Jun, 2025 | 21:01
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Bootstrap Site Alert - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-042

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Bootstrap Site Alert allows Cross-Site Scripting (XSS).This issue affects Bootstrap Site Alert: from 0.0.0 before 1.13.0, from 3.0.0 before 3.0.4.

Action-Not Available
Vendor-bootstrap_site_alert_projectThe Drupal Association
Product-bootstrap_site_alertBootstrap Site Alert
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-3900
Assigner-Drupal.org
ShareView Details
Assigner-Drupal.org
CVSS Score-6.1||MEDIUM
EPSS-0.23% / 13.49%
||
7 Day CHG~0.00%
Published-23 Apr, 2025 | 17:07
Updated-20 Jun, 2025 | 16:22
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Colorbox - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-041

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Colorbox allows Cross-Site Scripting (XSS).This issue affects Colorbox: from 0.0.0 before 2.1.3.

Action-Not Available
Vendor-colorbox_projectThe Drupal Association
Product-colorboxColorbox
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-3739
Assigner-Drupal.org
ShareView Details
Assigner-Drupal.org
CVSS Score-5.9||MEDIUM
EPSS-0.30% / 22.41%
||
7 Day CHG+0.02%
Published-16 Apr, 2025 | 16:32
Updated-18 Jun, 2025 | 13:12
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Drupal 8 Google Optimize Hide Page - Critical - Unsupported - SA-CONTRIB-2025-040

Vulnerability in Drupal Drupal 8 Google Optimize Hide Page.This issue affects Drupal 8 Google Optimize Hide Page: *.*.

Action-Not Available
Vendor-drupal_8_google_optimize_hide_page_projectThe Drupal Association
Product-drupal_8_google_optimize_hide_pageDrupal 8 Google Optimize Hide Page
CVE-2025-3738
Assigner-Drupal.org
ShareView Details
Assigner-Drupal.org
CVSS Score-5.9||MEDIUM
EPSS-0.30% / 22.41%
||
7 Day CHG+0.02%
Published-16 Apr, 2025 | 16:32
Updated-02 Sep, 2025 | 18:37
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Google Optimize - Critical - Unsupported - SA-CONTRIB-2025-039

Vulnerability in Drupal Google Optimize.This issue affects Google Optimize: *.*.

Action-Not Available
Vendor-google_optimize_projectThe Drupal Association
Product-google_optimizeGoogle Optimize
CVE-2025-3737
Assigner-Drupal.org
ShareView Details
Assigner-Drupal.org
CVSS Score-5.9||MEDIUM
EPSS-0.30% / 22.41%
||
7 Day CHG+0.02%
Published-16 Apr, 2025 | 16:32
Updated-02 Sep, 2025 | 18:37
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Google Maps: Store Locator - Critical - Unsupported - SA-CONTRIB-2025-038

Vulnerability in Drupal Google Maps: Store Locator.This issue affects Google Maps: Store Locator: *.*.

Action-Not Available
Vendor-google_maps\The Drupal Association
Product-_store_locator_projectGoogle Maps: Store Locator
CVE-2025-3736
Assigner-Drupal.org
ShareView Details
Assigner-Drupal.org
CVSS Score-5.9||MEDIUM
EPSS-0.30% / 22.41%
||
7 Day CHG+0.02%
Published-16 Apr, 2025 | 16:32
Updated-02 Sep, 2025 | 18:38
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Simple GTM - Critical - Unsupported - SA-CONTRIB-2025-037

Vulnerability in Drupal Simple GTM.This issue affects Simple GTM: *.*.

Action-Not Available
Vendor-simple_gtm_projectThe Drupal Association
Product-simple_gtmSimple GTM
CVE-2025-3735
Assigner-Drupal.org
ShareView Details
Assigner-Drupal.org
CVSS Score-5.9||MEDIUM
EPSS-0.30% / 21.89%
||
7 Day CHG+0.02%
Published-16 Apr, 2025 | 16:31
Updated-02 Sep, 2025 | 18:38
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Panelizer (obsolete) - Critical - Unsupported - SA-CONTRIB-2025-036

Vulnerability in Drupal Panelizer (obsolete).This issue affects Panelizer (obsolete): *.*.

Action-Not Available
Vendor-panelizer_\(obsolete\)_projectThe Drupal Association
Product-panelizer_\(obsolete\)Panelizer (obsolete)
CVE-2025-3734
Assigner-Drupal.org
ShareView Details
Assigner-Drupal.org
CVSS Score-5.9||MEDIUM
EPSS-0.34% / 26.19%
||
7 Day CHG+0.02%
Published-16 Apr, 2025 | 16:31
Updated-02 Sep, 2025 | 18:38
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Stage File Proxy - Moderately critical - Denial of Service - SA-CONTRIB-2025-035

Allocation of Resources Without Limits or Throttling vulnerability in Drupal Stage File Proxy allows Flooding.This issue affects Stage File Proxy: from 0.0.0 before 3.1.5.

Action-Not Available
Vendor-stage_file_proxy_projectThe Drupal Association
Product-stage_file_proxyStage File Proxy
CWE ID-CWE-770
Allocation of Resources Without Limits or Throttling
CVE-2025-3733
Assigner-Drupal.org
ShareView Details
Assigner-Drupal.org
CVSS Score-6.5||MEDIUM
EPSS-0.24% / 14.53%
||
7 Day CHG+0.02%
Published-16 Apr, 2025 | 16:30
Updated-02 Sep, 2025 | 18:38
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
baguetteBox.js - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-034

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal baguetteBox.Js allows Cross-Site Scripting (XSS).This issue affects baguetteBox.Js: from 0.0.0 before 2.0.4, from 3.0.0 before 3.0.1.

Action-Not Available
Vendor-baguettebox.js_projectThe Drupal Association
Product-baguettebox.jsbaguetteBox.js
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-3474
Assigner-Drupal.org
ShareView Details
Assigner-Drupal.org
CVSS Score-6.5||MEDIUM
EPSS-0.36% / 28.61%
||
7 Day CHG~0.00%
Published-09 Apr, 2025 | 17:48
Updated-01 May, 2025 | 14:38
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Panels - Critical - Access bypass - SA-CONTRIB-2025-033

Missing Authentication for Critical Function vulnerability in Drupal Panels allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Panels: from 0.0.0 before 4.9.0.

Action-Not Available
Vendor-The Drupal Association
Product-panelsPanels
CWE ID-CWE-306
Missing Authentication for Critical Function
CVE-2025-3131
Assigner-Drupal.org
ShareView Details
Assigner-Drupal.org
CVSS Score-5.4||MEDIUM
EPSS-0.17% / 6.42%
||
7 Day CHG~0.00%
Published-09 Apr, 2025 | 17:47
Updated-22 Apr, 2025 | 16:16
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
ECA: Event - Condition - Action - Critical - Cross site request forgery - SA-CONTRIB-2025-031

Cross-Site Request Forgery (CSRF) vulnerability in Drupal ECA: Event - Condition - Action allows Cross Site Request Forgery.This issue affects ECA: Event - Condition - Action: from 0.0.0 before 1.1.12, from 2.0.0 before 2.0.16, from 2.1.0 before 2.1.7, from 0.0.0 before 1.2.*.

Action-Not Available
Vendor-The Drupal Association
Product-eca\ECA: Event - Condition - Action
CWE ID-CWE-352
Cross-Site Request Forgery (CSRF)
CVE-2025-3475
Assigner-Drupal.org
ShareView Details
Assigner-Drupal.org
CVSS Score-6.5||MEDIUM
EPSS-0.42% / 34.30%
||
7 Day CHG~0.00%
Published-09 Apr, 2025 | 17:46
Updated-01 May, 2025 | 14:38
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
WEB-T - Moderately critical - Access bypass, Denial of service - SA-CONTRIB-2025-030

Allocation of Resources Without Limits or Throttling, Incorrect Authorization vulnerability in Drupal WEB-T allows Excessive Allocation, Content Spoofing.This issue affects WEB-T: from 0.0.0 before 1.1.0.

Action-Not Available
Vendor-The Drupal Association
Product-web-tWEB-T
CWE ID-CWE-770
Allocation of Resources Without Limits or Throttling
CWE ID-CWE-863
Incorrect Authorization
CVE-2025-3130
Assigner-Drupal.org
ShareView Details
Assigner-Drupal.org
CVSS Score-5.4||MEDIUM
EPSS-0.22% / 12.18%
||
7 Day CHG~0.00%
Published-02 Apr, 2025 | 21:10
Updated-29 Apr, 2025 | 13:09
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Obfuscate - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-029

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Obfuscate allows Stored XSS.This issue affects Obfuscate: from 0.0.0 before 2.0.1.

Action-Not Available
Vendor-The Drupal Association
Product-obfuscateObfuscate
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-3129
Assigner-Drupal.org
ShareView Details
Assigner-Drupal.org
CVSS Score-4.8||MEDIUM
EPSS-0.25% / 16.98%
||
7 Day CHG~0.00%
Published-02 Apr, 2025 | 21:10
Updated-02 Sep, 2025 | 18:32
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Access code - Moderately critical - Access bypass - SA-CONTRIB-2025-028

Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Access code allows Brute Force.This issue affects Access code: from 0.0.0 before 2.0.4.

Action-Not Available
Vendor-access_code_projectThe Drupal Association
Product-access_codeAccess code
CWE ID-CWE-307
Improper Restriction of Excessive Authentication Attempts
CVE-2025-3062
Assigner-Drupal.org
ShareView Details
Assigner-Drupal.org
CVSS Score-6.6||MEDIUM
EPSS-0.46% / 37.09%
||
7 Day CHG~0.00%
Published-31 Mar, 2025 | 22:22
Updated-02 Sep, 2025 | 18:34
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Drupal Admin LTE theme - Critical - Unsupported - SA-CONTRIB-2025-010

Vulnerability in Drupal Drupal Admin LTE theme.This issue affects Drupal Admin LTE theme: *.*.

Action-Not Available
Vendor-admin_lte_theme_projectThe Drupal Association
Product-admin_lte_themeDrupal Admin LTE theme
CWE ID-CWE-287
Improper Authentication
CVE-2025-3061
Assigner-Drupal.org
ShareView Details
Assigner-Drupal.org
CVSS Score-6.6||MEDIUM
EPSS-0.46% / 37.09%
||
7 Day CHG~0.00%
Published-31 Mar, 2025 | 22:22
Updated-02 Sep, 2025 | 18:34
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Material Admin - Critical - Unsupported - SA-CONTRIB-2025-006

Vulnerability in Drupal Material Admin.This issue affects Material Admin: *.*.

Action-Not Available
Vendor-material_admin_projectThe Drupal Association
Product-material_adminMaterial Admin
CWE ID-CWE-287
Improper Authentication
  • Previous
  • 1
  • 2
  • 3
  • 4
  • 5
  • 6
  • 7
  • 8
  • Next