Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools

Drupal.org

#2c85b837-eb8b-40ed-9d74-228c62987387
PolicyEmail

Short Name

drupal

Program Role

CNA

Top Level Root

MITRE Corporation

Security Advisories

View Advisories

Domain

drupal.org

Country

USA

Scope

All projects hosted under drupal.org, including End of Life (EOL) code.
Reported CVEsVendorsProductsReports
364Vulnerabilities found
CVE-2025-3060
Assigner-Drupal.org
ShareView Details
Assigner-Drupal.org
CVSS Score-6.6||MEDIUM
EPSS-0.49% / 39.41%
||
7 Day CHG~0.00%
Published-31 Mar, 2025 | 22:21
Updated-02 Sep, 2025 | 18:34
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Flattern – Multipurpose Bootstrap Business Profile - Critical - Unsupported - SA-CONTRIB-2025-005

Vulnerability in Drupal Flattern – Multipurpose Bootstrap Business Profile.This issue affects Flattern – Multipurpose Bootstrap Business Profile: *.*.

Action-Not Available
Vendor-flattern_projectThe Drupal Association
Product-flatternFlattern – Multipurpose Bootstrap Business Profile
CVE-2025-3059
Assigner-Drupal.org
ShareView Details
Assigner-Drupal.org
CVSS Score-5.3||MEDIUM
EPSS-0.43% / 34.89%
||
7 Day CHG~0.00%
Published-31 Mar, 2025 | 22:21
Updated-02 Sep, 2025 | 18:34
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Profile Private - Critical - Unsupported - SA-CONTRIB-2025-002

Vulnerability in Drupal Profile Private.This issue affects Profile Private: *.*.

Action-Not Available
Vendor-profile_private_projectThe Drupal Association
Product-profile_privateProfile Private
CWE ID-CWE-200
Exposure of Sensitive Information to an Unauthorized Actor
CVE-2025-31697
Assigner-Drupal.org
ShareView Details
Assigner-Drupal.org
CVSS Score-6.1||MEDIUM
EPSS-0.24% / 15.47%
||
7 Day CHG~0.00%
Published-31 Mar, 2025 | 21:55
Updated-02 Sep, 2025 | 18:34
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Formatter Suite - Moderately critical - Cross site scripting - SA-CONTRIB-2025-026

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Formatter Suite allows Cross-Site Scripting (XSS).This issue affects Formatter Suite: from 0.0.0 before 2.1.0.

Action-Not Available
Vendor-formatter_suite_projectThe Drupal Association
Product-formatter_suiteFormatter Suite
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-31696
Assigner-Drupal.org
ShareView Details
Assigner-Drupal.org
CVSS Score-6.1||MEDIUM
EPSS-0.24% / 15.47%
||
7 Day CHG~0.00%
Published-31 Mar, 2025 | 21:55
Updated-02 Sep, 2025 | 18:34
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
RapiDoc OAS Field Formatter - Moderately critical - Cross site scripting - SA-CONTRIB-2025-025

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal RapiDoc OAS Field Formatter allows Cross-Site Scripting (XSS).This issue affects RapiDoc OAS Field Formatter: from 0.0.0 before 1.0.1.

Action-Not Available
Vendor-chapterthreeThe Drupal Association
Product-rapidoc_oas_field_formatterRapiDoc OAS Field Formatter
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-31695
Assigner-Drupal.org
ShareView Details
Assigner-Drupal.org
CVSS Score-6.1||MEDIUM
EPSS-0.24% / 15.47%
||
7 Day CHG~0.00%
Published-31 Mar, 2025 | 21:52
Updated-02 Sep, 2025 | 18:34
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Link field display mode formatter - Moderately critical - Cross site scripting - SA-CONTRIB-2025-024

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Link field display mode formatter allows Cross-Site Scripting (XSS).This issue affects Link field display mode formatter: from 0.0.0 before 1.6.0.

Action-Not Available
Vendor-upstreamableThe Drupal Association
Product-link_field_display_mode_formatterLink field display mode formatter
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-31694
Assigner-Drupal.org
ShareView Details
Assigner-Drupal.org
CVSS Score-8.1||HIGH
EPSS-0.37% / 29.39%
||
7 Day CHG~0.00%
Published-31 Mar, 2025 | 21:51
Updated-02 Sep, 2025 | 18:35
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Two-factor Authentication (TFA) - Moderately critical - Access bypass - SA-CONTRIB-2025-023

Incorrect Authorization vulnerability in Drupal Two-factor Authentication (TFA) allows Forceful Browsing.This issue affects Two-factor Authentication (TFA): from 0.0.0 before 1.10.0.

Action-Not Available
Vendor-two-factor_authentication_projectThe Drupal Association
Product-two-factor_authenticationTwo-factor Authentication (TFA)
CWE ID-CWE-288
Authentication Bypass Using an Alternate Path or Channel
CVE-2025-31693
Assigner-Drupal.org
ShareView Details
Assigner-Drupal.org
CVSS Score-6.6||MEDIUM
EPSS-0.72% / 50.10%
||
7 Day CHG~0.00%
Published-31 Mar, 2025 | 21:51
Updated-16 Jul, 2026 | 15:21
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
AI (Artificial Intelligence) - Moderately critical - Gadget Chain - SA-CONTRIB-2025-022

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Drupal AI (Artificial Intelligence) allows OS Command Injection.This issue affects AI (Artificial Intelligence): from 0.0.0 before 1.0.5.

Action-Not Available
Vendor-artificial_intelligence_projectThe Drupal Association
Product-artificial_intelligenceAI (Artificial Intelligence)
CWE ID-CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2025-31692
Assigner-Drupal.org
ShareView Details
Assigner-Drupal.org
CVSS Score-7.5||HIGH
EPSS-0.72% / 49.95%
||
7 Day CHG~0.00%
Published-31 Mar, 2025 | 21:50
Updated-16 Jul, 2026 | 15:21
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
AI (Artificial Intelligence) - Critical - Remote Code Execution - SA-CONTRIB-2025-021

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Drupal AI (Artificial Intelligence) allows OS Command Injection.This issue affects AI (Artificial Intelligence): from 0.0.0 before 1.0.5.

Action-Not Available
Vendor-artificial_intelligence_projectThe Drupal Association
Product-artificial_intelligenceAI (Artificial Intelligence)
CWE ID-CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2025-31691
Assigner-Drupal.org
ShareView Details
Assigner-Drupal.org
CVSS Score-9.8||CRITICAL
EPSS-0.40% / 32.66%
||
7 Day CHG~0.00%
Published-31 Mar, 2025 | 21:49
Updated-02 Sep, 2025 | 18:35
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
OAuth2 Server - Moderately critical - Access bypass - SA-CONTRIB-2025-020

Missing Authorization vulnerability in Drupal OAuth2 Server allows Forceful Browsing.This issue affects OAuth2 Server: from 0.0.0 before 2.1.0.

Action-Not Available
Vendor-oauth2_server_projectThe Drupal Association
Product-oauth2_serverOAuth2 Server
CWE ID-CWE-862
Missing Authorization
CVE-2025-31690
Assigner-Drupal.org
ShareView Details
Assigner-Drupal.org
CVSS Score-8.8||HIGH
EPSS-0.21% / 11.33%
||
7 Day CHG~0.00%
Published-31 Mar, 2025 | 21:49
Updated-02 Sep, 2025 | 18:35
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Cache Utility - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-019

Cross-Site Request Forgery (CSRF) vulnerability in Drupal Cache Utility allows Cross Site Request Forgery.This issue affects Cache Utility: from 0.0.0 before 1.2.1.

Action-Not Available
Vendor-cache_utility_projectThe Drupal Association
Product-cache_utilityCache Utility
CWE ID-CWE-352
Cross-Site Request Forgery (CSRF)
CVE-2025-31689
Assigner-Drupal.org
ShareView Details
Assigner-Drupal.org
CVSS Score-8.1||HIGH
EPSS-0.19% / 9.18%
||
7 Day CHG~0.00%
Published-31 Mar, 2025 | 21:45
Updated-02 Sep, 2025 | 18:35
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
General Data Protection Regulation - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-018

Cross-Site Request Forgery (CSRF) vulnerability in Drupal General Data Protection Regulation allows Cross Site Request Forgery.This issue affects General Data Protection Regulation: from 0.0.0 before 3.0.1, from 3.1.0 before 3.1.2.

Action-Not Available
Vendor-general_data_protection_regulation_projectThe Drupal Association
Product-general_data_protection_regulationGeneral Data Protection Regulation
CWE ID-CWE-352
Cross-Site Request Forgery (CSRF)
CVE-2025-31688
Assigner-Drupal.org
ShareView Details
Assigner-Drupal.org
CVSS Score-6.8||MEDIUM
EPSS-0.18% / 7.81%
||
7 Day CHG~0.00%
Published-31 Mar, 2025 | 21:45
Updated-28 Aug, 2025 | 14:54
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Configuration Split - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-017

Cross-Site Request Forgery (CSRF) vulnerability in Drupal Configuration Split allows Cross Site Request Forgery.This issue affects Configuration Split: from 0.0.0 before 1.10.0, from 2.0.0 before 2.0.2.

Action-Not Available
Vendor-nuvoleThe Drupal Association
Product-configuration_splitConfiguration Split
CWE ID-CWE-352
Cross-Site Request Forgery (CSRF)
CVE-2025-31687
Assigner-Drupal.org
ShareView Details
Assigner-Drupal.org
CVSS Score-6.1||MEDIUM
EPSS-0.24% / 15.47%
||
7 Day CHG~0.00%
Published-31 Mar, 2025 | 21:44
Updated-28 Aug, 2025 | 14:53
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
SpamSpan filter - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-016

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal SpamSpan filter allows Cross-Site Scripting (XSS).This issue affects SpamSpan filter: from 0.0.0 before 3.2.1.

Action-Not Available
Vendor-drowlThe Drupal Association
Product-spamspan_filterSpamSpan filter
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-31686
Assigner-Drupal.org
ShareView Details
Assigner-Drupal.org
CVSS Score-8.1||HIGH
EPSS-0.38% / 30.70%
||
7 Day CHG~0.00%
Published-31 Mar, 2025 | 21:44
Updated-29 Apr, 2025 | 16:15
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Open Social - Less critical - Access bypass, Information Disclosure - SA-CONTRIB-2025-015

Missing Authorization vulnerability in Drupal Open Social allows Forceful Browsing.This issue affects Open Social: from 0.0.0 before 12.3.11, from 12.4.0 before 12.4.10.

Action-Not Available
Vendor-The Drupal Association
Product-Open Social
CWE ID-CWE-862
Missing Authorization
CVE-2025-31685
Assigner-Drupal.org
ShareView Details
Assigner-Drupal.org
CVSS Score-9.1||CRITICAL
EPSS-0.36% / 28.82%
||
7 Day CHG~0.00%
Published-31 Mar, 2025 | 21:43
Updated-29 Apr, 2025 | 16:15
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Open Social - Moderately critical - Access bypass - SA-CONTRIB-2025-014

Missing Authorization vulnerability in Drupal Open Social allows Forceful Browsing.This issue affects Open Social: from 0.0.0 before 12.3.11, from 12.4.0 before 12.4.10.

Action-Not Available
Vendor-The Drupal Association
Product-Open Social
CWE ID-CWE-862
Missing Authorization
CVE-2025-31684
Assigner-Drupal.org
ShareView Details
Assigner-Drupal.org
CVSS Score-6.8||MEDIUM
EPSS-0.17% / 6.26%
||
7 Day CHG~0.00%
Published-31 Mar, 2025 | 21:43
Updated-28 Aug, 2025 | 14:52
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
OAuth2 Client - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-013

Cross-Site Request Forgery (CSRF) vulnerability in Drupal OAuth2 Client allows Cross Site Request Forgery.This issue affects OAuth2 Client: from 0.0.0 before 4.1.3.

Action-Not Available
Vendor-mskccThe Drupal Association
Product-oauth2_clientOAuth2 Client
CWE ID-CWE-352
Cross-Site Request Forgery (CSRF)
CVE-2025-31683
Assigner-Drupal.org
ShareView Details
Assigner-Drupal.org
CVSS Score-6.8||MEDIUM
EPSS-0.17% / 6.26%
||
7 Day CHG~0.00%
Published-31 Mar, 2025 | 21:41
Updated-02 Jun, 2025 | 20:00
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Google Tag - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-012

Cross-Site Request Forgery (CSRF) vulnerability in Drupal Google Tag allows Cross Site Request Forgery.This issue affects Google Tag: from 0.0.0 before 1.8.0, from 2.0.0 before 2.0.8.

Action-Not Available
Vendor-google_tag_projectThe Drupal Association
Product-google_tagGoogle Tag
CWE ID-CWE-352
Cross-Site Request Forgery (CSRF)
CVE-2025-31682
Assigner-Drupal.org
ShareView Details
Assigner-Drupal.org
CVSS Score-4.8||MEDIUM
EPSS-0.22% / 12.35%
||
7 Day CHG~0.00%
Published-31 Mar, 2025 | 21:40
Updated-02 Jun, 2025 | 20:01
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Google Tag - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-011

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Google Tag allows Cross-Site Scripting (XSS).This issue affects Google Tag: from 0.0.0 before 1.8.0, from 2.0.0 before 2.0.8.

Action-Not Available
Vendor-google_tag_projectThe Drupal Association
Product-google_tagGoogle Tag
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-31681
Assigner-Drupal.org
ShareView Details
Assigner-Drupal.org
CVSS Score-9.8||CRITICAL
EPSS-0.40% / 32.66%
||
7 Day CHG~0.00%
Published-31 Mar, 2025 | 21:39
Updated-02 Jun, 2025 | 18:12
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Authenticator Login - Critical - Access bypass - SA-CONTRIB-2025-009

Missing Authorization vulnerability in Drupal Authenticator Login allows Forceful Browsing.This issue affects Authenticator Login: from 0.0.0 before 2.0.6.

Action-Not Available
Vendor-authenticator_login_projectThe Drupal Association
Product-authenticator_loginAuthenticator Login
CWE ID-CWE-862
Missing Authorization
CVE-2025-31680
Assigner-Drupal.org
ShareView Details
Assigner-Drupal.org
CVSS Score-6.8||MEDIUM
EPSS-0.17% / 6.26%
||
7 Day CHG~0.00%
Published-31 Mar, 2025 | 21:39
Updated-02 Jun, 2025 | 20:00
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Matomo Analytics - Moderately critical - Cross site request forgery - SA-CONTRIB-2025-008

Cross-Site Request Forgery (CSRF) vulnerability in Drupal Matomo Analytics allows Cross Site Request Forgery.This issue affects Matomo Analytics: from 0.0.0 before 1.24.0.

Action-Not Available
Vendor-matomo_analytics_projectThe Drupal Association
Product-matomo_analyticsMatomo Analytics
CWE ID-CWE-352
Cross-Site Request Forgery (CSRF)
CVE-2025-31679
Assigner-Drupal.org
ShareView Details
Assigner-Drupal.org
CVSS Score-6.1||MEDIUM
EPSS-0.24% / 15.47%
||
7 Day CHG~0.00%
Published-31 Mar, 2025 | 21:38
Updated-04 Jun, 2025 | 15:07
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Ignition Error Pages - Critical - Cross Site Scripting - SA-CONTRIB-2025-007

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Ignition Error Pages allows Cross-Site Scripting (XSS).This issue affects Ignition Error Pages: from 0.0.0 before 1.0.4.

Action-Not Available
Vendor-ignition_error_pages_projectThe Drupal Association
Product-ignition_error_pagesIgnition Error Pages
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-31678
Assigner-Drupal.org
ShareView Details
Assigner-Drupal.org
CVSS Score-8.2||HIGH
EPSS-0.35% / 27.63%
||
7 Day CHG~0.00%
Published-31 Mar, 2025 | 21:38
Updated-04 Jun, 2025 | 15:07
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
AI (Artificial Intelligence) - Moderately critical - Access bypass, Information Disclosure - SA-CONTRIB-2025-004

Missing Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Forceful Browsing.This issue affects AI (Artificial Intelligence): from 0.0.0 before 1.0.3.

Action-Not Available
Vendor-artificial_intelligence_projectThe Drupal Association
Product-artificial_intelligenceAI (Artificial Intelligence)
CWE ID-CWE-862
Missing Authorization
CVE-2025-31677
Assigner-Drupal.org
ShareView Details
Assigner-Drupal.org
CVSS Score-8.8||HIGH
EPSS-0.21% / 11.33%
||
7 Day CHG~0.00%
Published-31 Mar, 2025 | 21:37
Updated-04 Jun, 2025 | 15:06
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
AI (Artificial Intelligence) - Critical - Cross Site Request Forgery - SA-CONTRIB-2025-003

Cross-Site Request Forgery (CSRF) vulnerability in Drupal AI (Artificial Intelligence) allows Cross Site Request Forgery.This issue affects AI (Artificial Intelligence): from 1.0.0 before 1.0.2.

Action-Not Available
Vendor-artificial_intelligence_projectThe Drupal Association
Product-artificial_intelligenceAI (Artificial Intelligence)
CWE ID-CWE-352
Cross-Site Request Forgery (CSRF)
CVE-2025-31676
Assigner-Drupal.org
ShareView Details
Assigner-Drupal.org
CVSS Score-8.8||HIGH
EPSS-0.53% / 41.51%
||
7 Day CHG~0.00%
Published-31 Mar, 2025 | 21:36
Updated-19 Jun, 2025 | 22:42
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Email TFA - Moderately critical - Access bypass - SA-CONTRIB-2025-001

Weak Authentication vulnerability in Drupal Email TFA allows Brute Force.This issue affects Email TFA: from 0.0.0 before 2.0.3.

Action-Not Available
Vendor-email_tfa_projectThe Drupal Association
Product-email_tfaEmail TFA
CWE ID-CWE-1390
Weak Authentication
CWE ID-CWE-307
Improper Restriction of Excessive Authentication Attempts
CVE-2025-31675
Assigner-Drupal.org
ShareView Details
Assigner-Drupal.org
CVSS Score-5.4||MEDIUM
EPSS-0.46% / 37.09%
||
7 Day CHG~0.00%
Published-31 Mar, 2025 | 21:35
Updated-02 Apr, 2026 | 23:17
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Drupal core - Moderately critical - Cross Site Scripting - SA-CORE-2025-004

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS).This issue affects Drupal core: from 8.0.0 before 10.3.14, from 10.4.0 before 10.4.5, from 11.0.0 before 11.0.13, from 11.1.0 before 11.1.5. It also affects the Drupal 7 module from versions 7.x-1.0 through 7.x-1.12.

Action-Not Available
Vendor-The Drupal Association
Product-drupalLinkDrupal core
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-31674
Assigner-Drupal.org
ShareView Details
Assigner-Drupal.org
CVSS Score-7.5||HIGH
EPSS-0.54% / 41.97%
||
7 Day CHG~0.00%
Published-31 Mar, 2025 | 21:34
Updated-01 May, 2025 | 14:35
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Drupal core - Moderately critical - Gadget Chain - SA-CORE-2025-003

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection.This issue affects Drupal core: from 8.0.0 before 10.3.13, from 10.4.0 before 10.4.3, from 11.0.0 before 11.0.12, from 11.1.0 before 11.1.3.

Action-Not Available
Vendor-The Drupal Association
Product-drupalDrupal core
CWE ID-CWE-913
Improper Control of Dynamically-Managed Code Resources
CWE ID-CWE-915
Improperly Controlled Modification of Dynamically-Determined Object Attributes
CVE-2025-31673
Assigner-Drupal.org
ShareView Details
Assigner-Drupal.org
CVSS Score-4.6||MEDIUM
EPSS-0.29% / 21.39%
||
7 Day CHG~0.00%
Published-31 Mar, 2025 | 21:34
Updated-02 Jun, 2025 | 16:25
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Drupal core - Moderately critical - Access bypass - SA-CORE-2025-002

Incorrect Authorization vulnerability in Drupal Drupal core allows Forceful Browsing.This issue affects Drupal core: from 8.0.0 before 10.3.13, from 10.4.0 before 10.4.3, from 11.0.0 before 11.0.12, from 11.1.0 before 11.1.3.

Action-Not Available
Vendor-The Drupal Association
Product-drupalDrupal core
CWE ID-CWE-863
Incorrect Authorization
CVE-2025-3057
Assigner-Drupal.org
ShareView Details
Assigner-Drupal.org
CVSS Score-6.1||MEDIUM
EPSS-0.29% / 20.83%
||
7 Day CHG~0.00%
Published-31 Mar, 2025 | 21:33
Updated-15 Apr, 2025 | 14:31
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Drupal core - Critical - Cross site scripting - SA-CORE-2025-001

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS).This issue affects Drupal core: from 8.0.0 before 10.3.13, from 10.4.0 before 10.4.3, from 11.0.0 before 11.0.12, from 11.1.0 before 11.1.3.

Action-Not Available
Vendor-The Drupal Association
Product-drupalDrupal core
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2024-13312
Assigner-Drupal.org
ShareView Details
Assigner-Drupal.org
CVSS Score-5.3||MEDIUM
EPSS-0.30% / 21.80%
||
7 Day CHG~0.00%
Published-09 Jan, 2025 | 20:28
Updated-31 Jan, 2025 | 16:15
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Open Social - Moderately critical - Access bypass - SA-CONTRIB-2024-076

Missing Authorization vulnerability in Drupal Open Social allows Forceful Browsing.This issue affects Open Social: from 11.8.0 before 12.3.10, from 12.4.0 before 12.4.9.

Action-Not Available
Vendor-The Drupal Association
Product-Open Social
CWE ID-CWE-862
Missing Authorization
CVE-2024-13311
Assigner-Drupal.org
ShareView Details
Assigner-Drupal.org
CVSS Score-7.3||HIGH
EPSS-0.34% / 26.34%
||
7 Day CHG~0.00%
Published-09 Jan, 2025 | 20:28
Updated-02 Sep, 2025 | 18:29
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Allow All File Extensions for file fields - Critical - Unsupported - SA-CONTRIB-2024-075

Vulnerability in Drupal Allow All File Extensions for file fields.This issue affects Allow All File Extensions for file fields: *.*.

Action-Not Available
Vendor-allow_all_file_extensions_for_file_fields_projectThe Drupal Association
Product-allow_all_file_extensions_for_file_fieldsAllow All File Extensions for file fields
CVE-2024-13310
Assigner-Drupal.org
ShareView Details
Assigner-Drupal.org
CVSS Score-6.5||MEDIUM
EPSS-0.37% / 29.70%
||
7 Day CHG~0.00%
Published-09 Jan, 2025 | 20:27
Updated-02 Sep, 2025 | 18:29
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Git Utilities for Drupal - Critical - Unsupported - SA-CONTRIB-2024-074

Vulnerability in Drupal Git Utilities for Drupal.This issue affects Git Utilities for Drupal: *.*.

Action-Not Available
Vendor-git_utilities_projectThe Drupal Association
Product-git_utilitiesGit Utilities for Drupal
CVE-2024-13309
Assigner-Drupal.org
ShareView Details
Assigner-Drupal.org
CVSS Score-5.4||MEDIUM
EPSS-0.25% / 16.53%
||
7 Day CHG~0.00%
Published-09 Jan, 2025 | 20:27
Updated-28 Aug, 2025 | 11:26
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Login Disable - Critical - Access bypass - SA-CONTRIB-2024-073

Improper Authentication vulnerability in Drupal Login Disable allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Login Disable: from 2.0.0 before 2.1.1.

Action-Not Available
Vendor-login_disable_projectThe Drupal Association
Product-login_disableLogin Disable
CWE ID-CWE-287
Improper Authentication
CVE-2024-13308
Assigner-Drupal.org
ShareView Details
Assigner-Drupal.org
CVSS Score-3.8||LOW
EPSS-0.25% / 16.56%
||
7 Day CHG~0.00%
Published-09 Jan, 2025 | 20:27
Updated-05 Sep, 2025 | 16:51
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Browser Back Button - Moderately critical - Cross site scripting - SA-CONTRIB-2024-072

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Browser Back Button allows Cross-Site Scripting (XSS).This issue affects Browser Back Button: from 1.0.0 before 2.0.2.

Action-Not Available
Vendor-browser_back_button_projectThe Drupal Association
Product-browser_back_buttonBrowser Back Button
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2024-13305
Assigner-Drupal.org
ShareView Details
Assigner-Drupal.org
CVSS Score-4.8||MEDIUM
EPSS-0.23% / 14.07%
||
7 Day CHG~0.00%
Published-09 Jan, 2025 | 20:25
Updated-28 Aug, 2025 | 11:32
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Entity Form Steps - Moderately critical - Cross site scripting - SA-CONTRIB-2024-071

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Entity Form Steps allows Cross-Site Scripting (XSS).This issue affects Entity Form Steps: from 0.0.0 before 1.1.4.

Action-Not Available
Vendor-imagexmediaThe Drupal Association
Product-entity_form_stepsEntity Form Steps
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2024-13304
Assigner-Drupal.org
ShareView Details
Assigner-Drupal.org
CVSS Score-4.5||MEDIUM
EPSS-0.17% / 6.65%
||
7 Day CHG~0.00%
Published-09 Jan, 2025 | 20:25
Updated-28 Aug, 2025 | 11:34
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Minify JS - Moderately critical - Cross site request forgery - SA-CONTRIB-2024-070

Cross-Site Request Forgery (CSRF) vulnerability in Drupal Minify JS allows Cross Site Request Forgery.This issue affects Minify JS: from 0.0.0 before 3.0.3.

Action-Not Available
Vendor-matthiasmullieThe Drupal Association
Product-minify_jsMinify JS
CWE ID-CWE-352
Cross-Site Request Forgery (CSRF)
CVE-2024-13303
Assigner-Drupal.org
ShareView Details
Assigner-Drupal.org
CVSS Score-5.3||MEDIUM
EPSS-0.30% / 21.80%
||
7 Day CHG~0.00%
Published-09 Jan, 2025 | 20:24
Updated-02 Sep, 2025 | 18:29
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Download All Files - Critical - Access bypass - SA-CONTRIB-2024-069

Missing Authorization vulnerability in Drupal Download All Files allows Forceful Browsing.This issue affects Download All Files: from 0.0.0 before 2.0.2.

Action-Not Available
Vendor-download_all_files_projectThe Drupal Association
Product-download_all_filesDownload All Files
CWE ID-CWE-862
Missing Authorization
CVE-2024-13302
Assigner-Drupal.org
ShareView Details
Assigner-Drupal.org
CVSS Score-5.3||MEDIUM
EPSS-0.30% / 21.80%
||
7 Day CHG~0.00%
Published-09 Jan, 2025 | 20:24
Updated-02 Sep, 2025 | 18:29
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Pages Restriction Access - Critical - Access bypass - SA-CONTRIB-2024-068

Incorrect Authorization vulnerability in Drupal Pages Restriction Access allows Forceful Browsing.This issue affects Pages Restriction Access: from 2.0.0 before 2.0.3.

Action-Not Available
Vendor-ciandtThe Drupal Association
Product-pages_restriction_accessPages Restriction Access
CWE ID-CWE-863
Incorrect Authorization
CVE-2024-13301
Assigner-Drupal.org
ShareView Details
Assigner-Drupal.org
CVSS Score-6.1||MEDIUM
EPSS-0.24% / 15.45%
||
7 Day CHG~0.00%
Published-09 Jan, 2025 | 20:23
Updated-02 Sep, 2025 | 18:30
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
OAuth & OpenID Connect Single Sign On – SSO (OAuth/OIDC Client) - Critical - Cross Site Scripting - SA-CONTRIB-2024-067

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal OAuth & OpenID Connect Single Sign On – SSO (OAuth/OIDC Client) allows Cross-Site Scripting (XSS).This issue affects OAuth & OpenID Connect Single Sign On – SSO (OAuth/OIDC Client): from 3.0.0 before 3.44.0, from 4.0.0 before 4.0.19.

Action-Not Available
Vendor-miniorangeThe Drupal Association
Product-oauth_\&_openid_connect_single_sign-onOAuth & OpenID Connect Single Sign On – SSO (OAuth/OIDC Client)
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2024-13300
Assigner-Drupal.org
ShareView Details
Assigner-Drupal.org
CVSS Score-6.6||MEDIUM
EPSS-0.36% / 28.63%
||
7 Day CHG~0.00%
Published-09 Jan, 2025 | 20:23
Updated-02 Sep, 2025 | 18:30
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Print Anything - Critical - Unsupported - SA-CONTRIB-2024-066

Vulnerability in Drupal Print Anything.This issue affects Print Anything: *.*.

Action-Not Available
Vendor-print_anything_projectThe Drupal Association
Product-print_anythingPrint Anything
CVE-2024-13299
Assigner-Drupal.org
ShareView Details
Assigner-Drupal.org
CVSS Score-6.6||MEDIUM
EPSS-0.36% / 28.63%
||
7 Day CHG~0.00%
Published-09 Jan, 2025 | 20:22
Updated-02 Sep, 2025 | 18:30
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Megamenu Framework - Critical - Unsupported - SA-CONTRIB-2024-065

Vulnerability in Drupal Megamenu Framework.This issue affects Megamenu Framework: *.*.

Action-Not Available
Vendor-boozallenThe Drupal Association
Product-megamenu_frameworkMegamenu Framework
CVE-2024-13298
Assigner-Drupal.org
ShareView Details
Assigner-Drupal.org
CVSS Score-4.8||MEDIUM
EPSS-0.23% / 14.07%
||
7 Day CHG~0.00%
Published-09 Jan, 2025 | 20:21
Updated-02 Sep, 2025 | 18:30
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Tarte au Citron - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-064

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Tarte au Citron allows Cross-Site Scripting (XSS).This issue affects Tarte au Citron: from 2.0.0 before 2.0.5.

Action-Not Available
Vendor-kleegroupThe Drupal Association
Product-tarte_au_citronTarte au Citron
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2024-13297
Assigner-Drupal.org
ShareView Details
Assigner-Drupal.org
CVSS Score-6.6||MEDIUM
EPSS-0.40% / 32.50%
||
7 Day CHG~0.00%
Published-09 Jan, 2025 | 20:21
Updated-03 Sep, 2025 | 15:05
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Eloqua - Moderately critical - Arbitrary PHP code execution - SA-CONTRIB-2024-063

Deserialization of Untrusted Data vulnerability in Drupal Eloqua allows Object Injection.This issue affects Eloqua: from 7.X-* before 7.X-1.15.

Action-Not Available
Vendor-eloqua_projectThe Drupal Association
Product-eloquaEloqua
CWE ID-CWE-502
Deserialization of Untrusted Data
CVE-2024-13296
Assigner-Drupal.org
ShareView Details
Assigner-Drupal.org
CVSS Score-6.6||MEDIUM
EPSS-0.40% / 32.50%
||
7 Day CHG~0.00%
Published-09 Jan, 2025 | 20:19
Updated-03 Sep, 2025 | 15:01
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Mailjet - Moderately critical - Arbitrary PHP code execution - SA-CONTRIB-2024-062

Deserialization of Untrusted Data vulnerability in Drupal Mailjet allows Object Injection.This issue affects Mailjet: from 0.0.0 before 4.0.1.

Action-Not Available
Vendor-mailjetThe Drupal Association
Product-mailjetMailjet
CWE ID-CWE-502
Deserialization of Untrusted Data
CVE-2024-13295
Assigner-Drupal.org
ShareView Details
Assigner-Drupal.org
CVSS Score-6.6||MEDIUM
EPSS-0.40% / 32.50%
||
7 Day CHG~0.00%
Published-09 Jan, 2025 | 20:18
Updated-02 Sep, 2025 | 18:30
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Node export - Moderately critical - Arbitrary PHP code execution - SA-CONTRIB-2024-061

Deserialization of Untrusted Data vulnerability in Drupal Node export allows Object Injection.This issue affects Node export: from 7.X-* before 7.X-3.3.

Action-Not Available
Vendor-node_export_projectThe Drupal Association
Product-node_exportNode export
CWE ID-CWE-502
Deserialization of Untrusted Data
CVE-2024-13294
Assigner-Drupal.org
ShareView Details
Assigner-Drupal.org
CVSS Score-5.4||MEDIUM
EPSS-0.23% / 13.45%
||
7 Day CHG~0.00%
Published-09 Jan, 2025 | 20:17
Updated-02 Sep, 2025 | 18:30
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
POST File - Critical - Cross Site Scripting, Arbitrary PHP code execution - SA-CONTRIB-2024-060

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal POST File allows Cross-Site Scripting (XSS).This issue affects POST File: from 0.0.0 before 1.0.2.

Action-Not Available
Vendor-post_file_projectThe Drupal Association
Product-post_filePOST File
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2024-13293
Assigner-Drupal.org
ShareView Details
Assigner-Drupal.org
CVSS Score-3.1||LOW
EPSS-0.13% / 3.33%
||
7 Day CHG~0.00%
Published-09 Jan, 2025 | 20:17
Updated-02 Sep, 2025 | 18:31
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
POST File - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2024-059

Cross-Site Request Forgery (CSRF) vulnerability in Drupal POST File allows Cross Site Request Forgery.This issue affects POST File: from 0.0.0 before 1.0.2.

Action-Not Available
Vendor-post_file_projectThe Drupal Association
Product-post_filePOST File
CWE ID-CWE-352
Cross-Site Request Forgery (CSRF)
CVE-2024-13292
Assigner-Drupal.org
ShareView Details
Assigner-Drupal.org
CVSS Score-4.8||MEDIUM
EPSS-0.23% / 14.07%
||
7 Day CHG~0.00%
Published-09 Jan, 2025 | 20:16
Updated-02 Sep, 2025 | 18:31
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Tooltip - Moderately critical - Cross site scripting - SA-CONTRIB-2024-058

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Tooltip allows Cross-Site Scripting (XSS).This issue affects Tooltip: from 0.0.0 before 1.1.2.

Action-Not Available
Vendor-tooltip_projectThe Drupal Association
Product-tooltipTooltip
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2024-13291
Assigner-Drupal.org
ShareView Details
Assigner-Drupal.org
CVSS Score-7.3||HIGH
EPSS-0.32% / 23.84%
||
7 Day CHG~0.00%
Published-09 Jan, 2025 | 20:16
Updated-02 Sep, 2025 | 18:31
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Basic HTTP Authentication - Critical - Access bypass - SA-CONTRIB-2024-057

Incorrect Authorization vulnerability in Drupal Basic HTTP Authentication allows Forceful Browsing.This issue affects Basic HTTP Authentication: from 7.X-1.0 before 7.X-1.4.

Action-Not Available
Vendor-basic_http_authentication_projectThe Drupal Association
Product-basic_http_authenticationBasic HTTP Authentication
CWE ID-CWE-863
Incorrect Authorization
CVE-2024-13290
Assigner-Drupal.org
ShareView Details
Assigner-Drupal.org
CVSS Score-5.3||MEDIUM
EPSS-0.30% / 21.80%
||
7 Day CHG~0.00%
Published-09 Jan, 2025 | 20:15
Updated-02 Sep, 2025 | 18:31
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
OhDear Integration - Moderately critical - Access bypass - SA-CONTRIB-2024-056

Incorrect Authorization vulnerability in Drupal OhDear Integration allows Forceful Browsing.This issue affects OhDear Integration: from 0.0.0 before 2.0.4.

Action-Not Available
Vendor-ohdearThe Drupal Association
Product-ohdear_integrationOhDear Integration
CWE ID-CWE-863
Incorrect Authorization
CVE-2024-13289
Assigner-Drupal.org
ShareView Details
Assigner-Drupal.org
CVSS Score-5.4||MEDIUM
EPSS-0.28% / 19.66%
||
7 Day CHG~0.00%
Published-09 Jan, 2025 | 20:15
Updated-02 Sep, 2025 | 18:26
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Cookiebot + GTM - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-055

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Cookiebot + GTM allows Cross-Site Scripting (XSS).This issue affects Cookiebot + GTM: from 0.0.0 before 1.0.18.

Action-Not Available
Vendor-usercentricsThe Drupal Association
Product-cookiebot_\+_gtmCookiebot + GTM
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
  • Previous
  • 1
  • 2
  • 3
  • 4
  • 5
  • 6
  • 7
  • 8
  • Next