Vendor CVEs

Drupal

All CVEs

1,207 total · sorted by risk

CVE	Vendor / Product	CVSS	EPSS	Published	Description
CVE-2025-31697	Drupal Formatter Suite	—	0.00	Mar 31, 2025	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Formatter Suite allows Cross-Site Scripting (XSS).This issue affects Formatter Suite: from 0.0.0 before 2.1.0.
CVE-2025-31696	Drupal RapiDoc OAS Field Formatter	—	0.00	Mar 31, 2025	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal RapiDoc OAS Field Formatter allows Cross-Site Scripting (XSS).This issue affects RapiDoc OAS Field Formatter: from 0.0.0 before 1.0.1.
CVE-2025-31695	Drupal Link field display mode formatter	—	0.00	Mar 31, 2025	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Link field display mode formatter allows Cross-Site Scripting (XSS).This issue affects Link field display mode formatter: from 0.0.0 before 1.6.0.
CVE-2025-31694	Drupal Two-factor Authentication	—	0.00	Mar 31, 2025	Incorrect Authorization vulnerability in Drupal Two-factor Authentication (TFA) allows Forceful Browsing.This issue affects Two-factor Authentication (TFA): from 0.0.0 before 1.10.0.
CVE-2025-31690	Drupal Cache Utility	—	0.00	Mar 31, 2025	Cross-Site Request Forgery (CSRF) vulnerability in Drupal Cache Utility allows Cross Site Request Forgery.This issue affects Cache Utility: from 0.0.0 before 1.2.1.
CVE-2025-31689	Drupal General Data Protection Regulation	—	0.00	Mar 31, 2025	Cross-Site Request Forgery (CSRF) vulnerability in Drupal General Data Protection Regulation allows Cross Site Request Forgery.This issue affects General Data Protection Regulation: from 0.0.0 before 3.0.1, from 3.1.0 before 3.1.2.
CVE-2025-31688	Drupal Configuration Split	—	0.00	Mar 31, 2025	Cross-Site Request Forgery (CSRF) vulnerability in Drupal Configuration Split allows Cross Site Request Forgery.This issue affects Configuration Split: from 0.0.0 before 1.10.0, from 2.0.0 before 2.0.2.
CVE-2025-31687	Drupal SpamSpan filter	—	0.00	Mar 31, 2025	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal SpamSpan filter allows Cross-Site Scripting (XSS).This issue affects SpamSpan filter: from 0.0.0 before 3.2.1.
CVE-2025-31684	Drupal OAuth2 Client	—	0.00	Mar 31, 2025	Cross-Site Request Forgery (CSRF) vulnerability in Drupal OAuth2 Client allows Cross Site Request Forgery.This issue affects OAuth2 Client: from 0.0.0 before 4.1.3.
CVE-2025-31683	Drupal Google Tag	—	0.00	Mar 31, 2025	Cross-Site Request Forgery (CSRF) vulnerability in Drupal Google Tag allows Cross Site Request Forgery.This issue affects Google Tag: from 0.0.0 before 1.8.0, from 2.0.0 before 2.0.8.
CVE-2025-31682	Drupal Google Tag	—	0.00	Mar 31, 2025	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Google Tag allows Cross-Site Scripting (XSS).This issue affects Google Tag: from 0.0.0 before 1.8.0, from 2.0.0 before 2.0.8.
CVE-2025-31681	Drupal Authenticator Login	—	0.00	Mar 31, 2025	Missing Authorization vulnerability in Drupal Authenticator Login allows Forceful Browsing.This issue affects Authenticator Login: from 0.0.0 before 2.0.6.
CVE-2025-31680	Drupal Matomo Analytics	—	0.00	Mar 31, 2025	Cross-Site Request Forgery (CSRF) vulnerability in Drupal Matomo Analytics allows Cross Site Request Forgery.This issue affects Matomo Analytics: from 0.0.0 before 1.24.0.
CVE-2025-31679	Drupal Ignition Error Pages	—	0.00	Mar 31, 2025	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Ignition Error Pages allows Cross-Site Scripting (XSS).This issue affects Ignition Error Pages: from 0.0.0 before 1.0.4.
CVE-2025-31676	Drupal Email TFA	—	0.01	Mar 31, 2025	Weak Authentication vulnerability in Drupal Email TFA allows Brute Force.This issue affects Email TFA: from 0.0.0 before 2.0.3.
CVE-2025-31674	Drupal Drupal Core	—	0.01	Mar 31, 2025	Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection.This issue affects Drupal core: from 8.0.0 before 10.3.13, from 10.4.0 before 10.4.3, from 11.0.0 before 11.0.12, from 11.1.0 before 11.1.3.
CVE-2025-31673	Drupal Drupal Core	—	0.00	Mar 31, 2025	Incorrect Authorization vulnerability in Drupal Drupal core allows Forceful Browsing.This issue affects Drupal core: from 8.0.0 before 10.3.13, from 10.4.0 before 10.4.3, from 11.0.0 before 11.0.12, from 11.1.0 before 11.1.3.
CVE-2025-3057	Drupal Drupal Core	—	0.00	Mar 31, 2025	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS).This issue affects Drupal core: from 8.0.0 before 10.3.13, from 10.4.0 before 10.4.3, from 11.0.0 before 11.0.12, from…
CVE-2024-13311	Drupal Allow All File Extensions for file fields	—	0.00	Jan 9, 2025	Vulnerability in Drupal Allow All File Extensions for file fields.This issue affects Allow All File Extensions for file fields: ..
CVE-2024-13310	Drupal Git Utilities for Drupal	—	0.00	Jan 9, 2025	Vulnerability in Drupal Git Utilities for Drupal.This issue affects Git Utilities for Drupal: ..
CVE-2024-13308	Drupal Browser Back Button	—	0.00	Jan 9, 2025	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Browser Back Button allows Cross-Site Scripting (XSS).This issue affects Browser Back Button: from 1.0.0 before 2.0.2.
CVE-2024-13305	Drupal Entity Form Steps	—	0.00	Jan 9, 2025	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Entity Form Steps allows Cross-Site Scripting (XSS).This issue affects Entity Form Steps: from 0.0.0 before 1.1.4.
CVE-2024-13304	Drupal Minify JS	—	0.00	Jan 9, 2025	Cross-Site Request Forgery (CSRF) vulnerability in Drupal Minify JS allows Cross Site Request Forgery.This issue affects Minify JS: from 0.0.0 before 3.0.3.
CVE-2024-13303	Drupal Download All Files	—	0.00	Jan 9, 2025	Missing Authorization vulnerability in Drupal Download All Files allows Forceful Browsing.This issue affects Download All Files: from 0.0.0 before 2.0.2.
CVE-2024-13302	Drupal Pages Restriction Access	—	0.00	Jan 9, 2025	Incorrect Authorization vulnerability in Drupal Pages Restriction Access allows Forceful Browsing.This issue affects Pages Restriction Access: from 2.0.0 before 2.0.3.
CVE-2024-13301	Drupal OAuth & OpenID Connect Single Sign On – SSO (OAuth/OIDC Client)	—	0.00	Jan 9, 2025	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal OAuth & OpenID Connect Single Sign On – SSO (OAuth/OIDC Client) allows Cross-Site Scripting (XSS).This issue affects OAuth & OpenID Connect Single Sign On – SSO…
CVE-2024-13299	Drupal Megamenu Framework	—	0.00	Jan 9, 2025	Vulnerability in Drupal Megamenu Framework.This issue affects Megamenu Framework: ..
CVE-2024-13298	Drupal Tarte au Citron	—	0.00	Jan 9, 2025	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Tarte au Citron allows Cross-Site Scripting (XSS).This issue affects Tarte au Citron: from 2.0.0 before 2.0.5.
CVE-2024-13297	Drupal Eloqua	—	0.00	Jan 9, 2025	Deserialization of Untrusted Data vulnerability in Drupal Eloqua allows Object Injection.This issue affects Eloqua: from 7.X-* before 7.X-1.15.
CVE-2024-13296	Drupal Mailjet	—	0.00	Jan 9, 2025	Deserialization of Untrusted Data vulnerability in Drupal Mailjet allows Object Injection.This issue affects Mailjet: from 0.0.0 before 4.0.1.
CVE-2024-13295	Drupal Node export	—	0.00	Jan 9, 2025	Deserialization of Untrusted Data vulnerability in Drupal Node export allows Object Injection.This issue affects Node export: from 7.X-* before 7.X-3.3.
CVE-2024-13294	Drupal POST File	—	0.00	Jan 9, 2025	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal POST File allows Cross-Site Scripting (XSS).This issue affects POST File: from 0.0.0 before 1.0.2.
CVE-2024-13293	Drupal POST File	—	0.00	Jan 9, 2025	Cross-Site Request Forgery (CSRF) vulnerability in Drupal POST File allows Cross Site Request Forgery.This issue affects POST File: from 0.0.0 before 1.0.2.
CVE-2024-13291	Drupal Basic HTTP Authentication	—	0.00	Jan 9, 2025	Incorrect Authorization vulnerability in Drupal Basic HTTP Authentication allows Forceful Browsing.This issue affects Basic HTTP Authentication: from 7.X-1.0 before 7.X-1.4.
CVE-2024-13290	Drupal OhDear Integration	—	0.00	Jan 9, 2025	Incorrect Authorization vulnerability in Drupal OhDear Integration allows Forceful Browsing.This issue affects OhDear Integration: from 0.0.0 before 2.0.4.
CVE-2024-13289	Drupal Cookiebot + GTM	—	0.00	Jan 9, 2025	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Cookiebot + GTM allows Cross-Site Scripting (XSS).This issue affects Cookiebot + GTM: from 0.0.0 before 1.0.18.
CVE-2024-13287	Drupal Views SVG Animation	—	0.00	Jan 9, 2025	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Views SVG Animation allows Cross-Site Scripting (XSS).This issue affects Views SVG Animation: from 0.0.0 before 1.0.1.
CVE-2024-13286	Drupal SVG Embed	—	0.00	Jan 9, 2025	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal SVG Embed allows Cross-Site Scripting (XSS).This issue affects SVG Embed: from 0.0.0 before 2.1.2.
CVE-2024-13283	Drupal Facets	—	0.00	Jan 9, 2025	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Facets allows Cross-Site Scripting (XSS).This issue affects Facets: from 0.0.0 before 2.0.9.
CVE-2024-13282	Drupal Block permissions	—	0.00	Jan 9, 2025	Incorrect Authorization vulnerability in Drupal Block permissions allows Forceful Browsing.This issue affects Block permissions: from 1.0.0 before 1.2.0.
CVE-2024-13280	Drupal Persistent Login	—	0.00	Jan 9, 2025	Insufficient Session Expiration vulnerability in Drupal Persistent Login allows Forceful Browsing.This issue affects Persistent Login: from 0.0.0 before 1.8.0, from 2.0.* before 2.2.2.
CVE-2024-13279	Drupal Two-factor Authentication	—	0.00	Jan 9, 2025	Session Fixation vulnerability in Drupal Two-factor Authentication (TFA) allows Session Fixation.This issue affects Two-factor Authentication (TFA): from 0.0.0 before 1.8.0.
CVE-2024-13278	Drupal Diff	—	0.00	Jan 9, 2025	Incorrect Authorization vulnerability in Drupal Diff allows Functionality Misuse.This issue affects Diff: from 0.0.0 before 1.8.0.
CVE-2024-13277	Drupal Smart IP Ban	—	0.00	Jan 9, 2025	Incorrect Authorization vulnerability in Drupal Smart IP Ban allows Forceful Browsing.This issue affects Smart IP Ban: from 7.X-1.0 before 7.X-1.1.
CVE-2024-13276	Drupal File Entity (fieldable files)	—	0.00	Jan 9, 2025	Insertion of Sensitive Information Into Sent Data vulnerability in Drupal File Entity (fieldable files) allows Forceful Browsing.This issue affects File Entity (fieldable files): from 7.X-* before 7.X-2.39.
CVE-2024-13272	Drupal Paragraphs table	—	0.00	Jan 9, 2025	Insufficient Granularity of Access Control vulnerability in Drupal Paragraphs table allows Content Spoofing.This issue affects Paragraphs table: from 0.0.0 before 1.23.0, from 2.0.0 before 2.0.2.
CVE-2024-13271	Drupal Content Entity Clone	—	0.00	Jan 9, 2025	Incorrect Authorization vulnerability in Drupal Content Entity Clone allows Forceful Browsing.This issue affects Content Entity Clone: from 0.0.0 before 1.0.4.
CVE-2024-13269	Drupal Advanced Varnish	—	0.00	Jan 9, 2025	Insertion of Sensitive Information Into Sent Data vulnerability in Drupal Advanced Varnish allows Forceful Browsing.This issue affects Advanced Varnish: from 0.0.0 before 4.0.11.
CVE-2024-13268	Drupal Opigno	—	0.00	Jan 9, 2025	Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') vulnerability in Drupal Opigno allows PHP Local File Inclusion.This issue affects Opigno: from 7.X-1.0 before 7.X-1.23.
CVE-2024-13267	Drupal Opigno TinCan Question Type	—	0.01	Jan 9, 2025	Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') vulnerability in Drupal Opigno TinCan Question Type allows PHP Local File Inclusion.This issue affects Opigno TinCan Question Type: from 7.X-1.0 before 7.X-1.3.

CVE-2025-31697Mar 31, 2025
Drupal
Formatter Suite
risk 0.00cvss —epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Formatter Suite allows Cross-Site Scripting (XSS).This issue affects Formatter Suite: from 0.0.0 before 2.1.0.
CVE-2025-31696Mar 31, 2025
Drupal
RapiDoc OAS Field Formatter
risk 0.00cvss —epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal RapiDoc OAS Field Formatter allows Cross-Site Scripting (XSS).This issue affects RapiDoc OAS Field Formatter: from 0.0.0 before 1.0.1.
CVE-2025-31695Mar 31, 2025
Drupal
Link field display mode formatter
risk 0.00cvss —epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Link field display mode formatter allows Cross-Site Scripting (XSS).This issue affects Link field display mode formatter: from 0.0.0 before 1.6.0.
CVE-2025-31694Mar 31, 2025
Drupal
Two-factor Authentication
risk 0.00cvss —epss 0.00
Incorrect Authorization vulnerability in Drupal Two-factor Authentication (TFA) allows Forceful Browsing.This issue affects Two-factor Authentication (TFA): from 0.0.0 before 1.10.0.
CVE-2025-31690Mar 31, 2025
Drupal
Cache Utility
risk 0.00cvss —epss 0.00
Cross-Site Request Forgery (CSRF) vulnerability in Drupal Cache Utility allows Cross Site Request Forgery.This issue affects Cache Utility: from 0.0.0 before 1.2.1.
CVE-2025-31689Mar 31, 2025
Drupal
General Data Protection Regulation
risk 0.00cvss —epss 0.00
Cross-Site Request Forgery (CSRF) vulnerability in Drupal General Data Protection Regulation allows Cross Site Request Forgery.This issue affects General Data Protection Regulation: from 0.0.0 before 3.0.1, from 3.1.0 before 3.1.2.
CVE-2025-31688Mar 31, 2025
Drupal
Configuration Split
risk 0.00cvss —epss 0.00
Cross-Site Request Forgery (CSRF) vulnerability in Drupal Configuration Split allows Cross Site Request Forgery.This issue affects Configuration Split: from 0.0.0 before 1.10.0, from 2.0.0 before 2.0.2.
CVE-2025-31687Mar 31, 2025
Drupal
SpamSpan filter
risk 0.00cvss —epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal SpamSpan filter allows Cross-Site Scripting (XSS).This issue affects SpamSpan filter: from 0.0.0 before 3.2.1.
CVE-2025-31684Mar 31, 2025
Drupal
OAuth2 Client
risk 0.00cvss —epss 0.00
Cross-Site Request Forgery (CSRF) vulnerability in Drupal OAuth2 Client allows Cross Site Request Forgery.This issue affects OAuth2 Client: from 0.0.0 before 4.1.3.
CVE-2025-31683Mar 31, 2025
Drupal
Google Tag
risk 0.00cvss —epss 0.00
Cross-Site Request Forgery (CSRF) vulnerability in Drupal Google Tag allows Cross Site Request Forgery.This issue affects Google Tag: from 0.0.0 before 1.8.0, from 2.0.0 before 2.0.8.
CVE-2025-31682Mar 31, 2025
Drupal
Google Tag
risk 0.00cvss —epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Google Tag allows Cross-Site Scripting (XSS).This issue affects Google Tag: from 0.0.0 before 1.8.0, from 2.0.0 before 2.0.8.
CVE-2025-31681Mar 31, 2025
Drupal
Authenticator Login
risk 0.00cvss —epss 0.00
Missing Authorization vulnerability in Drupal Authenticator Login allows Forceful Browsing.This issue affects Authenticator Login: from 0.0.0 before 2.0.6.
CVE-2025-31680Mar 31, 2025
Drupal
Matomo Analytics
risk 0.00cvss —epss 0.00
Cross-Site Request Forgery (CSRF) vulnerability in Drupal Matomo Analytics allows Cross Site Request Forgery.This issue affects Matomo Analytics: from 0.0.0 before 1.24.0.
CVE-2025-31679Mar 31, 2025
Drupal
Ignition Error Pages
risk 0.00cvss —epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Ignition Error Pages allows Cross-Site Scripting (XSS).This issue affects Ignition Error Pages: from 0.0.0 before 1.0.4.
CVE-2025-31676Mar 31, 2025
Drupal
Email TFA
risk 0.00cvss —epss 0.01
Weak Authentication vulnerability in Drupal Email TFA allows Brute Force.This issue affects Email TFA: from 0.0.0 before 2.0.3.
CVE-2025-31674Mar 31, 2025
Drupal
Drupal Core
risk 0.00cvss —epss 0.01
Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection.This issue affects Drupal core: from 8.0.0 before 10.3.13, from 10.4.0 before 10.4.3, from 11.0.0 before 11.0.12, from 11.1.0 before 11.1.3.
CVE-2025-31673Mar 31, 2025
Drupal
Drupal Core
risk 0.00cvss —epss 0.00
Incorrect Authorization vulnerability in Drupal Drupal core allows Forceful Browsing.This issue affects Drupal core: from 8.0.0 before 10.3.13, from 10.4.0 before 10.4.3, from 11.0.0 before 11.0.12, from 11.1.0 before 11.1.3.
CVE-2025-3057Mar 31, 2025
Drupal
Drupal Core
risk 0.00cvss —epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS).This issue affects Drupal core: from 8.0.0 before 10.3.13, from 10.4.0 before 10.4.3, from 11.0.0 before 11.0.12, from…
CVE-2024-13311Jan 9, 2025
Drupal
Allow All File Extensions for file fields
risk 0.00cvss —epss 0.00
Vulnerability in Drupal Allow All File Extensions for file fields.This issue affects Allow All File Extensions for file fields: *.*.
CVE-2024-13310Jan 9, 2025
Drupal
Git Utilities for Drupal
risk 0.00cvss —epss 0.00
Vulnerability in Drupal Git Utilities for Drupal.This issue affects Git Utilities for Drupal: *.*.
CVE-2024-13308Jan 9, 2025
Drupal
Browser Back Button
risk 0.00cvss —epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Browser Back Button allows Cross-Site Scripting (XSS).This issue affects Browser Back Button: from 1.0.0 before 2.0.2.
CVE-2024-13305Jan 9, 2025
Drupal
Entity Form Steps
risk 0.00cvss —epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Entity Form Steps allows Cross-Site Scripting (XSS).This issue affects Entity Form Steps: from 0.0.0 before 1.1.4.
CVE-2024-13304Jan 9, 2025
Drupal
Minify JS
risk 0.00cvss —epss 0.00
Cross-Site Request Forgery (CSRF) vulnerability in Drupal Minify JS allows Cross Site Request Forgery.This issue affects Minify JS: from 0.0.0 before 3.0.3.
CVE-2024-13303Jan 9, 2025
Drupal
Download All Files
risk 0.00cvss —epss 0.00
Missing Authorization vulnerability in Drupal Download All Files allows Forceful Browsing.This issue affects Download All Files: from 0.0.0 before 2.0.2.
CVE-2024-13302Jan 9, 2025
Drupal
Pages Restriction Access
risk 0.00cvss —epss 0.00
Incorrect Authorization vulnerability in Drupal Pages Restriction Access allows Forceful Browsing.This issue affects Pages Restriction Access: from 2.0.0 before 2.0.3.
CVE-2024-13301Jan 9, 2025
Drupal
OAuth & OpenID Connect Single Sign On – SSO (OAuth/OIDC Client)
risk 0.00cvss —epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal OAuth & OpenID Connect Single Sign On – SSO (OAuth/OIDC Client) allows Cross-Site Scripting (XSS).This issue affects OAuth & OpenID Connect Single Sign On – SSO…
CVE-2024-13299Jan 9, 2025
Drupal
Megamenu Framework
risk 0.00cvss —epss 0.00
Vulnerability in Drupal Megamenu Framework.This issue affects Megamenu Framework: *.*.
CVE-2024-13298Jan 9, 2025
Drupal
Tarte au Citron
risk 0.00cvss —epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Tarte au Citron allows Cross-Site Scripting (XSS).This issue affects Tarte au Citron: from 2.0.0 before 2.0.5.
CVE-2024-13297Jan 9, 2025
Drupal
Eloqua
risk 0.00cvss —epss 0.00
Deserialization of Untrusted Data vulnerability in Drupal Eloqua allows Object Injection.This issue affects Eloqua: from 7.X-* before 7.X-1.15.
CVE-2024-13296Jan 9, 2025
Drupal
Mailjet
risk 0.00cvss —epss 0.00
Deserialization of Untrusted Data vulnerability in Drupal Mailjet allows Object Injection.This issue affects Mailjet: from 0.0.0 before 4.0.1.
CVE-2024-13295Jan 9, 2025
Drupal
Node export
risk 0.00cvss —epss 0.00
Deserialization of Untrusted Data vulnerability in Drupal Node export allows Object Injection.This issue affects Node export: from 7.X-* before 7.X-3.3.
CVE-2024-13294Jan 9, 2025
Drupal
POST File
risk 0.00cvss —epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal POST File allows Cross-Site Scripting (XSS).This issue affects POST File: from 0.0.0 before 1.0.2.
CVE-2024-13293Jan 9, 2025
Drupal
POST File
risk 0.00cvss —epss 0.00
Cross-Site Request Forgery (CSRF) vulnerability in Drupal POST File allows Cross Site Request Forgery.This issue affects POST File: from 0.0.0 before 1.0.2.
CVE-2024-13291Jan 9, 2025
Drupal
Basic HTTP Authentication
risk 0.00cvss —epss 0.00
Incorrect Authorization vulnerability in Drupal Basic HTTP Authentication allows Forceful Browsing.This issue affects Basic HTTP Authentication: from 7.X-1.0 before 7.X-1.4.
CVE-2024-13290Jan 9, 2025
Drupal
OhDear Integration
risk 0.00cvss —epss 0.00
Incorrect Authorization vulnerability in Drupal OhDear Integration allows Forceful Browsing.This issue affects OhDear Integration: from 0.0.0 before 2.0.4.
CVE-2024-13289Jan 9, 2025
Drupal
Cookiebot + GTM
risk 0.00cvss —epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Cookiebot + GTM allows Cross-Site Scripting (XSS).This issue affects Cookiebot + GTM: from 0.0.0 before 1.0.18.
CVE-2024-13287Jan 9, 2025
Drupal
Views SVG Animation
risk 0.00cvss —epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Views SVG Animation allows Cross-Site Scripting (XSS).This issue affects Views SVG Animation: from 0.0.0 before 1.0.1.
CVE-2024-13286Jan 9, 2025
Drupal
SVG Embed
risk 0.00cvss —epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal SVG Embed allows Cross-Site Scripting (XSS).This issue affects SVG Embed: from 0.0.0 before 2.1.2.
CVE-2024-13283Jan 9, 2025
Drupal
Facets
risk 0.00cvss —epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Facets allows Cross-Site Scripting (XSS).This issue affects Facets: from 0.0.0 before 2.0.9.
CVE-2024-13282Jan 9, 2025
Drupal
Block permissions
risk 0.00cvss —epss 0.00
Incorrect Authorization vulnerability in Drupal Block permissions allows Forceful Browsing.This issue affects Block permissions: from 1.0.0 before 1.2.0.
CVE-2024-13280Jan 9, 2025
Drupal
Persistent Login
risk 0.00cvss —epss 0.00
Insufficient Session Expiration vulnerability in Drupal Persistent Login allows Forceful Browsing.This issue affects Persistent Login: from 0.0.0 before 1.8.0, from 2.0.* before 2.2.2.
CVE-2024-13279Jan 9, 2025
Drupal
Two-factor Authentication
risk 0.00cvss —epss 0.00
Session Fixation vulnerability in Drupal Two-factor Authentication (TFA) allows Session Fixation.This issue affects Two-factor Authentication (TFA): from 0.0.0 before 1.8.0.
CVE-2024-13278Jan 9, 2025
Drupal
Diff
risk 0.00cvss —epss 0.00
Incorrect Authorization vulnerability in Drupal Diff allows Functionality Misuse.This issue affects Diff: from 0.0.0 before 1.8.0.
CVE-2024-13277Jan 9, 2025
Drupal
Smart IP Ban
risk 0.00cvss —epss 0.00
Incorrect Authorization vulnerability in Drupal Smart IP Ban allows Forceful Browsing.This issue affects Smart IP Ban: from 7.X-1.0 before 7.X-1.1.
CVE-2024-13276Jan 9, 2025
Drupal
File Entity (fieldable files)
risk 0.00cvss —epss 0.00
Insertion of Sensitive Information Into Sent Data vulnerability in Drupal File Entity (fieldable files) allows Forceful Browsing.This issue affects File Entity (fieldable files): from 7.X-* before 7.X-2.39.
CVE-2024-13272Jan 9, 2025
Drupal
Paragraphs table
risk 0.00cvss —epss 0.00
Insufficient Granularity of Access Control vulnerability in Drupal Paragraphs table allows Content Spoofing.This issue affects Paragraphs table: from 0.0.0 before 1.23.0, from 2.0.0 before 2.0.2.
CVE-2024-13271Jan 9, 2025
Drupal
Content Entity Clone
risk 0.00cvss —epss 0.00
Incorrect Authorization vulnerability in Drupal Content Entity Clone allows Forceful Browsing.This issue affects Content Entity Clone: from 0.0.0 before 1.0.4.
CVE-2024-13269Jan 9, 2025
Drupal
Advanced Varnish
risk 0.00cvss —epss 0.00
Insertion of Sensitive Information Into Sent Data vulnerability in Drupal Advanced Varnish allows Forceful Browsing.This issue affects Advanced Varnish: from 0.0.0 before 4.0.11.
CVE-2024-13268Jan 9, 2025
Drupal
Opigno
risk 0.00cvss —epss 0.00
Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') vulnerability in Drupal Opigno allows PHP Local File Inclusion.This issue affects Opigno: from 7.X-1.0 before 7.X-1.23.
CVE-2024-13267Jan 9, 2025
Drupal
Opigno TinCan Question Type
risk 0.00cvss —epss 0.01
Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') vulnerability in Drupal Opigno TinCan Question Type allows PHP Local File Inclusion.This issue affects Opigno TinCan Question Type: from 7.X-1.0 before 7.X-1.3.

Page 5 of 25