Vendor CVEs

Drupal

All CVEs

1,430 total · sorted by risk

CVE	Vendor / Product	Sev	Risk	CVSS	EPSS	Published	Description
CVE-2018-9861	Drupal Drupal	Med	0.33	6.1	0.02	Apr 19, 2018	Cross-site scripting (XSS) vulnerability in the Enhanced Image (aka image2) plugin for CKEditor (in versions 4.5.10 through 4.9.1; fixed in 4.9.2), as used in Drupal 8 before 8.4.7 and 8.5.x before 8.5.2 and other products, allows remote attackers to inject arbitrary web script…
CVE-2017-6927	Drupal Drupal	Med	0.33	6.1	0.02	Mar 1, 2018	Drupal 8.4.x versions before 8.4.5 and Drupal 7.x versions before 7.57 has a Drupal.checkPlain() JavaScript function which is used to escape potentially dangerous text before outputting it to HTML (as JavaScript output does not typically go through Twig autoescaping). This…
CVE-2015-2749	Drupal Drupal	Med	0.33	6.1	0.02	Sep 13, 2017	Open redirect vulnerability in Drupal 6.x before 6.35 and 7.x before 7.35 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the destination parameter.
CVE-2026-18986	Drupal Entity Browser	Med	0.31	4.8	0.00	Sep 2, 2026	Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Entity Browser allows Stored XSS. This issue affects Entity Browser versions: from 0.0.0 to 2.16.0.
CVE-2026-3218	Drupal Responsive Favicons	Med	0.31	4.8	0.00	Mar 25, 2026	Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Responsive Favicons allows Cross-Site Scripting (XSS).This issue affects Responsive Favicons: from 0.0.0 before 2.0.2.
CVE-2026-3213	Drupal Anti-Spam by CleanTalk	Med	0.31	4.7	0.00	Mar 25, 2026	Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Anti-Spam by CleanTalk allows Cross-Site Scripting (XSS).This issue affects Anti-Spam by CleanTalk: from 0.0.0 before 9.7.0.
CVE-2026-1553	Drupal Drupal Canvas	Med	0.31	4.8	0.00	Feb 4, 2026	Incorrect Authorization vulnerability in Drupal Drupal Canvas allows Forceful Browsing.This issue affects Drupal Canvas: from 0.0.0 before 1.0.4.
CVE-2026-0947	Drupal AT Internet Piano Analytics	Med	0.31	4.8	0.00	Feb 4, 2026	Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AT Internet Piano Analytics allows Cross-Site Scripting (XSS).This issue affects AT Internet Piano Analytics: from 0.0.0 before 1.0.1, from 2.0.0 before 2.3.1.
CVE-2025-14557	Drupal Facebook Pixel	Med	0.31	4.8	0.00	Jan 14, 2026	Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Drupal Facebook Pixel facebook_pixel allows Stored XSS.This issue affects Facebook Pixel: from 7.X-1.0 through 7.X-1.1.
CVE-2025-6675	Drupal Enterprise MFA - TFA for Drupal	Med	0.31	4.8	0.00	Jun 26, 2025	Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Enterprise MFA - TFA for Drupal allows Authentication Bypass.This issue affects Enterprise MFA - TFA for Drupal: from 0.0.0 before 4.8.0, from 5.2.0 before 5.2.1, from 0.0.0 before 5.0.*, from 0.0.0…
CVE-2025-4415	Drupal Piwik PRO	Med	0.31	4.8	0.00	May 21, 2025	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Piwik PRO allows Cross-Site Scripting (XSS).This issue affects Piwik PRO: from 0.0.0 before 1.3.2.
CVE-2025-48012	Drupal One Time Password	Med	0.31	4.8	0.00	May 21, 2025	Authentication Bypass by Capture-replay vulnerability in Drupal One Time Password allows Remote Services with Stolen Credentials.This issue affects One Time Password: from 0.0.0 before 1.3.0.
CVE-2025-48011	Drupal One Time Password	Med	0.31	4.8	0.00	May 21, 2025	Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal One Time Password allows Functionality Bypass.This issue affects One Time Password: from 0.0.0 before 1.3.0.
CVE-2025-48010	Drupal One Time Password	Med	0.31	4.8	0.00	May 21, 2025	Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal One Time Password allows Functionality Bypass.This issue affects One Time Password: from 0.0.0 before 1.3.0.
CVE-2025-47706	Drupal Enterprise MFA - TFA for Drupal	Med	0.31	4.8	0.00	May 14, 2025	Authentication Bypass by Capture-replay vulnerability in Drupal Enterprise MFA - TFA for Drupal allows Remote Services with Stolen Credentials.This issue affects Enterprise MFA - TFA for Drupal: from 0.0.0 before 4.7.0, from 5.0.0 before 5.2.0.
CVE-2025-3129	Drupal Access code	Med	0.31	4.8	0.00	Apr 2, 2025	Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Access code allows Brute Force.This issue affects Access code: from 0.0.0 before 2.0.4.
CVE-2025-31682	Drupal Google Tag	Med	0.31	4.8	0.00	Mar 31, 2025	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Google Tag allows Cross-Site Scripting (XSS).This issue affects Google Tag: from 0.0.0 before 1.8.0, from 2.0.0 before 2.0.8.
CVE-2024-13305	Drupal Entity Form Steps	Med	0.31	4.8	0.00	Jan 9, 2025	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Entity Form Steps allows Cross-Site Scripting (XSS).This issue affects Entity Form Steps: from 0.0.0 before 1.1.4.
CVE-2024-13298	Drupal Tarte au Citron	Med	0.31	4.8	0.00	Jan 9, 2025	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Tarte au Citron allows Cross-Site Scripting (XSS).This issue affects Tarte au Citron: from 2.0.0 before 2.0.5.
CVE-2024-13292	Drupal Tooltip	Med	0.31	4.8	0.00	Jan 9, 2025	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Tooltip allows Cross-Site Scripting (XSS).This issue affects Tooltip: from 0.0.0 before 1.1.2.
CVE-2024-13262	Drupal View Password	Med	0.31	4.8	0.00	Jan 9, 2025	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal View Password allows Cross-Site Scripting (XSS).This issue affects View Password: from 0.0.0 before 6.0.4.
CVE-2024-13247	Drupal Coffee	Med	0.31	4.8	0.00	Jan 9, 2025	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Coffee allows Cross-Site Scripting (XSS).This issue affects Coffee: from 0.0.0 before 1.4.0.
CVE-2024-45440	Drupal Drupal	Med	0.31	5.3	0.09	Aug 29, 2024	core/authorize.php in Drupal 11.x-dev allows Full Path Disclosure (even when error logging is None) if the value of hash_salt is file_get_contents of a file that does not exist.
CVE-2012-5558	Drupal Smiley module	Med	0.31	4.8	0.01	Jan 9, 2020	Cross-site scripting (XSS) vulnerability in the Smiley module 6.x-1.x versions prior to 6.x-1.1 and Smileys module 6.x-1.x versions prior to 6.x-1.1 for Drupal allows remote authenticated users with the "administer smiley" permission to inject arbitrary web script or HTML via a…
CVE-2012-2078	Drupal Activity	Med	0.31	4.8	0.01	Nov 21, 2019	Cross-site scripting (XSS) vulnerability in the Activity module 6.x-1.x for Drupal.
CVE-2012-1637	Drupal Quick Tabs	Med	0.31	4.8	0.01	Nov 21, 2019	Cross-site scripting vulnerability (XSS) in the Quick Tabs module 6.x-2.x before 6.x-2.1, 6.x-3.x before 6.x-3.1, and 7.x-3.x before 7.x-3.3 for Drupal.
CVE-2010-2472	Drupal Drupal	Med	0.31	4.8	0.01	Nov 7, 2019	Locale module and dependent contributed modules in Drupal 6.x before 6.16 and 5.x before version 5.22 do not sanitize the display of language codes, native and English language names properly which could allow an attacker to perform a cross-site scripting (XSS) attack. This…
CVE-2017-6921	Drupal Drupal	Med	0.31	5.9	0.02	Jan 15, 2019	In Drupal 8 prior to 8.3.4; The file REST resource does not properly validate some fields when manipulating files. A site is only affected by this if the site has the RESTful Web Services (rest) module enabled, the file REST resource is enabled and allows PATCH requests, and an…
CVE-2017-6932	Drupal Drupal	Med	0.31	4.7	0.01	Mar 1, 2018	Drupal core 7.x versions before 7.57 has an external link injection vulnerability when the language switcher block is used. A similar vulnerability exists in various custom and contributed modules. This vulnerability could allow an attacker to trick users into unwillingly…
CVE-2026-18260	Drupal Disable Login Page	Med	0.30	5.7	0.00	Aug 25, 2026	Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Disable Login Page allows Brute Force. This issue affects Disable Login Page versions: from 0.0.0 to 1.1.4.
CVE-2025-31673	Drupal Drupal	Med	0.30	4.6	0.00	Mar 31, 2025	Incorrect Authorization vulnerability in Drupal Drupal core allows Forceful Browsing.This issue affects Drupal core: from 8.0.0 before 10.3.13, from 10.4.0 before 10.4.3, from 11.0.0 before 11.0.12, from 11.1.0 before 11.1.3.
CVE-2025-13981	Drupal AI (Artificial Intelligence)	Med	0.29	4.4	0.00	Jan 28, 2026	Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Cross-Site Scripting (XSS).This issue affects AI (Artificial Intelligence): from 0.0.0 before 1.0.7, from 1.1.0 before 1.1.7, from…
CVE-2024-13304	Drupal Minify JS	Med	0.29	4.5	0.00	Jan 9, 2025	Cross-Site Request Forgery (CSRF) vulnerability in Drupal Minify JS allows Cross Site Request Forgery.This issue affects Minify JS: from 0.0.0 before 3.0.3.
CVE-2019-6341	Drupal Drupal	Med	0.29	5.4	0.09	Mar 26, 2019	In Drupal 7 versions prior to 7.65; Drupal 8.6 versions prior to 8.6.13;Drupal 8.5 versions prior to 8.5.14. Under certain circumstances the File module/subsystem allows a malicious user to upload a file that can trigger a cross-site scripting (XSS) vulnerability.
CVE-2026-81164	Drupal Entity PDF	Med	0.28	5.4	0.00	Sep 2, 2026	Missing Authorization vulnerability in Drupal Entity PDF allows Forceful Browsing. This issue affects Entity PDF versions: from 0.0.0 to 2.1.5.
CVE-2026-73476	Drupal External Authentication	Med	0.28	5.4	0.00	Sep 2, 2026	Improper Handling of Case Sensitivity vulnerability in Drupal External Authentication allows Privilege Escalation. This issue affects External Authentication versions: from 0.0.0 to 2.0.13.
CVE-2026-55805	Drupal Drupal Core	Med	0.28	5.4	0.00	Aug 25, 2026	Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Stored XSS. This issue affects Drupal core versions: from 0.0.0 to 10.6.13, from 11.3.0 to 11.3.14, from 11.4.0 to 11.4.4, from 0.0.0 to 11.0.*, from…
CVE-2026-58591	Drupal Colorbox	Med	0.28	5.4	0.00	Jul 10, 2026	Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Colorbox allows Cross-Site Scripting (XSS). This issue affects Colorbox versions: from 0.0.0 to 2.1.5, from 0.0.0 to 2.2.0.
CVE-2026-58590	Drupal FlowDrop	Med	0.28	5.4	0.00	Jul 10, 2026	Missing Authorization vulnerability in Drupal FlowDrop allows Forceful Browsing. This issue affects FlowDrop versions: from 0.0.0 to 1.6.0.
CVE-2026-58589	Drupal FlowDrop	Med	0.28	5.4	0.00	Jul 10, 2026	Missing Authorization vulnerability in Drupal FlowDrop allows Forceful Browsing. This issue affects FlowDrop versions: from 0.0.0 to 1.6.0.
CVE-2026-15085	Drupal Drupal	Med	0.28	5.4	0.00	Jul 10, 2026	Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI SEO/GEO Analyzer allows Stored XSS. This issue affects AI SEO/GEO Analyzer versions: from 0.0.0 to 1.1.3.
CVE-2026-15084	Drupal Drupal	Med	0.28	5.4	0.00	Jul 10, 2026	Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal UI Patterns (SDC in Drupal UI) allows Stored XSS. This issue affects UI Patterns (SDC in Drupal UI) versions: from 2.0.0 to 2.0.17.
CVE-2026-15082	Drupal Drupal	Med	0.28	5.4	0.00	Jul 10, 2026	Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Siteimprove Analytics allows Cross-Site Scripting (XSS). This issue affects Siteimprove Analytics versions: from 0.0.0 to 2.0.1.
CVE-2026-15079	Drupal Drupal	Med	0.28	5.4	0.00	Jul 10, 2026	Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Login Disable allows Brute Force. This issue affects Login Disable versions: from 0.0.0 to 2.1.4.
CVE-2026-11908	Drupal Drupal	Med	0.28	5.4	0.00	Jul 10, 2026	Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Tagify allows Stored XSS. This issue affects Tagify versions: from 0.0.0 to 1.2.52.
CVE-2026-10769	Drupal Drupal	Med	0.28	5.4	0.00	Jul 10, 2026	Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Commerce Core allows Stored XSS. This issue affects Commerce Core versions: from 3.3.0 to 3.3.6.
CVE-2026-0748	Internationalization Project Internationalization	Med	0.28	4.3	0.00	Mar 26, 2026	In the Drupal 7 Internationalization (i18n) module, the i18n_node submodule allows a user with both "Translate content" and "Administer content translations" permissions to view and attach unpublished nodes via the translation UI and its autocomplete widget. This bypasses…
CVE-2026-4393	Drupal Automated Logout	Med	0.28	4.3	0.00	Mar 26, 2026	Cross-Site Request Forgery (CSRF) vulnerability in Drupal Automated Logout allows Cross Site Request Forgery.This issue affects Automated Logout: from 0.0.0 before 1.7.0, from 2.0.0 before 2.0.2.
CVE-2026-3530	Drupal OpenID Connect / OAuth client	Med	0.28	4.3	0.00	Mar 26, 2026	Server-Side Request Forgery (SSRF) vulnerability in Drupal OpenID Connect / OAuth client allows Server Side Request Forgery.This issue affects OpenID Connect / OAuth client: from 0.0.0 before 1.5.0.
CVE-2026-3211	Drupal Theme Negotiation by Rules	Med	0.28	4.3	0.00	Mar 25, 2026	Cross-Site Request Forgery (CSRF) vulnerability in Drupal Theme Negotiation by Rules allows Cross Site Request Forgery.This issue affects Theme Negotiation by Rules: from 0.0.0 before 1.2.1.

CVE-2018-9861MedApr 19, 2018
Drupal
Drupal
risk 0.33cvss 6.1epss 0.02
Cross-site scripting (XSS) vulnerability in the Enhanced Image (aka image2) plugin for CKEditor (in versions 4.5.10 through 4.9.1; fixed in 4.9.2), as used in Drupal 8 before 8.4.7 and 8.5.x before 8.5.2 and other products, allows remote attackers to inject arbitrary web script…
CVE-2017-6927MedMar 1, 2018
Drupal
Drupal
risk 0.33cvss 6.1epss 0.02
Drupal 8.4.x versions before 8.4.5 and Drupal 7.x versions before 7.57 has a Drupal.checkPlain() JavaScript function which is used to escape potentially dangerous text before outputting it to HTML (as JavaScript output does not typically go through Twig autoescaping). This…
CVE-2015-2749MedSep 13, 2017
Drupal
Drupal
risk 0.33cvss 6.1epss 0.02
Open redirect vulnerability in Drupal 6.x before 6.35 and 7.x before 7.35 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the destination parameter.
CVE-2026-18986MedSep 2, 2026
Drupal
Entity Browser
risk 0.31cvss 4.8epss 0.00
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Entity Browser allows Stored XSS. This issue affects Entity Browser versions: from 0.0.0 to 2.16.0.
CVE-2026-3218MedMar 25, 2026
Drupal
Responsive Favicons
risk 0.31cvss 4.8epss 0.00
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Responsive Favicons allows Cross-Site Scripting (XSS).This issue affects Responsive Favicons: from 0.0.0 before 2.0.2.
CVE-2026-3213MedMar 25, 2026
Drupal
Anti-Spam by CleanTalk
risk 0.31cvss 4.7epss 0.00
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Anti-Spam by CleanTalk allows Cross-Site Scripting (XSS).This issue affects Anti-Spam by CleanTalk: from 0.0.0 before 9.7.0.
CVE-2026-1553MedFeb 4, 2026
Drupal
Drupal Canvas
risk 0.31cvss 4.8epss 0.00
Incorrect Authorization vulnerability in Drupal Drupal Canvas allows Forceful Browsing.This issue affects Drupal Canvas: from 0.0.0 before 1.0.4.
CVE-2026-0947MedFeb 4, 2026
Drupal
AT Internet Piano Analytics
risk 0.31cvss 4.8epss 0.00
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AT Internet Piano Analytics allows Cross-Site Scripting (XSS).This issue affects AT Internet Piano Analytics: from 0.0.0 before 1.0.1, from 2.0.0 before 2.3.1.
CVE-2025-14557MedJan 14, 2026
Drupal
Facebook Pixel
risk 0.31cvss 4.8epss 0.00
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Drupal Facebook Pixel facebook_pixel allows Stored XSS.This issue affects Facebook Pixel: from 7.X-1.0 through 7.X-1.1.
CVE-2025-6675MedJun 26, 2025
Drupal
Enterprise MFA - TFA for Drupal
risk 0.31cvss 4.8epss 0.00
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Enterprise MFA - TFA for Drupal allows Authentication Bypass.This issue affects Enterprise MFA - TFA for Drupal: from 0.0.0 before 4.8.0, from 5.2.0 before 5.2.1, from 0.0.0 before 5.0.*, from 0.0.0…
CVE-2025-4415MedMay 21, 2025
Drupal
Piwik PRO
risk 0.31cvss 4.8epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Piwik PRO allows Cross-Site Scripting (XSS).This issue affects Piwik PRO: from 0.0.0 before 1.3.2.
CVE-2025-48012MedMay 21, 2025
Drupal
One Time Password
risk 0.31cvss 4.8epss 0.00
Authentication Bypass by Capture-replay vulnerability in Drupal One Time Password allows Remote Services with Stolen Credentials.This issue affects One Time Password: from 0.0.0 before 1.3.0.
CVE-2025-48011MedMay 21, 2025
Drupal
One Time Password
risk 0.31cvss 4.8epss 0.00
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal One Time Password allows Functionality Bypass.This issue affects One Time Password: from 0.0.0 before 1.3.0.
CVE-2025-48010MedMay 21, 2025
Drupal
One Time Password
risk 0.31cvss 4.8epss 0.00
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal One Time Password allows Functionality Bypass.This issue affects One Time Password: from 0.0.0 before 1.3.0.
CVE-2025-47706MedMay 14, 2025
Drupal
Enterprise MFA - TFA for Drupal
risk 0.31cvss 4.8epss 0.00
Authentication Bypass by Capture-replay vulnerability in Drupal Enterprise MFA - TFA for Drupal allows Remote Services with Stolen Credentials.This issue affects Enterprise MFA - TFA for Drupal: from 0.0.0 before 4.7.0, from 5.0.0 before 5.2.0.
CVE-2025-3129MedApr 2, 2025
Drupal
Access code
risk 0.31cvss 4.8epss 0.00
Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Access code allows Brute Force.This issue affects Access code: from 0.0.0 before 2.0.4.
CVE-2025-31682MedMar 31, 2025
Drupal
Google Tag
risk 0.31cvss 4.8epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Google Tag allows Cross-Site Scripting (XSS).This issue affects Google Tag: from 0.0.0 before 1.8.0, from 2.0.0 before 2.0.8.
CVE-2024-13305MedJan 9, 2025
Drupal
Entity Form Steps
risk 0.31cvss 4.8epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Entity Form Steps allows Cross-Site Scripting (XSS).This issue affects Entity Form Steps: from 0.0.0 before 1.1.4.
CVE-2024-13298MedJan 9, 2025
Drupal
Tarte au Citron
risk 0.31cvss 4.8epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Tarte au Citron allows Cross-Site Scripting (XSS).This issue affects Tarte au Citron: from 2.0.0 before 2.0.5.
CVE-2024-13292MedJan 9, 2025
Drupal
Tooltip
risk 0.31cvss 4.8epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Tooltip allows Cross-Site Scripting (XSS).This issue affects Tooltip: from 0.0.0 before 1.1.2.
CVE-2024-13262MedJan 9, 2025
Drupal
View Password
risk 0.31cvss 4.8epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal View Password allows Cross-Site Scripting (XSS).This issue affects View Password: from 0.0.0 before 6.0.4.
CVE-2024-13247MedJan 9, 2025
Drupal
Coffee
risk 0.31cvss 4.8epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Coffee allows Cross-Site Scripting (XSS).This issue affects Coffee: from 0.0.0 before 1.4.0.
CVE-2024-45440MedAug 29, 2024
Drupal
Drupal
risk 0.31cvss 5.3epss 0.09
core/authorize.php in Drupal 11.x-dev allows Full Path Disclosure (even when error logging is None) if the value of hash_salt is file_get_contents of a file that does not exist.
CVE-2012-5558MedJan 9, 2020
Drupal
Smiley module
risk 0.31cvss 4.8epss 0.01
Cross-site scripting (XSS) vulnerability in the Smiley module 6.x-1.x versions prior to 6.x-1.1 and Smileys module 6.x-1.x versions prior to 6.x-1.1 for Drupal allows remote authenticated users with the "administer smiley" permission to inject arbitrary web script or HTML via a…
CVE-2012-2078MedNov 21, 2019
Drupal
Activity
risk 0.31cvss 4.8epss 0.01
Cross-site scripting (XSS) vulnerability in the Activity module 6.x-1.x for Drupal.
CVE-2012-1637MedNov 21, 2019
Drupal
Quick Tabs
risk 0.31cvss 4.8epss 0.01
Cross-site scripting vulnerability (XSS) in the Quick Tabs module 6.x-2.x before 6.x-2.1, 6.x-3.x before 6.x-3.1, and 7.x-3.x before 7.x-3.3 for Drupal.
CVE-2010-2472MedNov 7, 2019
Drupal
Drupal
risk 0.31cvss 4.8epss 0.01
Locale module and dependent contributed modules in Drupal 6.x before 6.16 and 5.x before version 5.22 do not sanitize the display of language codes, native and English language names properly which could allow an attacker to perform a cross-site scripting (XSS) attack. This…
CVE-2017-6921MedJan 15, 2019
Drupal
Drupal
risk 0.31cvss 5.9epss 0.02
In Drupal 8 prior to 8.3.4; The file REST resource does not properly validate some fields when manipulating files. A site is only affected by this if the site has the RESTful Web Services (rest) module enabled, the file REST resource is enabled and allows PATCH requests, and an…
CVE-2017-6932MedMar 1, 2018
Drupal
Drupal
risk 0.31cvss 4.7epss 0.01
Drupal core 7.x versions before 7.57 has an external link injection vulnerability when the language switcher block is used. A similar vulnerability exists in various custom and contributed modules. This vulnerability could allow an attacker to trick users into unwillingly…
CVE-2026-18260MedAug 25, 2026
Drupal
Disable Login Page
risk 0.30cvss 5.7epss 0.00
Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Disable Login Page allows Brute Force. This issue affects Disable Login Page versions: from 0.0.0 to 1.1.4.
CVE-2025-31673MedMar 31, 2025
Drupal
Drupal
risk 0.30cvss 4.6epss 0.00
Incorrect Authorization vulnerability in Drupal Drupal core allows Forceful Browsing.This issue affects Drupal core: from 8.0.0 before 10.3.13, from 10.4.0 before 10.4.3, from 11.0.0 before 11.0.12, from 11.1.0 before 11.1.3.
CVE-2025-13981MedJan 28, 2026
Drupal
AI (Artificial Intelligence)
risk 0.29cvss 4.4epss 0.00
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Cross-Site Scripting (XSS).This issue affects AI (Artificial Intelligence): from 0.0.0 before 1.0.7, from 1.1.0 before 1.1.7, from…
CVE-2024-13304MedJan 9, 2025
Drupal
Minify JS
risk 0.29cvss 4.5epss 0.00
Cross-Site Request Forgery (CSRF) vulnerability in Drupal Minify JS allows Cross Site Request Forgery.This issue affects Minify JS: from 0.0.0 before 3.0.3.
CVE-2019-6341MedMar 26, 2019
Drupal
Drupal
risk 0.29cvss 5.4epss 0.09
In Drupal 7 versions prior to 7.65; Drupal 8.6 versions prior to 8.6.13;Drupal 8.5 versions prior to 8.5.14. Under certain circumstances the File module/subsystem allows a malicious user to upload a file that can trigger a cross-site scripting (XSS) vulnerability.
CVE-2026-81164MedSep 2, 2026
Drupal
Entity PDF
risk 0.28cvss 5.4epss 0.00
Missing Authorization vulnerability in Drupal Entity PDF allows Forceful Browsing. This issue affects Entity PDF versions: from 0.0.0 to 2.1.5.
CVE-2026-73476MedSep 2, 2026
Drupal
External Authentication
risk 0.28cvss 5.4epss 0.00
Improper Handling of Case Sensitivity vulnerability in Drupal External Authentication allows Privilege Escalation. This issue affects External Authentication versions: from 0.0.0 to 2.0.13.
CVE-2026-55805MedAug 25, 2026
Drupal
Drupal Core
risk 0.28cvss 5.4epss 0.00
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Stored XSS. This issue affects Drupal core versions: from 0.0.0 to 10.6.13, from 11.3.0 to 11.3.14, from 11.4.0 to 11.4.4, from 0.0.0 to 11.0.*, from…
CVE-2026-58591MedJul 10, 2026
Drupal
Colorbox
risk 0.28cvss 5.4epss 0.00
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Colorbox allows Cross-Site Scripting (XSS). This issue affects Colorbox versions: from 0.0.0 to 2.1.5, from 0.0.0 to 2.2.0.
CVE-2026-58590MedJul 10, 2026
Drupal
FlowDrop
risk 0.28cvss 5.4epss 0.00
Missing Authorization vulnerability in Drupal FlowDrop allows Forceful Browsing. This issue affects FlowDrop versions: from 0.0.0 to 1.6.0.
CVE-2026-58589MedJul 10, 2026
Drupal
FlowDrop
risk 0.28cvss 5.4epss 0.00
Missing Authorization vulnerability in Drupal FlowDrop allows Forceful Browsing. This issue affects FlowDrop versions: from 0.0.0 to 1.6.0.
CVE-2026-15085MedJul 10, 2026
Drupal
Drupal
risk 0.28cvss 5.4epss 0.00
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI SEO/GEO Analyzer allows Stored XSS. This issue affects AI SEO/GEO Analyzer versions: from 0.0.0 to 1.1.3.
CVE-2026-15084MedJul 10, 2026
Drupal
Drupal
risk 0.28cvss 5.4epss 0.00
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal UI Patterns (SDC in Drupal UI) allows Stored XSS. This issue affects UI Patterns (SDC in Drupal UI) versions: from 2.0.0 to 2.0.17.
CVE-2026-15082MedJul 10, 2026
Drupal
Drupal
risk 0.28cvss 5.4epss 0.00
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Siteimprove Analytics allows Cross-Site Scripting (XSS). This issue affects Siteimprove Analytics versions: from 0.0.0 to 2.0.1.
CVE-2026-15079MedJul 10, 2026
Drupal
Drupal
risk 0.28cvss 5.4epss 0.00
Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Login Disable allows Brute Force. This issue affects Login Disable versions: from 0.0.0 to 2.1.4.
CVE-2026-11908MedJul 10, 2026
Drupal
Drupal
risk 0.28cvss 5.4epss 0.00
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Tagify allows Stored XSS. This issue affects Tagify versions: from 0.0.0 to 1.2.52.
CVE-2026-10769MedJul 10, 2026
Drupal
Drupal
risk 0.28cvss 5.4epss 0.00
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Commerce Core allows Stored XSS. This issue affects Commerce Core versions: from 3.3.0 to 3.3.6.
CVE-2026-0748MedMar 26, 2026
Internationalization Project
Internationalization
risk 0.28cvss 4.3epss 0.00
In the Drupal 7 Internationalization (i18n) module, the i18n_node submodule allows a user with both "Translate content" and "Administer content translations" permissions to view and attach unpublished nodes via the translation UI and its autocomplete widget. This bypasses…
CVE-2026-4393MedMar 26, 2026
Drupal
Automated Logout
risk 0.28cvss 4.3epss 0.00
Cross-Site Request Forgery (CSRF) vulnerability in Drupal Automated Logout allows Cross Site Request Forgery.This issue affects Automated Logout: from 0.0.0 before 1.7.0, from 2.0.0 before 2.0.2.
CVE-2026-3530MedMar 26, 2026
Drupal
OpenID Connect / OAuth client
risk 0.28cvss 4.3epss 0.00
Server-Side Request Forgery (SSRF) vulnerability in Drupal OpenID Connect / OAuth client allows Server Side Request Forgery.This issue affects OpenID Connect / OAuth client: from 0.0.0 before 1.5.0.
CVE-2026-3211MedMar 25, 2026
Drupal
Theme Negotiation by Rules
risk 0.28cvss 4.3epss 0.00
Cross-Site Request Forgery (CSRF) vulnerability in Drupal Theme Negotiation by Rules allows Cross Site Request Forgery.This issue affects Theme Negotiation by Rules: from 0.0.0 before 1.2.1.

Page 9 of 29