The Contact Forms module 7.x-1.x before 7.x-1.2 for Drupal does not specify sufficiently restrictive permissions, which allows remote authenticated users with the "access the site-wide contact form". Rated low severity (CVSS 3.5), this vulnerability is remotely exploitable.
Privilege Escalation
Contact Forms
NVD
CVSS 2.0
3.5
EPSS
0.3%
Cross-site scripting (XSS) vulnerability in the aberdeen_breadcrumb function in template.php in the Aberdeen theme 6.x-1.x before 6.x-1.11 for Drupal, when set to append the content title to the. Rated low severity (CVSS 2.6), this vulnerability is remotely exploitable. No vendor patch available.
PHP
XSS
Aberdeen
NVD
CVSS 2.0
2.6
EPSS
0.6%