Drupal
Monthly
Cross-site scripting in the AT Internet SmartTag Drupal module versions before 1.0.1 enables attackers to inject malicious scripts through improper input validation on web pages. An attacker can exploit this vulnerability remotely without authentication to steal session cookies, perform actions on behalf of users, or deface content, though user interaction is required for successful exploitation. No patch is currently available for affected Drupal installations.
Group Invite versions up to 2.3.9 is affected by improper check for unusual or exceptional conditions (CVSS 5.3).
Http Client Manager versions up to 9.3.13 is affected by improper check for unusual or exceptional conditions (CVSS 7.5).
Cross-Site Request Forgery (CSRF) vulnerability in Drupal Acquia Content Hub allows Cross Site Request Forgery.This issue affects Acquia Content Hub: from 0.0.0 before 3.6.4, from 3.7.0 before 3.7.3. [CVSS 8.1 HIGH]
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Disable Login Page allows Functionality Bypass.This issue affects Disable Login Page: from 0.0.0 before 1.1.3. [CVSS 4.2 MEDIUM]
Incorrect Authorization vulnerability in Drupal Entity Share allows Forceful Browsing.This issue affects Entity Share: from 0.0.0 before 3.13.0. [CVSS 5.3 MEDIUM]
Permissive Cross-domain Security Policy with Untrusted Domains vulnerability in Drupal Next.Js allows Cross-Site Scripting (XSS).This issue affects Next.Js: from 0.0.0 before 1.6.4, from 2.0.0 before 2.0.1. [CVSS 6.1 MEDIUM]
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Tagify allows Cross-Site Scripting (XSS).This issue affects Tagify: from 0.0.0 before 1.2.44. [CVSS 5.4 MEDIUM]
Login Time Restriction versions up to 1.0.3. is affected by cross-site request forgery (csrf) (CVSS 8.1).
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Cross-Site Scripting (XSS).This issue affects AI (Artificial Intelligence): from 0.0.0 before 1.0.7, from 1.1.0 before 1.1.7, from 1.2.0 before 1.2.4. [CVSS 4.4 MEDIUM]
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal CKEditor 5 Premium Features allows Functionality Bypass.This issue affects CKEditor 5 Premium Features: from 0.0.0 before 1.2.10, from 1.3.0 before 1.3.6, from 1.4.0 before 1.4.3, from 1.5.0 before 1.5.1, from 1.6.0 before 1.6.4. [CVSS 5.3 MEDIUM]
Privilege Defined With Unsafe Actions vulnerability in Drupal Mini site allows Stored XSS.This issue affects Mini site: from 0.0.0 before 3.0.2. [CVSS 5.4 MEDIUM]
Cross-site scripting (XSS) in Drupal Form Builder 7.x versions 1.0 through 1.22 allows unauthenticated attackers to inject malicious scripts through improperly sanitized form inputs, affecting users who interact with compromised forms. Public exploit code exists for this vulnerability, and no patch is currently available, leaving vulnerable installations at active risk of session hijacking, credential theft, and defacement.
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Drupal Facebook Pixel facebook_pixel allows Stored XSS.This issue affects Facebook Pixel: from 7.X-1.0 through 7.X-1.1. [CVSS 4.8 MEDIUM]
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Drupal Flag allows Cross-Site Scripting (XSS).This issue affects Flag: from 7.X-3.0 through 7.X-3.9. [CVSS 5.4 MEDIUM]
Cross-site scripting (XSS) in Drupal 7.x Webform Multiple File Upload module versions 7.x-1.2 through 7.x-1.6 enables unauthenticated attackers to execute arbitrary JavaScript in victims' browsers by uploading files with malicious filenames to Webform nodes where file type validation is disabled. The vulnerability originates in the third-party fyneworks/multifile library's file name renderer. With EPSS at 0.07% (21st percentile) and no public exploit identified at time of analysis, exploitation probability remains low despite the CVSS 7.0 score.
Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Drupal core allows Exploiting Incorrectly Configured Access Control Security Levels.0.0 before 10.4.9, from 10.5.0. Rated low severity (CVSS 3.7), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
User Interface (UI) Misrepresentation of Critical Information vulnerability in Drupal Drupal core allows Content Spoofing.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0 before 11.1.9, from. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable. No vendor patch available.
Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal Drupal core allows Forceful Browsing.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0 before 11.1.9, from 11.2.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Missing authorization in the Acquia DAM module for Drupal (all versions from 0.0.0 up to but not including 1.1.5) lets a remote, unauthenticated attacker bypass access controls and retrieve DAM-managed assets and protected resources by requesting them directly - classic forceful browsing against endpoints the module fails to guard. Per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), no credentials, user interaction, or non-default configuration are stated as required, but impact is confined to unauthorized disclosure with no modification or denial of service. There is no CISA KEV listing and no public exploit identified at time of analysis; EPSS is low at 0.31% (22nd percentile), and the vendor-released patch is version 1.1.5 (Drupal SA-CONTRIB-2025-105).
Authentication bypass in Drupal's Simple OAuth (OAuth2) & OpenID Connect contrib module (versions 6.0.0 up to, but not including, 6.0.7) lets unauthenticated remote attackers reach protected functionality through an alternate authentication path, exposing high-confidentiality data per the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Only sites that run the affected module version range and expose its OAuth2/OpenID Connect endpoints are in scope; sites already on 6.0.7+ or not using the module are unaffected. Exploitation is not confirmed as active - no public exploit has been identified at time of analysis - and EPSS is low (0.36%, 28th percentile), so this is a genuine but not emergency-level priority, and a vendor patch is already available.
Cross-site scripting in Drupal CivicTheme Design System before 1.12.0 allows unauthenticated remote attackers to execute script in a victim's browser when the victim interacts with attacker-controlled content, as reflected by CVSS PR:N/UI:R. The flaw is rated CVSS 3.1 6.1 with scope change and low confidentiality/integrity impact, and it does not enable silent server-side compromise. No public exploit was identified at time of analysis, and EPSS is low at 0.20% (9th percentile); a vendor patch is available.
Unauthenticated, network-reachable attackers can read access-restricted content on Drupal sites running the CivicTheme Design System contributed module at versions from 0.0.0 up to but not including 1.12.0, because the module's authorization logic is incorrect (CWE-863), permitting forceful browsing directly to resources that should be protected. With CVSS 3.1 scored 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), no authentication, user interaction, or non-default configuration is indicated as required, and the impact is confined to confidentiality - unauthorized disclosure of restricted resources rather than modification or denial of service. Exposure is limited to sites that have installed CivicTheme and rely on it to gate access to content; no public exploit code or confirmed active exploitation was identified at time of analysis.
Cross-site scripting in the Drupal Umami Analytics contributed module (versions 0.0.0 up to but not including 1.0.1) allows a user who already holds a high-privileged Drupal account with permission to configure the module to inject markup that is later rendered without output neutralization for other users viewing the affected page. The high-privilege prerequisite (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N, score 3.8) sharply narrows the attacker population to trusted/administrative users, there is no availability impact, and EPSS places exploitation likelihood at about 0.2% (9th percentile). There is no public exploit identified at time of analysis and the issue is not in CISA KEV, but a vendor patch is available.
Cross-site request forgery in the Drupal Currency contributed module (versions before 3.5.0) lets an attacker trigger state-changing requests through a victim's browser session, because the module fails to validate a per-request anti-CSRF token on that operation. As reflected in the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N), exploitation requires tricking a logged-in Drupal user - typically an administrator with Currency-management permissions - into visiting attacker-controlled content or clicking a crafted link while their session is active, and the resulting impact is limited to a low-integrity modification with no data disclosure or service disruption. No public exploit code has been identified and the issue is not in CISA KEV; EPSS is negligible at 0.13% (2nd percentile), making this a genuinely low-priority issue despite being a network-vector flaw, and sites already running Currency 3.5.0 or later are unaffected.
Improper validation of consistency within input in the Drupal contributed module Reverse Proxy Header (versions 0.0.0 through 1.1.1) allows manipulation of user-controlled variables derived from client-supplied HTTP headers. Affected sites are those that install the module and configure it to trust client-identifying headers from an upstream reverse proxy; in that deployment, unauthenticated remote attackers (CVSS PR:N) can send inconsistent or conflicting header values that the module fails to reconcile, potentially influencing downstream logic that consumes those variables. This is a moderate-severity (CVSS 5.3), low-priority issue in practice: EPSS is only 0.30% (21st percentile), there is no CISA KEV listing for active exploitation, and no public exploit code has been identified at time of analysis. A vendor patch is available in version 1.1.2.
The Drupal Access Code module (versions before 2.0.5) lacks rate limiting on its access code entry form, allowing brute-force guessing of access codes. While the vendor's CVSS vector indicates some authentication is required (PR:L), our independent analysis rates it as unauthenticated (PR:N) with limited impact-only the low-sensitivity access protected by the code-not full site compromise. No public exploit code is identified, and EPSS is low (0.24%, 13th percentile).
Cross-site scripting in the Drupal 'Plausible tracking' contributed module (versions from 0.0.0 before 1.0.2) lets injected input be rendered into a page without adequate escaping, so a crafted payload executes in the browser of a user who loads the affected page or link. The vulnerability requires victim user interaction (UI:R) and its authentication prerequisites are not confirmed from the available data, as the vendor vector indicates PR:N while our independent assessment rates PR:L and the exact unsanitized field is not identified. Impact is bounded (low confidentiality and integrity, no availability effect), EPSS is only 0.19% (8th percentile), no public exploit code has been identified at time of analysis, and a fix is available in version 1.0.2.
Cross-site scripting in the Drupal contributed module JSON Field (versions from 0.0.0 before 1.5) allows injected script to execute in the browser of a user who views a page rendering unsanitized JSON Field output. Per the CVSS vector AV:N/AC:L/PR:N/UI:R, exploitation is remote but requires victim user interaction, and per the independent assessment the realistic prerequisite is that the target site has the module installed below 1.5 and exposes a page or form that accepts and later renders JSON Field input without sanitization; impact is confined to the browser/session context with Low confidentiality and integrity impact and no availability impact. Exploitation status: no public exploit identified at time of analysis, and the EPSS score is low at 0.20% (9th percentile), so mass scanning and opportunistic exploitation are unlikely. No CISA KEV entry is present for this CVE.
Information disclosure in the Drupal 'Owl Carousel 2' contributed module (all versions) allows unauthenticated remote attackers to access limited sensitive information, with impact confined to confidentiality (CVSS 5.3). No public exploit code has been identified, and the EPSS score is 0.25% (15th percentile), indicating low real-world exploitation likelihood. The module must be installed and enabled on a Drupal site for exposure, and the specific vulnerable feature or endpoint is not detailed in available data.
Unauthenticated remote attackers can disclose sensitive information from Drupal sites that use the contributed API Key Manager module, as the vulnerability is network-reachable, low-complexity, and requires no privileges or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). The flaw affects all versions of the module (per CPE) and results in a low confidentiality impact, with an EPSS score of 0.25% indicating a low likelihood of exploitation. No public exploit identified at time of analysis.
Unauthenticated information disclosure in the Drupal contrib module 'Synchronize composer.json With Contrib Modules' allows a remote attacker to read limited sensitive data from any Drupal site where this module is installed and enabled (CVSS 3.1 base 5.3, AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). Only the confidentiality of the site is affected - there is no integrity or availability impact, no privilege escalation, and no user interaction required; the module is niche developer tooling rather than Drupal core, so the vast majority of Drupal installations are unaffected. There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV), and EPSS rates the likelihood of exploitation in the next 30 days at 0.25% (15th percentile), consistent with a low-priority reconnaissance-grade leak rather than an urgent, wormable issue.
Cross-site scripting in the Drupal Facets contributed module allows unauthenticated remote attackers to inject script into faceted-search output on sites running Facets before 2.0.10 (0.x/2.x branches) or before 3.0.1 (3.x branch). Exploitation is not automatic: it requires a victim to interact with attacker-supplied content - for instance clicking a crafted link or loading a page containing injected facet markup - after which script runs in the victim's browser context and can read or alter limited page data. There is no confirmed active exploitation (CISA KEV does not list this issue), no public exploit code identified at time of analysis, and EPSS is very low at 0.19% (8th percentile), consistent with a moderate-severity (CVSS 6.1) issue of low urgency rather than an emergency patch item.
Missing authorization in the Drupal Facets contributed module lets unauthenticated remote attackers bypass access controls and directly request facet endpoints to view content that was intended to be restricted (forceful browsing). All Facets releases before 2.0.10 and 3.0.x releases before 3.0.1 are affected, and the impact is limited to the information those exposed facets reveal rather than full data or system compromise. A vendor patch is available (2.0.10 / 3.0.1), EPSS is low at 0.20% (9th percentile), and no public exploit has been identified at time of analysis.
Second-factor authentication bypass in the Drupal Authenticator Login contrib module (versions before 2.1.8) allows an attacker who already possesses valid primary credentials for a target account to reach authenticated access without completing the module's two-factor challenge. The issue is rated CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), so it is remotely reachable with low privileges and no user interaction, but impact is bounded to accounts whose first-factor credentials the attacker can already supply, and only sites with this specific contrib module installed and enabled are exposed. No public exploit code has been identified at time of analysis, EPSS is low at 0.35% (26th percentile), and the vendor has released a fix, making this a mid-tier operational priority rather than an emergency.
Missing Authorization vulnerability in Drupal Layout Builder Advanced Permissions allows Forceful Browsing.0.0 before 2.2.0. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Authenticator Login allows Authentication Bypass.0.0 before 2.1.4. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Server-Side Request Forgery (SSRF) vulnerability in Drupal AI SEO Link Advisor allows Server Side Request Forgery.0.0 before 1.0.6. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal GoogleTag Manager allows Cross-Site Scripting (XSS).0.0 before 1.10.0. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal COOKiES Consent Management allows Cross-Site Scripting (XSS).0.0 before 1.2.16. Rated high severity (CVSS 7.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Missing Authentication for Critical Function vulnerability in Drupal Config Pages Viewer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Config Pages Viewer: from 0.0.0 before 1.0.4.
CVE-2025-7030 is a security vulnerability (CVSS 6.5). Remediation should follow standard vulnerability management procedures.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Paragraphs table allows Cross-Site Scripting (XSS).This issue affects Paragraphs table: from 2.0.0 before 2.0.5.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Simple XML sitemap allows Cross-Site Scripting (XSS).This issue affects Simple XML sitemap: from 0.0.0 before 4.2.2.
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Enterprise MFA - TFA for Drupal allows Authentication Bypass.This issue affects Enterprise MFA - TFA for Drupal: from 0.0.0 before 4.8.0, from 5.2.0 before 5.2.1, from 0.0.0 before 5.0.*, from 0.0.0 before 5.1.*.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal CKEditor5 Youtube allows Cross-Site Scripting (XSS).This issue affects CKEditor5 Youtube: from 0.0.0 before 1.0.3.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Klaro Cookie & Consent Management allows Cross-Site Scripting (XSS).This issue affects Klaro Cookie & Consent Management: from 0.0.0 before 3.0.7.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Toc.Js allows Cross-Site Scripting (XSS).This issue affects Toc.Js: from 0.0.0 before 3.2.1.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal GLightbox allows Cross-Site Scripting (XSS).This issue affects GLightbox: from 0.0.0 before 1.0.16.
Cross-Site Request Forgery (CSRF) vulnerability in Drupal Open Social allows Cross Site Request Forgery.This issue affects Open Social: from 0.0.0 before 12.3.14, from 12.4.0 before 12.4.13.
Stored/Reflected Cross-Site Scripting (XSS) vulnerability in the Drupal etracker module that allows unauthenticated remote attackers to inject malicious scripts into web pages without requiring user interaction. The vulnerability affects etracker versions prior to 3.1.0, enabling attackers to steal session tokens, perform unauthorized actions, or redirect users to malicious sites. The CVSS 7.3 score and network-accessible attack vector indicate this is a significant vulnerability affecting any Drupal installation with the vulnerable etracker module enabled.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Simple Klaro allows Cross-Site Scripting (XSS).This issue affects Simple Klaro: from 0.0.0 before 1.10.0.
Stored/Reflected Cross-Site Scripting (XSS) vulnerability in Drupal Simple Klaro module versions before 1.10.0 that fails to properly neutralize user input during web page generation. An unauthenticated remote attacker can inject malicious scripts that execute in victims' browsers with high impact on confidentiality and integrity, though the attack requires user interaction (clicking a malicious link). The vulnerability has a high CVSS score of 8.8 due to its network-based attack vector and broad scope, but real-world exploitation likelihood depends on KEV/EPSS data not provided in available intelligence.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal EU Cookie Compliance (GDPR Compliance) allows Cross-Site Scripting (XSS).This issue affects EU Cookie Compliance (GDPR Compliance): from 0.0.0 before 1.26.0.
Missing Authorization vulnerability in Drupal Bookable Calendar allows Forceful Browsing.This issue affects Bookable Calendar: from 0.0.0 before 2.2.13.
Cross-Site Scripting (XSS) vulnerability in Drupal's COOKiES Consent Management module that allows unauthenticated remote attackers to inject and execute malicious scripts during web page generation. All versions from 0.0.0 before 1.2.15 are affected. The vulnerability has a high CVSS score of 8.6 with no authentication or user interaction required, enabling attackers to compromise confidentiality, modify page content, and degrade availability. The network-based attack vector and low complexity indicate this is likely actively exploitable in real-world deployments.
Stored/Reflected Cross-Site Scripting (XSS) vulnerability in Drupal's COOKiES Consent Management module (versions before 1.2.15) that allows unauthenticated attackers to inject malicious scripts into web pages due to improper input neutralization. The vulnerability has a CVSS score of 8.6 (High severity) with network-based attack vector requiring no privileges or user interaction, enabling attackers to compromise confidentiality, integrity, and availability of affected sites. No active KEV or widespread public PoC data is available in standard vulnerability databases, suggesting limited real-world exploitation at time of analysis, though the high CVSS and ease of exploitation (AV:N/AC:L/PR:N/UI:N) warrant immediate patching.
Allocation of Resources Without Limits or Throttling vulnerability in Drupal Admin Audit Trail allows Excessive Allocation.This issue affects Admin Audit Trail: from 0.0.0 before 1.0.5.
A cross-site scripting vulnerability (CVSS 7.1). High severity vulnerability requiring prompt remediation.
CVE-2025-48446 is an Incorrect Authorization vulnerability (CWE-863) in the Drupal Commerce Alphabank Redirect module that allows unauthenticated attackers to misuse functionality through a network-based attack requiring user interaction. The vulnerability affects Commerce Alphabank Redirect versions prior to 1.0.3, with a CVSS score of 8.8 indicating high severity across confidentiality, integrity, and availability impacts. No public indicators of active exploitation or proof-of-concept code are currently documented, but the high CVSS score and authorization bypass nature warrant immediate patching.
CVE-2025-48445 is an Incorrect Authorization vulnerability (CWE-863) in Drupal Commerce Eurobank (Redirect) payment module versions before 2.1.1 that allows unauthenticated attackers to misuse functionality through a network-based attack requiring user interaction. With a CVSS score of 8.8 and high impact across confidentiality, integrity, and availability, this vulnerability affects payment processing workflows in Drupal e-commerce installations. The vulnerability requires user interaction (UI:R) but no authentication (PR:N), making it exploitable by attackers who can socially engineer victims or intercept redirect flows in payment processing.
Missing Authorization vulnerability in Drupal Quick Node Block allows Forceful Browsing.This issue affects Quick Node Block: from 0.0.0 before 2.0.0.
Missing Authorization vulnerability in Drupal Quick Node Block allows Forceful Browsing.This issue affects Quick Node Block: from 0.0.0 before 2.0.0.
Allocation of Resources Without Limits or Throttling vulnerability in Drupal Events Log Track allows Excessive Allocation.0.0 before 3.1.11, from 4.0.0 before 4.0.2. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Piwik PRO allows Cross-Site Scripting (XSS).0.0 before 1.3.2. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Authentication Bypass by Capture-replay vulnerability in Drupal One Time Password allows Remote Services with Stolen Credentials.0.0 before 1.3.0. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal One Time Password allows Functionality Bypass.0.0 before 1.3.0. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal One Time Password allows Functionality Bypass.0.0 before 1.3.0. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Missing Authorization vulnerability in Drupal Single Content Sync allows Functionality Misuse.0.0 before 1.4.12. Rated low severity (CVSS 3.1), this vulnerability is remotely exploitable. No vendor patch available.
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Enterprise MFA - TFA for Drupal allows Authentication Bypass.0.0 before 4.7.0, from 5.0.0 before 5.2.0. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Missing Authorization vulnerability in Drupal Enterprise MFA - TFA for Drupal allows Forceful Browsing.0.0 before 4.7.0, from 5.0.0 before 5.2.0. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Cross-Site Request Forgery (CSRF) vulnerability in Drupal Enterprise MFA - TFA for Drupal allows Cross Site Request Forgery.0.0 before 4.7.0, from 5.0.0 before 5.2.0. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Enterprise MFA - TFA for Drupal allows Authentication Bypass.0.0 before 4.7.0, from 5.0.0 before 5.2.0. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Authentication Bypass by Capture-replay vulnerability in Drupal Enterprise MFA - TFA for Drupal allows Remote Services with Stolen Credentials.0.0 before 4.7.0, from 5.0.0 before 5.2.0. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal IFrame Remove Filter allows Cross-Site Scripting (XSS).0.0 before 2.0.5, from 7.X-1.0. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Klaro Cookie & Consent Management allows Cross-Site Scripting (XSS).0.0 before 3.0.5. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal COOKiES Consent Management allows Cross-Site Scripting (XSS).0.0 before 1.2.14. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal oEmbed Providers allows Cross-Site Scripting (XSS).0.0 before 2.2.2. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Cross-Site Request Forgery (CSRF) vulnerability in Drupal Restrict route by IP allows Cross Site Request Forgery.0.0 before 1.3.0. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Cross-Site Request Forgery (CSRF) vulnerability in Drupal Search API Solr allows Cross Site Request Forgery.0.0 before 4.3.9. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Vulnerability in Drupal Sportsleague.*. Rated high severity (CVSS 7.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Block Class allows Cross-Site Scripting (XSS).0.0 before 4.0.1. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Bootstrap Site Alert allows Cross-Site Scripting (XSS).0.0 before 1.13.0, from 3.0.0. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Colorbox allows Cross-Site Scripting (XSS).0.0 before 2.1.3. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Vulnerability in Drupal Drupal 8 Google Optimize Hide Page.*. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable. No vendor patch available.
Vulnerability in Drupal Google Optimize.*. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable. No vendor patch available.
Vulnerability in Drupal Google Maps: Store Locator.*. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable. No vendor patch available.
Vulnerability in Drupal Simple GTM.*. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable. No vendor patch available.
Vulnerability in Drupal Panelizer (obsolete).*. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable. No vendor patch available.
Cross-site scripting in the AT Internet SmartTag Drupal module versions before 1.0.1 enables attackers to inject malicious scripts through improper input validation on web pages. An attacker can exploit this vulnerability remotely without authentication to steal session cookies, perform actions on behalf of users, or deface content, though user interaction is required for successful exploitation. No patch is currently available for affected Drupal installations.
Group Invite versions up to 2.3.9 is affected by improper check for unusual or exceptional conditions (CVSS 5.3).
Http Client Manager versions up to 9.3.13 is affected by improper check for unusual or exceptional conditions (CVSS 7.5).
Cross-Site Request Forgery (CSRF) vulnerability in Drupal Acquia Content Hub allows Cross Site Request Forgery.This issue affects Acquia Content Hub: from 0.0.0 before 3.6.4, from 3.7.0 before 3.7.3. [CVSS 8.1 HIGH]
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Disable Login Page allows Functionality Bypass.This issue affects Disable Login Page: from 0.0.0 before 1.1.3. [CVSS 4.2 MEDIUM]
Incorrect Authorization vulnerability in Drupal Entity Share allows Forceful Browsing.This issue affects Entity Share: from 0.0.0 before 3.13.0. [CVSS 5.3 MEDIUM]
Permissive Cross-domain Security Policy with Untrusted Domains vulnerability in Drupal Next.Js allows Cross-Site Scripting (XSS).This issue affects Next.Js: from 0.0.0 before 1.6.4, from 2.0.0 before 2.0.1. [CVSS 6.1 MEDIUM]
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Tagify allows Cross-Site Scripting (XSS).This issue affects Tagify: from 0.0.0 before 1.2.44. [CVSS 5.4 MEDIUM]
Login Time Restriction versions up to 1.0.3. is affected by cross-site request forgery (csrf) (CVSS 8.1).
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Cross-Site Scripting (XSS).This issue affects AI (Artificial Intelligence): from 0.0.0 before 1.0.7, from 1.1.0 before 1.1.7, from 1.2.0 before 1.2.4. [CVSS 4.4 MEDIUM]
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal CKEditor 5 Premium Features allows Functionality Bypass.This issue affects CKEditor 5 Premium Features: from 0.0.0 before 1.2.10, from 1.3.0 before 1.3.6, from 1.4.0 before 1.4.3, from 1.5.0 before 1.5.1, from 1.6.0 before 1.6.4. [CVSS 5.3 MEDIUM]
Privilege Defined With Unsafe Actions vulnerability in Drupal Mini site allows Stored XSS.This issue affects Mini site: from 0.0.0 before 3.0.2. [CVSS 5.4 MEDIUM]
Cross-site scripting (XSS) in Drupal Form Builder 7.x versions 1.0 through 1.22 allows unauthenticated attackers to inject malicious scripts through improperly sanitized form inputs, affecting users who interact with compromised forms. Public exploit code exists for this vulnerability, and no patch is currently available, leaving vulnerable installations at active risk of session hijacking, credential theft, and defacement.
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Drupal Facebook Pixel facebook_pixel allows Stored XSS.This issue affects Facebook Pixel: from 7.X-1.0 through 7.X-1.1. [CVSS 4.8 MEDIUM]
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Drupal Flag allows Cross-Site Scripting (XSS).This issue affects Flag: from 7.X-3.0 through 7.X-3.9. [CVSS 5.4 MEDIUM]
Cross-site scripting (XSS) in Drupal 7.x Webform Multiple File Upload module versions 7.x-1.2 through 7.x-1.6 enables unauthenticated attackers to execute arbitrary JavaScript in victims' browsers by uploading files with malicious filenames to Webform nodes where file type validation is disabled. The vulnerability originates in the third-party fyneworks/multifile library's file name renderer. With EPSS at 0.07% (21st percentile) and no public exploit identified at time of analysis, exploitation probability remains low despite the CVSS 7.0 score.
Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Drupal core allows Exploiting Incorrectly Configured Access Control Security Levels.0.0 before 10.4.9, from 10.5.0. Rated low severity (CVSS 3.7), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
User Interface (UI) Misrepresentation of Critical Information vulnerability in Drupal Drupal core allows Content Spoofing.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0 before 11.1.9, from. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable. No vendor patch available.
Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal Drupal core allows Forceful Browsing.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0 before 11.1.9, from 11.2.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Missing authorization in the Acquia DAM module for Drupal (all versions from 0.0.0 up to but not including 1.1.5) lets a remote, unauthenticated attacker bypass access controls and retrieve DAM-managed assets and protected resources by requesting them directly - classic forceful browsing against endpoints the module fails to guard. Per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), no credentials, user interaction, or non-default configuration are stated as required, but impact is confined to unauthorized disclosure with no modification or denial of service. There is no CISA KEV listing and no public exploit identified at time of analysis; EPSS is low at 0.31% (22nd percentile), and the vendor-released patch is version 1.1.5 (Drupal SA-CONTRIB-2025-105).
Authentication bypass in Drupal's Simple OAuth (OAuth2) & OpenID Connect contrib module (versions 6.0.0 up to, but not including, 6.0.7) lets unauthenticated remote attackers reach protected functionality through an alternate authentication path, exposing high-confidentiality data per the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Only sites that run the affected module version range and expose its OAuth2/OpenID Connect endpoints are in scope; sites already on 6.0.7+ or not using the module are unaffected. Exploitation is not confirmed as active - no public exploit has been identified at time of analysis - and EPSS is low (0.36%, 28th percentile), so this is a genuine but not emergency-level priority, and a vendor patch is already available.
Cross-site scripting in Drupal CivicTheme Design System before 1.12.0 allows unauthenticated remote attackers to execute script in a victim's browser when the victim interacts with attacker-controlled content, as reflected by CVSS PR:N/UI:R. The flaw is rated CVSS 3.1 6.1 with scope change and low confidentiality/integrity impact, and it does not enable silent server-side compromise. No public exploit was identified at time of analysis, and EPSS is low at 0.20% (9th percentile); a vendor patch is available.
Unauthenticated, network-reachable attackers can read access-restricted content on Drupal sites running the CivicTheme Design System contributed module at versions from 0.0.0 up to but not including 1.12.0, because the module's authorization logic is incorrect (CWE-863), permitting forceful browsing directly to resources that should be protected. With CVSS 3.1 scored 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), no authentication, user interaction, or non-default configuration is indicated as required, and the impact is confined to confidentiality - unauthorized disclosure of restricted resources rather than modification or denial of service. Exposure is limited to sites that have installed CivicTheme and rely on it to gate access to content; no public exploit code or confirmed active exploitation was identified at time of analysis.
Cross-site scripting in the Drupal Umami Analytics contributed module (versions 0.0.0 up to but not including 1.0.1) allows a user who already holds a high-privileged Drupal account with permission to configure the module to inject markup that is later rendered without output neutralization for other users viewing the affected page. The high-privilege prerequisite (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N, score 3.8) sharply narrows the attacker population to trusted/administrative users, there is no availability impact, and EPSS places exploitation likelihood at about 0.2% (9th percentile). There is no public exploit identified at time of analysis and the issue is not in CISA KEV, but a vendor patch is available.
Cross-site request forgery in the Drupal Currency contributed module (versions before 3.5.0) lets an attacker trigger state-changing requests through a victim's browser session, because the module fails to validate a per-request anti-CSRF token on that operation. As reflected in the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N), exploitation requires tricking a logged-in Drupal user - typically an administrator with Currency-management permissions - into visiting attacker-controlled content or clicking a crafted link while their session is active, and the resulting impact is limited to a low-integrity modification with no data disclosure or service disruption. No public exploit code has been identified and the issue is not in CISA KEV; EPSS is negligible at 0.13% (2nd percentile), making this a genuinely low-priority issue despite being a network-vector flaw, and sites already running Currency 3.5.0 or later are unaffected.
Improper validation of consistency within input in the Drupal contributed module Reverse Proxy Header (versions 0.0.0 through 1.1.1) allows manipulation of user-controlled variables derived from client-supplied HTTP headers. Affected sites are those that install the module and configure it to trust client-identifying headers from an upstream reverse proxy; in that deployment, unauthenticated remote attackers (CVSS PR:N) can send inconsistent or conflicting header values that the module fails to reconcile, potentially influencing downstream logic that consumes those variables. This is a moderate-severity (CVSS 5.3), low-priority issue in practice: EPSS is only 0.30% (21st percentile), there is no CISA KEV listing for active exploitation, and no public exploit code has been identified at time of analysis. A vendor patch is available in version 1.1.2.
The Drupal Access Code module (versions before 2.0.5) lacks rate limiting on its access code entry form, allowing brute-force guessing of access codes. While the vendor's CVSS vector indicates some authentication is required (PR:L), our independent analysis rates it as unauthenticated (PR:N) with limited impact-only the low-sensitivity access protected by the code-not full site compromise. No public exploit code is identified, and EPSS is low (0.24%, 13th percentile).
Cross-site scripting in the Drupal 'Plausible tracking' contributed module (versions from 0.0.0 before 1.0.2) lets injected input be rendered into a page without adequate escaping, so a crafted payload executes in the browser of a user who loads the affected page or link. The vulnerability requires victim user interaction (UI:R) and its authentication prerequisites are not confirmed from the available data, as the vendor vector indicates PR:N while our independent assessment rates PR:L and the exact unsanitized field is not identified. Impact is bounded (low confidentiality and integrity, no availability effect), EPSS is only 0.19% (8th percentile), no public exploit code has been identified at time of analysis, and a fix is available in version 1.0.2.
Cross-site scripting in the Drupal contributed module JSON Field (versions from 0.0.0 before 1.5) allows injected script to execute in the browser of a user who views a page rendering unsanitized JSON Field output. Per the CVSS vector AV:N/AC:L/PR:N/UI:R, exploitation is remote but requires victim user interaction, and per the independent assessment the realistic prerequisite is that the target site has the module installed below 1.5 and exposes a page or form that accepts and later renders JSON Field input without sanitization; impact is confined to the browser/session context with Low confidentiality and integrity impact and no availability impact. Exploitation status: no public exploit identified at time of analysis, and the EPSS score is low at 0.20% (9th percentile), so mass scanning and opportunistic exploitation are unlikely. No CISA KEV entry is present for this CVE.
Information disclosure in the Drupal 'Owl Carousel 2' contributed module (all versions) allows unauthenticated remote attackers to access limited sensitive information, with impact confined to confidentiality (CVSS 5.3). No public exploit code has been identified, and the EPSS score is 0.25% (15th percentile), indicating low real-world exploitation likelihood. The module must be installed and enabled on a Drupal site for exposure, and the specific vulnerable feature or endpoint is not detailed in available data.
Unauthenticated remote attackers can disclose sensitive information from Drupal sites that use the contributed API Key Manager module, as the vulnerability is network-reachable, low-complexity, and requires no privileges or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). The flaw affects all versions of the module (per CPE) and results in a low confidentiality impact, with an EPSS score of 0.25% indicating a low likelihood of exploitation. No public exploit identified at time of analysis.
Unauthenticated information disclosure in the Drupal contrib module 'Synchronize composer.json With Contrib Modules' allows a remote attacker to read limited sensitive data from any Drupal site where this module is installed and enabled (CVSS 3.1 base 5.3, AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). Only the confidentiality of the site is affected - there is no integrity or availability impact, no privilege escalation, and no user interaction required; the module is niche developer tooling rather than Drupal core, so the vast majority of Drupal installations are unaffected. There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV), and EPSS rates the likelihood of exploitation in the next 30 days at 0.25% (15th percentile), consistent with a low-priority reconnaissance-grade leak rather than an urgent, wormable issue.
Cross-site scripting in the Drupal Facets contributed module allows unauthenticated remote attackers to inject script into faceted-search output on sites running Facets before 2.0.10 (0.x/2.x branches) or before 3.0.1 (3.x branch). Exploitation is not automatic: it requires a victim to interact with attacker-supplied content - for instance clicking a crafted link or loading a page containing injected facet markup - after which script runs in the victim's browser context and can read or alter limited page data. There is no confirmed active exploitation (CISA KEV does not list this issue), no public exploit code identified at time of analysis, and EPSS is very low at 0.19% (8th percentile), consistent with a moderate-severity (CVSS 6.1) issue of low urgency rather than an emergency patch item.
Missing authorization in the Drupal Facets contributed module lets unauthenticated remote attackers bypass access controls and directly request facet endpoints to view content that was intended to be restricted (forceful browsing). All Facets releases before 2.0.10 and 3.0.x releases before 3.0.1 are affected, and the impact is limited to the information those exposed facets reveal rather than full data or system compromise. A vendor patch is available (2.0.10 / 3.0.1), EPSS is low at 0.20% (9th percentile), and no public exploit has been identified at time of analysis.
Second-factor authentication bypass in the Drupal Authenticator Login contrib module (versions before 2.1.8) allows an attacker who already possesses valid primary credentials for a target account to reach authenticated access without completing the module's two-factor challenge. The issue is rated CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), so it is remotely reachable with low privileges and no user interaction, but impact is bounded to accounts whose first-factor credentials the attacker can already supply, and only sites with this specific contrib module installed and enabled are exposed. No public exploit code has been identified at time of analysis, EPSS is low at 0.35% (26th percentile), and the vendor has released a fix, making this a mid-tier operational priority rather than an emergency.
Missing Authorization vulnerability in Drupal Layout Builder Advanced Permissions allows Forceful Browsing.0.0 before 2.2.0. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Authenticator Login allows Authentication Bypass.0.0 before 2.1.4. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Server-Side Request Forgery (SSRF) vulnerability in Drupal AI SEO Link Advisor allows Server Side Request Forgery.0.0 before 1.0.6. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal GoogleTag Manager allows Cross-Site Scripting (XSS).0.0 before 1.10.0. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal COOKiES Consent Management allows Cross-Site Scripting (XSS).0.0 before 1.2.16. Rated high severity (CVSS 7.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Missing Authentication for Critical Function vulnerability in Drupal Config Pages Viewer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Config Pages Viewer: from 0.0.0 before 1.0.4.
CVE-2025-7030 is a security vulnerability (CVSS 6.5). Remediation should follow standard vulnerability management procedures.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Paragraphs table allows Cross-Site Scripting (XSS).This issue affects Paragraphs table: from 2.0.0 before 2.0.5.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Simple XML sitemap allows Cross-Site Scripting (XSS).This issue affects Simple XML sitemap: from 0.0.0 before 4.2.2.
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Enterprise MFA - TFA for Drupal allows Authentication Bypass.This issue affects Enterprise MFA - TFA for Drupal: from 0.0.0 before 4.8.0, from 5.2.0 before 5.2.1, from 0.0.0 before 5.0.*, from 0.0.0 before 5.1.*.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal CKEditor5 Youtube allows Cross-Site Scripting (XSS).This issue affects CKEditor5 Youtube: from 0.0.0 before 1.0.3.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Klaro Cookie & Consent Management allows Cross-Site Scripting (XSS).This issue affects Klaro Cookie & Consent Management: from 0.0.0 before 3.0.7.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Toc.Js allows Cross-Site Scripting (XSS).This issue affects Toc.Js: from 0.0.0 before 3.2.1.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal GLightbox allows Cross-Site Scripting (XSS).This issue affects GLightbox: from 0.0.0 before 1.0.16.
Cross-Site Request Forgery (CSRF) vulnerability in Drupal Open Social allows Cross Site Request Forgery.This issue affects Open Social: from 0.0.0 before 12.3.14, from 12.4.0 before 12.4.13.
Stored/Reflected Cross-Site Scripting (XSS) vulnerability in the Drupal etracker module that allows unauthenticated remote attackers to inject malicious scripts into web pages without requiring user interaction. The vulnerability affects etracker versions prior to 3.1.0, enabling attackers to steal session tokens, perform unauthorized actions, or redirect users to malicious sites. The CVSS 7.3 score and network-accessible attack vector indicate this is a significant vulnerability affecting any Drupal installation with the vulnerable etracker module enabled.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Simple Klaro allows Cross-Site Scripting (XSS).This issue affects Simple Klaro: from 0.0.0 before 1.10.0.
Stored/Reflected Cross-Site Scripting (XSS) vulnerability in Drupal Simple Klaro module versions before 1.10.0 that fails to properly neutralize user input during web page generation. An unauthenticated remote attacker can inject malicious scripts that execute in victims' browsers with high impact on confidentiality and integrity, though the attack requires user interaction (clicking a malicious link). The vulnerability has a high CVSS score of 8.8 due to its network-based attack vector and broad scope, but real-world exploitation likelihood depends on KEV/EPSS data not provided in available intelligence.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal EU Cookie Compliance (GDPR Compliance) allows Cross-Site Scripting (XSS).This issue affects EU Cookie Compliance (GDPR Compliance): from 0.0.0 before 1.26.0.
Missing Authorization vulnerability in Drupal Bookable Calendar allows Forceful Browsing.This issue affects Bookable Calendar: from 0.0.0 before 2.2.13.
Cross-Site Scripting (XSS) vulnerability in Drupal's COOKiES Consent Management module that allows unauthenticated remote attackers to inject and execute malicious scripts during web page generation. All versions from 0.0.0 before 1.2.15 are affected. The vulnerability has a high CVSS score of 8.6 with no authentication or user interaction required, enabling attackers to compromise confidentiality, modify page content, and degrade availability. The network-based attack vector and low complexity indicate this is likely actively exploitable in real-world deployments.
Stored/Reflected Cross-Site Scripting (XSS) vulnerability in Drupal's COOKiES Consent Management module (versions before 1.2.15) that allows unauthenticated attackers to inject malicious scripts into web pages due to improper input neutralization. The vulnerability has a CVSS score of 8.6 (High severity) with network-based attack vector requiring no privileges or user interaction, enabling attackers to compromise confidentiality, integrity, and availability of affected sites. No active KEV or widespread public PoC data is available in standard vulnerability databases, suggesting limited real-world exploitation at time of analysis, though the high CVSS and ease of exploitation (AV:N/AC:L/PR:N/UI:N) warrant immediate patching.
Allocation of Resources Without Limits or Throttling vulnerability in Drupal Admin Audit Trail allows Excessive Allocation.This issue affects Admin Audit Trail: from 0.0.0 before 1.0.5.
A cross-site scripting vulnerability (CVSS 7.1). High severity vulnerability requiring prompt remediation.
CVE-2025-48446 is an Incorrect Authorization vulnerability (CWE-863) in the Drupal Commerce Alphabank Redirect module that allows unauthenticated attackers to misuse functionality through a network-based attack requiring user interaction. The vulnerability affects Commerce Alphabank Redirect versions prior to 1.0.3, with a CVSS score of 8.8 indicating high severity across confidentiality, integrity, and availability impacts. No public indicators of active exploitation or proof-of-concept code are currently documented, but the high CVSS score and authorization bypass nature warrant immediate patching.
CVE-2025-48445 is an Incorrect Authorization vulnerability (CWE-863) in Drupal Commerce Eurobank (Redirect) payment module versions before 2.1.1 that allows unauthenticated attackers to misuse functionality through a network-based attack requiring user interaction. With a CVSS score of 8.8 and high impact across confidentiality, integrity, and availability, this vulnerability affects payment processing workflows in Drupal e-commerce installations. The vulnerability requires user interaction (UI:R) but no authentication (PR:N), making it exploitable by attackers who can socially engineer victims or intercept redirect flows in payment processing.
Missing Authorization vulnerability in Drupal Quick Node Block allows Forceful Browsing.This issue affects Quick Node Block: from 0.0.0 before 2.0.0.
Missing Authorization vulnerability in Drupal Quick Node Block allows Forceful Browsing.This issue affects Quick Node Block: from 0.0.0 before 2.0.0.
Allocation of Resources Without Limits or Throttling vulnerability in Drupal Events Log Track allows Excessive Allocation.0.0 before 3.1.11, from 4.0.0 before 4.0.2. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Piwik PRO allows Cross-Site Scripting (XSS).0.0 before 1.3.2. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Authentication Bypass by Capture-replay vulnerability in Drupal One Time Password allows Remote Services with Stolen Credentials.0.0 before 1.3.0. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal One Time Password allows Functionality Bypass.0.0 before 1.3.0. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal One Time Password allows Functionality Bypass.0.0 before 1.3.0. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Missing Authorization vulnerability in Drupal Single Content Sync allows Functionality Misuse.0.0 before 1.4.12. Rated low severity (CVSS 3.1), this vulnerability is remotely exploitable. No vendor patch available.
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Enterprise MFA - TFA for Drupal allows Authentication Bypass.0.0 before 4.7.0, from 5.0.0 before 5.2.0. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Missing Authorization vulnerability in Drupal Enterprise MFA - TFA for Drupal allows Forceful Browsing.0.0 before 4.7.0, from 5.0.0 before 5.2.0. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Cross-Site Request Forgery (CSRF) vulnerability in Drupal Enterprise MFA - TFA for Drupal allows Cross Site Request Forgery.0.0 before 4.7.0, from 5.0.0 before 5.2.0. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Enterprise MFA - TFA for Drupal allows Authentication Bypass.0.0 before 4.7.0, from 5.0.0 before 5.2.0. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Authentication Bypass by Capture-replay vulnerability in Drupal Enterprise MFA - TFA for Drupal allows Remote Services with Stolen Credentials.0.0 before 4.7.0, from 5.0.0 before 5.2.0. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal IFrame Remove Filter allows Cross-Site Scripting (XSS).0.0 before 2.0.5, from 7.X-1.0. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Klaro Cookie & Consent Management allows Cross-Site Scripting (XSS).0.0 before 3.0.5. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal COOKiES Consent Management allows Cross-Site Scripting (XSS).0.0 before 1.2.14. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal oEmbed Providers allows Cross-Site Scripting (XSS).0.0 before 2.2.2. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Cross-Site Request Forgery (CSRF) vulnerability in Drupal Restrict route by IP allows Cross Site Request Forgery.0.0 before 1.3.0. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Cross-Site Request Forgery (CSRF) vulnerability in Drupal Search API Solr allows Cross Site Request Forgery.0.0 before 4.3.9. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Vulnerability in Drupal Sportsleague.*. Rated high severity (CVSS 7.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Block Class allows Cross-Site Scripting (XSS).0.0 before 4.0.1. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Bootstrap Site Alert allows Cross-Site Scripting (XSS).0.0 before 1.13.0, from 3.0.0. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Colorbox allows Cross-Site Scripting (XSS).0.0 before 2.1.3. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Vulnerability in Drupal Drupal 8 Google Optimize Hide Page.*. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable. No vendor patch available.
Vulnerability in Drupal Google Optimize.*. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable. No vendor patch available.
Vulnerability in Drupal Google Maps: Store Locator.*. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable. No vendor patch available.
Vulnerability in Drupal Simple GTM.*. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable. No vendor patch available.
Vulnerability in Drupal Panelizer (obsolete).*. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable. No vendor patch available.