Skip to content
OpenAdvisories
Medium WID-SEC-2025-1172 7 CVEs

Drupal: Mehrere Schwachstellen

Published May 29, 2025 · Updated May 29, 2025 · de-DE

Platform: Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in Drupal ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen oder Sicherheitsvorkehrungen zu umgehen.

Product

Drupal ist ein freies Content-Management-System, basierend auf der Scriptsprache PHP und einer SQL-Datenbank. Über zahlreiche Extensions kann der Funktionsumfang der Core-Installation individuell erweitert werden.

Vulnerabilities 7

  • High 8.8
    CVE-2025-48918

    Simple Klaro - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-071

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Simple Klaro allows Cross-Site Scripting (XSS).This issue affects Simple Klaro: from 0.0.0 before 1.10.0.

    Drupal Simple Klaro drupal/simple_klaro Packagist
  • High 8.6
    CVE-2025-48914

    COOKiES Consent Management - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-075

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal COOKiES Consent Management allows Cross-Site Scripting (XSS).This issue affects COOKiES Consent Management: from 0.0.0 before 1.2.15.

    Drupal COOKiES Consent Management drupal/cookies Packagist
  • High 8.6
    CVE-2025-48915

    COOKiES Consent Management - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-076

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal COOKiES Consent Management allows Cross-Site Scripting (XSS).This issue affects COOKiES Consent Management: from 0.0.0 before 1.2.15.

    Drupal COOKiES Consent Management drupal/cookies Packagist
  • High 7.3
    CVE-2025-48920

    etracker - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-074

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal etracker allows Cross-Site Scripting (XSS).This issue affects etracker: from 0.0.0 before 3.1.0.

    Drupal etracker drupal/etracker Packagist
  • Medium 6.5
    CVE-2025-48916

    Bookable Calendar - Less critical - Access bypass - SA-CONTRIB-2025-070

    Missing Authorization vulnerability in Drupal Bookable Calendar allows Forceful Browsing.This issue affects Bookable Calendar: from 0.0.0 before 2.2.13.

    Drupal Bookable Calendar drupal/bookable_calendar Packagist
  • Medium 5.0
    CVE-2025-48917

    EU Cookie Compliance (GDPR Compliance) - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-072

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal EU Cookie Compliance (GDPR Compliance) allows Cross-Site Scripting (XSS).This issue affects EU Cookie Compliance (GDPR Compliance): from 0.0.0 before …

    Drupal EU Cookie Compliance (GDPR Compliance) drupal/eu_cookie_compliance Packagist
  • Medium 5.0
    CVE-2025-48919

    Simple Klaro - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-073

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Simple Klaro allows Cross-Site Scripting (XSS).This issue affects Simple Klaro: from 0.0.0 before 1.10.0.

    Drupal Simple Klaro drupal/simple_klaro Packagist

Revision history

  1. #1

    Initiale Fassung

References