Skip to content
OpenAdvisories
Medium WID-SEC-2025-1404 8 CVEs

Drupal Module: Mehrere Schwachstellen

Published Jun 25, 2025 · Updated Jun 25, 2025 · de-DE

Platform: Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in Drupal ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen, und um Sicherheitsvorkehrungen zu umgehen.

Product

Drupal ist ein freies Content-Management-System, basierend auf der Scriptsprache PHP und einer SQL-Datenbank. Über zahlreiche Extensions kann der Funktionsumfang der Core-Installation individuell erweitert werden.

Vulnerabilities 8

  • High 8.8
    CVE-2025-48921

    Open Social - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-079

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal Open Social allows Cross Site Request Forgery.This issue affects Open Social: from 0.0.0 before 12.3.14, from 12.4.0 before 12.4.13.

    Drupal Open Social
  • Medium 6.1
    CVE-2025-48922

    GLightbox - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-078

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal GLightbox allows Cross-Site Scripting (XSS).This issue affects GLightbox: from 0.0.0 before 1.0.16.

    Drupal GLightbox drupal/glightbox Packagist
  • Medium 6.1
    CVE-2025-48923

    Toc.js - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-077

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Toc.Js allows Cross-Site Scripting (XSS).This issue affects Toc.Js: from 0.0.0 before 3.2.1.

    Drupal Toc.js drupal/toc_js Packagist
  • Medium 6.1
    CVE-2025-6674

    CKEditor5 Youtube - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-081

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal CKEditor5 Youtube allows Cross-Site Scripting (XSS).This issue affects CKEditor5 Youtube: from 0.0.0 before 1.0.3.

    Drupal CKEditor5 Youtube drupal/ckeditor5_youtube Packagist
  • Medium 5.4
    CVE-2025-6676

    Simple XML sitemap - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-083

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Simple XML sitemap allows Cross-Site Scripting (XSS).This issue affects Simple XML sitemap: from 0.0.0 before 4.2.2.

    Drupal Simple XML sitemap drupal/simple_sitemap Packagist
  • Medium 5.4
    CVE-2025-6677

    Paragraphs table - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-084

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Paragraphs table allows Cross-Site Scripting (XSS).This issue affects Paragraphs table: from 2.0.0 before 2.0.5.

    Drupal Paragraphs table drupal/paragraphs_table Packagist
  • Medium 4.8
    CVE-2025-6675

    Enterprise MFA - TFA for Drupal - Critical - Access bypass - SA-CONTRIB-2025-082

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Enterprise MFA - TFA for Drupal allows Authentication Bypass.This issue affects Enterprise MFA - TFA for Drupal: from 0.0.0 before 4.8.0, from 5.2.0 before 5.2.1, from 0.0.0 befo…

    Drupal Enterprise MFA - TFA for Drupal drupal/miniorange_2fa Web / CMS Packagist
  • Medium 4.3
    CVE-2025-5682

    Klaro Cookie & Consent Management - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-080

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Klaro Cookie & Consent Management allows Cross-Site Scripting (XSS).This issue affects Klaro Cookie & Consent Management: from 0.0.0 before 3.0.7.

    Drupal Klaro Cookie & Consent Management drupal/klaro Packagist

Revision history

  1. #1

    Initiale Fassung

References