Skip to content
OpenAdvisories
High WID-SEC-2025-2126 6 CVEs

Drupal Module: Mehrere Schwachstellen

Published Sep 24, 2025 · Updated Oct 29, 2025 · Revision 2 · de-DE

Platform: Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in Drupal Module ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen, um Sicherheitsvorkehrungen zu umgehen, und um falsche Informationen darzustellen.

Product

Drupal ist ein freies Content-Management-System, basierend auf der Scriptsprache PHP und einer SQL-Datenbank. Über zahlreiche Extensions kann der Funktionsumfang der Core-Installation individuell erweitert werden.

Vulnerabilities 6

  • Medium 6.5
    CVE-2025-10930

    Currency - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-110

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal Currency allows Cross Site Request Forgery.This issue affects Currency: from 0.0.0 before 3.5.0.

    Drupal Currency drupal/currency Packagist
  • Medium 6.3
    CVE-2025-10928

    Access code - Moderately critical - Access bypass - SA-CONTRIB-2025-108

    Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Access code allows Brute Force.This issue affects Access code: from 0.0.0 before 2.0.5.

    Drupal Access code drupal/access_code Packagist
  • Medium 6.1
    CVE-2025-10926

    JSON Field - Critical - Cross Site Scripting - SA-CONTRIB-2025-106

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal JSON Field allows Cross-Site Scripting (XSS).This issue affects JSON Field: from 0.0.0 before 1.5.

    Drupal JSON Field drupal/json_field Packagist
  • Medium 6.1
    CVE-2025-10927

    Plausible tracking - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-107

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Plausible tracking allows Cross-Site Scripting (XSS).This issue affects Plausible tracking: from 0.0.0 before 1.0.2.

    Drupal Plausible tracking drupal/plausible_tracking Packagist
  • Medium 5.3
    CVE-2025-10929

    Reverse Proxy Header - Less critical - Access bypass - SA-CONTRIB-2025-111

    Improper Validation of Consistency within Input vulnerability in Drupal Reverse Proxy Header allows Manipulating User-Controlled Variables.This issue affects Reverse Proxy Header: from 0.0.0 before 1.1.2.

    Drupal Reverse Proxy Header drupal/reverse_proxy_header Packagist
  • Low 3.8
    CVE-2025-10931

    Umami Analytics - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-109

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Umami Analytics allows Cross-Site Scripting (XSS).This issue affects Umami Analytics: from 0.0.0 before 1.0.1.

    Drupal Umami Analytics drupal/umami_analytics Packagist

Revision history

  1. #2

    Referenz(en) aufgenommen: EUVD-2025-36875, EUVD-2025-36879, EUVD-2025-36878, EUVD-2025-36877, EUVD-2025-36880, EUVD-2025-36876

  2. #1

    Initiale Fassung

References