Skip to content
OpenAdvisories
Medium WID-SEC-2025-2733 8 CVEs

Drupal-Module: Mehrere Schwachstellen

Published Dec 3, 2025 · Updated Jan 28, 2026 · Revision 2 · de-DE

Platform: Windows

Summary

Ein entfernter, authentisierter oder anonymer Angreifer kann mehrere Schwachstellen in Drupal ausnutzen, um Cross-Site-Scripting-Angriffe zu starten, Sicherheitsmaßnahmen zu umgehen und vertrauliche Informationen offenzulegen.

Product

Drupal ist ein freies Content-Management-System, basierend auf der Scriptsprache PHP und einer SQL-Datenbank. Über zahlreiche Extensions kann der Funktionsumfang der Core-Installation individuell erweitert werden.

Vulnerabilities 8

  • High 8.1
    CVE-2025-13982

    Login Time Restriction - Moderately critical - Cross-Site Request Forgery - SA-CONTRIB-2025-120

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal Login Time Restriction allows Cross Site Request Forgery.This issue affects Login Time Restriction: from 0.0.0 before 1.0.3.

    Drupal Login Time Restriction drupal/login_time_restriction Packagist
  • Medium 6.1
    CVE-2025-13984

    Next.js - Critical - Access bypass - SA-CONTRIB-2025-122

    Permissive Cross-domain Security Policy with Untrusted Domains vulnerability in Drupal Next.Js allows Cross-Site Scripting (XSS).This issue affects Next.Js: from 0.0.0 before 1.6.4, from 2.0.0 before 2.0.1.

    Drupal Next.js drupal/next Packagist
  • Medium 5.4
    CVE-2025-13979

    Mini site - Moderately critical - Cross-Site Scripting - SA-CONTRIB-2025-117

    Privilege Defined With Unsafe Actions vulnerability in Drupal Mini site allows Stored XSS.This issue affects Mini site: from 0.0.0 before 3.0.2.

    Drupal Mini site drupal/minisite Packagist
  • Medium 5.4
    CVE-2025-13983

    Tagify - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-121

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Tagify allows Cross-Site Scripting (XSS).This issue affects Tagify: from 0.0.0 before 1.2.44.

    Drupal Tagify drupal/tagify Packagist
  • Medium 5.3
    CVE-2025-13980

    CKEditor 5 Premium Features - Moderately critical - Access bypass - SA-CONTRIB-2025-118

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal CKEditor 5 Premium Features allows Functionality Bypass.This issue affects CKEditor 5 Premium Features: from 0.0.0 before 1.2.10, from 1.3.0 before 1.3.6, from 1.4.0 before 1.4.3…

    Drupal CKEditor 5 Premium Features drupal/ckeditor5_premium_features Packagist
  • Medium 5.3
    CVE-2025-13985

    Entity Share - Moderately critical - Access bypass, Information Disclosure - SA-CONTRIB-2025-123

    Incorrect Authorization vulnerability in Drupal Entity Share allows Forceful Browsing.This issue affects Entity Share: from 0.0.0 before 3.13.0.

    Drupal Entity Share drupal/entity_share Packagist
  • Medium 4.4
    CVE-2025-13981

    AI (Artificial Intelligence) - Moderately critical - Cross-Site Scripting - SA-CONTRIB-2025-119

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Cross-Site Scripting (XSS).This issue affects AI (Artificial Intelligence): from 0.0.0 before 1.0.7, from 1.1.0 be…

    Drupal AI (Artificial Intelligence) drupal/ai Packagist
  • Medium 4.2
    CVE-2025-13986

    Disable Login Page - Critical - Access bypass - SA-CONTRIB-2025-124

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Disable Login Page allows Functionality Bypass.This issue affects Disable Login Page: from 0.0.0 before 1.1.3.

    Drupal Disable Login Page drupal/disable_login Packagist

Revision history

  1. #2

    Referenz(en) aufgenommen: EUVD-2025-206436, EUVD-2025-206437, EUVD-2025-206438, EUVD-2025-206439, EUVD-2025-206440, EUVD-2025-206441, EUVD-2025-206442, EUVD-2025-206435

  2. #1

    Initiale Fassung

References