Medium WID-SEC-2026-1882 5 CVEs

Drupal: Mehrere Schwachstellen

Published Jun 10, 2026 · Updated Jul 12, 2026 · Revision 2 · de-DE

Platform: Windows

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Drupal ausnutzen, um einen Cross Site Scripting Angriff durchzuführen, Sicherheitsmaßnahmen zu umgehen und weitere, nicht spezifizierte Auswirkungen zu verursachen.

Product

Drupal ist ein freies Content-Management-System, basierend auf der Scriptsprache PHP und einer SQL-Datenbank. Über zahlreiche Extensions kann der Funktionsumfang der Core-Installation individuell erweitert werden.

Vulnerabilities 5

Critical 9.8

CVE-2026-11913

Mother May I - Critical - Unsupported - SA-CONTRIB-2026-045

vulnerability in Drupal Mother May I allows . This issue affects Mother May I versions: *.*.

Drupal Mother May I drupal/mothermayi Packagist

Jul 10, 2026
Medium 5.9

CVE-2026-11914

Composer - Critical - Unsupported - SA-CONTRIB-2026-046

vulnerability in Drupal Composer allows . This issue affects Composer versions: *.*.

Drupal Composer drupal/composer Packagist

Jul 10, 2026
Medium 5.9

CVE-2026-11915

Brute force attack protection - Critical - Unsupported - SA-CONTRIB-2026-047

vulnerability in Drupal Brute force attack protection allows . This issue affects Brute force attack protection versions: *.*.

Drupal Brute force attack protection drupal/bfap_sb Packagist

Jul 10, 2026
Medium 5.4

CVE-2026-11908

Tagify - Moderately critical - Cross-site scripting (XSS) - SA-CONTRIB-2026-043

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Tagify allows Stored XSS. This issue affects Tagify versions: from 0.0.0 to 1.2.52.

Drupal Tagify drupal/tagify Packagist

Jul 10, 2026
Low 3.3

CVE-2026-11909

Examples for Developers - Moderately critical - Access bypass - SA-CONTRIB-2026-044

Missing Authorization vulnerability in Drupal Examples for Developers allows Forceful Browsing. This issue affects Examples for Developers versions: from 0.0.0 to 4.0.6.

Drupal Examples for Developers drupal/examples Packagist

Jul 10, 2026

Revision history

2026-07-12 #2
Referenz(en) aufgenommen: EUVD-2026-43050, EUVD-2026-43049, EUVD-2026-43091, EUVD-2026-43092, EUVD-2026-43093
2026-06-10 #1
Initiale Fassung

References

Drupal Security Advisory sa-contrib-2026-043 vom 2026-06-10
https://www.drupal.org/sa-contrib-2026-043
Drupal Security Advisory sa-contrib-2026-044 vom 2026-06-10
https://www.drupal.org/sa-contrib-2026-044
Drupal Security Advisory sa-contrib-2026-045 vom 2026-06-10
https://www.drupal.org/sa-contrib-2026-045
Drupal Security Advisory sa-contrib-2026-046 vom 2026-06-10
https://www.drupal.org/sa-contrib-2026-046
Drupal Security Advisory sa-contrib-2026-047 vom 2026-06-10
https://www.drupal.org/sa-contrib-2026-047