Skip to content
OpenAdvisories
Medium WID-SEC-2026-2080 14 CVEs

Drupal: Mehrere Schwachstellen

Published Jun 24, 2026 · Updated Jul 12, 2026 · Revision 2 · de-DE

Platform: Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in Drupal ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um einen Cross-Site Scripting Angriff durchzuführen, um Informationen offenzulegen, um einen SQL-Injection Angriff durchzuführen, und um Daten zu manipulieren.

Product

Drupal ist ein freies Content-Management-System, basierend auf der Scriptsprache PHP und einer SQL-Datenbank. Über zahlreiche Extensions kann der Funktionsumfang der Core-Installation individuell erweitert werden.

Vulnerabilities 14

  • High 8.1
    CVE-2026-13244

    Tealium iQ Tag Management - Critical - PHP object injection - SA-CONTRIB-2026-064

    Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Tealium iQ Tag Management allows Object Injection. This issue affects Tealium iQ Tag Management versions: from 0.0.0 to 2.4.0.

    Drupal Tealium iQ Tag Management drupal/tealiumiq Packagist
  • Medium 6.5
    CVE-2026-13239

    WissKI - Critical - Access bypass - SA-CONTRIB-2026-059

    Missing Authorization vulnerability in Drupal WissKI allows Forceful Browsing. This issue affects WissKI versions: from 0.0.0 to 4.2.0.

    Drupal WissKI drupal/wisski Packagist
  • Medium 6.5
    CVE-2026-13240

    Paragraphs - Less critical - Access bypass - SA-CONTRIB-2026-060

    Missing Authorization vulnerability in Drupal Paragraphs allows Forceful Browsing. This issue affects Paragraphs versions: from 0.0.0 to 1.21.0.

    Drupal Paragraphs drupal/paragraphs Packagist
  • Medium 6.5
    CVE-2026-13241

    Paragraphs - Moderately critical - Access bypass - SA-CONTRIB-2026-061

    Missing Authorization vulnerability in Drupal Paragraphs allows Forceful Browsing. This issue affects Paragraphs versions: from 0.0.0 to 1.21.0.

    Drupal Paragraphs drupal/paragraphs Packagist
  • Medium 6.5
    CVE-2026-13242

    Geolocation Field - Critical - SQL Injection - SA-CONTRIB-2026-062

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Geolocation Field allows SQL Injection. This issue affects Geolocation Field versions: from 0.0.0 to 3.15.0.

    Drupal Geolocation Field drupal/geolocation Packagist
  • Medium 6.1
    CVE-2026-13231

    Advanced Content Feedback (aka admin_feedback) - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-051

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Advanced Content Feedback (aka admin_feedback) allows Stored XSS. This issue affects Advanced Content Feedback (aka admin_feedback) versions: from 0.0…

    Drupal Advanced Content Feedback (aka admin_feedback) drupal/admin_feedback Packagist
  • Medium 6.1
    CVE-2026-13234

    AI (Artificial Intelligence) - Moderately critical - Information Disclosure / Cross-site Scripting - SA-CONTRIB-2026-054

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Cross-Site Scripting (XSS). This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.2.17, from 1…

    Drupal AI (Artificial Intelligence) drupal/ai Packagist
  • Medium 4.8
    CVE-2026-13237

    AI Agents - Moderately critical - Information disclosure, Access bypass - SA-CONTRIB-2026-057

    Incorrect Authorization vulnerability in Drupal AI Agents allows Forceful Browsing. This issue affects AI Agents versions: from 0.0.0 to 1.1.4, from 1.2.0 to 1.2.5, from 1.3.0 to 1.3.1.

    Drupal AI Agents drupal/ai_agents Packagist
  • Medium 4.8
    CVE-2026-13238

    Commerce Realex / Global Payments - Moderately critical - Access Bypass - SA-CONTRIB-2026-058

    Incorrect Authorization vulnerability in Drupal Commerce Realex / Global Payments allows Forceful Browsing. This issue affects Commerce Realex / Global Payments versions: from 0.0.0 to 3.0.2.

    Drupal Commerce Realex / Global Payments drupal/commerce_realex Packagist
  • Medium 4.8
    CVE-2026-13243

    Salesforce Suite - Moderately critical - Cross-site request forgery - SA-CONTRIB-2026-063

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal Salesforce Suite allows Cross Site Request Forgery. This issue affects Salesforce Suite versions: from 0.0.0 to 5.1.3.

    Drupal Salesforce Suite drupal/salesforce Packagist
  • Medium 4.2
    CVE-2026-13236

    AI Agents - Less critical - Access bypass - SA-CONTRIB-2026-056

    Missing Authorization vulnerability in Drupal AI Agents allows Forceful Browsing. This issue affects AI Agents versions: from 0.0.0 to 1.1.4, from 1.2.0 to 1.2.5, from 1.3.0 to 1.3.1.

    Drupal AI Agents drupal/ai_agents Packagist
  • Low 3.3
    CVE-2026-13233 Public exploit

    OpenAI Provider - Moderately critical - Server-side Request Forgery - SA-CONTRIB-2026-053

    Server-Side Request Forgery (SSRF) vulnerability in Drupal OpenAI Provider allows Server Side Request Forgery. This issue affects OpenAI Provider versions: from 0.0.0 to 1.1.1, from 1.2.0 to 1.2.2.

    Drupal OpenAI Provider drupal/ai_provider_openai Packagist
  • Low 3.3
    CVE-2026-13235

    AI (Artificial Intelligence) - Moderately critical - Access bypass - SA-CONTRIB-2026-055

    Missing Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Forceful Browsing. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.2.17, from 1.3.0 to 1.3.8, from 1.4.0 to 1.4.3.

    Drupal AI (Artificial Intelligence) drupal/ai Packagist
  • Low 3.1
    CVE-2026-13232

    Advanced Content Feedback (aka admin_feedback) - Moderately critical - Access bypass / Insecure Direct Object Reference (IDOR) - SA-CONTRIB-2026-052

    Incorrect Authorization vulnerability in Drupal Advanced Content Feedback (aka admin_feedback) allows Forceful Browsing. This issue affects Advanced Content Feedback (aka admin_feedback) versions: from 0.0.0 to 2.8.0.

    Drupal Advanced Content Feedback (aka admin_feedback) drupal/admin_feedback Packagist

Revision history

  1. #2

    Referenz(en) aufgenommen: EUVD-2026-43068, EUVD-2026-43066, EUVD-2026-43064, EUVD-2026-43065, EUVD-2026-43063, EUVD-2026-43062, EUVD-2026-43061, EUVD-2026-43060, EUVD-2026-43059, EUVD-2026-43058, EUVD-2026-43056, EUVD-2026-43055, EUVD-2026-43067, EUVD-2026-43057

  2. #1

    Initiale Fassung

References