Skip to content
OpenAdvisories
High WID-SEC-2026-2251 10 CVEs

Drupal Module: Mehrere Schwachstellen

Published Jul 8, 2026 · Updated Jul 22, 2026 · Revision 3 · de-DE

Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in Drupal ausnutzen, umSQL-Injection-Angriffe durchzuführen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen und Cross-Site-Scripting-Angriffe durchzuführen.

Product

Drupal ist ein freies Content-Management-System, basierend auf der Scriptsprache PHP und einer SQL-Datenbank. Über zahlreiche Extensions kann der Funktionsumfang der Core-Installation individuell erweitert werden.

Vulnerabilities 10

  • Critical 9.1
    CVE-2026-15089

    Commerce guest registration - Critical - Unsupported - SA-CONTRIB-2026-079

    Vulnerability in Drupal Commerce guest registration. This issue affects Commerce guest registration versions: *.*.

    Drupal Commerce guest registration drupal/commerce_guest_registration Packagist
  • High 7.4
    CVE-2026-15081

    Location Selector - Critical - SQL Injection - SA-CONTRIB-2026-072

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Location Selector allows SQL Injection. This issue affects Location Selector versions: from 0.0.0 to 1.3.0.

    Drupal Location Selector drupal/location_selector Packagist
  • Medium 5.9
    CVE-2026-15086

    Raw Formatter [Meta Tag Formatter] - Critical - Unsupported - SA-CONTRIB-2026-077

    vulnerability in Drupal Raw Formatter [Meta Tag Formatter] allows . This issue affects Raw Formatter [Meta Tag Formatter] versions: *.*.

    Drupal Raw Formatter [Meta Tag Formatter] drupal/raw_formatter Packagist
  • Medium 5.9
    CVE-2026-15087

    Clean RESTful - Critical - Unsupported - SA-CONTRIB-2026-078

    vulnerability in Drupal Clean RESTful allows . This issue affects Clean RESTful versions: *.*.

    Drupal Clean RESTful drupal/clean_node_api Packagist
  • Medium 5.4
    CVE-2026-15079

    Login Disable - Moderately critical - Access bypass - SA-CONTRIB-2026-070

    Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Login Disable allows Brute Force. This issue affects Login Disable versions: from 0.0.0 to 2.1.4.

    Drupal Login Disable drupal/login_disable Packagist
  • Medium 5.4
    CVE-2026-15082

    Siteimprove Analytics - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-073

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Siteimprove Analytics allows Cross-Site Scripting (XSS). This issue affects Siteimprove Analytics versions: from 0.0.0 to 2.0.1.

    Drupal Siteimprove Analytics drupal/siteimprove_analytics Packagist
  • Medium 5.4
    CVE-2026-15084

    UI Patterns (SDC in Drupal UI) - Moderately critical - Cross site scripting - SA-CONTRIB-2026-075

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal UI Patterns (SDC in Drupal UI) allows Stored XSS. This issue affects UI Patterns (SDC in Drupal UI) versions: from 2.0.0 to 2.0.17.

    Drupal UI Patterns (SDC in Drupal UI) drupal/ui_patterns Web / CMS Packagist
  • Medium 5.4
    CVE-2026-15085

    AI SEO/GEO Analyzer - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-076

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI SEO/GEO Analyzer allows Stored XSS. This issue affects AI SEO/GEO Analyzer versions: from 0.0.0 to 1.1.3.

    Drupal AI SEO/GEO Analyzer drupal/ai_seo Packagist
  • Medium 4.3
    CVE-2026-15080

    Ray Enterprise Translation - Moderately critical - Cross site request forgery - SA-CONTRIB-2026-071

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal Ray Enterprise Translation allows Cross Site Request Forgery. This issue affects Ray Enterprise Translation versions: from 0.0.0 to 4.0.4, from 4.1.0 to 4.1.4, from 11.0.0 to 11.0.4.

    Drupal Ray Enterprise Translation drupal/lingotek Packagist
  • Medium 4.2
    CVE-2026-15083

    ECA: Event - Condition - Action - Less critical - Information disclosure - SA-CONTRIB-2026-074

    Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal ECA: Event - Condition - Action allows Object Injection. This issue affects ECA: Event - Condition - Action versions: from 0.0.0 to 2.1.20, from 3.0.0 to 3.…

    Drupal ECA: Event - Condition - Action drupal/eca Packagist

Revision history

  1. #3

    Schreibfehler korrigiert

  2. #2

    Referenz(en) aufgenommen: EUVD-2026-43076, EUVD-2026-43075, EUVD-2026-43074, EUVD-2026-43080, EUVD-2026-43079, EUVD-2026-43078, EUVD-2026-43077, EUVD-2026-43089, EUVD-2026-43090, EUVD-2026-43088, GHSA-XG2F-C7H9-QW99

  3. #1

    Initiale Fassung

References