Skip to content
OpenAdvisories
High WID-SEC-2026-3041 14 CVEs

Drupal Extensions: Mehrere Schwachstellen

Published Aug 26, 2026 · Updated Sep 2, 2026 · Revision 2 · de-DE

Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in verschiedenen Drupal Erweiterungen ausnutzen, um Sicherheitsmaßnahmen zu umgehen, sensible Informationen offenzulegen, Daten zu manipulieren und Cross-Site-Scripting-Angriffe durchzuführen.

Product

Drupal ist ein freies Content-Management-System, basierend auf der Scriptsprache PHP und einer SQL-Datenbank. Über zahlreiche Extensions kann der Funktionsumfang der Core-Installation individuell erweitert werden.

Vulnerabilities 14

  • Medium 6.1
    CVE-2026-81160

    Slick Carousel - Moderately critical - Cross Site Scripting - SA-CONTRIB-2026-117

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Slick Carousel allows Stored XSS. This issue affects Slick Carousel versions: from 0.0.0 to 2.1.0.

    Drupal Slick Carousel drupal/slick Packagist
  • Medium 6.1
    CVE-2026-81201

    Monster Menus - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-116

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Monster Menus allows Stored XSS. This issue affects Monster Menus versions: from 0.0.0 to 9.5.3.

    Drupal Monster Menus drupal/monster_menus Packagist
  • Medium 5.4
    CVE-2026-81164

    Entity PDF - Moderately critical - Access bypass - SA-CONTRIB-2026-114

    Missing Authorization vulnerability in Drupal Entity PDF allows Forceful Browsing. This issue affects Entity PDF versions: from 0.0.0 to 2.1.5.

    Drupal Entity PDF drupal/entity_pdf Packagist
  • Medium 5.3
    CVE-2026-81158

    Entity API - Moderately critical - Information disclosure - SA-CONTRIB-2026-113

    Incorrect Authorization vulnerability in Drupal Entity API allows Forceful Browsing. This issue affects Entity API versions: from 0.0.0 to 1.8.0.

    Drupal Entity API drupal/entity Packagist
  • Medium 5.3
    CVE-2026-81162

    DXPR Builder: The AI Visual Page Builder for Drupal - Moderately critical - Information Disclosure - SA-CONTRIB-2026-112

    Insertion of Sensitive Information Into Sent Data vulnerability in Drupal DXPR Builder: The Best Editing (AI) Experience for Drupal allows Forceful Browsing. This issue affects DXPR Builder: The Best Editing (AI) Experience for Drupal versions: from 0.0.0 to …

    Drupal DXPR Builder: The Best Editing (AI) Experience for Drupal drupal/dxpr_builder Web / CMS Packagist
  • Medium 5.3
    CVE-2026-81165

    Blazy - Less critical - Access bypass - SA-CONTRIB-2026-104

    Incorrect Authorization vulnerability in Drupal Blazy allows Forceful Browsing. This issue affects Blazy versions: from 0.0.0 to 3.0.18.

    Drupal Blazy drupal/blazy Packagist
  • Medium 5.3
    CVE-2026-81166

    Digital Signage Framework - Moderately critical - Access bypass - SA-CONTRIB-2026-109

    Missing Authorization vulnerability in Drupal Digital Signage Framework allows Forceful Browsing. This issue affects Digital Signage Framework versions: from 0.0.0 to 2.6.1.

    Drupal Digital Signage Framework drupal/digital_signage_framework Packagist
  • Medium 5.3
    CVE-2026-81205

    LDAP / Active Directory Integration - Moderately critical - Information Disclosure - SA-CONTRIB-2026-115

    Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability in Drupal LDAP / Active Directory Integration allows LDAP Injection. This issue affects LDAP / Active Directory Integration versions: from 0.0.0 to 2.2.1.

    Drupal LDAP / Active Directory Integration drupal/ldap_auth Packagist
  • Medium 5.3
    CVE-2026-81269

    Data field - Moderately critical - Information disclosure - SA-CONTRIB-2026-108

    Missing Authorization vulnerability in Drupal Data field allows Forceful Browsing. This issue affects Data field versions: from 0.0.0 to 2.0.13.

    Drupal Data field drupal/datafield Packagist
  • Medium 4.8
    CVE-2026-81167

    Address Suggestion - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-103

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Address Suggestion allows Cross-Site Scripting (XSS). This issue affects Address Suggestion versions: from 0.0.0 to 1.0.25.

    Drupal Address Suggestion drupal/address_suggestion Packagist
  • Medium 4.1
    CVE-2026-16647

    Disable Login Page - Moderately critical - Access bypass - SA-CONTRIB-2026-111

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Disable Login Page allows Functionality Bypass. This issue affects Disable Login Page versions: from 0.0.0 to 1.1.4.

    Drupal Disable Login Page drupal/disable_login Packagist
  • Low 3.7
    CVE-2026-81159

    Commerce CyberSource - Moderately critical - Insufficient input validation - SA-CONTRIB-2026-106

    Observable Timing Discrepancy vulnerability in Drupal Commerce CyberSource allows Brute Force. This issue affects Commerce CyberSource versions: from 0.0.0 to 1.10.0.

    Drupal Commerce CyberSource drupal/commerce_cybersource Packagist
  • Low 3.7
    CVE-2026-81168

    CAPTCHA Protected Page - Moderately critical - Cookie Forgery - SA-CONTRIB-2026-105

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal CAPTCHA Protected Page allows Functionality Bypass. This issue affects CAPTCHA Protected Page versions: from 0.0.0 to 1.0.2.

    Drupal CAPTCHA Protected Page drupal/captcha_protected_page Packagist
  • Low 3.3
    CVE-2026-81161

    Content Moderation Notifications - Moderately critical - Access bypass - SA-CONTRIB-2026-107

    Privilege Defined With Unsafe Actions vulnerability in Drupal Content Moderation Notifications allows Privilege Escalation. This issue affects Content Moderation Notifications versions: from 0.0.0 to 3.9.0.

    Drupal Content Moderation Notifications drupal/content_moderation_notifications Packagist

Revision history

  1. #2

    Referenz(en) aufgenommen: EUVD-2026-70007, EUVD-2026-70003, EUVD-2026-70002, EUVD-2026-70001, EUVD-2026-70000, EUVD-2026-69999, EUVD-2026-69997, EUVD-2026-69996, EUVD-2026-69998, CVE-2026-16647, EUVD-2026-69995, EUVD-2026-70008, EUVD-2026-70006, EUVD-2026-70005, EUVD-2026-70004

  2. #1

    Initiale Fassung

References