Skip to content
OpenAdvisories

Package · Packagist

drupal/drupal

81 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

8 results · Clear filters · Feed

  • Medium 5.3
    CVE-2024-45440 Public exploit

    Drupal Full Path Disclosure

    core/authorize.php in Drupal 11.x-dev allows Full Path Disclosure (even when error logging is None) if the value of hash_salt is file_get_contents of a file that does not exist.

    Drupal Drupal core drupal/core drupal/drupal Web / CMS Ubuntu Packagist
  • High 8.8
    CVE-2020-13664 Public exploit

    Drupal Core Arbitrary PHP code execution vulnerability

    Arbitrary PHP code execution vulnerability in Drupal Core under certain circumstances. An attacker could trick an administrator into visiting a malicious site that could result in creating a carefully named directory on the file system. With this directory in…

    Drupal Drupal core drupal/core drupal/drupal Web / CMS Packagist
  • High 8.8
    CVE-2020-13671 Exploited Public exploit EPSS 36%

    Drupal core Unrestricted Upload of File with Dangerous Type

    Drupal core does not properly sanitize certain filenames on uploaded files, which can lead to files being interpreted as the incorrect extension and served as the wrong MIME type or executed as PHP for certain hosting configurations. This issue affects: Drupa…

    Drupal Drupal core drupal/core drupal/drupal Web / CMS Ubuntu Alpine Packagist
    KEV Jan 18, 2022
  • Medium 5.4
    CVE-2019-10909 Public exploit

    Symfony Cross-site Scripting (XSS) vulnerability

    In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, validation messages are not escaped, which can lead to XSS when user input is included. This is related to symfony/framework-bundle.

    drupal/core symfony/symfony symfony symfony Debian Ubuntu Packagist
  • High 8.1
    CVE-2019-6340 Exploited Public exploit EPSS 92%

    Drupal core - Highly critical - Remote Code Execution

    Some field types do not properly sanitize data from non-form sources in Drupal 8.5.x before 8.5.11 and Drupal 8.6.x before 8.6.10. This can lead to arbitrary PHP code execution in some cases. A site is only affected by this if one of the following conditions …

    Drupal Drupal core drupal/core drupal/drupal Web / CMS Packagist
    KEV Mar 25, 2022
  • Critical 9.8
    CVE-2019-6339 Public exploit EPSS 36%

    PHAR stream wrapper Arbitrary PHP code execution

    In Drupal Core versions 7.x prior to 7.62, 8.6.x prior to 8.6.6 and 8.5.x prior to 8.5.9; A remote code execution vulnerability exists in PHP's built-in phar stream wrapper when performing file operations on an untrusted phar:// URI. Some Drupal code (core, c…

    Drupal Drupal core drupal/core drupal/drupal Web / CMS Ubuntu Packagist
  • High 8.1
    CVE-2018-7602 Exploited · Ransomware Public exploit EPSS 99%

    Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-004

    A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result in the site being compromised. This vulnerability is relat…

    Drupal Core drupal/core drupal/drupal Ubuntu Alpine Packagist
    KEV Apr 13, 2022
  • Critical 9.8
    CVE-2018-7600 Exploited · Ransomware Public exploit EPSS 100%

    Drupal Core Remote Code Execution Vulnerability

    Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because of an issue affecting multiple subsystems with default or common module configurations.

    drupal/core drupal/drupal drupal7 drupal7 Web / CMS Ubuntu Alpine Packagist
    KEV Nov 3, 2021