Ecosystem
Packagist
7,188 known vulnerabilities.
Most affected packages
7,178 results · Feed
-
Unscored —
The Allowed Languages module makes it possible to set restrictions on which content a user can edit based on language. …
-
Unscored —
This module provides a separate page with a form for users to change their own password, which asks for the current pas…
-
Unscored —
This module enables you to schedule content to be published or unpublished at a certain time in the future. The module …
-
Unscored —
This module enables you to reset passwords via one time passcode to email or SMS rather than reset password links. The …
-
Unscored —
The Name Field module provides a field for storing a personal name as separate components. The module does not sufficie…
-
Unscored —
This module allows forums to be set private and to be given moderators. The module doesn't sufficiently check access fo…
-
Unscored —
This module enables you to accept payments through Escrow.com with Drupal Commerce. The module doesn't sufficiently ver…
-
Unscored —
This module lets customers replace an item in their cart with one of the alternative product variations listed for it. …
-
Unscored —
The AlternativeCommerce PayPal Checkout module provides an AlternativeCommerce method to embed payment services from Pa…
-
Unscored —
This module enables you to add syntax-highlighted code snippets to content using CKEditor 5. The module doesn't suffici…
-
Unscored —
The REST & JSON API Authentication module provides API authentication for Drupal sites. The module does not properly re…
-
Unscored —
This module enables you to send messages ("Notifications") to users upon a certain Workflow state change. The module do…
-
Unscored —
This module introduces an OAuth 2.0 authorization server, which can be configured to protect your Drupal instance with …
-
Unscored —
This module enables you to upload files from the browser directly to Amazon S3 and register them as Drupal files, bypas…
-
Unscored —
The Content Synchronizer module allows content to be exported and imported between Drupal sites via uploaded archive fi…
-
Unscored —
The Content Synchronizer module allows content to be exported and imported between Drupal sites via uploaded archive fi…
-
Medium 4.2
Silverstripe MFA: Can bypass MFA during password reset flow
Silverstripe MFA provides multi-factor authentication for Silverstripe CMS. Prior to 6.0.0, the CMS 5 password reset flow can issue a logged-in session after a user changes a password but before the user's configured multi-factor authentication challenge is c…
-
Medium —
AdminNeo SQLite: multi_query Incorrect Check of Function Return Value RCE
### Summary This vulnerability is a patch bypass that exploits catastrophic backtracking in a regular expression used to filter ATTACH statements in AdminNeo's SQLite functionality. The original vulnerability (CVE-2021-43008) allowed authenticated users to cr…
-
High 8.1
AdminNeo SQLite Database-List Drop Arbitrary File Deletion
## Summary AdminNeo allows an authenticated SQLite-mode user to delete arbitrary files writable by the PHP process through the database-list drop action. The SQLite driver validates file extensions when creating or renaming databases, but the database-list dr…
-
High 8.2
AdminNeo has Cookie Attribute Injection via Unsanitized X-Forwarded-Prefix in Set-Cookie Headers
### Summary AdminNeo versions 4.6.0 through at least 5.5.0 are vulnerable to cookie attribute injection via the `X-Forwarded-Prefix` HTTP header. An attacker who can influence this header (e.g., through a reverse proxy that forwards it from clients, an attack…
-
High —
AdminNeo Vulnerable to XSS via Rogue MySQL Server Version String (CSP Nonce Bypass)
## Summary AdminNeo inserts the database server's version string into a `<script>` tag that carries a valid CSP nonce, without any sanitization. A rogue database server can return a crafted version string that breaks out of the JavaScript context and executes…
-
High 7.2
AdminNeo: RCE via SQLite VACUUM INTO (ATTACH Blocklist Bypass)
## Summary Adminer blocks `ATTACH` queries for SQLite to prevent arbitrary file creation. However, `VACUUM INTO` is not blocked and achieves the same result: writing a database file containing attacker-controlled PHP code to any path with any extension. An au…
-
Medium 6.8
AdminNeo: CSRF Token Secret Recoverable from Single Observed Token, Enabling Cross-Site Request Forgery
### Summary AdminNeo's CSRF protection uses a BREACH-resistant XOR masking scheme, but the implementation transmits both the XOR mask and the masked value in every token. This allows any observer who sees a single CSRF token (via network sniffing, log files, …
-
High 7.5
AdminNeo: version-cache array injection causes persistent denial of service
AdminNeo is a full-featured database management tool written in PHP. From 4.6.2 until 5.5.0, the unauthenticated `?script=version` endpoint accepts POST data without origin, CSRF or parameter-type validation. A `version[]` parameter becomes a PHP array that `…
-
Low 3.7
CakePHP through 5.4.3 Email Header Injection via Bare CR/LF in SmtpTransport and MailTransport
CakePHP 4.5.12, 4.6.5, 5.1.8 through 5.1.10, 5.2.14 through 5.2.15, 5.3.7, and 5.4.0 through 5.4.3 contain an email header injection vulnerability because SmtpTransport and MailTransport strip only CRLF pairs from header values, an incomplete fix for CVE-2026…
-
Critical 9.8
Block AJAX - Highly critical - PHP object injection - SA-CONTRIB-2026-192
Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Block AJAX allows Object Injection. This issue affects Block AJAX versions: from 0.0.0 to 3.0.2.
-
Medium 5.9
ECA Helper - Critical - Unsupported - SA-CONTRIB-2026-193
Vulnerability in Drupal ECA Helper. This issue affects ECA Helper versions: *.*.
-
Medium 6.5
Entity Reference Manager (Merge entities) - Critical - Access bypass - SA-CONTRIB-2026-194
Incorrect Authorization vulnerability in Drupal Entity Reference Manager (Merge entities) allows Forceful Browsing. This issue affects Entity Reference Manager (Merge entities) versions: from 0.0.0 to 1.0.3.
-
Medium 5.4
MathJax: LaTeX for Drupal - Critical - Cross site scripting - SA-CONTRIB-2026-195
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal MathJax: LaTeX for Drupal allows Cross-Site Scripting (XSS). This issue affects MathJax: LaTeX for Drupal versions: from 0.0.0 to 4.1.2.
-
Medium 5.9
Orphans Media - Critical - Unsupported - SA-CONTRIB-2026-196
Vulnerability in Drupal Orphans Media. This issue affects Orphans Media versions: *.*.
-
Medium 4.8
Authenticator Login Plus (2FA) - Critical - Improper authentication - SA-CONTRIB-2026-197
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Authenticator Login Plus (2FA) allows Authentication Bypass. This issue affects Authenticator Login Plus (2FA) versions: from 0.0.0 to 1.0.1.
-
Medium 6.5
Actstream - Critical - Access bypass - SA-CONTRIB-2026-198
Incorrect Authorization vulnerability in Drupal Actstream allows Forceful Browsing. This issue affects Actstream versions: from 0.0.0 to 2.0.1, from 2.1.0 to 2.1.1.
-
Medium 5.4
Inline Entity Form Dialog - Moderately critical - Access bypass - SA-CONTRIB-2026-199
Incorrect Authorization vulnerability in Drupal Inline Entity Form Dialog allows Forceful Browsing. This issue affects Inline Entity Form Dialog versions: from 0.0.0 to 1.0.6.
-
Medium 5.4
Linked Field - Moderately critical - Server-side template injection - SA-CONTRIB-2026-200
Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal Linked Field allows Code Injection. This issue affects Linked Field versions: from 0.0.0 to 1.8.0.
-
Medium 4.2
Authenticator Login Plus (2FA) - Moderately critical - Improper authentication - SA-CONTRIB-2026-201
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Authenticator Login Plus (2FA) allows Authentication Bypass. This issue affects Authenticator Login Plus (2FA) versions: from 0.0.0 to 1.0.1.
-
Medium 5.4
Gutenberg - Moderately critical - Access bypass - SA-CONTRIB-2026-202
Incorrect Authorization vulnerability in Drupal Gutenberg allows Forceful Browsing. This issue affects Gutenberg versions: from 0.0.0 to 2.15.0, from 3.0.0 to 3.0.7.
-
Medium 5.4
Inline Formatter Field - Moderately critical - Server-side template injection - SA-CONTRIB-2026-203
Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal Inline Formatter Field allows Code Injection. This issue affects Inline Formatter Field versions: from 0.0.0 to 4.2.0.
-
Medium 5.4
Leaflet - Moderately critical - Cross site scripting - SA-CONTRIB-2026-204
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Leaflet allows Stored XSS. This issue affects Leaflet versions: from 0.0.0 to 10.4.13.
-
Medium 5.3
Views Share - Moderately critical - Access bypass - SA-CONTRIB-2026-205
Missing Authorization vulnerability in Drupal Views Share allows Forceful Browsing. This issue affects Views Share versions: from 0.0.0 to 2.0.1.
-
Medium 6.5
Xray Audit - Moderately critical - Access bypass - SA-CONTRIB-2026-206
Missing Authorization vulnerability in Drupal Xray Audit allows Forceful Browsing. This issue affects Xray Audit versions: from 0.0.0 to 1.6.3, from 2.0.0 to 2.0.4, from 3.0.0 to 3.1.1.