Skip to content
OpenAdvisories

Vendor

Drupal

585 known vulnerabilities.

Products

Drupal core 60 Webform 20 Core 19 AI (Artificial Intelligence) 18 SAML SSO - Service Provider 13 Open Social 8 Commerce Core 7 Enterprise MFA - TFA for Drupal 6 Monster Menus 4 Two-factor Authentication (TFA) 4 COOKiES Consent Management 4 Drupal Canvas 4 Tagify 3 Facets 3 OpenID Connect / OAuth client 3 Disable Login Page 3 Single Content Sync 3 Authenticator Login 3 Login Disable 3 Commerce Stripe 3 Gammu SMS Daemon 3 Drupal 3 UI Icons 3 One Time Password 3 Cloud 2 Access code 2 CivicTheme Design System 2 Webform REST 2 Node Access Rebuild Progressive 2 AI Agents 2 Data-module 2 Frontend Editing 2 Paragraphs 2 Anti-Spam by CleanTalk 2 POST File 2 Unpublished Node Permissions 2 Field Permissions 2 Block Attributes 2 ECA: Event - Condition - Action 2 Acquia DAM 2
All Critical High Medium Low Exploited only Public exploit

103 results · Clear filters · Feed

  • High 7.5
    CVE-2025-7717

    File Download - Moderately critical - Access bypass - SA-CONTRIB-2025-089

    Missing Authorization vulnerability in Drupal File Download allows Forceful Browsing.This issue affects File Download: from 0.0.0 before 1.9.0, from 2.0.0 before 2.0.1.

    Drupal File Download drupal/file_download Packagist
  • High 8.8
    CVE-2025-48921

    Open Social - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-079

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal Open Social allows Cross Site Request Forgery.This issue affects Open Social: from 0.0.0 before 12.3.14, from 12.4.0 before 12.4.13.

    Drupal Open Social
  • High 8.6
    CVE-2025-48915

    COOKiES Consent Management - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-076

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal COOKiES Consent Management allows Cross-Site Scripting (XSS).This issue affects COOKiES Consent Management: from 0.0.0 before 1.2.15.

    Drupal COOKiES Consent Management drupal/cookies Packagist
  • High 8.6
    CVE-2025-48914

    COOKiES Consent Management - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-075

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal COOKiES Consent Management allows Cross-Site Scripting (XSS).This issue affects COOKiES Consent Management: from 0.0.0 before 1.2.15.

    Drupal COOKiES Consent Management drupal/cookies Packagist
  • High 7.3
    CVE-2025-48920

    etracker - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-074

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal etracker allows Cross-Site Scripting (XSS).This issue affects etracker: from 0.0.0 before 3.1.0.

    Drupal etracker drupal/etracker Packagist
  • High 8.8
    CVE-2025-48918

    Simple Klaro - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-071

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Simple Klaro allows Cross-Site Scripting (XSS).This issue affects Simple Klaro: from 0.0.0 before 1.10.0.

    Drupal Simple Klaro drupal/simple_klaro Packagist
  • High 7.1
    CVE-2025-48447

    Lightgallery - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-069

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Lightgallery allows Cross-Site Scripting (XSS).This issue affects Lightgallery: from 0.0.0 before 1.6.0.

    Drupal Lightgallery drupal/lightgallery Packagist
  • High 8.8
    CVE-2025-48446

    Commerce Alphabank Redirect - Moderately critical - Access bypass - SA-CONTRIB-2025-067

    Incorrect Authorization vulnerability in Drupal Commerce Alphabank Redirect allows Functionality Misuse.This issue affects Commerce Alphabank Redirect: from 0.0.0 before 1.0.3.

    Drupal Commerce Alphabank Redirect drupal/commerce_alphabank_redirect Packagist
  • High 8.8
    CVE-2025-48445

    Commerce Eurobank (Redirect) - Moderately critical - Access bypass - SA-CONTRIB-2025-066

    Incorrect Authorization vulnerability in Drupal Commerce Eurobank (Redirect) allows Functionality Misuse.This issue affects Commerce Eurobank (Redirect): from 0.0.0 before 2.1.1.

    Drupal Commerce Eurobank (Redirect) drupal/commerce_eurobank_redirect Packagist
  • High 7.5
    CVE-2025-4416

    Events Log Track - Moderately critical - Denial of Service - SA-CONTRIB-2025-059

    Allocation of Resources Without Limits or Throttling vulnerability in Drupal Events Log Track allows Excessive Allocation.This issue affects Events Log Track: from 0.0.0 before 3.1.11, from 4.0.0 before 4.0.2.

    Drupal Events Log Track drupal/events_log_track Packagist
  • High 7.4
    CVE-2025-47710

    Enterprise MFA - TFA for Drupal - Critical - Access bypass - SA-CONTRIB-2025-056

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Enterprise MFA - TFA for Drupal allows Authentication Bypass.This issue affects Enterprise MFA - TFA for Drupal: from 0.0.0 before 4.7.0, from 5.0.0 before 5.2.0.

    Drupal Enterprise MFA - TFA for Drupal drupal/miniorange_2fa Web / CMS Packagist
  • High 8.8
    CVE-2025-47708

    Enterprise MFA - TFA for Drupal - Critical - Cross Site Request Forgery - SA-CONTRIB-2025-054

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal Enterprise MFA - TFA for Drupal allows Cross Site Request Forgery.This issue affects Enterprise MFA - TFA for Drupal: from 0.0.0 before 4.7.0, from 5.0.0 before 5.2.0.

    Drupal Enterprise MFA - TFA for Drupal drupal/miniorange_2fa Web / CMS Packagist
  • High 7.5
    CVE-2025-47707

    Enterprise MFA - TFA for Drupal - Moderately critical - Access bypass - SA-CONTRIB-2025-053

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Enterprise MFA - TFA for Drupal allows Authentication Bypass.This issue affects Enterprise MFA - TFA for Drupal: from 0.0.0 before 4.7.0, from 5.0.0 before 5.2.0.

    Drupal Enterprise MFA - TFA for Drupal drupal/miniorange_2fa Web / CMS Packagist
  • High 8.8
    CVE-2025-47701

    Restrict route by IP - Critical - Cross Site Request Forgery - SA-CONTRIB-2025-047

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal Restrict route by IP allows Cross Site Request Forgery.This issue affects Restrict route by IP: from 0.0.0 before 1.3.0.

    Drupal Restrict route by IP drupal/restrict_route_by_ip Packagist
  • High 7.3
    CVE-2025-3904

    Sportsleague - Critical - Unsupported - SA-CONTRIB-2025-045

    Vulnerability in Drupal Sportsleague.This issue affects Sportsleague: *.*.

    Drupal Sportsleague
  • High 7.3
    CVE-2025-3903

    UEditor - 百度编辑器 - Critical - Unsupported - SA-CONTRIB-2025-044

    Vulnerability in Drupal UEditor - 百度编辑器.This issue affects UEditor - 百度编辑器: *.*.

    Drupal UEditor - 百度编辑器 drupal/ueditor Packagist
  • High 8.1
    CVE-2025-31694

    Two-factor Authentication (TFA) - Moderately critical - Access bypass - SA-CONTRIB-2025-023

    Incorrect Authorization vulnerability in Drupal Two-factor Authentication (TFA) allows Forceful Browsing.This issue affects Two-factor Authentication (TFA): from 0.0.0 before 1.10.0.

    Drupal Two-factor Authentication (TFA) drupal/tfa Packagist
  • High 7.5
    CVE-2025-31692

    AI (Artificial Intelligence) - Critical - Remote Code Execution - SA-CONTRIB-2025-021

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Drupal AI (Artificial Intelligence) allows OS Command Injection.This issue affects AI (Artificial Intelligence): from 0.0.0 before 1.0.5.

    Drupal AI (Artificial Intelligence) drupal/ai Packagist
  • High 8.8
    CVE-2025-31690

    Cache Utility - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-019

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal Cache Utility allows Cross Site Request Forgery.This issue affects Cache Utility: from 0.0.0 before 1.2.1.

    Drupal Cache Utility drupal/cache_utility Packagist
  • High 8.1
    CVE-2025-31689

    General Data Protection Regulation - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-018

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal General Data Protection Regulation allows Cross Site Request Forgery.This issue affects General Data Protection Regulation: from 0.0.0 before 3.0.1, from 3.1.0 before 3.1.2.

    Drupal General Data Protection Regulation drupal/gdpr Packagist
  • High 8.1
    CVE-2025-31686

    Open Social - Less critical - Access bypass, Information Disclosure - SA-CONTRIB-2025-015

    Missing Authorization vulnerability in Drupal Open Social allows Forceful Browsing.This issue affects Open Social: from 0.0.0 before 12.3.11, from 12.4.0 before 12.4.10.

    Drupal Open Social goalgorilla/open_social Packagist
  • High 8.2
    CVE-2025-31678

    AI (Artificial Intelligence) - Moderately critical - Access bypass, Information Disclosure - SA-CONTRIB-2025-004

    Missing Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Forceful Browsing.This issue affects AI (Artificial Intelligence): from 0.0.0 before 1.0.3.

    Drupal AI (Artificial Intelligence) drupal/ai Packagist
  • High 8.8
    CVE-2025-31677

    AI (Artificial Intelligence) - Critical - Cross Site Request Forgery - SA-CONTRIB-2025-003

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal AI (Artificial Intelligence) allows Cross Site Request Forgery.This issue affects AI (Artificial Intelligence): from 1.0.0 before 1.0.2.

    Drupal AI (Artificial Intelligence) drupal/ai Packagist
  • High 8.8
    CVE-2025-31676

    Email TFA - Moderately critical - Access bypass - SA-CONTRIB-2025-001

    Weak Authentication vulnerability in Drupal Email TFA allows Brute Force.This issue affects Email TFA: from 0.0.0 before 2.0.3.

    Drupal Email TFA drupal/email_tfa Packagist
  • High 7.5
    CVE-2025-31674

    Drupal core - Moderately critical - Gadget Chain - SA-CORE-2025-003

    Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection.This issue affects Drupal core: from 8.0.0 before 10.3.13, from 10.4.0 before 10.4.3, from 11.0.0 before 11.0.12, from 1…

    Drupal Drupal core drupal/core Web / CMS Packagist
  • High 7.3
    CVE-2024-13311

    Allow All File Extensions for file fields - Critical - Unsupported - SA-CONTRIB-2024-075

    Vulnerability in Drupal Allow All File Extensions for file fields.This issue affects Allow All File Extensions for file fields: *.*.

    Drupal Allow All File Extensions for file fields drupal/all_extensions Packagist
  • High 7.3
    CVE-2024-13291

    Basic HTTP Authentication - Critical - Access bypass - SA-CONTRIB-2024-057

    Incorrect Authorization vulnerability in Drupal Basic HTTP Authentication allows Forceful Browsing.This issue affects Basic HTTP Authentication: from 7.X-1.0 before 7.X-1.4.

    Drupal Basic HTTP Authentication
  • High 8.8
    CVE-2024-13284

    Gutenberg - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2024-048

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal Gutenberg allows Cross Site Request Forgery.This issue affects Gutenberg: from 0.0.0 before 2.13.0, from 3.0.0 before 3.0.5.

    Drupal Gutenberg drupal/gutenberg Packagist
  • High 8.8
    CVE-2024-13282

    Block permissions - Moderately critical - Access bypass - SA-CONTRIB-2024-046

    Incorrect Authorization vulnerability in Drupal Block permissions allows Forceful Browsing.This issue affects Block permissions: from 1.0.0 before 1.2.0.

    Drupal Block permissions drupal/block_permissions Packagist
  • High 7.5
    CVE-2024-13276

    File Entity (fieldable files) - Moderately critical - Information Disclosure - SA-CONTRIB-2024-040

    Insertion of Sensitive Information Into Sent Data vulnerability in Drupal File Entity (fieldable files) allows Forceful Browsing.This issue affects File Entity (fieldable files): from 7.X-* before 7.X-2.39.

    Drupal File Entity (fieldable files)
  • High 7.5
    CVE-2024-13267

    Opigno TinCan Question Type - Critical - Arbitrary PHP code execution - SA-CONTRIB-2024-031

    Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') vulnerability in Drupal Opigno TinCan Question Type allows PHP Local File Inclusion.This issue affects Opigno TinCan Question Type: from 7.X-1.0 before 7.X-1.3.

    Drupal Opigno TinCan Question Type
  • High 7.5
    CVE-2024-13265

    Opigno Learning path - Critical - Arbitrary PHP code execution - SA-CONTRIB-2024-029

    Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') vulnerability in Drupal Opigno Learning path allows PHP Local File Inclusion.This issue affects Opigno Learning path: from 0.0.0 before 3.1.2.

    Drupal Opigno Learning path drupal/opigno_learning_path Packagist
  • High 8.8
    CVE-2024-13260

    Migrate queue importer - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2024-024

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal Migrate queue importer allows Cross Site Request Forgery.This issue affects Migrate queue importer: from 0.0.0 before 2.1.1.

    Drupal Migrate queue importer drupal/migrate_queue_importer Packagist
  • High 7.5
    CVE-2024-13259

    Image Sizes - Moderately critical - Access bypass - SA-CONTRIB-2024-023

    Insertion of Sensitive Information Into Sent Data vulnerability in Drupal Image Sizes allows Forceful Browsing.This issue affects Image Sizes: from 0.0.0 before 3.0.2.

    Drupal Image Sizes drupal/image_sizes Packagist
  • High 7.5
    CVE-2024-13256

    Email Contact - Moderately critical - Access bypass - SA-CONTRIB-2024-020

    Insufficient Granularity of Access Control vulnerability in Drupal Email Contact allows Forceful Browsing.This issue affects Email Contact: from 0.0.0 before 2.0.4.

    Drupal Email Contact drupal/email_contact Packagist
  • High 7.5
    CVE-2024-13255

    RESTful Web Services - Critical - Access bypass - SA-CONTRIB-2024-019

    Exposure of Sensitive Information Through Data Queries vulnerability in Drupal RESTful Web Services allows Forceful Browsing.This issue affects RESTful Web Services: from 7.X-2.0 before 7.X-2.10.

    Drupal RESTful Web Services
  • High 7.5
    CVE-2024-13254

    REST Views - Moderately critical - Information Disclosure - SA-CONTRIB-2024-018

    Insertion of Sensitive Information Into Sent Data vulnerability in Drupal REST Views allows Forceful Browsing.This issue affects REST Views: from 0.0.0 before 3.0.1.

    Drupal REST Views drupal/rest_views Packagist
  • High 8.8
    CVE-2024-13251

    Registration role - Critical - Access bypass - SA-CONTRIB-2024-015

    Incorrect Privilege Assignment vulnerability in Drupal Registration role allows Privilege Escalation.This issue affects Registration role: from 0.0.0 before 2.0.1.

    Drupal Registration role drupal/registration_role Packagist
  • High 8.8
    CVE-2024-13250

    Drupal Symfony Mailer Lite - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2024-014

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal Drupal Symfony Mailer Lite allows Cross Site Request Forgery.This issue affects Drupal Symfony Mailer Lite: from 0.0.0 before 1.0.6.

    Drupal Drupal Symfony Mailer Lite drupal/symfony_mailer_lite Web / CMS Packagist
  • High 8.8
    CVE-2024-13244

    Migrate Tools - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2024-008

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal Migrate Tools allows Cross Site Request Forgery.This issue affects Migrate Tools: from 0.0.0 before 6.0.3.

    Drupal Migrate Tools drupal/migrate_tools Packagist