Skip to content
OpenAdvisories

Vendor

Drupal

585 known vulnerabilities.

Products

Drupal core 60 Webform 20 Core 19 AI (Artificial Intelligence) 18 SAML SSO - Service Provider 13 Open Social 8 Commerce Core 7 Enterprise MFA - TFA for Drupal 6 Monster Menus 4 Two-factor Authentication (TFA) 4 COOKiES Consent Management 4 Drupal Canvas 4 Tagify 3 Facets 3 OpenID Connect / OAuth client 3 Disable Login Page 3 Single Content Sync 3 Authenticator Login 3 Login Disable 3 Commerce Stripe 3 Gammu SMS Daemon 3 Drupal 3 UI Icons 3 One Time Password 3 Cloud 2 Access code 2 CivicTheme Design System 2 Webform REST 2 Node Access Rebuild Progressive 2 AI Agents 2 Data-module 2 Frontend Editing 2 Paragraphs 2 Anti-Spam by CleanTalk 2 POST File 2 Unpublished Node Permissions 2 Field Permissions 2 Block Attributes 2 ECA: Event - Condition - Action 2 Acquia DAM 2
All Critical High Medium Low Exploited only Public exploit

389 results · Clear filters · Feed

  • Medium 6.1
    CVE-2025-47705

    IFrame Remove Filter - Moderately critical - Cross site scripting - SA-CONTRIB-2025-051

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal IFrame Remove Filter allows Cross-Site Scripting (XSS).This issue affects IFrame Remove Filter: from 2.0.0 before 2.0.5, from 7.X-1.0 through 7.X-1.5,…

    Drupal IFrame Remove Filter drupal/iframeremove Packagist
  • Medium 6.1
    CVE-2025-47704

    Klaro Cookie & Consent Management - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-050

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Klaro Cookie & Consent Management allows Cross-Site Scripting (XSS).This issue affects Klaro Cookie & Consent Management: from 0.0.0 before 3.0.5.

    Drupal Klaro Cookie & Consent Management drupal/klaro Packagist
  • Medium 6.1
    CVE-2025-47703

    COOKiES Consent Management - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-049

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal COOKiES Consent Management allows Cross-Site Scripting (XSS).This issue affects COOKiES Consent Management: from 0.0.0 before 1.2.14.

    Drupal COOKiES Consent Management drupal/cookies Packagist
  • Medium 6.1
    CVE-2025-47702

    oEmbed Providers - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-048

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal oEmbed Providers allows Cross-Site Scripting (XSS).This issue affects oEmbed Providers: from 0.0.0 before 2.2.2.

    Drupal oEmbed Providers drupal/oembed_providers Packagist
  • Medium 4.3
    CVE-2025-3907

    Search API Solr - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-046

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal Search API Solr allows Cross Site Request Forgery.This issue affects Search API Solr: from 0.0.0 before 4.3.9.

    Drupal Search API Solr drupal/search_api_solr Packagist
  • Medium 6.1
    CVE-2025-3902

    Block Class - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-043

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Block Class allows Cross-Site Scripting (XSS).This issue affects Block Class: from 4.0.0 before 4.0.1.

    Drupal Block Class drupal/block_class Packagist
  • Medium 6.1
    CVE-2025-3901

    Bootstrap Site Alert - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-042

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Bootstrap Site Alert allows Cross-Site Scripting (XSS).This issue affects Bootstrap Site Alert: from 0.0.0 before 1.13.0, from 3.0.0 before 3.0.4.

    Drupal Bootstrap Site Alert drupal/bootstrap_site_alert Packagist
  • Medium 6.1
    CVE-2025-3900

    Colorbox - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-041

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Colorbox allows Cross-Site Scripting (XSS).This issue affects Colorbox: from 0.0.0 before 2.1.3.

    Drupal Colorbox drupal/colorbox Packagist
  • Medium 5.9
    CVE-2025-3739

    Drupal 8 Google Optimize Hide Page - Critical - Unsupported - SA-CONTRIB-2025-040

    Vulnerability in Drupal Drupal 8 Google Optimize Hide Page.This issue affects Drupal 8 Google Optimize Hide Page: *.*.

    Drupal Drupal 8 Google Optimize Hide Page drupal/d8_google_optimize_hide_page Web / CMS Packagist
  • Medium 5.9
    CVE-2025-3738

    Google Optimize - Critical - Unsupported - SA-CONTRIB-2025-039

    Vulnerability in Drupal Google Optimize.This issue affects Google Optimize: *.*.

    Drupal Google Optimize drupal/google_optimize Packagist
  • Medium 5.9
    CVE-2025-3737

    Google Maps: Store Locator - Critical - Unsupported - SA-CONTRIB-2025-038

    Vulnerability in Drupal Google Maps: Store Locator.This issue affects Google Maps: Store Locator: *.*.

    Drupal Google Maps: Store Locator drupal/gmap_store_locator Packagist
  • Medium 5.9
    CVE-2025-3736

    Simple GTM - Critical - Unsupported - SA-CONTRIB-2025-037

    Vulnerability in Drupal Simple GTM.This issue affects Simple GTM: *.*.

    Drupal Simple GTM drupal/simple_gtm Packagist
  • Medium 5.9
    CVE-2025-3735

    Panelizer (obsolete) - Critical - Unsupported - SA-CONTRIB-2025-036

    Vulnerability in Drupal Panelizer (obsolete).This issue affects Panelizer (obsolete): *.*.

    Drupal Panelizer (obsolete) drupal/panelizer Packagist
  • Medium 5.9
    CVE-2025-3734

    Stage File Proxy - Moderately critical - Denial of Service - SA-CONTRIB-2025-035

    Allocation of Resources Without Limits or Throttling vulnerability in Drupal Stage File Proxy allows Flooding.This issue affects Stage File Proxy: from 0.0.0 before 3.1.5.

    Drupal Stage File Proxy drupal/stage_file_proxy Packagist
  • Medium 6.5
    CVE-2025-3733

    baguetteBox.js - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-034

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal baguetteBox.Js allows Cross-Site Scripting (XSS).This issue affects baguetteBox.Js: from 0.0.0 before 2.0.4, from 3.0.0 before 3.0.1.

    Drupal baguetteBox.js drupal/baguettebox Packagist
  • Medium 6.5
    CVE-2025-3474

    Panels - Critical - Access bypass - SA-CONTRIB-2025-033

    Missing Authentication for Critical Function vulnerability in Drupal Panels allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Panels: from 0.0.0 before 4.9.0.

    Drupal Panels drupal/panels Packagist
  • Medium 5.4
    CVE-2025-3131

    ECA: Event - Condition - Action - Critical - Cross site request forgery - SA-CONTRIB-2025-031

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal ECA: Event - Condition - Action allows Cross Site Request Forgery.This issue affects ECA: Event - Condition - Action: from 0.0.0 before 1.1.12, from 2.0.0 before 2.0.16, from 2.1.0 before 2.1.7, from 0…

    Drupal ECA: Event - Condition - Action drupal/eca Packagist
  • Medium 6.5
    CVE-2025-3475

    WEB-T - Moderately critical - Access bypass, Denial of service - SA-CONTRIB-2025-030

    Allocation of Resources Without Limits or Throttling, Incorrect Authorization vulnerability in Drupal WEB-T allows Excessive Allocation, Content Spoofing.This issue affects WEB-T: from 0.0.0 before 1.1.0.

    Drupal WEB-T drupal/webt Packagist
  • Medium 5.4
    CVE-2025-3130

    Obfuscate - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-029

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Obfuscate allows Stored XSS.This issue affects Obfuscate: from 0.0.0 before 2.0.1.

    Drupal Obfuscate drupal/obfuscate Packagist
  • Medium 4.8
    CVE-2025-3129

    Access code - Moderately critical - Access bypass - SA-CONTRIB-2025-028

    Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Access code allows Brute Force.This issue affects Access code: from 0.0.0 before 2.0.4.

    Drupal Access code drupal/access_code Packagist
  • Medium 6.6
    CVE-2025-3062

    Drupal Admin LTE theme - Critical - Unsupported - SA-CONTRIB-2025-010

    Vulnerability in Drupal Drupal Admin LTE theme.This issue affects Drupal Admin LTE theme: *.*.

    Drupal Drupal Admin LTE theme drupal/druadmin_lte_theme Web / CMS Packagist
  • Medium 6.6
    CVE-2025-3061

    Material Admin - Critical - Unsupported - SA-CONTRIB-2025-006

    Vulnerability in Drupal Material Admin.This issue affects Material Admin: *.*.

    Drupal Material Admin drupal/material_admin Packagist
  • Medium 6.6
    CVE-2025-3060

    Flattern – Multipurpose Bootstrap Business Profile - Critical - Unsupported - SA-CONTRIB-2025-005

    Vulnerability in Drupal Flattern – Multipurpose Bootstrap Business Profile.This issue affects Flattern – Multipurpose Bootstrap Business Profile: *.*.

    Drupal Flattern – Multipurpose Bootstrap Business Profile
  • Medium 5.3
    CVE-2025-3059

    Profile Private - Critical - Unsupported - SA-CONTRIB-2025-002

    Vulnerability in Drupal Profile Private.This issue affects Profile Private: *.*.

    Drupal Profile Private drupal/profile_private Packagist
  • Medium 6.1
    CVE-2025-31697

    Formatter Suite - Moderately critical - Cross site scripting - SA-CONTRIB-2025-026

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Formatter Suite allows Cross-Site Scripting (XSS).This issue affects Formatter Suite: from 0.0.0 before 2.1.0.

    Drupal Formatter Suite drupal/formatter_suite Packagist
  • Medium 6.1
    CVE-2025-31696

    RapiDoc OAS Field Formatter - Moderately critical - Cross site scripting - SA-CONTRIB-2025-025

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal RapiDoc OAS Field Formatter allows Cross-Site Scripting (XSS).This issue affects RapiDoc OAS Field Formatter: from 0.0.0 before 1.0.1.

    Drupal RapiDoc OAS Field Formatter drupal/rapidoc_elements_field_formatter Packagist
  • Medium 6.1
    CVE-2025-31695

    Link field display mode formatter - Moderately critical - Cross site scripting - SA-CONTRIB-2025-024

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Link field display mode formatter allows Cross-Site Scripting (XSS).This issue affects Link field display mode formatter: from 0.0.0 before 1.6.0.

    Drupal Link field display mode formatter drupal/link_field_display_mode_formatter Packagist
  • Medium 6.6
    CVE-2025-31693

    AI (Artificial Intelligence) - Moderately critical - Gadget Chain - SA-CONTRIB-2025-022

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Drupal AI (Artificial Intelligence) allows OS Command Injection.This issue affects AI (Artificial Intelligence): from 0.0.0 before 1.0.5.

    Drupal AI (Artificial Intelligence) drupal/ai Packagist
  • Medium 6.8
    CVE-2025-31688

    Configuration Split - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-017

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal Configuration Split allows Cross Site Request Forgery.This issue affects Configuration Split: from 0.0.0 before 1.10.0, from 2.0.0 before 2.0.2.

    Drupal Configuration Split drupal/config_split Packagist
  • Medium 6.1
    CVE-2025-31687

    SpamSpan filter - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-016

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal SpamSpan filter allows Cross-Site Scripting (XSS).This issue affects SpamSpan filter: from 0.0.0 before 3.2.1.

    Drupal SpamSpan filter drupal/spamspan Packagist
  • Medium 6.8
    CVE-2025-31684

    OAuth2 Client - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-013

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal OAuth2 Client allows Cross Site Request Forgery.This issue affects OAuth2 Client: from 0.0.0 before 4.1.3.

    Drupal OAuth2 Client drupal/oauth2_client Packagist
  • Medium 6.8
    CVE-2025-31683

    Google Tag - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-012

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal Google Tag allows Cross Site Request Forgery.This issue affects Google Tag: from 0.0.0 before 1.8.0, from 2.0.0 before 2.0.8.

    Drupal Google Tag drupal/google_tag Packagist
  • Medium 4.8
    CVE-2025-31682

    Google Tag - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-011

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Google Tag allows Cross-Site Scripting (XSS).This issue affects Google Tag: from 0.0.0 before 1.8.0, from 2.0.0 before 2.0.8.

    Drupal Google Tag drupal/google_tag Packagist
  • Medium 6.8
    CVE-2025-31680

    Matomo Analytics - Moderately critical - Cross site request forgery - SA-CONTRIB-2025-008

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal Matomo Analytics allows Cross Site Request Forgery.This issue affects Matomo Analytics: from 0.0.0 before 1.24.0.

    Drupal Matomo Analytics drupal/matomo Packagist
  • Medium 6.1
    CVE-2025-31679

    Ignition Error Pages - Critical - Cross Site Scripting - SA-CONTRIB-2025-007

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Ignition Error Pages allows Cross-Site Scripting (XSS).This issue affects Ignition Error Pages: from 0.0.0 before 1.0.4.

    Drupal Ignition Error Pages drupal/ignition Packagist
  • Medium 5.4
    CVE-2025-31675

    Drupal core - Moderately critical - Cross Site Scripting - SA-CORE-2025-004

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS).This issue affects Drupal core: from 8.0.0 before 10.3.14, from 10.4.0 before 10.4.5, from 11.0.0 before…

    Drupal Drupal core Link drupal/core Web / CMS Packagist
  • Medium 4.6
    CVE-2025-31673

    Drupal core - Moderately critical - Access bypass - SA-CORE-2025-002

    Incorrect Authorization vulnerability in Drupal Drupal core allows Forceful Browsing.This issue affects Drupal core: from 8.0.0 before 10.3.13, from 10.4.0 before 10.4.3, from 11.0.0 before 11.0.12, from 11.1.0 before 11.1.3.

    Drupal Drupal core drupal/core Web / CMS Packagist
  • Medium 6.1
    CVE-2025-3057

    Drupal core - Critical - Cross site scripting - SA-CORE-2025-001

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS).This issue affects Drupal core: from 8.0.0 before 10.3.13, from 10.4.0 before 10.4.3, from 11.0.0 before…

    Drupal Drupal core drupal/core Web / CMS Packagist
  • Medium 5.3
    CVE-2024-13312

    Open Social - Moderately critical - Access bypass - SA-CONTRIB-2024-076

    Missing Authorization vulnerability in Drupal Open Social allows Forceful Browsing.This issue affects Open Social: from 11.8.0 before 12.3.10, from 12.4.0 before 12.4.9.

    Drupal Open Social
  • Medium 6.5
    CVE-2024-13310

    Git Utilities for Drupal - Critical - Unsupported - SA-CONTRIB-2024-074

    Vulnerability in Drupal Git Utilities for Drupal.This issue affects Git Utilities for Drupal: *.*.

    Drupal Git Utilities for Drupal drupal/git_utils Web / CMS Packagist