Skip to content
OpenAdvisories

Vendor

Drupal

585 known vulnerabilities.

Products

Drupal core 60 Webform 20 Core 19 AI (Artificial Intelligence) 18 SAML SSO - Service Provider 13 Open Social 8 Commerce Core 7 Enterprise MFA - TFA for Drupal 6 Monster Menus 4 Two-factor Authentication (TFA) 4 COOKiES Consent Management 4 Drupal Canvas 4 Tagify 3 Facets 3 OpenID Connect / OAuth client 3 Disable Login Page 3 Single Content Sync 3 Authenticator Login 3 Login Disable 3 Commerce Stripe 3 Gammu SMS Daemon 3 Drupal 3 UI Icons 3 One Time Password 3 Cloud 2 Access code 2 CivicTheme Design System 2 Webform REST 2 Node Access Rebuild Progressive 2 AI Agents 2 Data-module 2 Frontend Editing 2 Paragraphs 2 Anti-Spam by CleanTalk 2 POST File 2 Unpublished Node Permissions 2 Field Permissions 2 Block Attributes 2 ECA: Event - Condition - Action 2 Acquia DAM 2
All Critical High Medium Low Exploited only Public exploit

585 results · Feed

  • Medium 6.1
    CVE-2025-7392

    Cookies Addons - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-087

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Cookies Addons allows Cross-Site Scripting (XSS).This issue affects Cookies Addons: from 1.0.0 before 1.2.4.

    Drupal Cookies Addons drupal/cookies_addons Packagist
  • Critical 9.8
    CVE-2025-7393

    Mail Login - Critical - Access bypass - SA-CONTRIB-2025-088

    Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Mail Login allows Brute Force.This issue affects Mail Login: from 3.0.0 before 3.2.0, from 4.0.0 before 4.2.0.

    Drupal Mail Login drupal/mail_login Packagist
  • Medium 5.3
    CVE-2025-7031

    Config Pages Viewer - Critical - Access bypass - SA-CONTRIB-2025-086

    Missing Authentication for Critical Function vulnerability in Drupal Config Pages Viewer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Config Pages Viewer: from 0.0.0 before 1.0.4.

    Drupal Config Pages Viewer drupal/config_pages_viewer Packagist
  • Medium 6.5
    CVE-2025-7030

    Two-factor Authentication (TFA) - Less critical - Access bypass - SA-CONTRIB-2025-085

    Privilege Defined With Unsafe Actions vulnerability in Drupal Two-factor Authentication (TFA) allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Two-factor Authentication (TFA): from 0.0.0 before 1.11.0.

    Drupal Two-factor Authentication (TFA) drupal/tfa Packagist
  • Medium 5.4
    CVE-2025-6677

    Paragraphs table - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-084

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Paragraphs table allows Cross-Site Scripting (XSS).This issue affects Paragraphs table: from 2.0.0 before 2.0.5.

    Drupal Paragraphs table drupal/paragraphs_table Packagist
  • Medium 5.4
    CVE-2025-6676

    Simple XML sitemap - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-083

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Simple XML sitemap allows Cross-Site Scripting (XSS).This issue affects Simple XML sitemap: from 0.0.0 before 4.2.2.

    Drupal Simple XML sitemap drupal/simple_sitemap Packagist
  • Medium 4.8
    CVE-2025-6675

    Enterprise MFA - TFA for Drupal - Critical - Access bypass - SA-CONTRIB-2025-082

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Enterprise MFA - TFA for Drupal allows Authentication Bypass.This issue affects Enterprise MFA - TFA for Drupal: from 0.0.0 before 4.8.0, from 5.2.0 before 5.2.1, from 0.0.0 befo…

    Drupal Enterprise MFA - TFA for Drupal drupal/miniorange_2fa Web / CMS Packagist
  • Medium 6.1
    CVE-2025-6674

    CKEditor5 Youtube - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-081

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal CKEditor5 Youtube allows Cross-Site Scripting (XSS).This issue affects CKEditor5 Youtube: from 0.0.0 before 1.0.3.

    Drupal CKEditor5 Youtube drupal/ckeditor5_youtube Packagist
  • Medium 4.3
    CVE-2025-5682

    Klaro Cookie & Consent Management - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-080

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Klaro Cookie & Consent Management allows Cross-Site Scripting (XSS).This issue affects Klaro Cookie & Consent Management: from 0.0.0 before 3.0.7.

    Drupal Klaro Cookie & Consent Management drupal/klaro Packagist
  • High 8.8
    CVE-2025-48921

    Open Social - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-079

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal Open Social allows Cross Site Request Forgery.This issue affects Open Social: from 0.0.0 before 12.3.14, from 12.4.0 before 12.4.13.

    Drupal Open Social
  • Medium 6.1
    CVE-2025-48922

    GLightbox - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-078

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal GLightbox allows Cross-Site Scripting (XSS).This issue affects GLightbox: from 0.0.0 before 1.0.16.

    Drupal GLightbox drupal/glightbox Packagist
  • Medium 6.1
    CVE-2025-48923

    Toc.js - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-077

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Toc.Js allows Cross-Site Scripting (XSS).This issue affects Toc.Js: from 0.0.0 before 3.2.1.

    Drupal Toc.js drupal/toc_js Packagist
  • High 8.6
    CVE-2025-48915

    COOKiES Consent Management - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-076

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal COOKiES Consent Management allows Cross-Site Scripting (XSS).This issue affects COOKiES Consent Management: from 0.0.0 before 1.2.15.

    Drupal COOKiES Consent Management drupal/cookies Packagist
  • High 8.6
    CVE-2025-48914

    COOKiES Consent Management - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-075

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal COOKiES Consent Management allows Cross-Site Scripting (XSS).This issue affects COOKiES Consent Management: from 0.0.0 before 1.2.15.

    Drupal COOKiES Consent Management drupal/cookies Packagist
  • High 7.3
    CVE-2025-48920

    etracker - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-074

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal etracker allows Cross-Site Scripting (XSS).This issue affects etracker: from 0.0.0 before 3.1.0.

    Drupal etracker drupal/etracker Packagist
  • Medium 5.0
    CVE-2025-48919

    Simple Klaro - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-073

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Simple Klaro allows Cross-Site Scripting (XSS).This issue affects Simple Klaro: from 0.0.0 before 1.10.0.

    Drupal Simple Klaro drupal/simple_klaro Packagist
  • Medium 5.0
    CVE-2025-48917

    EU Cookie Compliance (GDPR Compliance) - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-072

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal EU Cookie Compliance (GDPR Compliance) allows Cross-Site Scripting (XSS).This issue affects EU Cookie Compliance (GDPR Compliance): from 0.0.0 before …

    Drupal EU Cookie Compliance (GDPR Compliance) drupal/eu_cookie_compliance Packagist
  • High 8.8
    CVE-2025-48918

    Simple Klaro - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-071

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Simple Klaro allows Cross-Site Scripting (XSS).This issue affects Simple Klaro: from 0.0.0 before 1.10.0.

    Drupal Simple Klaro drupal/simple_klaro Packagist
  • Medium 6.5
    CVE-2025-48916

    Bookable Calendar - Less critical - Access bypass - SA-CONTRIB-2025-070

    Missing Authorization vulnerability in Drupal Bookable Calendar allows Forceful Browsing.This issue affects Bookable Calendar: from 0.0.0 before 2.2.13.

    Drupal Bookable Calendar drupal/bookable_calendar Packagist
  • High 7.1
    CVE-2025-48447

    Lightgallery - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-069

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Lightgallery allows Cross-Site Scripting (XSS).This issue affects Lightgallery: from 0.0.0 before 1.6.0.

    Drupal Lightgallery drupal/lightgallery Packagist
  • Medium 6.5
    CVE-2025-48448

    Admin Audit Trail - Less critical - Denial of Service - SA-CONTRIB-2025-068

    Allocation of Resources Without Limits or Throttling vulnerability in Drupal Admin Audit Trail allows Excessive Allocation.This issue affects Admin Audit Trail: from 0.0.0 before 1.0.5.

    Drupal Admin Audit Trail drupal/admin_audit_trail Packagist
  • High 8.8
    CVE-2025-48446

    Commerce Alphabank Redirect - Moderately critical - Access bypass - SA-CONTRIB-2025-067

    Incorrect Authorization vulnerability in Drupal Commerce Alphabank Redirect allows Functionality Misuse.This issue affects Commerce Alphabank Redirect: from 0.0.0 before 1.0.3.

    Drupal Commerce Alphabank Redirect drupal/commerce_alphabank_redirect Packagist
  • High 8.8
    CVE-2025-48445

    Commerce Eurobank (Redirect) - Moderately critical - Access bypass - SA-CONTRIB-2025-066

    Incorrect Authorization vulnerability in Drupal Commerce Eurobank (Redirect) allows Functionality Misuse.This issue affects Commerce Eurobank (Redirect): from 0.0.0 before 2.1.1.

    Drupal Commerce Eurobank (Redirect) drupal/commerce_eurobank_redirect Packagist
  • Medium 5.3
    CVE-2025-48013

    Quick Node Block - Moderately critical - Access bypass - SA-CONTRIB-2025-065

    Missing Authorization vulnerability in Drupal Quick Node Block allows Forceful Browsing.This issue affects Quick Node Block: from 0.0.0 before 2.0.0.

    Drupal Quick Node Block drupal/quick_node_block Packagist
  • Medium 5.3
    CVE-2025-48444

    Quick Node Block - Moderately critical - Access bypass - SA-CONTRIB-2025-064

    Missing Authorization vulnerability in Drupal Quick Node Block allows Forceful Browsing.This issue affects Quick Node Block: from 0.0.0 before 2.0.0.

    Drupal Quick Node Block drupal/quick_node_block Packagist
  • Medium 4.8
    CVE-2025-48012

    One Time Password - Moderately critical - Access bypass - SA-CONTRIB-2025-063

    Authentication Bypass by Capture-replay vulnerability in Drupal One Time Password allows Remote Services with Stolen Credentials.This issue affects One Time Password: from 0.0.0 before 1.3.0.

    Drupal One Time Password drupal/one_time_password Packagist
  • Medium 4.8
    CVE-2025-48011

    One Time Password - Moderately critical - Access bypass - SA-CONTRIB-2025-062

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal One Time Password allows Functionality Bypass.This issue affects One Time Password: from 0.0.0 before 1.3.0.

    Drupal One Time Password drupal/one_time_password Packagist
  • Medium 4.8
    CVE-2025-48010

    One Time Password - Moderately critical - Access bypass - SA-CONTRIB-2025-061

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal One Time Password allows Functionality Bypass.This issue affects One Time Password: from 0.0.0 before 1.3.0.

    Drupal One Time Password drupal/one_time_password Packagist
  • Low 3.1
    CVE-2025-48009

    Single Content Sync - Moderately critical - Access bypass - SA-CONTRIB-2025-060

    Missing Authorization vulnerability in Drupal Single Content Sync allows Functionality Misuse.This issue affects Single Content Sync: from 0.0.0 before 1.4.12.

    Drupal Single Content Sync drupal/single_content_sync Packagist
  • High 7.5
    CVE-2025-4416

    Events Log Track - Moderately critical - Denial of Service - SA-CONTRIB-2025-059

    Allocation of Resources Without Limits or Throttling vulnerability in Drupal Events Log Track allows Excessive Allocation.This issue affects Events Log Track: from 0.0.0 before 3.1.11, from 4.0.0 before 4.0.2.

    Drupal Events Log Track drupal/events_log_track Packagist
  • Medium 4.8
    CVE-2025-4415

    Piwik PRO - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-058

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Piwik PRO allows Cross-Site Scripting (XSS).This issue affects Piwik PRO: from 0.0.0 before 1.3.2.

    Drupal Piwik PRO drupal/piwik_pro Packagist
  • High 7.4
    CVE-2025-47710

    Enterprise MFA - TFA for Drupal - Critical - Access bypass - SA-CONTRIB-2025-056

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Enterprise MFA - TFA for Drupal allows Authentication Bypass.This issue affects Enterprise MFA - TFA for Drupal: from 0.0.0 before 4.7.0, from 5.0.0 before 5.2.0.

    Drupal Enterprise MFA - TFA for Drupal drupal/miniorange_2fa Web / CMS Packagist
  • Medium 6.5
    CVE-2025-47709

    Enterprise MFA - TFA for Drupal - Critical - Access bypass - SA-CONTRIB-2025-055

    Missing Authorization vulnerability in Drupal Enterprise MFA - TFA for Drupal allows Forceful Browsing.This issue affects Enterprise MFA - TFA for Drupal: from 0.0.0 before 4.7.0, from 5.0.0 before 5.2.0.

    Drupal Enterprise MFA - TFA for Drupal drupal/miniorange_2fa Web / CMS Packagist
  • High 8.8
    CVE-2025-47708

    Enterprise MFA - TFA for Drupal - Critical - Cross Site Request Forgery - SA-CONTRIB-2025-054

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal Enterprise MFA - TFA for Drupal allows Cross Site Request Forgery.This issue affects Enterprise MFA - TFA for Drupal: from 0.0.0 before 4.7.0, from 5.0.0 before 5.2.0.

    Drupal Enterprise MFA - TFA for Drupal drupal/miniorange_2fa Web / CMS Packagist
  • High 7.5
    CVE-2025-47707

    Enterprise MFA - TFA for Drupal - Moderately critical - Access bypass - SA-CONTRIB-2025-053

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Enterprise MFA - TFA for Drupal allows Authentication Bypass.This issue affects Enterprise MFA - TFA for Drupal: from 0.0.0 before 4.7.0, from 5.0.0 before 5.2.0.

    Drupal Enterprise MFA - TFA for Drupal drupal/miniorange_2fa Web / CMS Packagist
  • Medium 4.8
    CVE-2025-47706

    Enterprise MFA - TFA for Drupal - Moderately critical - Access bypass - SA-CONTRIB-2025-052

    Authentication Bypass by Capture-replay vulnerability in Drupal Enterprise MFA - TFA for Drupal allows Remote Services with Stolen Credentials.This issue affects Enterprise MFA - TFA for Drupal: from 0.0.0 before 4.7.0, from 5.0.0 before 5.2.0.

    Drupal Enterprise MFA - TFA for Drupal drupal/miniorange_2fa Web / CMS Packagist
  • Medium 6.1
    CVE-2025-47705

    IFrame Remove Filter - Moderately critical - Cross site scripting - SA-CONTRIB-2025-051

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal IFrame Remove Filter allows Cross-Site Scripting (XSS).This issue affects IFrame Remove Filter: from 2.0.0 before 2.0.5, from 7.X-1.0 through 7.X-1.5,…

    Drupal IFrame Remove Filter drupal/iframeremove Packagist
  • Medium 6.1
    CVE-2025-47704

    Klaro Cookie & Consent Management - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-050

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Klaro Cookie & Consent Management allows Cross-Site Scripting (XSS).This issue affects Klaro Cookie & Consent Management: from 0.0.0 before 3.0.5.

    Drupal Klaro Cookie & Consent Management drupal/klaro Packagist
  • Medium 6.1
    CVE-2025-47703

    COOKiES Consent Management - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-049

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal COOKiES Consent Management allows Cross-Site Scripting (XSS).This issue affects COOKiES Consent Management: from 0.0.0 before 1.2.14.

    Drupal COOKiES Consent Management drupal/cookies Packagist
  • Medium 6.1
    CVE-2025-47702

    oEmbed Providers - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-048

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal oEmbed Providers allows Cross-Site Scripting (XSS).This issue affects oEmbed Providers: from 0.0.0 before 2.2.2.

    Drupal oEmbed Providers drupal/oembed_providers Packagist