Skip to content
OpenAdvisories

Vendor

Drupal

585 known vulnerabilities.

Products

Drupal core 60 Webform 20 Core 19 AI (Artificial Intelligence) 18 SAML SSO - Service Provider 13 Open Social 8 Commerce Core 7 Enterprise MFA - TFA for Drupal 6 Monster Menus 4 Two-factor Authentication (TFA) 4 COOKiES Consent Management 4 Drupal Canvas 4 Tagify 3 Facets 3 OpenID Connect / OAuth client 3 Disable Login Page 3 Single Content Sync 3 Authenticator Login 3 Login Disable 3 Commerce Stripe 3 Gammu SMS Daemon 3 Drupal 3 UI Icons 3 One Time Password 3 Cloud 2 Access code 2 CivicTheme Design System 2 Webform REST 2 Node Access Rebuild Progressive 2 AI Agents 2 Data-module 2 Frontend Editing 2 Paragraphs 2 Anti-Spam by CleanTalk 2 POST File 2 Unpublished Node Permissions 2 Field Permissions 2 Block Attributes 2 ECA: Event - Condition - Action 2 Acquia DAM 2
All Critical High Medium Low Exploited only Public exploit

585 results · Feed

  • High 8.8
    CVE-2025-47701

    Restrict route by IP - Critical - Cross Site Request Forgery - SA-CONTRIB-2025-047

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal Restrict route by IP allows Cross Site Request Forgery.This issue affects Restrict route by IP: from 0.0.0 before 1.3.0.

    Drupal Restrict route by IP drupal/restrict_route_by_ip Packagist
  • Medium 4.3
    CVE-2025-3907

    Search API Solr - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-046

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal Search API Solr allows Cross Site Request Forgery.This issue affects Search API Solr: from 0.0.0 before 4.3.9.

    Drupal Search API Solr drupal/search_api_solr Packagist
  • High 7.3
    CVE-2025-3904

    Sportsleague - Critical - Unsupported - SA-CONTRIB-2025-045

    Vulnerability in Drupal Sportsleague.This issue affects Sportsleague: *.*.

    Drupal Sportsleague
  • High 7.3
    CVE-2025-3903

    UEditor - 百度编辑器 - Critical - Unsupported - SA-CONTRIB-2025-044

    Vulnerability in Drupal UEditor - 百度编辑器.This issue affects UEditor - 百度编辑器: *.*.

    Drupal UEditor - 百度编辑器 drupal/ueditor Packagist
  • Medium 6.1
    CVE-2025-3902

    Block Class - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-043

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Block Class allows Cross-Site Scripting (XSS).This issue affects Block Class: from 4.0.0 before 4.0.1.

    Drupal Block Class drupal/block_class Packagist
  • Medium 6.1
    CVE-2025-3901

    Bootstrap Site Alert - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-042

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Bootstrap Site Alert allows Cross-Site Scripting (XSS).This issue affects Bootstrap Site Alert: from 0.0.0 before 1.13.0, from 3.0.0 before 3.0.4.

    Drupal Bootstrap Site Alert drupal/bootstrap_site_alert Packagist
  • Medium 6.1
    CVE-2025-3900

    Colorbox - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-041

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Colorbox allows Cross-Site Scripting (XSS).This issue affects Colorbox: from 0.0.0 before 2.1.3.

    Drupal Colorbox drupal/colorbox Packagist
  • Medium 5.9
    CVE-2025-3739

    Drupal 8 Google Optimize Hide Page - Critical - Unsupported - SA-CONTRIB-2025-040

    Vulnerability in Drupal Drupal 8 Google Optimize Hide Page.This issue affects Drupal 8 Google Optimize Hide Page: *.*.

    Drupal Drupal 8 Google Optimize Hide Page drupal/d8_google_optimize_hide_page Web / CMS Packagist
  • Medium 5.9
    CVE-2025-3738

    Google Optimize - Critical - Unsupported - SA-CONTRIB-2025-039

    Vulnerability in Drupal Google Optimize.This issue affects Google Optimize: *.*.

    Drupal Google Optimize drupal/google_optimize Packagist
  • Medium 5.9
    CVE-2025-3737

    Google Maps: Store Locator - Critical - Unsupported - SA-CONTRIB-2025-038

    Vulnerability in Drupal Google Maps: Store Locator.This issue affects Google Maps: Store Locator: *.*.

    Drupal Google Maps: Store Locator drupal/gmap_store_locator Packagist
  • Medium 5.9
    CVE-2025-3736

    Simple GTM - Critical - Unsupported - SA-CONTRIB-2025-037

    Vulnerability in Drupal Simple GTM.This issue affects Simple GTM: *.*.

    Drupal Simple GTM drupal/simple_gtm Packagist
  • Medium 5.9
    CVE-2025-3735

    Panelizer (obsolete) - Critical - Unsupported - SA-CONTRIB-2025-036

    Vulnerability in Drupal Panelizer (obsolete).This issue affects Panelizer (obsolete): *.*.

    Drupal Panelizer (obsolete) drupal/panelizer Packagist
  • Medium 5.9
    CVE-2025-3734

    Stage File Proxy - Moderately critical - Denial of Service - SA-CONTRIB-2025-035

    Allocation of Resources Without Limits or Throttling vulnerability in Drupal Stage File Proxy allows Flooding.This issue affects Stage File Proxy: from 0.0.0 before 3.1.5.

    Drupal Stage File Proxy drupal/stage_file_proxy Packagist
  • Medium 6.5
    CVE-2025-3733

    baguetteBox.js - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-034

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal baguetteBox.Js allows Cross-Site Scripting (XSS).This issue affects baguetteBox.Js: from 0.0.0 before 2.0.4, from 3.0.0 before 3.0.1.

    Drupal baguetteBox.js drupal/baguettebox Packagist
  • Medium 6.5
    CVE-2025-3474

    Panels - Critical - Access bypass - SA-CONTRIB-2025-033

    Missing Authentication for Critical Function vulnerability in Drupal Panels allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Panels: from 0.0.0 before 4.9.0.

    Drupal Panels drupal/panels Packagist
  • Medium 5.4
    CVE-2025-3131

    ECA: Event - Condition - Action - Critical - Cross site request forgery - SA-CONTRIB-2025-031

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal ECA: Event - Condition - Action allows Cross Site Request Forgery.This issue affects ECA: Event - Condition - Action: from 0.0.0 before 1.1.12, from 2.0.0 before 2.0.16, from 2.1.0 before 2.1.7, from 0…

    Drupal ECA: Event - Condition - Action drupal/eca Packagist
  • Medium 6.5
    CVE-2025-3475

    WEB-T - Moderately critical - Access bypass, Denial of service - SA-CONTRIB-2025-030

    Allocation of Resources Without Limits or Throttling, Incorrect Authorization vulnerability in Drupal WEB-T allows Excessive Allocation, Content Spoofing.This issue affects WEB-T: from 0.0.0 before 1.1.0.

    Drupal WEB-T drupal/webt Packagist
  • Medium 5.4
    CVE-2025-3130

    Obfuscate - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-029

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Obfuscate allows Stored XSS.This issue affects Obfuscate: from 0.0.0 before 2.0.1.

    Drupal Obfuscate drupal/obfuscate Packagist
  • Medium 4.8
    CVE-2025-3129

    Access code - Moderately critical - Access bypass - SA-CONTRIB-2025-028

    Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Access code allows Brute Force.This issue affects Access code: from 0.0.0 before 2.0.4.

    Drupal Access code drupal/access_code Packagist
  • Medium 6.6
    CVE-2025-3062

    Drupal Admin LTE theme - Critical - Unsupported - SA-CONTRIB-2025-010

    Vulnerability in Drupal Drupal Admin LTE theme.This issue affects Drupal Admin LTE theme: *.*.

    Drupal Drupal Admin LTE theme drupal/druadmin_lte_theme Web / CMS Packagist
  • Medium 6.6
    CVE-2025-3061

    Material Admin - Critical - Unsupported - SA-CONTRIB-2025-006

    Vulnerability in Drupal Material Admin.This issue affects Material Admin: *.*.

    Drupal Material Admin drupal/material_admin Packagist
  • Medium 6.6
    CVE-2025-3060

    Flattern – Multipurpose Bootstrap Business Profile - Critical - Unsupported - SA-CONTRIB-2025-005

    Vulnerability in Drupal Flattern – Multipurpose Bootstrap Business Profile.This issue affects Flattern – Multipurpose Bootstrap Business Profile: *.*.

    Drupal Flattern – Multipurpose Bootstrap Business Profile
  • Medium 5.3
    CVE-2025-3059

    Profile Private - Critical - Unsupported - SA-CONTRIB-2025-002

    Vulnerability in Drupal Profile Private.This issue affects Profile Private: *.*.

    Drupal Profile Private drupal/profile_private Packagist
  • Medium 6.1
    CVE-2025-31697

    Formatter Suite - Moderately critical - Cross site scripting - SA-CONTRIB-2025-026

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Formatter Suite allows Cross-Site Scripting (XSS).This issue affects Formatter Suite: from 0.0.0 before 2.1.0.

    Drupal Formatter Suite drupal/formatter_suite Packagist
  • Medium 6.1
    CVE-2025-31696

    RapiDoc OAS Field Formatter - Moderately critical - Cross site scripting - SA-CONTRIB-2025-025

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal RapiDoc OAS Field Formatter allows Cross-Site Scripting (XSS).This issue affects RapiDoc OAS Field Formatter: from 0.0.0 before 1.0.1.

    Drupal RapiDoc OAS Field Formatter drupal/rapidoc_elements_field_formatter Packagist
  • Medium 6.1
    CVE-2025-31695

    Link field display mode formatter - Moderately critical - Cross site scripting - SA-CONTRIB-2025-024

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Link field display mode formatter allows Cross-Site Scripting (XSS).This issue affects Link field display mode formatter: from 0.0.0 before 1.6.0.

    Drupal Link field display mode formatter drupal/link_field_display_mode_formatter Packagist
  • High 8.1
    CVE-2025-31694

    Two-factor Authentication (TFA) - Moderately critical - Access bypass - SA-CONTRIB-2025-023

    Incorrect Authorization vulnerability in Drupal Two-factor Authentication (TFA) allows Forceful Browsing.This issue affects Two-factor Authentication (TFA): from 0.0.0 before 1.10.0.

    Drupal Two-factor Authentication (TFA) drupal/tfa Packagist
  • Medium 6.6
    CVE-2025-31693

    AI (Artificial Intelligence) - Moderately critical - Gadget Chain - SA-CONTRIB-2025-022

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Drupal AI (Artificial Intelligence) allows OS Command Injection.This issue affects AI (Artificial Intelligence): from 0.0.0 before 1.0.5.

    Drupal AI (Artificial Intelligence) drupal/ai Packagist
  • High 7.5
    CVE-2025-31692

    AI (Artificial Intelligence) - Critical - Remote Code Execution - SA-CONTRIB-2025-021

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Drupal AI (Artificial Intelligence) allows OS Command Injection.This issue affects AI (Artificial Intelligence): from 0.0.0 before 1.0.5.

    Drupal AI (Artificial Intelligence) drupal/ai Packagist
  • Critical 9.8
    CVE-2025-31691

    OAuth2 Server - Moderately critical - Access bypass - SA-CONTRIB-2025-020

    Missing Authorization vulnerability in Drupal OAuth2 Server allows Forceful Browsing.This issue affects OAuth2 Server: from 0.0.0 before 2.1.0.

    Drupal OAuth2 Server drupal/oauth2_server Packagist
  • High 8.8
    CVE-2025-31690

    Cache Utility - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-019

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal Cache Utility allows Cross Site Request Forgery.This issue affects Cache Utility: from 0.0.0 before 1.2.1.

    Drupal Cache Utility drupal/cache_utility Packagist
  • High 8.1
    CVE-2025-31689

    General Data Protection Regulation - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-018

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal General Data Protection Regulation allows Cross Site Request Forgery.This issue affects General Data Protection Regulation: from 0.0.0 before 3.0.1, from 3.1.0 before 3.1.2.

    Drupal General Data Protection Regulation drupal/gdpr Packagist
  • Medium 6.8
    CVE-2025-31688

    Configuration Split - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-017

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal Configuration Split allows Cross Site Request Forgery.This issue affects Configuration Split: from 0.0.0 before 1.10.0, from 2.0.0 before 2.0.2.

    Drupal Configuration Split drupal/config_split Packagist
  • Medium 6.1
    CVE-2025-31687

    SpamSpan filter - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-016

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal SpamSpan filter allows Cross-Site Scripting (XSS).This issue affects SpamSpan filter: from 0.0.0 before 3.2.1.

    Drupal SpamSpan filter drupal/spamspan Packagist
  • High 8.1
    CVE-2025-31686

    Open Social - Less critical - Access bypass, Information Disclosure - SA-CONTRIB-2025-015

    Missing Authorization vulnerability in Drupal Open Social allows Forceful Browsing.This issue affects Open Social: from 0.0.0 before 12.3.11, from 12.4.0 before 12.4.10.

    Drupal Open Social goalgorilla/open_social Packagist
  • Critical 9.1
    CVE-2025-31685

    Open Social - Moderately critical - Access bypass - SA-CONTRIB-2025-014

    Missing Authorization vulnerability in Drupal Open Social allows Forceful Browsing.This issue affects Open Social: from 0.0.0 before 12.3.11, from 12.4.0 before 12.4.10.

    Drupal Open Social goalgorilla/open_social Packagist
  • Medium 6.8
    CVE-2025-31684

    OAuth2 Client - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-013

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal OAuth2 Client allows Cross Site Request Forgery.This issue affects OAuth2 Client: from 0.0.0 before 4.1.3.

    Drupal OAuth2 Client drupal/oauth2_client Packagist
  • Medium 6.8
    CVE-2025-31683

    Google Tag - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-012

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal Google Tag allows Cross Site Request Forgery.This issue affects Google Tag: from 0.0.0 before 1.8.0, from 2.0.0 before 2.0.8.

    Drupal Google Tag drupal/google_tag Packagist
  • Medium 4.8
    CVE-2025-31682

    Google Tag - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-011

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Google Tag allows Cross-Site Scripting (XSS).This issue affects Google Tag: from 0.0.0 before 1.8.0, from 2.0.0 before 2.0.8.

    Drupal Google Tag drupal/google_tag Packagist
  • Critical 9.8
    CVE-2025-31681

    Authenticator Login - Critical - Access bypass - SA-CONTRIB-2025-009

    Missing Authorization vulnerability in Drupal Authenticator Login allows Forceful Browsing.This issue affects Authenticator Login: from 0.0.0 before 2.0.6.

    Drupal Authenticator Login drupal/alogin Packagist