Drupal
Page 4 of 11 — Drupal CVEs from a corpus of 1057, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-13238 | Medium | 5.4 | 2025-01-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Typogrify allows Cross-Site Scripting (XSS).This i… |
CVE-2024-13237 | Medium | 5.4 | 2025-01-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal File Entity (fieldable files) allows Cross-Site Sc… |
CVE-2024-55638 | Critical | 9.8 | 2024-12-10 | Deserialization of Untrusted Data vulnerability in Drupal Core allows Object Injection.This issue affects Drupal Core: from 7.0 before 7.102, from 8.0.0 before… |
CVE-2024-55637 | Critical | 9.8 | 2024-12-10 | Deserialization of Untrusted Data vulnerability in Drupal Core allows Object Injection.This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 b… |
CVE-2024-55636 | Critical | 9.8 | 2024-12-10 | Deserialization of Untrusted Data vulnerability in Drupal Core allows Object Injection.This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 b… |
CVE-2024-55635 | Medium | 6.1 | 2024-12-10 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Drupal Core allows Cross-Site Scripting (XSS).This… |
CVE-2024-55634 | High | 8.1 | 2024-12-10 | A vulnerability in Drupal Core allows Privilege Escalation.This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 be… |
CVE-2024-12393 | Medium | 5.4 | 2024-12-10 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Drupal Core allows Cross-Site Scripting (XSS).This… |
CVE-2024-11942 | Medium | 5.9 | 2024-12-05 | A vulnerability in Drupal Core allows File Manipulation.This issue affects Drupal Core: from 10.0.0 before 10.2.10. |
CVE-2024-11941 | High | 7.5 | 2024-12-05 | A vulnerability in Drupal Core allows Excessive Allocation.This issue affects Drupal Core: from 10.2.0 before 10.2.2, from 10.1.0 before 10.1.8. |
CVE-2024-45440 | Medium | 5.3 | 2024-08-29 | core/authorize.php in Drupal 11.x-dev allows Full Path Disclosure (even when error logging is None) if the value of hash_salt is file_get_contents of a file th… |
CVE-2024-22362 | High | 7.5 | 2024-01-16 | Drupal contains a vulnerability with improper handling of structural elements. If this vulnerability is exploited, an attacker may be able to cause a denial-of… |
CVE-2023-5256 | High | 7.5 | 2023-09-28 | In certain scenarios, Drupal's JSON:API module will output error backtraces. With some configurations, this may cause sensitive information to be cached and ma… |
CVE-2018-25085 | Low | 2.4 | 2023-05-01 | A vulnerability classified as problematic was found in Responsive Menus 7.x-1.x-dev on Drupal. Affected by this vulnerability is the function responsive_menus_… |
CVE-2023-31250 | Medium | 6.5 | 2023-04-26 | The file download facility doesn't sufficiently sanitize file paths in certain situations. This may result in users gaining access to private files that they s… |
CVE-2022-25278 | Medium | 6.5 | 2023-04-26 | Under certain circumstances, the Drupal core form API evaluates form element access incorrectly. This may lead to a user being able to alter data they should n… |
CVE-2022-25277 | High | 7.2 | 2023-04-26 | Drupal core sanitizes filenames with dangerous extensions upon upload (reference: SA-CORE-2020-012) and strips leading and trailing dots from filenames to prev… |
CVE-2022-25276 | Medium | 6.1 | 2023-04-26 | The Media oEmbed iframe route does not properly validate the iframe domain setting, which allows embeds to be displayed in the context of the primary domain. U… |
CVE-2022-25275 | High | 7.5 | 2023-04-26 | In some situations, the Image module does not correctly check access to image files not stored in the standard public files directory when generating derivativ… |
CVE-2022-25274 | Medium | 5.4 | 2023-04-26 | Drupal 9.3 implemented a generic entity access API for entity revisions. However, this API was not completely integrated with existing permissions, resulting i… |
CVE-2022-25273 | High | 7.5 | 2023-04-26 | Drupal core's form API has a vulnerability where certain contributed or custom modules' forms may be vulnerable to improper input validation. This could allow… |
CVE-2022-39261 | High | 7.5 | 2022-09-28 | Twig is a template language for PHP. Versions 1.x prior to 1.44.7, 2.x prior to 2.15.3, and 3.x prior to 3.4.3 encounter an issue when the filesystem loader lo… |
CVE-2022-31160 | Medium | 6.1 | 2022-07-20 | jQuery UI is a curated set of user interface interactions, effects, widgets, and themes built on top of jQuery. Versions prior to 1.13.2 are potentially vulner… |
CVE-2022-31043 | High | 7.5 | 2022-06-10 | Guzzle is an open source PHP HTTP client. In affected versions `Authorization` headers on requests are sensitive information. On making a request using the `ht… |
CVE-2022-31042 | High | 7.5 | 2022-06-10 | Guzzle is an open source PHP HTTP client. In affected versions the `Cookie` headers on requests are sensitive information. On making a request using the `https… |
CVE-2022-26493 | Critical | 9.8 | 2022-06-03 | Xecurify's miniOrange Premium, Standard, and Enterprise Drupal SAML SP modules possess an authentication and authorization bypass vulnerability. An attacker wi… |
CVE-2022-29248 | High | 8.0 | 2022-05-25 | Guzzle is a PHP HTTP client. Guzzle prior to versions 6.5.6 and 7.4.3 contains a vulnerability with the cookie middleware. The vulnerability is that it is not… |
CVE-2022-24775 | High | 7.5 | 2022-03-21 | guzzlehttp/psr7 is a PSR-7 HTTP message library. Versions prior to 1.8.4 and 2.1.1 are vulnerable to improper header parsing. An attacker could sneak in a new… |
CVE-2022-24729 | Medium | 6.5 | 2022-03-16 | CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. CKEditor4 prior to version 4.18.0 contains a vulnerability in the `dialog` plugin. The vu… |
CVE-2022-24728 | Medium | 5.4 | 2022-03-16 | CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A vulnerability has been discovered in the core HTML processing module and may affect all… |
CVE-2022-25270 | Medium | 6.5 | 2022-02-17 | The Quick Edit module does not properly check entity access in some circumstances. This could result in users with the "access in-place editing" permission vie… |
CVE-2022-25271 | High | 7.5 | 2022-02-16 | Drupal core's form API has a vulnerability where certain contributed or custom modules' forms may be vulnerable to improper input validation. This could allow… |
CVE-2020-13677 | High | 7.5 | 2022-02-11 | Under some circumstances, the Drupal core JSON:API module does not properly restrict access to certain content, which may result in unintended access bypass. S… |
CVE-2020-13676 | Medium | 6.5 | 2022-02-11 | The QuickEdit module does not properly check access to fields in some circumstances, which can lead to unintended disclosure of field data. Sites are only affe… |
CVE-2020-13675 | Critical | 9.8 | 2022-02-11 | Drupal's JSON:API and REST/File modules allow file uploads through their HTTP APIs. The modules do not correctly run all file validation, which causes an acces… |
CVE-2020-13674 | Medium | 6.5 | 2022-02-11 | The QuickEdit module does not properly validate access to routes, which could allow cross-site request forgery under some circumstances and lead to possible da… |
CVE-2020-13673 | Medium | 6.1 | 2022-02-11 | The Entity Embed module provides a filter to allow embedding entities in content fields. In certain circumstances, the filter could allow an unprivileged user… |
CVE-2020-13672 | Medium | 6.1 | 2022-02-11 | Cross-site Scripting (XSS) vulnerability in Drupal core's sanitization API fails to properly filter cross-site scripting under certain circumstances. This issu… |
CVE-2020-13670 | High | 7.5 | 2022-02-11 | Information Disclosure vulnerability in file module of Drupal Core allows an attacker to gain access to the file metadata of a permanent private file that they… |
CVE-2020-13669 | Medium | 6.1 | 2022-02-11 | Cross-site Scripting (XSS) vulnerability in ckeditor of Drupal Core allows attacker to inject XSS. This issue affects: Drupal Core 8.8.x versions prior to 8.8… |
CVE-2020-13668 | Medium | 6.1 | 2022-02-11 | Access Bypass vulnerability in Drupal Core allows for an attacker to leverage the way that HTML is rendered for affected forms in order to exploit the vulnerab… |
CVE-2021-41165 | High | 8.2 | 2021-11-17 | CKEditor4 is an open source WYSIWYG HTML editor. In affected version a vulnerability has been discovered in the core HTML processing module and may affect all… |
CVE-2021-41164 | High | 8.2 | 2021-11-17 | CKEditor4 is an open source WYSIWYG HTML editor. In affected versions a vulnerability has been discovered in the Advanced Content Filter (ACF) module and may a… |
CVE-2021-41184 | Medium | 6.5 | 2021-10-26 | jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `of` option of the `.position()` util from untrust… |
CVE-2021-41183 | Medium | 6.5 | 2021-10-26 | jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of various `*Text` options of the Datepicker widget from… |
CVE-2021-41182 | Medium | 6.5 | 2021-10-26 | jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `altField` option of the Datepicker widget from un… |
CVE-2020-13663 | High | 8.8 | 2021-06-11 | Cross Site Request Forgery vulnerability in Drupal Core Form API does not properly handle certain form input from cross-site requests, which can lead to other… |
CVE-2020-13688 | Medium | 6.1 | 2021-06-11 | Cross-site scripting vulnerability in l Drupal Core allows an attacker could leverage the way that HTML is rendered for affected forms in order to exploit the… |
CVE-2021-33829 | Medium | 6.1 | 2021-06-09 | A cross-site scripting (XSS) vulnerability in the HTML Data Processor in CKEditor 4 4.14.0 through 4.16.x before 4.16.1 allows remote attackers to inject execu… |
CVE-2020-13667 | Medium | 5.3 | 2021-05-17 | Access bypass vulnerability in of Drupal Core Workspaces allows an attacker to access data without correct permissions. The Workspaces module doesn't sufficien… |
CVE-2020-13665 | Critical | 9.8 | 2021-05-05 | Access bypass vulnerability in Drupal Core allows JSON:API when JSON:API is in read/write mode. Only sites that have the read_only set to FALSE under jsonapi.s… |
CVE-2020-13664 | High | 8.8 | 2021-05-05 | Arbitrary PHP code execution vulnerability in Drupal Core under certain circumstances. An attacker could trick an administrator into visiting a malicious site… |
CVE-2020-13662 | Medium | 6.1 | 2021-05-05 | Open Redirect vulnerability in Drupal Core allows a user to be tricked into visiting a specially crafted link which would redirect them to an arbitrary externa… |
CVE-2020-13666 | Medium | 6.1 | 2021-05-05 | Cross-site scripting vulnerability in Drupal Core. Drupal AJAX API does not disable JSONP by default, allowing for an XSS attack. This issue affects: Drupal Dr… |
CVE-2020-36193 | High | 7.5 | 2021-01-18 | Tar.php in Archive_Tar through 1.4.11 allows write operations with Directory Traversal due to inadequate checking of symbolic links, a related issue to CVE-202… |
CVE-2020-35191 | Critical | 9.8 | 2020-12-17 | The official drupal docker images before 8.5.10-fpm-alpine (Alpine specific) contain a blank password for a root user. System using the drupal docker container… |
CVE-2020-13671 | High | 8.8 | 2020-11-20 | Drupal core does not properly sanitize certain filenames on uploaded files, which can lead to files being interpreted as the incorrect extension and served as… |
CVE-2020-28949 | High | 7.8 | 2020-11-19 | Archive_Tar through 1.4.10 has :// filename sanitization only to address phar attacks, and thus any other stream-wrapper attack (such as file:// to overwrite f… |
CVE-2020-28948 | High | 7.8 | 2020-11-19 | Archive_Tar through 1.4.10 allows an unserialization attack because phar: is blocked but PHAR: is not blocked. |
CVE-2019-6342 | Critical | 9.8 | 2020-05-28 | An access bypass vulnerability exists when the experimental Workspaces module in Drupal 8 core is enabled. This can be mitigated by disabling the Workspaces mo… |
CVE-2020-11022 | Medium | 6.9 | 2020-04-29 | In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (… |
CVE-2020-11023 | Medium | 6.9 | 2020-04-29 | In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it… |
CVE-2020-9281 | Medium | 6.1 | 2020-03-07 | A cross-site scripting (XSS) vulnerability in the HTML Data Processor for CKEditor 4.0 before 4.14 allows remote attackers to inject arbitrary web script throu… |
CVE-2013-4226 | Medium | 6.5 | 2020-02-18 | The Authenticated User Page Caching (Authcache) module 7.x-1.x before 7.x-1.5 for Drupal does not properly restrict access to cached pages, which allows remote… |
CVE-2011-2715 | Critical | 9.8 | 2020-01-14 | An SQL Injection vulnerability exists in Drupal 6.20 with Data 6.x-1.0-alpha14 due to insufficient sanitization of table names or column names. |
CVE-2011-2714 | Medium | 6.1 | 2020-01-14 | A Cross-Site Scripting vulnerability exists in Drupal 6.20 with Data 6.x-1.0-alpha14 due to insufficient sanitization of table descriptions, field names, or la… |
CVE-2019-19826 | Critical | 9.8 | 2019-12-16 | The Views Dynamic Fields module through 7.x-1.0-alpha4 for Drupal makes insecure unserialize calls in handlers/views_handler_filter_dynamic_fields.inc, as demo… |
CVE-2011-3373 | Medium | 6.1 | 2019-11-25 | Drupal Views Builk Operations (VBO) module 6.x-1.0 through 6.x-1.10 does not properly escape the vocabulary help when the vocabulary has had user tagging enabl… |
CVE-2012-2079 | High | 8.8 | 2019-11-22 | A cross-site request forgery (CSRF) vulnerability in the Activity module 6.x-1.x for Drupal. |
CVE-2012-2078 | Medium | 4.8 | 2019-11-21 | Cross-site scripting (XSS) vulnerability in the Activity module 6.x-1.x for Drupal. |
CVE-2012-1637 | Medium | 4.8 | 2019-11-21 | Cross-site scripting vulnerability (XSS) in the Quick Tabs module 6.x-2.x before 6.x-2.1, 6.x-3.x before 6.x-3.1, and 7.x-3.x before 7.x-3.3 for Drupal. |
CVE-2011-2726 | High | 7.5 | 2019-11-15 | An access bypass issue was found in Drupal 7.x before version 7.5. If a Drupal site has the ability to attach File upload fields to any entity type in the syst… |
CVE-2019-18856 | High | 7.5 | 2019-11-11 | A Denial Of Service vulnerability exists in the SVG Sanitizer module through 8.x-1.0-alpha1 for Drupal because access to external resources with an SVG use ele… |
CVE-2010-2473 | Medium | 6.5 | 2019-11-07 | Drupal 6.x before 6.16 and 5.x before version 5.22 does not properly block users under certain circumstances. A user with an open session that was blocked coul… |
CVE-2010-2472 | Medium | 4.8 | 2019-11-07 | Locale module and dependent contributed modules in Drupal 6.x before 6.16 and 5.x before version 5.22 do not sanitize the display of language codes, native and… |
CVE-2010-2250 | Medium | 6.1 | 2019-11-07 | Drupal 5.x and 6.x before 6.16 uses a user-supplied value in output during site installation which could allow an attacker to craft a URL and perform a cross-s… |
CVE-2010-2471 | Medium | 6.1 | 2019-11-06 | Drupal versions 5.x and 6.x has open redirection |
CVE-2019-11876 | Medium | 6.1 | 2019-05-24 | In PrestaShop 1.7.5.2, the shop_country parameter in the install/index.php installation script/component is affected by Reflected XSS. Exploitation by a malici… |
CVE-2019-10911 | High | 7.5 | 2019-05-16 | In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, a vulnerability would allow an attacker to authent… |
CVE-2019-10910 | Critical | 9.8 | 2019-05-16 | In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, when service ids allow user input, this could allo… |
CVE-2019-10909 | Medium | 5.4 | 2019-05-16 | In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, validation messages are not escaped, which can lea… |
CVE-2019-11831 | Critical | 9.8 | 2019-05-09 | The PharStreamWrapper (aka phar-stream-wrapper) package 2.x before 2.1.1 and 3.x before 3.1.1 for TYPO3 does not prevent directory traversal, which allows atta… |
CVE-2019-11358 | Medium | 6.1 | 2019-04-20 | jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an… |
CVE-2019-6341 | Medium | 5.4 | 2019-03-26 | In Drupal 7 versions prior to 7.65; Drupal 8.6 versions prior to 8.6.13;Drupal 8.5 versions prior to 8.5.14. Under certain circumstances the File module/subsys… |
CVE-2019-6340 | High | 8.1 | 2019-02-21 | Some field types do not properly sanitize data from non-form sources in Drupal 8.5.x before 8.5.11 and Drupal 8.6.x before 8.6.10. This can lead to arbitrary P… |
CVE-2019-6339 | Critical | 9.8 | 2019-01-22 | In Drupal Core versions 7.x prior to 7.62, 8.6.x prior to 8.6.6 and 8.5.x prior to 8.5.9; A remote code execution vulnerability exists in PHP's built-in phar s… |
CVE-2017-6923 | Medium | 6.5 | 2019-01-22 | In Drupal 8.x prior to 8.3.7 When creating a view, you can optionally use Ajax to update the displayed data via filter parameters. The views subsystem/module d… |
CVE-2017-6922 | Medium | 6.5 | 2019-01-22 | In Drupal core 8.x prior to 8.3.4 and Drupal core 7.x prior to 7.56; Private files that have been uploaded by an anonymous user but not permanently attached to… |
CVE-2019-6338 | High | 8.0 | 2019-01-22 | In Drupal Core versions 7.x prior to 7.62, 8.6.x prior to 8.6.6 and 8.5.x prior to 8.5.9; Drupal core uses the third-party PEAR Archive_Tar library. This libra… |
CVE-2018-7603 | Medium | 6.1 | 2019-01-15 | In Drupal's 3rd party module search auto complete prior to versions 7.x-4.8 there is a Cross Site Scripting vulnerability. This Search Autocomplete module enab… |
CVE-2017-6921 | Medium | 5.9 | 2019-01-15 | In Drupal 8 prior to 8.3.4; The file REST resource does not properly validate some fields when manipulating files. A site is only affected by this if the site… |
CVE-2017-6924 | High | 7.4 | 2019-01-15 | In Drupal 8 prior to 8.3.7; When using the REST API, users without the correct permission can post comments via REST that are approved even if the user does no… |
CVE-2017-6925 | Critical | 9.8 | 2019-01-15 | In versions of Drupal 8 core prior to 8.3.7; There is a vulnerability in the entity access system that could allow unwanted access to view, create, update, or… |
CVE-2017-6920 | Critical | 9.8 | 2018-08-06 | Drupal core 8 before versions 8.3.4 allows remote attackers to execute arbitrary code due to the PECL YAML parser not handling PHP objects safely during certai… |
CVE-2018-14773 | Medium | 6.5 | 2018-08-03 | An issue was discovered in Http Foundation in Symfony 2.7.0 through 2.7.48, 2.8.0 through 2.8.43, 3.3.0 through 3.3.17, 3.4.0 through 3.4.13, 4.0.0 through 4.0… |
CVE-2018-7602 | Critical | 9.8 | 2018-07-19 | A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vec… |
CVE-2018-9861 | Medium | 6.1 | 2018-04-19 | Cross-site scripting (XSS) vulnerability in the Enhanced Image (aka image2) plugin for CKEditor (in versions 4.5.10 through 4.9.1; fixed in 4.9.2), as used in… |
CVE-2018-9205 | High | 7.5 | 2018-04-04 | Vulnerability in avatar_uploader v7.x-1.0-beta8 , The code in view.php doesn't verify users or sanitize the file path. |
CVE-2014-5170 | Critical | 9.8 | 2018-03-29 | The Storage API module 7.x before 7.x-1.6 for Drupal might allow remote attackers to execute arbitrary code by leveraging failure to update .htaccess file cont… |
CVE-2018-7600 | Critical | 9.8 | 2018-03-29 | Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because of an issue affectin… |