Drupal vulnerabilities
758 vulnerabilities
Known vulnerabilities in Drupal products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 396 products.
Products
49 of 396- Drupal274 vulnerabilities
- Drupal Core49 vulnerabilities
- Core19 vulnerabilities
- AI (Artificial Intelligence)8 vulnerabilities
- Open Social8 vulnerabilities
- Enterprise MFA TFA For Drupal6 vulnerabilities
- Project Issue Tracking Module6 vulnerabilities
- Print5 vulnerabilities
- Aggregation Module4 vulnerabilities
- Cookies Consent Management4 vulnerabilities
- Drupal Canvas4 vulnerabilities
- Everyblog4 vulnerabilities
- Project4 vulnerabilities
- Two Factor Authentication (Tfa)4 vulnerabilities
- Authenticator Login3 vulnerabilities
- Content Construction Kit3 vulnerabilities
- Disable Login Page3 vulnerabilities
- Drupal Project Issue Tracking3 vulnerabilities
- Facets3 vulnerabilities
- Gammu SMS Daemon3 vulnerabilities
- Login Disable3 vulnerabilities
- Monster Menus3 vulnerabilities
- One Time Password3 vulnerabilities
- Openid Connect / Oauth Client3 vulnerabilities
- Shindig Integrator3 vulnerabilities
- Tagify3 vulnerabilities
- Ubercart Module3 vulnerabilities
- Access Code2 vulnerabilities
- Acquia DAM2 vulnerabilities
- Activity2 vulnerabilities
- Advanced Content Feedback (Aka Admin Feedback)2 vulnerabilities
- AI Agents2 vulnerabilities
- Ajax Checklist2 vulnerabilities
- Anti Spam By Cleantalk2 vulnerabilities
- Bibliography Module2 vulnerabilities
- Brilliant Gallery2 vulnerabilities
- Chatroom Module2 vulnerabilities
- Civictheme Design System2 vulnerabilities
- Colorbox2 vulnerabilities
- Custom Search Module2 vulnerabilities
- Data2 vulnerabilities
- Data Module2 vulnerabilities
- Database Administration Module2 vulnerabilities
- Diff2 vulnerabilities
- Drupal Easylinks Module2 vulnerabilities
- Email TFA2 vulnerabilities
- File Access Fix (Deprecated)2 vulnerabilities
- File Entity (Fieldable Files)2 vulnerabilities
- Flowdrop2 vulnerabilities
CVE-2018-9861ckeditorenhanced_image+5
EPSS score1.72%
Cross-site scripting (XSS) vulnerability in the Enhanced Image (aka image2) plugin for CKEditor (in versions 4.5.10 through 4.9.1; fixed in 4.9.2), as used in Drupal 8 before 8.4.7 and 8.5.x before 8.5.2 and other products, allows remote attackers to inject arbitrary web script through a crafted IMG element.CVE-2018-9205drupalavatar_uploader+1EPSS score55.08%
Vulnerability in avatar_uploader v7.x-1.0-beta8 , The code in view.php doesn't verify users or sanitize the file path.CVE-2018-14773debiansymfony+4EPSS score57.64%
An issue was discovered in Http Foundation in Symfony 2.7.0 through 2.7.48, 2.8.0 through 2.8.43, 3.3.0 through 3.3.17, 3.4.0 through 3.4.13, 4.0.0 through 4.0.13, and 4.1.0 through 4.1.2. It arises from support for a (legacy) IIS header that lets users override the path in the request URL via the X-Original-URL or X-Rewrite-URL HTTP request header. These headers are designed for IIS support, but it's not verified that the server is in fact running IIS, which means anybody who can send these requests to an application can trigger this. This affects \Symfony\Component\HttpFoundation\Request::prepareRequestUri() where X-Original-URL and X_REWRITE_URL are both used. The fix drops support for these methods so that they cannot be used as attack vectors such as web cache poisoning.CVE-2018-25085drupalresponsive_menusEPSS score0.49%
A vulnerability classified as problematic was found in Responsive Menus 7.x-1.x-dev on Drupal. Affected by this vulnerability is the function responsive_menus_admin_form_submit of the file responsive_menus.module of the component Configuration Setting Handler. The manipulation leads to cross site scripting. The attack can be launched remotely. Upgrading to version 7.x-1.7 is able to address this issue. The patch is named 3c554b31d32a367188f44d44857b061eac949fb8. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-227755.CVE-2018-7602debiandrupal7+4KEVRansomwareEPSS score99.17%
A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result in the site being compromised. This vulnerability is related to Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-002. Both SA-CORE-2018-002 and this vulnerability are being exploited in the wild.CVE-2018-7600debiandrupal7+3KEVRansomwareEPSS score99.99%
Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because of an issue affecting multiple subsystems with default or common module configurations.CVE-2018-7603drupal3rd party module - search autocomplete+1EPSS score0.79%
In Drupal's 3rd party module search auto complete prior to versions 7.x-4.8 there is a Cross Site Scripting vulnerability. This Search Autocomplete module enables you to autocomplete textfield using data from your website (nodes, comments, etc.). The module doesn't sufficiently filter user-entered text among the autocompletion items leading to a Cross Site Scripting (XSS) vulnerability. This vulnerability can be exploited by any user allowed to create one of the autocompletion item, for instance, nodes, users, comments.CVE-2013-0316drupaldrupalEPSS score1.85%
The Image module in Drupal 7.x before 7.20 allows remote attackers to cause a denial of service (CPU and disk space consumption) via a large number of new derivative requests.CVE-2013-0244drupaldrupalEPSS score2.14%
Cross-site scripting (XSS) vulnerability in Drupal 6.x before 6.28 and 7.x before 7.19, when running with older versions of jQuery that are vulnerable to CVE-2011-4969, allows remote attackers to inject arbitrary web script or HTML via vectors involving unspecified Javascript functions that are used to select DOM elements.CVE-2013-0246drupaldrupalEPSS score2.10%
The Image module in Drupal 7.x before 7.19, when a private file system is used, does not properly restrict access to derivative images, which allows remote attackers to read derivative images of otherwise restricted images via unspecified vectors.CVE-2013-0245drupaldrupalEPSS score1.89%
The printer friendly version functionality in the Book module in Drupal 6.x before 6.28 and 7.x before 7.19 does not properly restrict access to node that are part of a book outline, which allows remote authenticated users with the "access printer-friendly version" permission to read node titles and possibly node content via unspecified vectors.CVE-2013-4226drupalauthenticated_user_page_cachingEPSS score1.63%
The Authenticated User Page Caching (Authcache) module 7.x-1.x before 7.x-1.5 for Drupal does not properly restrict access to cached pages, which allows remote attackers with the same role-combination as the superuser to obtain sensitive information via the cached pages of the superuser.CVE-2013-7407drupalmrbs_moduleEPSS score0.58%
Cross-site request forgery (CSRF) vulnerability in the MRBS module for Drupal allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.CVE-2013-6385ubuntudrupal7+1EPSS score3.07%
The form API in Drupal 6.x before 6.29 and 7.x before 7.24, when used with unspecified third-party modules, performs form validation even when CSRF validation has failed, which might allow remote attackers to trigger application-specific impacts such as arbitrary code execution via application-specific vectors.CVE-2013-6389ubuntudrupal7+1EPSS score1.21%
Open redirect vulnerability in the Overlay module in Drupal 7.x before 7.24 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.CVE-2013-6386ubuntudrupal7+1EPSS score2.08%
Drupal 6.x before 6.29 and 7.x before 7.24 uses the PHP mt_rand function to generate random numbers, which uses predictable seeds and allows remote attackers to predict security strings and bypass intended restrictions via a brute force attack.CVE-2013-6388ubuntudrupal7+1EPSS score1.83%
Cross-site scripting (XSS) vulnerability in the Color module in Drupal 7.x before 7.24 allows remote attackers to inject arbitrary web script or HTML via vectors related to CSS.CVE-2013-6387ubuntudrupal7+1EPSS score1.44%
Cross-site scripting (XSS) vulnerability in the Image module in Drupal 7.x before 7.24 allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via the description field.CVE-2021-41183debianjqueryui+34EPSS score8.53%
jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of various `*Text` options of the Datepicker widget from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. The values passed to various `*Text` options are now always treated as pure text, not HTML. A workaround is to not accept the value of the `*Text` options from untrusted sources.CVE-2021-41182debianjqueryui+35EPSS score39.36%
jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `altField` option of the Datepicker widget from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. Any string value passed to the `altField` option is now treated as a CSS selector. A workaround is to not accept the value of the `altField` option from untrusted sources.