Drupal vulnerabilities
576 CVEs and advisories name Drupal as an affected vendor, 4 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2022-25270The Quick Edit module does not properly check entity access in some circumstances.
- CVE-2022-25271Drupal core's form API has a vulnerability where certain contributed or custom modules' forms may be vulnerable to improper input validation
- CVE-2020-13677Under some circumstances, the Drupal core JSON:API module does not properly restrict access to certain content, which may result in unintend
- CVE-2020-13676The QuickEdit module does not properly check access to fields in some circumstances, which can lead to unintended disclosure of field data.
- CVE-2020-13670Information Disclosure vulnerability in file module of Drupal Core allows an attacker to gain access to the file metadata of a permanent pri
- CVE-2020-13674The QuickEdit module does not properly validate access to routes, which could allow cross-site request forgery under some circumstances and
- CVE-2020-13675Drupal's JSON:API and REST/File modules allow file uploads through their HTTP APIs.
- CVE-2020-13673The Entity Embed module provides a filter to allow embedding entities in content fields.
- CVE-2020-13672Cross-site Scripting (XSS) vulnerability in Drupal core's sanitization API fails to properly filter cross-site scripting under certain circu
- CVE-2020-13669Cross-site Scripting (XSS) vulnerability in ckeditor of Drupal Core allows attacker to inject XSS.
- CVE-2020-13668Access bypass in Drupal Core 8/9
- CVE-2020-13688Cross-site scripting vulnerability in l Drupal Core allows an attacker could leverage the way that HTML is rendered for affected forms in or
- CVE-2020-13663Cross Site Request Forgery vulnerability in Drupal Core Form API does not properly handle certain form input from cross-site requests, which
- CVE-2020-13667Access bypass vulnerability in of Drupal Core Workspaces allows an attacker to access data without correct permissions.
- CVE-2020-13664Arbitrary PHP code execution vulnerability in Drupal Core under certain circumstances.
- CVE-2020-13662Open Redirect vulnerability in Drupal Core allows a user to be tricked into visiting a specially crafted link which would redirect them to a
- CVE-2020-13665Access bypass vulnerability in Drupal Core allows JSON:API when JSON:API is in read/write mode.
- CVE-2020-13666Cross-site scripting vulnerability in Drupal Core.
- CVE-2020-13671Drupal core does not properly sanitize certain filenames on uploaded files, which can lead to files being interpreted as the incorrect exten
- CVE-2019-6342Drupal core - Critical - Access bypass - SA-CORE-2019-008
- CVE-2011-2715An SQL Injection vulnerability exists in Drupal 6.20 with Data 6.x-1.0-alpha14 due to insufficient sanitization of table names or column nam
- CVE-2011-2714A Cross-Site Scripting vulnerability exists in Drupal 6.20 with Data 6.x-1.0-alpha14 due to insufficient sanitization of table descriptions,
- CVE-2010-2471Drupal versions 5.x and 6.x has open redirection
- CVE-2019-6341Drupal core - Moderately critical - Cross Site Scripting - SA-CORE-2019-004
- CVE-2019-6340Drupal core - Highly critical - Remote Code Execution
- CVE-2017-6923Access bypass in Drupal 8 views
- CVE-2019-6339PHAR stream wrapper Arbitrary PHP code execution
- CVE-2019-6338third-party PEAR Archive_Tar library updates
- CVE-2017-6922Files uploaded by anonymous users into a private file system can be accessed by other anonymous users
- CVE-2018-7603Search Autocomplete