Drupal Security
Drupal Answers
Project: COOKiES Consent Management Date: 2025-July-23 Security risk: Moderately critical 12 ∕ 25 AC:Complex/A:Admin/CI:Some/II:Some/E:Theoretical/TD:All Vulnerability: Cross-site Scripting Affected versions: <1.2.16 CVE IDs: CVE-2025-8092 Description: This module allows you to manage video media items using the COOKiES module (disabling …
Project: Real-time SEO for Drupal Date: 2025-July-16 Security risk: Moderately critical 14 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All Vulnerability: Cross Site Scripting Affected versions: <2.2.0 CVE IDs: CVE-2025-7716 Description: This module enables you to analyze the content that you're authoring for a website. It shows …
Project: Block Attributes Date: 2025-July-16 Security risk: Moderately critical 14 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All Vulnerability: Cross-site Scripting Affected versions: <1.1.0 || >=2.0.0 <2.0.1 CVE IDs: CVE-2025-7715 Description: This module allows you to define custom attributes for a block. You can speci…
Project: File Download Date: 2025-July-16 Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:None/CI:Some/II:None/E:Theoretical/TD:All Vulnerability: Access bypass Affected versions: <1.9.0 || >=2.0.0 <2.0.1 CVE IDs: CVE-2025-7717 Description: The File Download enables you to allow users to download file and image entities direct…
Project: Mail Login Date: 2025-July-09 Security risk: Critical 15 ∕ 25 AC:Complex/A:None/CI:Some/II:Some/E:Theoretical/TD:All Vulnerability: Access bypass Affected versions: >3.0.0 <3.2.0 || >=4.0.0 <4.2.0 CVE IDs: CVE-2025-7393 Description: This module enables users to login by email address with the minimal configurations. The…
Project: Cookies Addons Date: 2025-July-09 Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default Vulnerability: Cross-site Scripting Affected versions: >1.0.0 < 1.2.4 CVE IDs: CVE-2025-7392 Description: This module provides a format filter, which allows you to "disable" iframes (e.g. remove…
Project: Config Pages Viewer Date: 2025-July-02 Security risk: Critical 15 ∕ 25 AC:None/A:None/CI:Some/II:None/E:Theoretical/TD:All Vulnerability: Access bypass Affected versions: <1.0.4 CVE IDs: CVE-2025-7031 Description: This module enables you to use config_pages as a content entity. The module doesn't check permission or entity acces…
Project: Two-factor Authentication (TFA) Date: 2025-July-02 Security risk: Less critical 9 ∕ 25 AC:Basic/A:Admin/CI:Some/II:None/E:Theoretical/TD:Default Vulnerability: Access bypass Affected versions: <1.11.0 CVE IDs: CVE-2025-7030 Description: This module enables you to allow and/or require a second authentication method in addition to …
Project: Paragraphs table Date: 2025-June-25 Security risk: Moderately critical 13 ∕ 25 AC:None/A:Admin/CI:Some/II:Some/E:Theoretical/TD:Uncommon Vulnerability: Cross Site Scripting Affected versions: >=2.0.0 <2.0.5 CVE IDs: CVE-2025-6677 Description: Project Paragraphs table provides a field for a collection table. The module doesn't…
Project: Simple XML sitemap Date: 2025-June-25 Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:All Vulnerability: Cross-site Scripting Affected versions: < 4.2.2 CVE IDs: CVE-2025-6676 Description: Simple XML sitemap is a SEO module that allows creating various XML sitemaps of the site's conten…
Project: Enterprise MFA - TFA for Drupal Date: 2025-June-25 Security risk: Critical 15 ∕ 25 AC:Complex/A:None/CI:Some/II:Some/E:Theoretical/TD:All Vulnerability: Access bypass Affected versions: <4.8.0 || >=5.2.0 <5.2.1 || 5.0.* || 5.1.* CVE IDs: CVE-2025-6675 Description: The module enables you to add second-factor authentication o…
Project: CKEditor5 Youtube Date: 2025-June-25 Security risk: Moderately critical 14 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All Vulnerability: Cross-site Scripting Affected versions: <1.0.3 CVE IDs: CVE-2025-6674 Description: The CKEditor5 Youtube module enhances content creation in Drupal by seamlessly integrating YouTube v…
Project: Klaro Cookie & Consent Management Date: 2025-June-25 Security risk: Moderately critical 14 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All Vulnerability: Cross-site Scripting Affected versions: <3.0.7 CVE IDs: CVE-2025-5682 Description: Klaro Cookie & Consent Management module is used for consent management for …
Project: Open Social Date: 2025-June-25 Security risk: Moderately critical 13 ∕ 25 AC:None/A:User/CI:None/II:Some/E:Theoretical/TD:All Vulnerability: Cross Site Request Forgery Affected versions: <12.3.14 || >=12.4.0 <12.4.13 CVE IDs: CVE-2025-48921 Description: Open Social is a Drupal distribution for online communities, which ship…
Project: GLightbox Date: 2025-June-25 Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default Vulnerability: Cross-site Scripting Affected versions: <1.0.16 CVE IDs: CVE-2025-48922 Description: GLightbox module is a pure Javascript lightbox for CKEditor. The module doesn't sufficiently filter u…
Project: Toc.js Date: 2025-June-25 Security risk: Moderately critical 12 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Uncommon Vulnerability: Cross-site Scripting Affected versions: <3.2.1 CVE IDs: CVE-2025-48923 Description: This module enables you to generate Table of content of your pages given a configuration. The module doe…
Project: COOKiES Consent Management Date: 2025-May-28 Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default Vulnerability: Cross Site Scripting Affected versions: <1.2.15 CVE IDs: CVE-2025-48915 Description: The COOKIES module protects users from executing JavaScript code provided by third par…
Project: COOKiES Consent Management Date: 2025-May-28 Security risk: Moderately critical 12 ∕ 25 AC:Complex/A:Admin/CI:Some/II:Some/E:Theoretical/TD:All Vulnerability: Cross Site Scripting Affected versions: <1.2.15 CVE IDs: CVE-2025-48914 Description: This module provides a format filter, which allows you to "disable" certain HTML elemen…
Project: etracker Date: 2025-May-28 Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default Vulnerability: Cross Site Scripting Affected versions: <3.1.0 CVE IDs: CVE-2025-48920 Description: The module adds the etracker web statistics tracking system to your website. The cookies_etracker submod…
Project: Simple Klaro Date: 2025-May-28 Security risk: Moderately critical 13 ∕ 25 AC:Complex/A:User/CI:Some/II:Some/E:Theoretical/TD:All Vulnerability: Cross Site Scripting Affected versions: <1.10.0 CVE IDs: CVE-2025-48919 Description: The "Simple Klaro" module adds the "Klaro! A Simple Consent Manager" to your website and allows you to…
Project: EU Cookie Compliance (GDPR Compliance) Date: 2025-May-28 Security risk: Moderately critical 13 ∕ 25 AC:Complex/A:User/CI:Some/II:Some/E:Theoretical/TD:All Vulnerability: Cross Site Scripting Affected versions: <1.26.0 CVE IDs: CVE-2025-48917 Description: This module addresses the General Data Protection Regulation (GDPR) and the …
Project: Simple Klaro Date: 2025-May-28 Security risk: Moderately critical 13 ∕ 25 AC:Complex/A:User/CI:Some/II:Some/E:Theoretical/TD:All Vulnerability: Cross Site Scripting Affected versions: <1.10.0 CVE IDs: CVE-2025-48918 Description: The "Simple Klaro" module adds the "Klaro! A Simple Consent Manager" to your website and allows you to…
Project: Bookable Calendar Date: 2025-May-28 Security risk: Less critical 9 ∕ 25 AC:Basic/A:User/CI:Some/II:None/E:Theoretical/TD:Uncommon Vulnerability: Access bypass Affected versions: <2.2.13 CVE IDs: CVE-2025-48916 Description: This module enables you to setup a repeating date rule that users can "book" different dates, allowing you t…
Project: Lightgallery Date: 2025-May-21 Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default Vulnerability: Cross Site Scripting Affected versions: <1.6.0 CVE IDs: CVE-2025-48447 Description: This module integrates Drupal with LightGallery, enabling the use of the LightGallery library with an…
Project: Admin Audit Trail Date: 2025-May-21 Security risk: Less critical 9 ∕ 25 AC:Basic/A:None/CI:None/II:None/E:Theoretical/TD:Default Vulnerability: Denial of Service Affected versions: <1.0.5 CVE IDs: CVE-2025-48448 Description: The Admin Audit Trail module tracks logs of specific events that you'd like to review. When the submodule …
Project: Commerce Alphabank Redirect Date: 2025-May-21 Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:All Vulnerability: Access bypass Affected versions: <1.0.3 CVE IDs: CVE-2025-48446 Description: This module enables you to pay for Commerce order to an environment provided and secured by the b…
Project: Commerce Eurobank (Redirect) Date: 2025-May-21 Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:All Vulnerability: Access bypass Affected versions: <2.1.1 CVE IDs: CVE-2025-48445 Description: This module enables you to pay for Commerce order to an environment provided and secured by the …
Project: Quick Node Block Date: 2025-May-21 Security risk: Moderately critical 13 ∕ 25 AC:None/A:None/CI:Some/II:None/E:Theoretical/TD:Uncommon Vulnerability: Access bypass Affected versions: <2.0.0 CVE IDs: CVE-2025-48013 Description: This module provides a block to easily display a rendered node. Access to the rendered node isn't vali…
Project: Quick Node Block Date: 2025-May-21 Security risk: Moderately critical 11 ∕ 25 AC:Basic/A:None/CI:Some/II:None/E:Theoretical/TD:Uncommon Vulnerability: Access bypass Affected versions: <2.0.0 CVE IDs: CVE-2025-48444 Description: This module provides a block to easily display a rendered node. The module doesn't check access to co…
Project: One Time Password Date: 2025-May-14 Security risk: Moderately critical 14 ∕ 25 AC:Complex/A:None/CI:Some/II:Some/E:Theoretical/TD:Default Vulnerability: Access bypass Affected versions: <1.3.0 CVE IDs: CVE-2025-48012 Description: This module enables you to allow users to include a second authentication method in addition to passw…
Project: One Time Password Date: 2025-May-14 Security risk: Moderately critical 14 ∕ 25 AC:Complex/A:None/CI:Some/II:Some/E:Theoretical/TD:Default Vulnerability: Access bypass Affected versions: <1.3.0 CVE IDs: CVE-2025-48011 Description: This module enables you to allow users to include a second authentication method in addition to passw…
Project: One Time Password Date: 2025-May-14 Security risk: Moderately critical 14 ∕ 25 AC:Complex/A:None/CI:Some/II:Some/E:Theoretical/TD:Default Vulnerability: Access bypass Affected versions: <1.3.0 CVE IDs: CVE-2025-48010 Description: This module enables you to allow users to include a second authentication method in addition to passw…
Project: Single Content Sync Date: 2025-May-14 Security risk: Moderately critical 10 ∕ 25 AC:Complex/A:User/CI:Some/II:None/E:Theoretical/TD:All Vulnerability: Access bypass Affected versions: <1.4.12 CVE IDs: CVE-2025-48009 Description: This module enables you to seamlessly migrate and deploy content across environments, eliminating manu…
Project: Events Log Track Date: 2025-May-14 Security risk: Moderately critical 10 ∕ 25 AC:Basic/A:None/CI:None/II:None/E:Theoretical/TD:All Vulnerability: Denial of Service Affected versions: <3.1.11 || >=4.0.0 <4.0.2 CVE IDs: CVE-2025-4416 Description: The Events Log Track module enables you to log specific events on a Drupal site.…
Project: Piwik PRO Date: 2025-May-14 Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:All Vulnerability: Cross Site Scripting Affected versions: <1.3.2 CVE IDs: CVE-2025-4415 Description: This module enables you to add the Piwik Pro web statistics tracking system to your website. The module doe…
Project: Advanced File Destination Date: 2025-May-14 Security risk: Critical 15 ∕ 25 Critical 16 ∕ 25 AC:Complex/A:Admin/CI:All/II:All/E:Theoretical/TD:All Vulnerability: Multiple vulnerabilities Affected versions: * Description: The Advanced File Destination module enhances file upload management in Drupal by allowing users to choose and create cus…
Project: Enterprise MFA - TFA for Drupal Date: 2025-May-07 Security risk: Critical 15 ∕ 25 AC:Complex/A:None/CI:Some/II:Some/E:Theoretical/TD:All Vulnerability: Access bypass Affected versions: <4.7.0 || >=5.2.0 <5.2.0 || 5.0.* CVE IDs: CVE-2025-47710 Description: The module enables you to add second-factor authentication in additio…
Project: Enterprise MFA - TFA for Drupal Date: 2025-May-07 Security risk: Critical 18 ∕ 25 AC:None/A:None/CI:Some/II:Some/E:Theoretical/TD:All Vulnerability: Access bypass Affected versions: <4.7.0 || >=5.2.0 <5.2.0 || 5.0.* CVE IDs: CVE-2025-47709 Description: The module enables you to add second-factor authentication in addition t…
Project: Enterprise MFA - TFA for Drupal Date: 2025-May-07 Security risk: Critical 18 ∕ 25 AC:None/A:None/CI:Some/II:Some/E:Theoretical/TD:All Vulnerability: Cross Site Request Forgery Affected versions: <4.7.0 || >=5.0.0 <5.2.0 CVE IDs: CVE-2025-47708 Description: The module enables you to add second-factor authentication in additi…
Project: Enterprise MFA - TFA for Drupal Date: 2025-May-07 Security risk: Moderately critical 13 ∕ 25 AC:Complex/A:User/CI:Some/II:Some/E:Theoretical/TD:All Vulnerability: Access bypass Affected versions: <4.7.0 || >=5.0.0 <5.2.0 CVE IDs: CVE-2025-47707 Description: The module enables you to add second-factor authentication in addit…
Project: Enterprise MFA - TFA for Drupal Date: 2025-May-07 Security risk: Moderately critical 14 ∕ 25 AC:Complex/A:None/CI:Some/II:Some/E:Theoretical/TD:Default Vulnerability: Access bypass Affected versions: <4.7.0 || >=5.0.0 <5.2.0 CVE IDs: CVE-2025-47706 Description: The module enables you to add second-factor authentication in a…
Project: IFrame Remove Filter Date: 2025-May-07 Security risk: Moderately critical 14 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All Vulnerability: Cross site scripting Affected versions: <2.0.5 CVE IDs: CVE-2025-47705 Description: This module enables you to add a filter to text formats (Full HTML, Filtered HTML), which will re…
Project: Klaro Cookie & Consent Management Date: 2025-May-07 Security risk: Moderately critical 14 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All Vulnerability: Cross Site Scripting Affected versions: <3.0.5 CVE IDs: CVE-2025-47704 Description: Klaro Cookie & Consent Management module is used for consent management for …
Project: COOKiES Consent Management Date: 2025-May-07 Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default Vulnerability: Cross Site Scripting Affected versions: <1.2.14 CVE IDs: CVE-2025-47703 Description: The COOKIES module protects users from executing JavaScript code provided by third par…
Project: oEmbed Providers Date: 2025-May-07 Security risk: Moderately critical 10 ∕ 25 AC:Complex/A:Admin/CI:Some/II:Some/E:Theoretical/TD:Uncommon Vulnerability: Cross Site Scripting Affected versions: <2.2.2 CVE IDs: CVE-2025-47702 Description: This module extends the core Media module and allows site creators to permit oEmbed providers…
Project: Restrict route by IP Date: 2025-May-07 Security risk: Critical 16 ∕ 25 AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:All Vulnerability: Cross Site Request Forgery Affected versions: <1.3.0 CVE IDs: CVE-2025-47701 Description: The Restrict route by IP module provides an interface to manage route restriction by IP address. The …
Project: Search API Solr Date: 2025-April-23 Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:All Vulnerability: Cross Site Request Forgery Affected versions: <4.3.9 CVE IDs: CVE-2025-3907 Description: This module provides support for creating searches using the Apache Solr search engine and the …
Project: Sportsleague Date: 2025-April-23 Security risk: Critical 16 ∕ 25 AC:Complex/A:Admin/CI:All/II:All/E:Theoretical/TD:All Vulnerability: Unsupported Affected versions: * CVE IDs: CVE-2025-3904 Description: The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by …
Project: UEditor - 百度编辑器 Date: 2025-April-23 Security risk: Critical 16 ∕ 25 AC:Complex/A:Admin/CI:All/II:All/E:Theoretical/TD:All Vulnerability: Unsupported Affected versions: * CVE IDs: CVE-2025-3903 Description: The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed …
Project: Block Class Date: 2025-April-23 Security risk: Moderately critical 12 ∕ 25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:Default Vulnerability: Cross Site Scripting Affected versions: >=4.0.0 <4.0.1 CVE IDs: CVE-2025-3902 Description: Block Class enables you to add custom attributes to blocks. The module did not sufficien…