Skip to contentDrupal vulnerabilities
Products
Show 46 moreShow less
Newest
- drupalThe multisite feature in Drupal 6.x before 6.32 and 7.x before 7.29 allows remote attackers to...CVE-2014-50195.0 Medium
- drupal, debian linux +1 moreDrupal 6.x before 6.31 and 7.x before 7.27 does not properly isolate the cached data of different...CVE-2014-2983Fix available5.0 Medium
- drupal** DISPUTED ** Cross-site scripting (XSS) vulnerability in the EventCalendar module for Drupal 7...CVE-2014-1607Disputed4.3 Medium
- drupalThe Taxonomy module in Drupal 7.x before 7.26, when upgraded from an earlier version of Drupal,...CVE-2014-14764.0 Medium
- drupalThe OpenID module in Drupal 6.x before 6.30 and 7.x before 7.26 allows remote OpenID users to...CVE-2014-1475Fix available7.5 High
- drupalDrupal has open redirect vulnerability in the Overlay moduleCVE-2013-6389Fix available5.8 Medium
- drupalCross-site scripting (XSS) vulnerability in the Color module in Drupal 7.x before 7.24 allows...CVE-2013-63884.3 Medium
- drupalCross-site scripting (XSS) vulnerability in the Image module in Drupal 7.x before 7.24 allows...CVE-2013-63872.1 Low
- drupalDrupal 6.x before 6.29 and 7.x before 7.24 uses the PHP mt_rand function to generate random...CVE-2013-63866.8 Medium
- drupalThe form API in Drupal 6.x before 6.29 and 7.x before 7.24, when used with unspecified third...CVE-2013-63855.1 Medium
- drupalThe File module in Drupal 7.x before 7.11, when using unspecified field access modules, allows...CVE-2012-08273.5 Low
- drupalCross-site scripting (XSS) vulnerability in Drupal 6.x before 6.28 and 7.x before 7.19, when...CVE-2013-02442.6 Low
- drupalCross-site request forgery (CSRF) vulnerability in the Aggregator module in Drupal 6.x before 6...CVE-2012-08266.8 Medium
- drupalDrupal 6.x before 6.23 and 7.x before 7.11 does not verify that Attribute Exchange (AX)...CVE-2012-08256.8 Medium
- drupalThe Image module in Drupal 7.x before 7.19, when a private file system is used, does not properly...CVE-2013-02464.3 Medium
- drupalThe printer friendly version functionality in the Book module in Drupal 6.x before 6.28 and 7.x...CVE-2013-02452.1 Low
- drupalThe Image module in Drupal 7.x before 7.20 allows remote attackers to cause a denial of service ...CVE-2013-03165.0 Medium
- drupal, debian linux +1 moreThe file upload feature in Drupal 6.x before 6.27 and 7.x before 7.18 allows remote authenticated...CVE-2012-56536.0 Medium
- drupalDrupal 6.x before 6.27 allows remote attackers to obtain sensitive information about uploaded...CVE-2012-56525.0 Medium
- drupalDrupal 6.x before 6.27 and 7.x before 7.18 displays information for blocked users, which might...CVE-2012-56515.0 Medium
- drupalThe OpenID module in Drupal 7.x before 7.16 allows remote OpenID servers to read arbitrary files...CVE-2012-4554EPSS 15.8%5.0 Medium
- drupalDrupal 7.x before 7.16 allows remote attackers to obtain sensitive information and possibly re...CVE-2012-45536.8 Medium
- drupalDrupal improper access restrictionsCVE-2012-2153Fix available4.0 Medium
- drupalThe image module in Drupal 7.x before 7.14 does not properly check permissions when caching...CVE-2012-15915.0 Medium
- drupalThe forum list in Drupal 7.x before 7.14 does not properly check user permissions for unpublished...CVE-2012-15904.0 Medium
- drupalAlgorithmic complexity vulnerability in the _filter_url function in the text filtering system ...CVE-2012-15883.5 Low
- drupal faqMultiple cross-site scripting (XSS) vulnerabilities in the FAQ module 6.x-1.x before 6.x-1.13 and...CVE-2012-16464.3 Medium
- drupal realnameMultiple cross-site scripting (XSS) vulnerabilities in the RealName module 6.x-1.x before 6.x-1.5...CVE-2012-22984.3 Medium
- drupalSQL injection vulnerability in the Addressbook module for Drupal 6.x-4.2 and earlier allows...CVE-2012-23067.5 High
- drupalThe request_path function in includes/bootstrap.inc in Drupal 7.14 and earlier allows remote...CVE-2012-29225.0 Medium
- drupal, nancy wichmann glossary +1 moreCross-site scripting (XSS) vulnerability in the Glossary module 6.x-1.x before 6.x-1.8 for Drupal...CVE-2012-23394.3 Medium
- drupalDrupal Open RedirectCVE-2012-1589Fix available5.8 Medium
- drupal** DISPUTED ** Cross-site request forgery (CSRF) vulnerability in Drupal 7.12 and earlier allows...CVE-2007-6752Public exploitDisputed6.8 Medium
- drupal petition node moduleCross-site scripting (XSS) vulnerability in the Petition Node module 6.x-1.x before 6.x-1.5 for...CVE-2011-45603.5 Low
- drupalDrupal 7.0 allows remote attackers to obtain sensitive information via a direct request to a .php...CVE-2011-37305.0 Medium
- drupalDrupal Access Control BypassCVE-2011-2687Fix available7.5 High
- drupal, peter wolanin openid +1 moreThe OpenID module in Drupal 6.x before 6.18, and the OpenID module 5.x before 5.x-1.4 for Drupal,...CVE-2010-36865.0 Medium
- drupal, peter wolanin openid +1 moreThe OpenID module in Drupal 6.x before 6.18, and the OpenID module 5.x before 5.x-1.4 for Drupal,...CVE-2010-36855.0 Medium
- drupalDrupal cross-site scripting vulnerability via actions feature and trigger moduleCVE-2010-3094Fix available2.1 Low
- drupalThe comment module in Drupal 5.x before 5.23 and 6.x before 6.18 allows remote authenticated...CVE-2010-30933.5 Low
- drupalThe upload module in Drupal 5.x before 5.23 and 6.x before 6.18 does not properly support case...CVE-2010-30925.5 Medium
- drupal, peter wolanin openid +1 moreThe OpenID module in Drupal 6.x before 6.18, and the OpenID module 5.x before 5.x-1.4 for Drupal,...CVE-2010-30915.0 Medium
- drupal devel moduleCross-site scripting (XSS) vulnerability in the Performance logging module in the Devel module 5...CVE-2010-30222.6 Low
- drupal, drupal6 +1 moreDrupal 6.x before 6.16 and 5.x before version 5.22 does not properly block users under certain...CVE-2010-24736.5 Medium
- drupal, drupal6 +1 moreLocale module and dependent contributed modules in Drupal 6.x before 6.16 and 5.x before version...CVE-2010-24724.8 Medium
- drupal, drupal drupal6, debian linux +2 moredrupal6 version 6.16 has open redirectionCVE-2010-24716.1 Medium
- drupal, drupal6 +1 moreDrupal 6.x before 6.16 uses a user-supplied value in output during site installation which could...CVE-2010-22506.1 Medium
- drupal randomizerCross-site scripting (XSS) vulnerability in the Randomizer module 5.x through 5.x-1.0 and 6.x...CVE-2009-46024.3 Medium
- drupalCross-site scripting (XSS) vulnerability in the Locale module (modules/locale/locale.module) in...CVE-2009-43713.5 Low
- drupalCross-site scripting (XSS) vulnerability in the Menu module (modules/menu/menu.admin.inc) in...CVE-2009-43703.5 Low
- Show moreLoading…