Skip to contentDrupal vulnerabilities
Products
Show 46 moreShow less
Newest
- drupalDrupal Form API ignores access restrictions on submit buttonsCVE-2016-3165Fix available7.5 High
- drupal, debian linux +1 moreDrupal sensitive information disclosureCVE-2016-3170Fix available5.3 Medium
- drupal, debian linux +1 moreDrupal saving user accounts can sometimes grant the user all rolesCVE-2016-3169Fix available8.1 High
- drupal, debian linux +1 moreDrupal Reflected file download vulnerabilityCVE-2016-3168Fix available6.4 Medium
- drupal, debian linux +1 moreDrupal Open RedirectCVE-2016-3164Fix available7.4 High
- drupal, debian linux +1 moreDrupal Brute force amplification attacks via XML-RPCCVE-2016-3163Fix available7.5 High
- drupal, debian linux +1 moreDrupal File upload access bypass and denial of serviceCVE-2016-3162Fix available8.1 High
- drupal, jquery update project update, labjs project labjs +2 moreOpen redirect vulnerability in the Overlay module in Drupal 7.x before 7.41, the jQuery Update...CVE-2015-7943Fix available6.1 Medium
- chaos tool suite project ctools, drupal, fedoraproject fedora +2 moreCross-site scripting (XSS) vulnerability in the Ajax handler in Drupal 7.x before 7.39 and the...CVE-2015-66654.3 Medium
- drupalDrupal 6.x before 6.37 and 7.x before 7.39 allows remote attackers to obtain sensitive node...CVE-2015-66615.0 Medium
- drupalThe Form API in Drupal 6.x before 6.37 and 7.x before 7.39 does not properly validate the form...CVE-2015-66606.8 Medium
- drupalSQL injection vulnerability in the SQL comment filtering system in the Database API in Drupal 7.x...CVE-2015-66597.5 High
- drupalCross-site scripting (XSS) vulnerability in the Autocomplete system in Drupal 6.x before 6.37 and...CVE-2015-66584.3 Medium
- drupal, debian linux +1 moreThe OpenID module in Drupal 6.x before 6.36 and 7.x before 7.38 allows remote attackers to log...CVE-2015-32344.3 Medium
- drupalOpen redirect vulnerability in the Overlay module in Drupal 7.x before 7.38 allows remote...CVE-2015-32335.8 Medium
- drupal, debian linux +1 moreOpen redirect vulnerability in the Field UI module in Drupal 7.x before 7.38 allows remote...CVE-2015-32325.8 Medium
- drupal, debian linux +1 moreThe Render cache system in Drupal 7.x before 7.38, when used to cache content by user role,...CVE-2015-32314.0 Medium
- drupal, debian linux +1 moreOpen redirect vulnerability in URL-related API functions in Drupal 6.x before 6.35 and 7.x before...CVE-2015-2750Fix available6.1 Medium
- drupal, debian linux +1 moreOpen redirect vulnerability in Drupal 6.x before 6.35 and 7.x before 7.35 allows remote attackers...CVE-2015-2749Fix available6.1 Medium
- drupal, debian linux +1 moreDrupal 6.x before 6.35 and 7.x before 7.35 allows remote authenticated users to reset the...CVE-2015-2559Fix available3.5 Low
- jqueryui jquery ui, apache drill, debian linux +3 more +5 moreCross-site Scripting in jquery-uiCVE-2010-5312Fix availableEPSS 18.4%6.1 Medium
- drupal, debian linux, secure password hashes project passwords hashes +2 moreThe password hashing API in Drupal 7.x before 7.34 and the Secure Password Hashes (aka phpass)...CVE-2014-9016Public exploitEPSS 79.1%5.0 Medium
- drupal, debian linux +1 moreDrupal 6.x before 6.34 and 7.x before 7.34 allows remote attackers to hijack sessions via a...CVE-2014-90156.8 Medium
- drupal organic groups menuThe Organic Groups Menu (aka OG Menu) module before 7.x-2.2 for Drupal allows remote...CVE-2014-87343.5 Low
- drupal mrbs moduleCross-site request forgery (CSRF) vulnerability in the MRBS module for Drupal allows remote...CVE-2013-74076.8 Medium
- drupal modal frameCross-site scripting (XSS) vulnerability in the Modal Frame API module 6.x-1.x before 6.x-1.9 for...CVE-2014-82964.3 Medium
- drupal, debian linux +1 moreThe expandArguments function in the database abstraction API in Drupal core 7.x before 7.32 does...CVE-2014-3704Public exploitFix availableEPSS 100.0%7.5 High
- drupal project issue file reviewMultiple cross-site scripting (XSS) vulnerabilities in the Project Issue File Review module (PIFR...CVE-2014-87654.3 Medium
- drupal doubleclick for publishersCross-site scripting (XSS) vulnerability in the Google Doubleclick for Publishers (DFP) module 7...CVE-2014-87483.5 Low
- drupal commonsCross-site scripting (XSS) vulnerability in the Drupal Commons module 7.x-3.x before 7.x-3.9 for...CVE-2014-87474.3 Medium
- drupal skeleton themeCross-site scripting (XSS) vulnerability in the Skeleton theme 7.x-1.2 through 7.x-1.3 before 7.x...CVE-2014-87463.5 Low
- drupal custom search moduleCross-site scripting (XSS) vulnerability in the Custom Search module 6.x-1.x before 6.x-1.13 and...CVE-2014-87453.5 Low
- drupal nivo sliderCross-site scripting (XSS) vulnerability in the Nivo Slider module 7.x-2.x before 7.x-1.11 for...CVE-2014-87443.5 Low
- drupal maestroMultiple cross-site scripting (XSS) vulnerabilities in the Maestro module 7.x-1.x before 7.x-1.4...CVE-2014-87433.5 Low
- drupal mayoCross-site scripting (XSS) vulnerability in the MAYO theme 7.x-1.x before 7.x-1.3 for Drupal...CVE-2014-80794.0 Medium
- drupal printCross-site scripting (XSS) vulnerability in the Print (aka Printer, e-mail and PDF versions)...CVE-2014-80783.5 Low
- drupal newsflashCross-site scripting (XSS) vulnerability in the NewsFlash theme 6.x-1.x before 6.x-1.7 and 7.x-1...CVE-2014-80773.5 Low
- drupal professional themeCross-site scripting (XSS) vulnerability in the Professional theme 7.x before 7.x-2.04 for Drupal...CVE-2014-80763.5 Low
- drupal tribuneCross-site scripting (XSS) vulnerability in the Tribune module 6.x-1.x and 7.x-3.x for Drupal...CVE-2014-80753.5 Low
- drupal zenMultiple cross-site scripting (XSS) vulnerabilities in template.php in Zen theme 7.x-3.x before 7...CVE-2014-79803.5 Low
- drupal simplecorpCross-site scripting (XSS) vulnerability in the SimpleCorp theme 7.x-1.x before 7.x-1.1 for...CVE-2014-79793.5 Low
- drupal bluemastersCross-site scripting (XSS) vulnerability in the BlueMasters theme 7.x-2.x before 7.x-2.1 for...CVE-2014-79783.5 Low
- drupal custom search moduleCross-site scripting (XSS) vulnerability in the Custom Search module 6.x-1.x before 6.x-1.12 and...CVE-2014-78703.5 Low
- drupal context form alteration moduleCross-site scripting (XSS) vulnerability in the configuration UI in the Context Form Alteration...CVE-2014-78693.5 Low
- drupalmodules/openid/xrds.inc in Drupal 6.x before 6.33 and 7.x before 7.31 allows remote attackers to...CVE-2014-52676.8 Medium
- drupal, wordpress, debian linux +2 moreThe Incutio XML-RPC (IXR) Library, as used in WordPress before 3.9.2 and Drupal 6.x before 6.33...CVE-2014-5266Fix availableEPSS 25.2%5.0 Medium
- drupal, wordpress, debian linux +2 moreThe Incutio XML-RPC (IXR) Library, as used in WordPress before 3.9.2 and Drupal 6.x before 6.33...CVE-2014-5265Fix available5.0 Medium
- drupalCross-site scripting (XSS) vulnerability in the Ajax system in Drupal 7.x before 7.29 allows...CVE-2014-50224.3 Medium
- drupalCross-site scripting (XSS) vulnerability in the Form API in Drupal 6.x before 6.32 and possibly 7...CVE-2014-50212.1 Low
- drupalThe File module in Drupal 7.x before 7.29 does not properly check permissions to view files,...CVE-2014-50204.9 Medium
- Show moreLoading…