CVSS: 6.1EPSS: 0%CPEs: 4EXPL: 0CVE-2025-31675 – Drupal core - Moderately critical - Cross Site Scripting - SA-CORE-2025-004
https://notcve.org/view.php?id=CVE-2025-31675
31 Mar 2025 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS).This issue affects Drupal core: from 8.0.0 before 10.3.14, from 10.4.0 before 10.4.5, from 11.0.0 before 11.0.13, from 11.1.0 before 11.1.5. • https://www.drupal.org/sa-core-2025-004 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 0CVE-2025-31674 – Drupal core - Moderately critical - Gadget Chain - SA-CORE-2025-003
https://notcve.org/view.php?id=CVE-2025-31674
31 Mar 2025 — Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection.This issue affects Drupal core: from 8.0.0 before 10.3.13, from 10.4.0 before 10.4.3, from 11.0.0 before 11.0.12, from 11.1.0 before 11.1.3. • https://www.drupal.org/sa-core-2025-003 • CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes •
CVSS: 9.1EPSS: 0%CPEs: 4EXPL: 0CVE-2025-31673 – Drupal core - Moderately critical - Access bypass - SA-CORE-2025-002
https://notcve.org/view.php?id=CVE-2025-31673
31 Mar 2025 — Incorrect Authorization vulnerability in Drupal Drupal core allows Forceful Browsing.This issue affects Drupal core: from 8.0.0 before 10.3.13, from 10.4.0 before 10.4.3, from 11.0.0 before 11.0.12, from 11.1.0 before 11.1.3. • https://www.drupal.org/sa-core-2025-002 • CWE-863: Incorrect Authorization •
CVSS: 6.1EPSS: 0%CPEs: 4EXPL: 0CVE-2025-3057 – Drupal core - Critical - Cross site scripting - SA-CORE-2025-001
https://notcve.org/view.php?id=CVE-2025-3057
31 Mar 2025 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS).This issue affects Drupal core: from 8.0.0 before 10.3.13, from 10.4.0 before 10.4.3, from 11.0.0 before 11.0.12, from 11.1.0 before 11.1.3. • https://www.drupal.org/sa-core-2025-001 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 0%CPEs: 3EXPL: 0CVE-2024-55638 – Drupal core - Moderately critical - Gadget chain - SA-CORE-2024-008
https://notcve.org/view.php?id=CVE-2024-55638
09 Dec 2024 — Deserialization of Untrusted Data vulnerability in Drupal Core allows Object Injection.This issue affects Drupal Core: from 7.0 before 7.102, from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9. Deserialization of Untrusted Data vulnerability in Drupal Core allows Object Injection.This issue affects Drupal Core: from 7.0 before 7.102, from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9. Drupal core contains a chain of methods that is exploitable when an insecure deserialization vulnerability exists on the... • https://www.drupal.org/sa-core-2024-008 • CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes •
CVSS: 9.8EPSS: 0%CPEs: 3EXPL: 0CVE-2024-55637 – Drupal core - Moderately critical - Gadget chain - SA-CORE-2024-007
https://notcve.org/view.php?id=CVE-2024-55637
09 Dec 2024 — Deserialization of Untrusted Data vulnerability in Drupal Core allows Object Injection.This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8. Deserialization of Untrusted Data vulnerability in Drupal Core allows Object Injection.This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8. Drupal core contains a chain of methods that is exploitable when an insecure deserialization vulnerability exist... • https://www.drupal.org/sa-core-2024-007 • CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes •
CVSS: 9.8EPSS: 0%CPEs: 3EXPL: 0CVE-2024-55636 – Drupal core - Less critical - Gadget chain - SA-CORE-2024-006
https://notcve.org/view.php?id=CVE-2024-55636
09 Dec 2024 — Deserialization of Untrusted Data vulnerability in Drupal Core allows Object Injection.This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8. Deserialization of Untrusted Data vulnerability in Drupal Core allows Object Injection.This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8. Drupal core contains a chain of methods that is exploitable when an insecure deserialization vulnerability exist... • https://www.drupal.org/sa-core-2024-006 • CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes •
CVSS: 8.1EPSS: 0%CPEs: 3EXPL: 0CVE-2024-55634 – Drupal core - Moderately critical - Access bypass - SA-CORE-2024-004
https://notcve.org/view.php?id=CVE-2024-55634
09 Dec 2024 — A vulnerability in Drupal Core allows Privilege Escalation.This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8. • https://www.drupal.org/sa-core-2024-004 • CWE-178: Improper Handling of Case Sensitivity CWE-289: Authentication Bypass by Alternate Name •
CVSS: 5.4EPSS: 0%CPEs: 3EXPL: 0CVE-2024-12393 – Drupal core - Moderately critical - Cross Site Scripting - SA-CORE-2024-003
https://notcve.org/view.php?id=CVE-2024-12393
09 Dec 2024 — Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Drupal Core allows Cross-Site Scripting (XSS).This issue affects Drupal Core: from 8.8.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8. • https://www.drupal.org/sa-core-2024-003 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •