U.S. flag   An official website of the United States government
Dot gov

Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Https

Secure .gov websites use HTTPS
A lock (Dot gov) or https:// means you've safely connected to the .gov website. Share sensitive information only on official, secure websites.

National Vulnerability Database

National Vulnerability Database

NVD

National Vulnerability Database
  1. VulnerabilitiesSearch And Statistics

Search Results (Refine Search)

Search Parameters:
  • Results Type: Overview
  • Keyword (text search): drupal
  • Search Type: Search All
There are 1,267 matching records.
Displaying matches 1 through 20.
Vuln ID Summary CVSS Severity
CVE-2025-48920

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal etracker allows Cross-Site Scripting (XSS).This issue affects etracker: from 0.0.0 before 3.1.0.

Published: June 13, 2025; 12:15:27 PM -0400 		V4.0:(not available)
 V3.x:(not available)
 V2.0:(not available)
CVE-2025-48919

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Simple Klaro allows Cross-Site Scripting (XSS).This issue affects Simple Klaro: from 0.0.0 before 1.10.0.

Published: June 13, 2025; 12:15:27 PM -0400 		V4.0:(not available)
 V3.x:(not available)
 V2.0:(not available)
CVE-2025-48918

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Simple Klaro allows Cross-Site Scripting (XSS).This issue affects Simple Klaro: from 0.0.0 before 1.10.0.

Published: June 13, 2025; 12:15:27 PM -0400 		V4.0:(not available)
 V3.x:(not available)
 V2.0:(not available)
CVE-2025-48917

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal EU Cookie Compliance (GDPR Compliance) allows Cross-Site Scripting (XSS).This issue affects EU Cookie Compliance (GDPR Compliance): from 0.0.0 before 1.26.0.

Published: June 13, 2025; 12:15:26 PM -0400 		V4.0:(not available)
 V3.x:(not available)
 V2.0:(not available)
CVE-2025-48916

Missing Authorization vulnerability in Drupal Bookable Calendar allows Forceful Browsing.This issue affects Bookable Calendar: from 0.0.0 before 2.2.13.

Published: June 13, 2025; 12:15:26 PM -0400 		V4.0:(not available)
 V3.x:(not available)
 V2.0:(not available)
CVE-2025-48915

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal COOKiES Consent Management allows Cross-Site Scripting (XSS).This issue affects COOKiES Consent Management: from 0.0.0 before 1.2.15.

Published: June 13, 2025; 12:15:26 PM -0400 		V4.0:(not available)
 V3.x:(not available)
 V2.0:(not available)
CVE-2025-48914

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal COOKiES Consent Management allows Cross-Site Scripting (XSS).This issue affects COOKiES Consent Management: from 0.0.0 before 1.2.15.

Published: June 13, 2025; 12:15:26 PM -0400 		V4.0:(not available)
 V3.x:(not available)
 V2.0:(not available)
CVE-2025-48448

Allocation of Resources Without Limits or Throttling vulnerability in Drupal Admin Audit Trail allows Excessive Allocation.This issue affects Admin Audit Trail: from 0.0.0 before 1.0.5.

Published: June 11, 2025; 11:15:42 AM -0400 		V4.0:(not available)
 V3.x:(not available)
 V2.0:(not available)
CVE-2025-48447

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Lightgallery allows Cross-Site Scripting (XSS).This issue affects Lightgallery: from 0.0.0 before 1.6.0.

Published: June 11, 2025; 11:15:42 AM -0400 		V4.0:(not available)
 V3.x:(not available)
 V2.0:(not available)
CVE-2025-48446

Incorrect Authorization vulnerability in Drupal Commerce Alphabank Redirect allows Functionality Misuse.This issue affects Commerce Alphabank Redirect: from 0.0.0 before 1.0.3.

Published: June 11, 2025; 11:15:42 AM -0400 		V4.0:(not available)
 V3.x:(not available)
 V2.0:(not available)
CVE-2025-48445

Incorrect Authorization vulnerability in Drupal Commerce Eurobank (Redirect) allows Functionality Misuse.This issue affects Commerce Eurobank (Redirect): from 0.0.0 before 2.1.1.

Published: June 11, 2025; 11:15:42 AM -0400 		V4.0:(not available)
 V3.x:(not available)
 V2.0:(not available)
CVE-2025-48444

Missing Authorization vulnerability in Drupal Quick Node Block allows Forceful Browsing.This issue affects Quick Node Block: from 0.0.0 before 2.0.0.

Published: June 11, 2025; 11:15:42 AM -0400 		V4.0:(not available)
 V3.x:(not available)
 V2.0:(not available)
CVE-2025-48013

Missing Authorization vulnerability in Drupal Quick Node Block allows Forceful Browsing.This issue affects Quick Node Block: from 0.0.0 before 2.0.0.

Published: June 11, 2025; 11:15:41 AM -0400 		V4.0:(not available)
 V3.x:(not available)
 V2.0:(not available)
CVE-2025-4416

Allocation of Resources Without Limits or Throttling vulnerability in Drupal Events Log Track allows Excessive Allocation.This issue affects Events Log Track: from 0.0.0 before 3.1.11, from 4.0.0 before 4.0.2.

Published: May 21, 2025; 1:15:59 PM -0400 		V4.0:(not available)
 V3.x:(not available)
 V2.0:(not available)
CVE-2025-4415

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Piwik PRO allows Cross-Site Scripting (XSS).This issue affects Piwik PRO: from 0.0.0 before 1.3.2.

Published: May 21, 2025; 1:15:58 PM -0400 		V4.0:(not available)
 V3.x:(not available)
 V2.0:(not available)
CVE-2025-48012

Authentication Bypass by Capture-replay vulnerability in Drupal One Time Password allows Remote Services with Stolen Credentials.This issue affects One Time Password: from 0.0.0 before 1.3.0.

Published: May 21, 2025; 1:15:58 PM -0400 		V4.0:(not available)
 V3.x:(not available)
 V2.0:(not available)
CVE-2025-48011

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal One Time Password allows Functionality Bypass.This issue affects One Time Password: from 0.0.0 before 1.3.0.

Published: May 21, 2025; 1:15:58 PM -0400 		V4.0:(not available)
 V3.x:(not available)
 V2.0:(not available)
CVE-2025-48010

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal One Time Password allows Functionality Bypass.This issue affects One Time Password: from 0.0.0 before 1.3.0.

Published: May 21, 2025; 1:15:58 PM -0400 		V4.0:(not available)
 V3.x:(not available)
 V2.0:(not available)
CVE-2025-48009

Missing Authorization vulnerability in Drupal Single Content Sync allows Functionality Misuse.This issue affects Single Content Sync: from 0.0.0 before 1.4.12.

Published: May 21, 2025; 1:15:58 PM -0400 		V4.0:(not available)
 V3.x:(not available)
 V2.0:(not available)
CVE-2025-47710

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Enterprise MFA - TFA for Drupal allows Authentication Bypass.This issue affects Enterprise MFA - TFA for Drupal: from 0.0.0 before 4.7.0, from 5.0.0 before 5.2.0.

Published: May 14, 2025; 1:15:50 PM -0400 		V4.0:(not available)
 V3.x:(not available)
 V2.0:(not available)