Drupal vulnerabilities
Published CVEs affecting Drupal products: 180 record(s), with severity, exploitation and fixes.
Drupal 22Drupal core 19AI (Artificial Intelligence) 4Drupal Canvas 4Tagify 3Disable Login Page 3OpenID Connect / OAuth client 3Gammu SMS Daemon 3Anti-Spam by CleanTalk 2CivicTheme Design System 2Facets 2Login Disable 2SAML SSO - Service Provider 2File Access Fix (deprecated) 2Advanced Content Feedback (aka admin feedback) 2AI Agents 2Paragraphs 2FlowDrop 2Screenshot 2UI Icons 1Internationalization (i18n) - i18n node submodule 1Responsive Favicons 1Theme Negotiation by Rules 1Google Analytics GA4 1Access code 1Acquia DAM 1Owl Carousel 2 1HTTP Client Manager 1Drupal Commerce Paybox 1Mini site 1CKEditor 5 Premium Features 1Login Time Restriction 1Next.js 1Entity Share 1Acquia Content Hub 1Quick Edit 1Translate Drupal with GTranslate 1Date iCal 1Node View Permissions 1Colorbox Inline 1
CVE-2020-28949
High · 7.8
KEV High · 68 Public exploit Nov 19, 2020
PEAR Archive_Tar Deserialization of Untrusted Data Vulnerability
Archive_Tar through 1.4.10 has :// filename sanitization only to address phar attacks, and thus any other stream-wrapper attack (such as file:// to overwrite files) can still succeed.
CVE-2020-11023
Medium · 6.1
KEV High · 67 Public exploit CWE-79 Apr 29, 2020
JQuery Cross-Site Scripting (XSS) Vulnerability
In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.
CVE-2019-6340
High · 8.1
KEV Urgent · 76 Public exploit CWE-502 Feb 21, 2019
Drupal Core Remote Code Execution Vulnerability
Some field types do not properly sanitize data from non-form sources in Drupal 8.5.x before 8.5.11 and Drupal 8.6.x before 8.6.10. This can lead to arbitrary PHP code execution in some cases. A site is only affected by this if one of the following conditions is met: The site has the Drupal 8 core RESTful Web Services (rest) module enabled and allows PATCH or POST requests, or the site has another web services module enabled, like JSON:API in Drupal 8, or Services or RESTful Web Services in Drupal 7. (Note: The Drupal 7 Services module itself does not require an update at this time, but you should apply other contributed updates associated with this advisory if Services is in use.)
CVE-2018-7602
Critical · 9.8
KEV Urgent · 88 Public exploit Ransomware CWE-94 Jul 19, 2018
Drupal Core Remote Code Execution Vulnerability
A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result in the site being compromised. This vulnerability is related to Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-002. Both SA-CORE-2018-002 and this vulnerability are being exploited in the wild.
CVE-2018-7600
Critical · 9.8
KEV Urgent · 93 Public exploit Ransomware CWE-20 Mar 29, 2018
Drupal Core Remote Code Execution Vulnerability
Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because of an issue affecting multiple subsystems with default or common module configurations.