CVE Intelligence

Vulnerabilidades de Drupal

🔔 Criar alerta RSS

CVEs publicadas que afetam produtos de Drupal: 138 registro(s), com severidade, exploração e correções.

Drupal 22Drupal core 16Drupal Canvas 4AI (Artificial Intelligence) 4OpenID Connect / OAuth client 3Tagify 3Facets 2SAML SSO - Service Provider 2File Access Fix (deprecated) 2Paragraphs 2FlowDrop 2Anti-Spam by CleanTalk 2Login Disable 2CivicTheme Design System 2AI Agents 2Advanced Content Feedback (aka admin feedback) 2Commerce Core 1Umami Analytics 1Drupal AlternativeCommerce (Basket) 1Flag 1LocalGov Workflows 1Facebook Pixel 1API Key manager 1Protected Pages 1Synchronize composer.json With Contrib Modules 1JSON Field 1Reverse Proxy Header 1Currency 1Simple OAuth (OAuth2) & OpenID Connect 1Authenticator Login 1Email TFA 1Plausible tracking 1Commerce guest registration 1ECA: Event - Condition - Action 1Clean RESTful 1Raw Formatter [Meta Tag Formatter] 1Brute force attack protection 1Composer 1Mother May I 1Colorbox 1

Somente exploradas (KEV) →

CVE-2025-9553 Média · 5.3 10/10/2025
API Key manager - Critical - Unsupported - SA-CONTRIB-2025-103
Vulnerability in Drupal API Key manager.This issue affects API Key manager: *.*.
CVE-2025-9552 Média · 5.3 10/10/2025
Synchronize composer.json With Contrib Modules - Critical - Unsupported - SA-CONTRIB-2025-102
Vulnerability in Drupal Synchronize composer.Json With Contrib Modules.This issue affects Synchronize composer.Json With Contrib Modules: *.*.
CVE-2025-9551 Média · 6.5 CWE-307 10/10/2025
Protected Pages - Moderately critical - Access bypass - SA-CONTRIB-2025-101
Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Protected Pages allows Brute Force.This issue affects Protected Pages: from 0.0.0 before 1.8.0, from 7.X-1.0 before 7.X-2.5.
CVE-2025-9550 Média · 6.1 CWE-79 10/10/2025
Facets - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-100
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Facets allows Cross-Site Scripting (XSS).This issue affects Facets: from 0.0.0 before 2.0.10, from 3.0.0 before 3.0.1.
CVE-2025-9549 Média · 6.5 CWE-862 10/10/2025
Facets - Moderately critical - Information Disclosure - SA-CONTRIB-2025-099
Missing Authorization vulnerability in Drupal Facets allows Forceful Browsing.This issue affects Facets: from 0.0.0 before 2.0.10, from 3.0.0 before 3.0.1.
CVE-2025-8093 Alta · 8.8 CWE-288 10/10/2025
Authenticator Login - Moderately critical - Access bypass - SA-CONTRIB-2025-098
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Authenticator Login allows Authentication Bypass.This issue affects Authenticator Login: from 0.0.0 before 2.1.8.
CVE-2020-36193 Alta · 7.5 KEV Alta · 59 CWE-22 18/01/2021
PEAR Archive_Tar Improper Link Resolution Vulnerability
Tar.php in Archive_Tar through 1.4.11 allows write operations with Directory Traversal due to inadequate checking of symbolic links, a related issue to CVE-2020-28948.
CVE-2020-13671 Alta · 8.8 KEV Alta · 62 Exploit público CWE-434 20/11/2020
Drupal core Un-restricted Upload of File
Drupal core does not properly sanitize certain filenames on uploaded files, which can lead to files being interpreted as the incorrect extension and served as the wrong MIME type or executed as PHP for certain hosting configurations. This issue affects: Drupal Drupal Core 9.0 versions prior to 9.0.8, 8.9 versions prior to 8.9.9, 8.8 versions prior to 8.8.11, and 7 versions prior to 7.74.
CVE-2020-28949 Alta · 7.8 KEV Alta · 68 Exploit público 19/11/2020
PEAR Archive_Tar Deserialization of Untrusted Data Vulnerability
Archive_Tar through 1.4.10 has :// filename sanitization only to address phar attacks, and thus any other stream-wrapper attack (such as file:// to overwrite files) can still succeed.
CVE-2020-11023 Média · 6.1 KEV Alta · 67 Exploit público CWE-79 29/04/2020
JQuery Cross-Site Scripting (XSS) Vulnerability
In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.
CVE-2019-6340 Alta · 8.1 KEV Urgente · 76 Exploit público CWE-502 21/02/2019
Drupal Core Remote Code Execution Vulnerability
Some field types do not properly sanitize data from non-form sources in Drupal 8.5.x before 8.5.11 and Drupal 8.6.x before 8.6.10. This can lead to arbitrary PHP code execution in some cases. A site is only affected by this if one of the following conditions is met: The site has the Drupal 8 core RESTful Web Services (rest) module enabled and allows PATCH or POST requests, or the site has another web services module enabled, like JSON:API in Drupal 8, or Services or RESTful Web Services in Drupal 7. (Note: The Drupal 7 Services module itself does not require an update at this time, but you should apply other contributed updates associated with this advisory if Services is in use.)
CVE-2018-7602 Crítica · 9.8 KEV Urgente · 82 Exploit público Ransomware CWE-94 19/07/2018
Execução remota de código no Drupal Core (CVE-2018-7602)
Existe uma vulnerabilidade de execução remota de código em múltiplos subsistemas do Drupal 7.x e 8.x. Isso potencialmente permite que atacantes explorem múltiplos vetores de ataque em um site Drupal, o que pode resultar no comprometimento do site. Esta vulnerabilidade está relacionada ao núcleo do Drupal - Altamente crítica - Execução remota de código - SA-CORE-2018-002. Tanto a SA-CORE-2018-002 quanto esta vulnerabilidade estão sendo exploradas na natureza.
CVE-2018-7600 Crítica · 9.8 KEV Urgente · 93 Exploit público Ransomware CWE-20 29/03/2018
Drupal Core Remote Code Execution Vulnerability
Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because of an issue affecting multiple subsystems with default or common module configurations.