CVE-2025-3057

published 2025-03-31

CVE-2025-3057: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS).This…

Priority P4 25 medium 6.1 CVSS 3.1

AV N AC L PR N UI R S C C L I L A N

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS).This issue affects Drupal core: from 8.0.0 before 10.3.13, from 10.4.0 before 10.4.3, from 11.0.0 before 11.0.12, from 11.1.0 before 11.1.3.

Affected

13 ranges

Vendor	Product	Version range	Fixed in
drupal	core	>= 10.4.0 < 10.4.3	10.4.3
drupal	core	>= 11.0.0 < 11.0.12	11.0.12
drupal	core	>= 11.1.0 < 11.1.3	11.1.3
drupal	core	>= 8.0.0 < 10.3.13	10.3.13
drupal	drupal	>= 10.4.0 < 10.4.3	10.4.3
drupal	drupal	>= 11.0.0 < 11.0.12	11.0.12
drupal	drupal	>= 11.1.0 < 11.1.3	11.1.3
drupal	drupal	>= 8.0.0 < 10.3.13	10.3.13
drupal	drupal_core	—	—
drupal	drupal_core	>= 10.4.0 < 10.4.3	10.4.3
drupal	drupal_core	>= 11.0.0 < 11.0.12	11.0.12
drupal	drupal_core	>= 11.1.0 < 11.1.3	11.1.3
drupal	drupal_core	>= 8.0.0 < 10.3.13	10.3.13

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-79