Drupal Core vulnerabilities

CVE-2020-13663 [HIGH] CWE-352 CVE-2020-13663: Cross Site Request Forgery vulnerability in Drupal Core Form API does not properly handle certain fo Cross Site Request Forgery vulnerability in Drupal Core Form API does not properly handle certain form input from cross-site requests, which can lead to other vulnerabilities.

CVE-2017-6923 [MEDIUM] CWE-862 CVE-2017-6923: In Drupal 8.x prior to 8.3.7 When creating a view, you can optionally use Ajax to update the display In Drupal 8.x prior to 8.3.7 When creating a view, you can optionally use Ajax to update the displayed data via filter parameters. The views subsystem/module did not restrict access to the Ajax endpoint to only views configured to use Ajax. This is mitigated if you have access restrictions on the view. It is best practice to always include some form o

CVE-2025-13081 [MEDIUM] CWE-915 CVE-2025-13081: Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drup Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection.This issue affects Drupal core: from 8.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0 before 11.1.9, from 11.2.0 before 11.2.8.

CVE-2017-6921 [MEDIUM] CWE-20 CVE-2017-6921: In Drupal 8 prior to 8.3.4; The file REST resource does not properly validate some fields when manip In Drupal 8 prior to 8.3.4; The file REST resource does not properly validate some fields when manipulating files. A site is only affected by this if the site has the RESTful Web Services (rest) module enabled, the file REST resource is enabled and allows PATCH requests, and an attacker can get or register a user account on the site with permissions to

CVE-2019-6341 [MEDIUM] CWE-79 CVE-2019-6341: In Drupal 7 versions prior to 7.65; Drupal 8.6 versions prior to 8.6.13;Drupal 8.5 versions prior to In Drupal 7 versions prior to 7.65; Drupal 8.6 versions prior to 8.6.13;Drupal 8.5 versions prior to 8.5.14. Under certain circumstances the File module/subsystem allows a malicious user to upload a file that can trigger a cross-site scripting (XSS) vulnerability.

CVE-2024-11942 [MEDIUM] CWE-390 CVE-2024-11942: A vulnerability in Drupal Core allows File Manipulation.This issue affects Drupal Core: from 10.0.0 A vulnerability in Drupal Core allows File Manipulation.This issue affects Drupal Core: from 10.0.0 before 10.2.10.

CVE-2017-6379 [HIGH] CWE-352 CVE-2017-6379: Some administrative paths in Drupal 8.2.x before 8.2.7 did not include protection for CSRF. This wou Some administrative paths in Drupal 8.2.x before 8.2.7 did not include protection for CSRF. This would allow an attacker to disable some blocks on a site. This issue is mitigated by the fact that users would have to know the block ID.

CVE-2020-13666 [MEDIUM] CWE-79 CVE-2020-13666: Cross-site scripting vulnerability in Drupal Core. Drupal AJAX API does not disable JSONP by default Cross-site scripting vulnerability in Drupal Core. Drupal AJAX API does not disable JSONP by default, allowing for an XSS attack. This issue affects: Drupal Drupal Core 7.x versions prior to 7.73; 8.8.x versions prior to 8.8.10; 8.9.x versions prior to 8.9.6; 9.0.x versions prior to 9.0.6.

CVE-2025-13080 [MEDIUM] CWE-754 CVE-2025-13080: Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal Drupal core allows Forc Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal Drupal core allows Forceful Browsing.This issue affects Drupal core: from 8.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0 before 11.1.9, from 11.2.0 before 11.2.8.

CVE-2020-13667 [MEDIUM] CWE-276 CVE-2020-13667: Access bypass vulnerability in of Drupal Core Workspaces allows an attacker to access data without c Access bypass vulnerability in of Drupal Core Workspaces allows an attacker to access data without correct permissions. The Workspaces module doesn't sufficiently check access permissions when switching workspaces, leading to an access bypass vulnerability. An attacker might be able to see content before the site owner intends people to see the cont

CVE-2020-13688 [MEDIUM] CWE-79 CVE-2020-13688: Cross-site scripting vulnerability in l Drupal Core allows an attacker could leverage the way that H Cross-site scripting vulnerability in l Drupal Core allows an attacker could leverage the way that HTML is rendered for affected forms in order to exploit the vulnerability. This issue affects: Drupal Core 8.8.X versions prior to 8.8.10; 8.9.X versions prior to 8.9.6; 9.0.X versions prior to 9.0.6.

CVE-2020-13662 [MEDIUM] CWE-601 CVE-2020-13662: Open Redirect vulnerability in Drupal Core allows a user to be tricked into visiting a specially cra Open Redirect vulnerability in Drupal Core allows a user to be tricked into visiting a specially crafted link which would redirect them to an arbitrary external URL. This issue affects: Drupal Drupal Core 7 version 7.70 and prior versions.

CVE-2026-6365 [MEDIUM] CWE-79 CVE-2026-6365: Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability i Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects Drupal core: from 8.0.0 before 10.5.9, from 10.6.0 before 10.6.7, from 11.0.0 before 11.2.11, from 11.3.0 before 11.3.7.

CVE-2026-6367 [MEDIUM] CWE-79 CVE-2026-6367: Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability i Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects Drupal core: from 11.3.0 before 11.3.7.

CVE-2025-3057 [MEDIUM] CWE-79 CVE-2025-3057: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS).This issue affects Drupal core: from 8.0.0 before 10.3.13, from 10.4.0 before 10.4.3, from 11.0.0 before 11.0.12, from 11.1.0 before 11.1.3.

CVE-2025-31675 [MEDIUM] CWE-79 CVE-2025-31675: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS).This issue affects Drupal core: from 8.0.0 before 10.3.14, from 10.4.0 before 10.4.5, from 11.0.0 before 11.0.13, from 11.1.0 before 11.1.5. It also affects the Drupal 7 module from versions 7.x-1.

CVE-2025-31673 [MEDIUM] CWE-863 CVE-2025-31673: Incorrect Authorization vulnerability in Drupal Drupal core allows Forceful Browsing.This issue affe Incorrect Authorization vulnerability in Drupal Drupal core allows Forceful Browsing.This issue affects Drupal core: from 8.0.0 before 10.3.13, from 10.4.0 before 10.4.3, from 11.0.0 before 11.0.12, from 11.1.0 before 11.1.3.

CVE-2024-55635 [MEDIUM] CWE-79 CVE-2024-55635: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerab Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Drupal Core allows Cross-Site Scripting (XSS).This issue affects Drupal Core: from 7.0 before 7.102.

CVE-2024-12393 [MEDIUM] CWE-79 CVE-2024-12393: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerab Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Drupal Core allows Cross-Site Scripting (XSS).This issue affects Drupal Core: from 8.8.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8.

CVE-2025-13083 [LOW] CWE-525 CVE-2025-13083: Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Drupal core allows Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Drupal core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Drupal core: from 8.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0 before 11.1.9, from 11.2.0 before 11.2.8, from 7.0 before 7.103.