Vulmon
Recent Vulnerabilities
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
drupal project vulnerabilities and exploits
(subscribe to this query)
4.3
CVSSv2
CVE-2006-1226
Cross-site scripting (XSS) vulnerability in Drupal 4.5.x prior to 4.5.8 and 4.6.x prior to 4.5.8 allows remote malicious users to inject arbitrary web script or HTML via unknown attack vectors.
Drupal Drupal 4.6.1
Drupal Drupal 4.5.1
Drupal Drupal 4.5.2
Drupal Drupal 4.5.0
Drupal Drupal 4.5.3
Drupal Drupal 4.6.0
5.1
CVSSv2
CVE-2006-1228
Session fixation vulnerability in Drupal 4.5.x prior to 4.5.8 and 4.6.x prior to 4.5.8 allows remote malicious users to gain privileges by tricking a user to click on a URL that fixes the session identifier.
Drupal Drupal 4.5.0
Drupal Drupal 4.5.1
Drupal Drupal 4.6.0
Drupal Drupal 4.6.1
Drupal Drupal 4.5.2
Drupal Drupal 4.5.3
5
CVSSv2
CVE-2010-3091
The OpenID module in Drupal 6.x prior to 6.18, and the OpenID module 5.x prior to 5.x-1.4 for Drupal, violates the OpenID 2.0 protocol by not verifying the openid.return_to value, which allows remote malicious users to bypass authentication by leveraging an assertion from an Open...
Drupal Drupal 6.0
Drupal Drupal 6.3
Drupal Drupal 6.4
Drupal Drupal 6.5
Drupal Drupal 6.6
Drupal Drupal 6.11
Drupal Drupal 6.12
Drupal Drupal 6.13
Drupal Drupal 6.14
Drupal Drupal 6.1
Drupal Drupal 6.16
Drupal Drupal 6.2
Drupal Drupal 6.7
Drupal Drupal 6.9
Drupal Drupal 6.10
Drupal Drupal 6.15
Drupal Drupal 6.17
Drupal Drupal 6.8
Peter Wolanin Openid 5.x-1.1
Peter Wolanin Openid 5.x-1.2
Peter Wolanin Openid 5.x-1.3
Peter Wolanin Openid 5.x-1.x
7.5
CVSSv2
CVE-2015-7876
The escapeLike function in sqlsrv/database.inc in the Drupal 7 driver for SQL Server and SQL Azure 7.x-1.x prior to 7.x-1.4 does not properly escape certain characters, which allows remote malicious users to execute arbitrary SQL commands via vectors involving a module using the ...
Drupal 7 Driver For Sql Server And Sql Azure Project Drupal 7 Driver For Sql Server And Sql Azure 7.x-1.0
Drupal 7 Driver For Sql Server And Sql Azure Project Drupal 7 Driver For Sql Server And Sql Azure 7.x-1.1
Drupal 7 Driver For Sql Server And Sql Azure Project Drupal 7 Driver For Sql Server And Sql Azure 7.x-1.2
Drupal 7 Driver For Sql Server And Sql Azure Project Drupal 7 Driver For Sql Server And Sql Azure 7.x-1.3
6
CVSSv2
CVE-2008-6383
SQL injection vulnerability in SpeedTech Organization and Resource Manager (Storm) 5.x prior to 5.x-1.14 and 6.x prior to 6.x-1.18, a module for Drupal, allows remote authenticated users with storm project access to execute arbitrary SQL commands via unspecified vectors.
Drupal Storm 5.x-1.13
Drupal Storm 5.x-1.7
Drupal Storm 5.x-1.4
Drupal Storm 6.x-1.16
Drupal Storm 6.x-1.15
Drupal Storm 6.x-1.14
Drupal Storm 6.x-1.7
Drupal Storm 6.x-1.8
Drupal Storm 6.x-1.x-dev
Drupal Storm 5.x-1.12
Drupal Storm 5.x-1.11
Drupal Storm 5.x-1.5
Drupal Storm 5.x-1.3
Drupal Storm 6.x-1.13
Drupal Storm 6.x-1.12
Drupal Storm 6.x-1.4
Drupal Storm 6.x-1.5
Drupal Storm 5.x-1.8
Drupal Storm 5.x-1.6
Drupal Storm 5.x-1.x-dev
Drupal Storm 6.x-1.17
Drupal Storm 6.x-1.9
2.6
CVSSv2
CVE-2006-2833
Cross-site scripting (XSS) vulnerability in the taxonomy module in Drupal 4.6.8 and 4.7.2 allows remote malicious users to inject arbitrary web script or HTML via inputs that are not properly validated when the page title is output, possibly involving the $names variable.
Drupal Drupal 4.6.8
Drupal Drupal 4.7.2
6.5
CVSSv2
CVE-2009-2372
Drupal 6.x prior to 6.13 does not prevent users from modifying user signatures after the associated comment format has been changed to an administrator-controlled input format, which allows remote authenticated users to inject arbitrary web script, HTML, and possibly PHP code via...
Drupal Drupal
4.3
CVSSv2
CVE-2009-2374
Drupal 5.x prior to 5.19 and 6.x prior to 6.13 does not properly sanitize failed login attempts for pages that contain a sortable table, which includes the username and password in links that can be read from (1) the HTTP referer header of external web sites that are visited from...
Drupal Drupal
6.8
CVSSv2
CVE-2014-9015
Drupal 6.x prior to 6.34 and 7.x prior to 7.34 allows remote malicious users to hijack sessions via a crafted request, as demonstrated by a crafted request to a server that supports both HTTP and HTTPS sessions.
Drupal Drupal
Debian Debian Linux 7.0
4
CVSSv2
CVE-2017-6922
In Drupal core 8.x before 8.3.4 and Drupal core 7.x before 7.56; Private files that have been uploaded by an anonymous user but not permanently attached to content on the site should only be visible to the anonymous user that uploaded them, rather than all anonymous users. Drupal...
Drupal Drupal
Debian Debian Linux 8.0
Debian Debian Linux 9.0
CVSSv2
CVSSv2
CVSSv3
VMScore
Recommendations:
NULL pointer dereference
CVE-2023-52689
CVE-2024-23803
client side
CVE-2023-52696
information disclosure
CVE-2024-35843
CVE-2024-27130
CVE-2023-52697
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
« PREV
1
2
3
4
5
6
7
8
9
NEXT »