DR
CMS
Drupal
On CISA KEVExploited in the wildRansomware-linked
520
CVEs
8
On KEV
9.8
Max CVSS
72
New 30D
Severity mix
Critical 39High 70Medium 233Low 30
Watch
Add Drupal to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2009-1047 | – | Mar 23 | Cross-site scripting (XSS) vulnerability in the Send by e-mail module in the "Printer, e-mail and PDF versions" module 5.x before 5.x-4.4 and 6.x before 6.x-1.4, a module for… Affected: All versions, or not specified |
| CVE-2008-6171 | – | Feb 19 | includes/bootstrap.inc in Drupal 5.x before 5.12 and 6.x before 6.6, when the server is configured for "IP-based virtual hosts," allows remote attackers to include and execute… Affected: 5.0; 5.1; 5.2; 5.3; 5.4; 5.5; +12 more |
| CVE-2008-6170 | – | Feb 19 | Cross-site scripting (XSS) vulnerability in Drupal 5.x before 5.12 and 6.x before 6.6 allows remote authenticated users with create book content or edit node book hierarchy… Affected: 5.0; 5.1; 5.2; 5.3; 5.4; 5.5; +12 more |
| CVE-2008-4793 | – | Oct 29 | The node module API in Drupal 5.x before 5.11 allows remote attackers to bypass node validation and have unspecified other impact via unknown vectors related to contributed… Affected: through 5.10; 5.0; 5.0; 5.0; 5.0; 5.0; +9 more |
| CVE-2008-4792 | – | Oct 29 | The core BlogAPI module in Drupal 5.x before 5.11 and 6.x before 6.5 does not properly validate unspecified content fields of an internal Drupal form, which allows remote… Affected: 5.0 before 5.11; 6.0 before 6.5 |
| CVE-2008-4791 | – | Oct 29 | The user module in Drupal 5.x before 5.11 and 6.x before 6.5 might allow remote authenticated users to bypass intended login access rules and successfully login via unknown… Affected: 5.0 before 5.11; 6.0 before 6.5 |
| CVE-2008-4790 | – | Oct 29 | The core upload module in Drupal 5.x before 5.11 allows remote authenticated users to bypass intended access restrictions and read "files attached to content" via unknown vectors Affected: through 5.10; 5.0; 5.0; 5.0; 5.0; 5.0; +9 more |
| CVE-2008-4789 | – | Oct 29 | The validation functionality in the core upload module in Drupal 6.x before 6.5 allows remote authenticated users to bypass intended access restrictions and "attach files to… Affected: through 6.4; 6.0; 6.0; 6.0; 6.0; 6.0; +7 more |
| CVE-2008-3661 | – | Sep 23 | Drupal, probably 5.10 and 6.4, does not set the secure flag for the session cookie in an https session, which can cause the cookie to be sent in http requests and make it easier… Affected: 5.10; 6.4 |
| CVE-2008-3743 | – | Aug 27 | Multiple cross-site request forgery (CSRF) vulnerabilities in forms in Drupal 6.x before 6.4 allow remote attackers to perform unspecified actions via unknown vectors, related to… Affected: 6.0; 6.1; 6.2; 6.3 |
| CVE-2008-3745 | – | Aug 27 | The Upload module in Drupal 6.x before 6.4 allows remote authenticated users to edit nodes, delete files, and download unauthorized attachments via unspecified vectors Affected: 6.0; 6.1; 6.2; 6.3 |
| CVE-2008-3740 | – | Aug 27 | Cross-site scripting (XSS) vulnerability in the output filter in Drupal 5.x before 5.10 and 6.x before 6.4 allows remote attackers to inject arbitrary web script or HTML via… Affected: 5.0; 5.1; 5.2; 5.3; 5.4; 5.5; +8 more |
| CVE-2008-3741 | – | Aug 27 | The private filesystem in Drupal 5.x before 5.10 and 6.x before 6.4 trusts the MIME type sent by a web browser, which allows remote authenticated users to conduct cross-site… Affected: 5.0; 5.1; 5.2; 5.3; 5.4; 5.5; +8 more |
| CVE-2008-3742 | – | Aug 27 | Unrestricted file upload vulnerability in the BlogAPI module in Drupal 5.x before 5.10 and 6.x before 6.4 allows remote authenticated users to execute arbitrary code by uploading… Affected: 5.0; 5.1; 5.2; 5.3; 5.4; 5.5; +8 more |
| CVE-2008-3744 | – | Aug 27 | Multiple cross-site request forgery (CSRF) vulnerabilities in Drupal 5.x before 5.10 and 6.x before 6.4 allow remote attackers to hijack the authentication of administrators for… Affected: 5.0; 5.1; 5.2; 5.3; 5.4; 5.5; +8 more |
| CVE-2008-3222 | – | Jul 18 | Session fixation vulnerability in Drupal 5.x before 5.9 and 6.x before 6.3, when contributed modules "terminate the current request during a login event," allows remote attackers… Affected: 5.0 before 5.9; 6.0 before 6.3 |
| CVE-2008-3223 | – | Jul 18 | SQL injection vulnerability in the Schema API in Drupal 6.x before 6.3 allows remote attackers to execute arbitrary SQL commands via vectors related to "an inappropriate… Affected: 6.0 before 6.3 |
| CVE-2008-3218 | – | Jul 18 | Multiple cross-site scripting (XSS) vulnerabilities in Drupal 6.x before 6.3 allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) free tagging… Affected: 6.0 before 6.3 |
| CVE-2008-3219 | – | Jul 18 | The Drupal filter_xss_admin function in 5.x before 5.8 and 6.x before 6.3 does not "prevent use of the object HTML tag in administrator input," which has unknown impact and attack… Affected: 5.0 before 5.8; 6.0 before 6.3 |
| CVE-2008-3220 | – | Jul 18 | Cross-site request forgery (CSRF) vulnerability in Drupal 5.x before 5.8 and 6.x before 6.3 allows remote attackers to perform administrative actions via vectors involving… Affected: 5.0 before 5.8; 6.0 before 6.3 |
| CVE-2008-3221 | – | Jul 18 | Cross-site request forgery (CSRF) vulnerability in Drupal 6.x before 6.3 allows remote attackers to perform administrative actions via vectors involving deletion of OpenID… Affected: 6.0 before 6.3 |
| CVE-2008-2999 | – | Jul 3 | Multiple SQL injection vulnerabilities in the Aggregation module 5.x before 5.x-4.4 for Drupal allow remote attackers to execute arbitrary SQL commands via unspecified vectors Affected: 5.0; 5.1; 5.1_rev1.1; 5.2; 5.3; 5.4; +2 more |
| CVE-2008-2771 | – | Jun 18 | The Node Hierarchy module 5.x before 5.x-1.1 and 6.x before 6.x-1.0 for Drupal does not properly implement access checks, which allows remote attackers with "access content"… Affected: 5.0; 6.0 |
| CVE-2008-1729 | – | Apr 11 | The menu system in Drupal 6 before 6.2 has incorrect menu settings, which allows remote attackers to (1) edit the profile pages of arbitrary users, and obtain sensitive… Affected: 6.0 before 6.2 |
| CVE-2008-1133 | – | Mar 4 | The Drupal.checkPlain function in Drupal 6.0 only escapes the first instance of a character in ECMAScript, which allows remote attackers to conduct cross-site scripting (XSS)… Affected: 6.0 |
| CVE-2008-1131 | – | Mar 4 | Cross-site scripting (XSS) vulnerability in Drupal 6.0 allows remote authenticated users to inject arbitrary web script or HTML via titles in content edit forms Affected: 6.0 |
| CVE-2008-0462 | – | Jan 25 | Cross-site scripting (XSS) vulnerability in the Archive 5.x before 5.x-1.8 module for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors Affected: All versions, or not specified |
| CVE-2008-0276 | – | Jan 15 | Cross-site scripting (XSS) vulnerability in the Devel module before 5.x-0.1 for Drupal allows remote attackers to inject arbitrary web script or HTML via a site variable, related… Affected: 4.0.0; 4.1.0; 4.2.0_rc; 4.4; 4.4.1; 4.4.2; +34 more |
| CVE-2008-0273 | – | Jan 15 | Interpretation conflict in Drupal 4.7.x before 4.7.11 and 5.x before 5.6, when Internet Explorer 6 is used, allows remote attackers to conduct cross-site scripting (XSS) attacks… Affected: 4.0.0; 4.1.0; 4.2.0_rc; 4.4; 4.4.1; 4.4.2; +34 more |
| CVE-2008-0272 | – | Jan 15 | Cross-site request forgery (CSRF) vulnerability in the aggregator module in Drupal 4.7.x before 4.7.11 and 5.x before 5.6 allows remote attackers to delete items from a feed as… Affected: 4.0.0; 4.1.0; 4.2.0_rc; 4.4; 4.4.1; 4.4.2; +34 more |
| CVE-2008-0274 | – | Jan 15 | Cross-site scripting (XSS) vulnerability in Drupal 4.7.x and 5.x, when certain .htaccess protections are disabled, allows remote attackers to inject arbitrary web script or HTML… Affected: 4.7; 5.0 |
| CVE-2007-6299 | – | Dec 10 | Multiple SQL injection vulnerabilities in Drupal and vbDrupal 4.7.x before 4.7.9 and 5.x before 5.4 allow remote attackers to execute arbitrary SQL commands via modules that pass… Affected: 4.0.0; 4.1.0; 4.2.0_rc; 4.4.0; 4.4.1; 4.4.2; +34 more |
| CVE-2007-5621 | – | Oct 22 | Multiple cross-site scripting (XSS) vulnerabilities in the Token module before 4.7.x-1.5, and 5.x before 5.x-1.9, for Drupal; as used by the ASIN Field, e-Commerce, Fullname field… Affected: 4.7; 5.0; 5.1; 5.2 |
| CVE-2007-5597 | – | Oct 19 | The hook_comments API in Drupal 4.7.x before 4.7.8 and 5.x before 5.3 does not pass publication status, which might allow attackers to bypass access restrictions and trigger… Affected: 4.7.0 before 4.7.8; 5.0 before 5.3 |
| CVE-2007-5596 | – | Oct 19 | The core Upload module in Drupal 4.7.x before 4.7.8 and 5.x before 5.3 places the .html extension on a whitelist, which allows remote attackers to conduct cross-site scripting… Affected: 4.7.0 before 4.7.8; 5.0 before 5.3 |
| CVE-2007-5595 | – | Oct 19 | CRLF injection vulnerability in the drupal_goto function in includes/common.inc Drupal 4.7.x before 4.7.8 and 5.x before 5.3 allows remote attackers to inject arbitrary HTTP… Affected: 4.7.0 before 4.7.8; 5.0 before 5.3 |
| CVE-2007-5594 | – | Oct 19 | Drupal 5.x before 5.3 does not apply its Drupal Forms API protection against the user deletion form, which allows remote attackers to delete users via a cross-site request forgery… Affected: 5.0 before 5.3 |
| CVE-2007-5593 | – | Oct 19 | install.php in Drupal 5.x before 5.3, when the configured database server is not reachable, allows remote attackers to execute arbitrary code via vectors that cause settings.php… Affected: 5.0 before 5.3 |
| CVE-2007-5416 | – | Oct 12 | Drupal 5.2 and earlier does not properly unset variables when the input data includes a numeric parameter with a value matching an alphanumeric parameter's hash value, which… Affected: through 5.2 |
| CVE-2007-4063 | – | Jul 30 | Multiple cross-site request forgery (CSRF) vulnerabilities in Drupal 5.x before 5.2 allow remote attackers to (1) delete comments, (2) delete content revisions, and (3) disable… Affected: 5.0; 5.1; 5.1_rev1.1 |
| CVE-2007-4064 | – | Jul 30 | Multiple cross-site scripting (XSS) vulnerabilities in Drupal 5.x before 5.2, and 4.7.x before 4.7.7, (1) allow remote attackers to inject arbitrary web script or HTML via "some… Affected: 4.7; 4.7.0; 4.7.1; 4.7.2; 4.7.3; 4.7.4; +5 more |
| CVE-2007-0658 | – | Feb 1 | The (1) Textimage 4.7.x before 4.7-1.2 and 5.x before 5.x-1.1 module for Drupal and the (2) Captcha 4.7.x before 4.7-1.2 and 5.x before 5.x-1.1 module for Drupal allow remote… Affected: 4.7; 4.7.1; 4.7.2; 4.7.3; 4.7.4; 4.7.5; +4 more |
| CVE-2007-0626 | – | Jan 31 | The comment_form_add_preview function in comment.module in Drupal before 4.7.6, and 5.x before 5.1, and vbDrupal, allows remote attackers with "post comments" privileges and… Affected: after 4.7.0 before 4.7.6; 5.0 before 5.1 |
| CVE-2007-0136 | – | Jan 9 | Multiple cross-site scripting (XSS) vulnerabilities in Drupal before 4.6.11, and 4.7 before 4.7.5, allow remote attackers to inject arbitrary web script or HTML via unspecified… Affected: 4.6.0 before 4.6.11; 4.7.0 before 4.7.5 |
| CVE-2007-0124 | – | Jan 9 | Unspecified vulnerability in Drupal before 4.6.11, and 4.7 before 4.7.5, when MySQL is used, allows remote authenticated users to cause a denial of service by poisoning the page… Affected: 4.6; 4.6.0; 4.6.1; 4.6.2; 4.6.3; 4.6.4; +12 more |
| CVE-2006-5476 | – | Oct 24 | Cross-site request forgery (CSRF) vulnerability in Drupal 4.6.x before 4.6.10 and 4.7.x before 4.7.4 allows remote attackers to perform unauthorized actions as an arbitrary user… Affected: 4.6.0; 4.6.1; 4.6.2; 4.6.3; 4.6.4; 4.6.5; +8 more |
| CVE-2006-5475 | – | Oct 24 | Multiple cross-site scripting (XSS) vulnerabilities in the XML parser in Drupal 4.6.x before 4.6.10 and 4.7.x before 4.7.4 allow remote attackers to inject arbitrary web script or… Affected: 4.6.0; 4.6.1; 4.6.2; 4.6.3; 4.6.4; 4.6.5; +8 more |
| CVE-2006-5477 | – | Oct 24 | Drupal 4.6.x before 4.6.10 and 4.7.x before 4.7.4 allows form submissions to be redirected, which allows remote attackers to obtain arbitrary form information via a crafted URL Affected: 4.6.0; 4.6.1; 4.6.2; 4.6.3; 4.6.4; 4.6.5; +8 more |
| CVE-2006-4120 | – | Aug 14 | Cross-site scripting (XSS) vulnerability in the Recipe module (recipe.module) before 1.54 for Drupal 4.6 and earlier allows remote attackers to inject arbitrary web script or HTML… Affected: through 4.6; 4.0; 4.4.0; 4.4.1; 4.4.2; 4.5; +7 more |
| CVE-2006-4002 | – | Aug 7 | Cross-site scripting (XSS) vulnerability in user.module in Drupal 4.6 before 4.6.9, and 4.7 before 4.7.3, allows remote attackers to inject arbitrary web script or HTML via the… Affected: 4.6.0; 4.6.1; 4.6.2; 4.6.3; 4.6.4; 4.6.5; +6 more |
The 500 most important CVEs for this product (exploited first, then by severity)