M2
Product
Miniorange 2fa
6
CVEs
0
On KEV
8.8
Max CVSS
0
New 30D
Severity mix
Critical 0High 3Medium 3Low 0
Watch
Add Miniorange 2fa to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-47708 | 8.8 | May 14 | Cross-Site Request Forgery (CSRF) vulnerability in Drupal Enterprise MFA - TFA for Drupal allows Cross Site Request Forgery.This issue affects Enterprise MFA - TFA for Drupal:… Affected: 5.0.0 before 5.2.0; 7.x-2.16 before 8.x-4.7 |
| CVE-2025-47707 | 7.5 | May 14 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Enterprise MFA - TFA for Drupal allows Authentication Bypass.This issue affects Enterprise MFA -… Affected: 5.0.0 before 5.2.0; 7.x-2.16 before 8.x-4.7 |
| CVE-2025-47710 | 7.4 | May 14 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Enterprise MFA - TFA for Drupal allows Authentication Bypass.This issue affects Enterprise MFA -… Affected: 5.0.0 before 5.2.0; 7.x-2.16 before 8.x-4.7 |
| CVE-2025-47709 | 6.5 | May 14 | Missing Authorization vulnerability in Drupal Enterprise MFA - TFA for Drupal allows Forceful Browsing.This issue affects Enterprise MFA - TFA for Drupal: from 0.0.0 before 4.7.0,… Affected: 5.0.0 before 5.2.0; 7.x-2.16 before 8.x-4.7 |
| CVE-2025-6675 | 4.8 | Jun 26 | Enterprise MFA - TFA for Drupal - Critical - Access bypass - SA-CONTRIB-2025-082 Affected: before 4.8.0; 5.0.1 before 5.2.1 |
| CVE-2025-47706 | 4.8 | May 14 | Authentication Bypass by Capture-replay vulnerability in Drupal Enterprise MFA - TFA for Drupal allows Remote Services with Stolen Credentials.This issue affects Enterprise MFA -… Affected: 5.0.0 before 5.2.0; 7.x-2.16 before 8.x-4.7 |
Showing 6