Drupal Vulnerabilities and Affected Products
Vulnerabilities associated with Drupal.
Products
Clear product- Drupal Core49 vulnerabilities
- Core21 vulnerabilities
- AI (Artificial Intelligence)8 vulnerabilities
- Open Social8 vulnerabilities
- Enterprise MFA - TFA for Drupal6 vulnerabilities
- COOKiES Consent Management4 vulnerabilities
- Drupal4 vulnerabilities
- Drupal Canvas4 vulnerabilities
- Two-factor Authentication (TFA)4 vulnerabilities
- Authenticator Login3 vulnerabilities
- Facets3 vulnerabilities
- Login Disable3 vulnerabilities
- One Time Password3 vulnerabilities
- OpenID Connect / OAuth client3 vulnerabilities
- Tagify3 vulnerabilities
- Access code2 vulnerabilities
- Acquia DAM2 vulnerabilities
- Advanced Content Feedback (aka admin_feedback)2 vulnerabilities
- AI Agents2 vulnerabilities
- Anti-Spam by CleanTalk2 vulnerabilities
- CivicTheme Design System2 vulnerabilities
- Colorbox2 vulnerabilities
- Data-module2 vulnerabilities
- drupal_core2 vulnerabilities
- ECA: Event - Condition - Action2 vulnerabilities
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2026-0749MEDIUM | Cross-Site Scripting Vulnerability in Drupal Form Builder ModuleImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Form Builder allows Cross-Site Scripting (XSS).This issue affects Drupal: from 7.X-1.0 through 7.X-1.22. CWE-79Jan 28, 2026 | CVSS4.8v4.0 | EPSS0.204% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-12848HIGH | XSS vulnerability when rendering filename in Webform MultiformWebform Multiple File Upload module for Drupal 7.x contains a cross-site scripting (XSS) vulnerability in the file name renderer. An unauthenticated attacker can exploit this vulnerability by uploading a file with a malicious filename containing JavaScript code (e.g., "<img src=1 onerror=alert(document.domain)>") to a Webform node with a Multifile field where file type validation is disabled. This allows the execution of arbitrary scripts in the context of the victim's browser. The issue is pr… CWE-79Nov 26, 2025 | CVSS7.0v4.0 | EPSS0.341% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
Drupal Full Path Disclosurecore/authorize.php in Drupal 11.x-dev allows Full Path Disclosure (even when error logging is None) if the value of hash_salt is file_get_contents of a file that does not exist. | CVSS-v4.0 | EPSS9.27% | PoCs3 | SignalsNot listed in CISA KEVNo known ransomware use1 Nuclei template | STIX | |
CVE-2023-5256HIGH | Drupal core - Critical - Cache poisoning - SA-CORE-2023-006In certain scenarios, Drupal's JSON:API module will output error backtraces. With some configurations, this may cause sensitive information to be cached and made available to anonymous users, leading to privilege escalation. This vulnerability only affects sites with the JSON:API module enabled, and can be mitigated by uninstalling JSON:API. The core REST and contributed GraphQL modules are not affected. CWE-200Sep 28, 2023 | CVSS7.5v3.1 | EPSS0.694% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |