CVE Database

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal SAML SSO - Service Provider allows Cross-Site Scripting (XSS). This issue affects …

Improper Verification of Cryptographic Signature vulnerability in Drupal SAML SSO - Service Provider allows Signature Spoof. This issue affects SAML SSO - Service Provider versions: …

Observable Timing Discrepancy vulnerability in Drupal SAML SSO - Service Provider allows Brute Force. This issue affects SAML SSO - Service Provider versions: from 0.0.0 …

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal SAML SSO - Service Provider allows Fake the Source of Data. This issue affects SAML …

Improper Certificate Validation vulnerability in Drupal SAML SSO - Service Provider allows Adversary in the Middle (AiTM). This issue affects SAML SSO - Service Provider …

Missing Authorization vulnerability in Drupal SAML SSO - Service Provider allows Forceful Browsing. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to …

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal SafeDelete allows Stored XSS. This issue affects SafeDelete versions: from 0.0.0 to …

Vulnerability in Drupal Patreon. This issue affects Patreon versions: 7.x.

Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Key auth allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Key …

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Feed Block allows Stored XSS. This issue affects Feed Block versions: from …

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal CSP log allows SQL Injection. This issue affects CSP log …

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal Central Authentication System (CAS) Server allows Fake the Source of Data. This issue affects Central …

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal amazee.ai Private AI Provider allows SQL Injection. This issue affects …

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Email Verification / SMS Verification / OTP Verification allows Reflected XSS. This …

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Email Verification / SMS Verification / OTP Verification allows Authentication Bypass. This issue affects …

Missing Authorization vulnerability in Drupal Webform Submissions Delete allows Forceful Browsing. This issue affects Webform Submissions Delete versions: from 0.0.0 to 1.2.0.

Incorrect Authorization vulnerability in Drupal Unpublished Node Permissions allows Forceful Browsing. This issue affects Unpublished Node Permissions versions: from 0.0.0 to 1.8.0.

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal PhotoSwipe - Responsive JavaScript Modal Image Gallery allows Stored XSS. This issue …

Improper Verification of Cryptographic Signature vulnerability in Drupal Monobank payment API allows Signature Spoof. This issue affects Monobank payment API versions: from 0.0.0 to 1.0.3.

Incorrect Authorization vulnerability in Drupal Jsonapi Role Access allows Forceful Browsing. This issue affects Jsonapi Role Access versions: from 0.0.0 to 2.0.2.

Missing Authorization vulnerability in Drupal Islandora allows Forceful Browsing. This issue affects Islandora versions: from 0.0.0 to 2.19.0.

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Component blocks allows Stored XSS. This issue affects Component blocks versions: from …

Missing Authorization vulnerability in Drupal Calculate Working Days allows Forceful Browsing. This issue affects Calculate Working Days versions: from 0.0.0 to 2.0.3.

Missing Authorization vulnerability in Drupal AI Translate allows Forceful Browsing. This issue affects AI Translate versions: from 0.0.0 to 1.3.2, from 1.4.0 to 1.4.1.

Missing Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Forceful Browsing. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.3.13, from 1.4.0 to …

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Stored XSS. This issue affects AI (Artificial Intelligence) …

Missing Authorization vulnerability in Drupal Advanced Search allows Forceful Browsing. This issue affects Advanced Search versions: from 0.0.0 to 2.4.5.

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Drupal Media Library Importer allows Path Traversal. This issue affects Media Library …

Insertion of Sensitive Information into Log File vulnerability in Drupal Mailer Plus Log allows Remote Services with Stolen Credentials. This issue affects Mailer Plus Log …

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass in the handling of FuncIRI attributes. rcube_washtml detected the …

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 passes potentially unsafe content into ImageMagick when resizing images. SVG and EPS were accepted as valid image …

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability in the Bounce (resend) action. rcube_mime::decode_address_list() did not strip …

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability. rcmail_sendmail stripped newline characters only from the Subject and …

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 contains an object injection primitive in rcube_session::unserialize(). A session key prefixed with “!” was treated as having …

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the ImageMagick resource limits to be bypassed during thumbnail generation. When rcube_image falls back to GD, …

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSS scoping bypass in HTML messages. rcube_utils::mod_css_styles() did not treat an at-rule prologue …

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the disabled_actions configuration setting to be bypassed. The check compared only the action name as requested, …

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an IMAP command injection vulnerability. A remote authenticated attacker can exploit this via CRLF …

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSRF validation bypass in the mark-as-junk action of the markasjunk plugin. The plugin …

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a cross-site scripting vulnerability in the password plugin. Error text returned by a password …

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability when a message is forwarded as an attachment. The …

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability. rcmail_sendmail::extract_inline_images() used the media type taken from an inline …

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an incorrect authorization vulnerability in the Modoboa driver of the password plugin. The driver …

Frappe Framework before 16.33.0 contains a blind SQL injection vulnerability in the frappe.desk.doctype.event.event.get_events method, which fails to properly neutralize user-supplied input before including it in …

Vyper 0.4.0b1 through 0.5.0b1 miscompiles unfoldable constants and omitted default arguments from imported modules, because parse_Name resolves their names in the using function's scope rather …

Obot before 0.26.0 contains an authentication bypass vulnerability in the CLI login flow that allows unauthenticated attackers to steal API keys by choosing token request …

OpenRemote 1.2.0 before 1.31.0 contains a missing authorization vulnerability in GatewayServiceResource that allows any authenticated user to start, stop and query gateway tunnels without an …

Grav from 2.0.0 before 2.2.5 contains an improper access control vulnerability in FlexDirectory::dynamicFlexField() that allows page authors to call arbitrary Flex object methods via flex-*@ …

Grav Flex Objects plugin 1.4.0 before 1.4.17 contains an authorization bypass because its generic /api/v1/flex-objects/pages API routes check only directory-level admin.pages permissions, without enforcing the …

Grav Login plugin from 3.6.0 before 3.9.13 contains a missing authorization vulnerability in the login.invite task that allows page authors to obtain super user accounts. …