gin-vue-admin through 2.9.2 contains a path traversal vulnerability that allows authenticated administrators to recursively delete arbitrary directories by supplying traversal sequences in the pluginName parameter. Attackers can send a crafted POST request to /autoCode/removePlugin with '../' sequences, causing os.RemoveAll to delete any directory writable by the server process.
pdfmake versions 0.3.8 through 0.3.11 have a vulnerability where the setLocalAccessPolicy() restriction is not enforced on images referenced inside SVG content. This allows attackers to embed SVG images with href attributes pointing to local file paths, potentially exposing restricted local file contents in generated PDFs.
The Frontend editing module for Drupal allows editors to modify content directly on the rendered page. A vulnerability exists due to insufficient protection against Cross-Site Request Forgery (CSRF) on routes used to delete and reorder paragraphs. An attacker could exploit this by tricking a logged-in editor with appropriate permissions into visiting a crafted link, causing unintended deletion or reordering of content paragraphs.
A flaw was found in multicluster-global-hub-operator-bundle. The operator is configured with overly broad role-based access control (RBAC) permissions that grant cluster-wide impersonation of arbitrary users, groups, and service accounts without restriction. An attacker who compromises the operator or obtains its service account credentials can exploit this flaw to achieve privilege escalation, gaining full administrative control over the cluster.
The Simple User Management module for Drupal allows non-administrators to approve, deactivate, and delete users based on delegated roles. However, it insufficiently verifies role delegation when approving users and provides an Activate link for blocked administrators. Additionally, it does not protect the primary user (user 1) from deactivation or deletion. Exploitation requires the attacker to have a role with specific module action permissions.
A vulnerability exists in the Drupal Domain Access module versions prior to 3.0.2 where insufficient checks are performed on domain assignments when the per-content-type grant setting is enabled. This setting is off by default. Exploitation requires the attacker to have specific permissions and be assigned to at least one domain.
The Drupal Bootstrap theme contains a cross-site scripting (XSS) vulnerability due to insufficient filtering of certain attributes. This issue specifically affects the optional tooltip and popover features. A short-term mitigation is to disable these features via the theme settings in the Drupal admin interface. A patch is available to address this vulnerability.
The View unpublished module for Drupal allows users with the "access content" permission to view published translations of nodes that have at least one unpublished translation, bypassing other node access restrictions. This issue requires a multilingual site with nodes having both unpublished and published translations, and the presence of other node access modules restricting view access. A fix is available for this vulnerability.
The Drupal module 'uswds_paragraph_components' contains a vulnerability where its twig templates do not sufficiently sanitize values passed to markup. This issue affects versions prior to 3.1.3. Exploitation requires the attacker to have a role capable of editing content that uses the paragraph bundles provided by the module, which mitigates the risk. A patch is available to address this vulnerability.
The Swiper formatter module for Drupal provides a route to display published content entities in a dialog but does not sufficiently verify user access to these entities. However, the vulnerability is mitigated because only rendered output is returned and field-level access controls remain enforced. A patch is available for affected versions.
The Block Attributes module for Drupal allows defining custom attributes for blocks but insufficiently sanitizes these attributes, leading to a cross-site scripting (XSS) vulnerability. Exploitation requires the attacker to have the 'administer blocks' permission, which limits the attack surface. A patch is available to address this issue.
The Agora theme for Drupal provides a front-end design for transparency and open-government sites, including a feature to preview CSV files attached to content. However, it insufficiently checks file access when rendering these previews, allowing visitors who cannot download the file to still read its contents on the page. Additionally, previews rendered for one visitor can be cached and shown to others. This vulnerability only affects CSV files stored outside the public file system and requires additional access restrictions beyond content access. Files stored in the public file system are not impacted. A patch is available for versions prior to 1.2.3.
CVE-2026-114264 is a SQL injection vulnerability in ProjectWorlds Advanced Library Management System version 1.0. The flaw exists in an unspecified function within the edit_member.php file, where manipulation of parameters such as firstname, middlename, lastname, address, branch, or type can lead to SQL injection. Remote exploitation is possible, and a public exploit has been released. The vulnerability has a CVSS 4.0 base score of 5.1, indicating medium severity.
The Drupal UI Icons module includes a CKEditor 5 button and widget that embed icons in formatted text. Under uncommon conditions, the widget can display admin-controlled text with insufficient filtering, leading to a Cross-site scripting (XSS) vulnerability. Exploitation requires the attacker to have permission to edit content using a text format that enables the UI Icons CKEditor 5 button. Patches are available for affected versions.
Sector, a Drupal distribution, contains a vulnerability in a module that insufficiently sanitizes media names, which could allow cross-site scripting (XSS) attacks. Exploitation requires the attacker to have permissions to create or edit media entities. The vulnerability affects versions prior to 10.3.3 and versions from 10.4.0 up to but not including 10.4.2. A patch is available to address this issue.
The Drupal swiper_formatter module integrates the SwiperJs library and suffers from a cross-site scripting (XSS) vulnerability due to insufficient filtering of user-entered text used in slide captions. Exploitation requires the attacker to have a role with permission to edit captions, limiting the attack surface. Patches are available for affected versions.
The Dopup module for Drupal provides functionality for selecting and working with Webforms. A vulnerability exists due to insufficient entity access checking in some cases, which may lead to exposure of the titles of private Webforms. This issue affects versions prior to 1.0.7. A patch is available to address this vulnerability.
The Drupal csv_field module allows uploading CSV files to a field and displaying them as interactive tables. A vulnerability exists due to insufficient escaping of CSV cell and header values before passing them to the DataTables library, which can lead to cross-site scripting (XSS). Exploitation requires the attacker to have permissions to create or edit content containing a CSV field. Patches are available for affected versions.
The Custom Formatters module for Drupal allows users to create custom Field Formatters via an admin UI without needing to write a custom module. It executes user-provided PHP code using eval(), enabling arbitrary PHP code execution on the site. The permissions interface does not warn users about this capability. Versions prior to 4.2.1 are affected. A patch is available to address this issue.
The ABC theme for Drupal websites has a vulnerability where menu link titles are not properly sanitized before being used in HTML class attributes. This flaw requires an attacker to have permissions to create or modify menu link titles to exploit it. A patch is available to address this issue.