Threat database

A stored cross-site scripting (XSS) vulnerability exists in Drupal AI (Artificial Intelligence) affecting versions from 0.0.0 to 1.3.13 and 1.4.0 to 1.4.8. The vulnerability involves improper neutralization of input during web page generation, which could allow an attacker with high privileges and user interaction to inject malicious scripts. The CVSS score is 3.1, indicating a low severity impact primarily affecting confidentiality and integrity with no impact on availability.

A missing authorization vulnerability in the Drupal AI module allows forceful browsing, potentially enabling unauthorized users with some privileges to access restricted resources. The issue affects Drupal AI versions from 0.0.0 to 1.3.13 and from 1.4.0 to 1.4.8. The vulnerability has a medium severity with a CVSS score of 4.6.

A missing authorization vulnerability in the Drupal AI Translate module allows forceful browsing, potentially enabling unauthorized access to certain resources. The issue affects AI Translate versions from 0.0.0 to 1.3.2 and from 1.4.0 to 1.4.1. The vulnerability has a medium severity with a CVSS score of 4.6.

Missing Authorization vulnerability in Drupal Calculate Working Days allows Forceful Browsing. This issue affects Calculate Working Days versions: from 0.0.0 to 2.0.3.

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Component blocks allows Stored XSS. This issue affects Component blocks versions: from 0.0.0 to 1.2.7.

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Email Verification / SMS Verification / OTP Verification allows Authentication Bypass. This issue affects Email Verification / SMS Verification / OTP Verification versions: from 0.0.0 to 2.4.0.

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Email Verification / SMS Verification / OTP Verification allows Reflected XSS. This issue affects Email Verification / SMS Verification / OTP Verification versions: from 0.0.0 to 2.4.0.

Missing Authorization vulnerability in Drupal Islandora allows Forceful Browsing. This issue affects Islandora versions: from 0.0.0 to 2.19.0.

Incorrect Authorization vulnerability in Drupal Jsonapi Role Access allows Forceful Browsing. This issue affects Jsonapi Role Access versions: from 0.0.0 to 2.0.2.

Insertion of Sensitive Information into Log File vulnerability in Drupal Mailer Plus Log allows Remote Services with Stolen Credentials. This issue affects Mailer Plus Log versions: from 0.0.0 to 1.2.7.

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Drupal Media Library Importer allows Path Traversal. This issue affects Media Library Importer versions: from 0.0.0 to 2.1.6.

Improper Verification of Cryptographic Signature vulnerability in Drupal Monobank payment API allows Signature Spoof. This issue affects Monobank payment API versions: from 0.0.0 to 1.0.3.

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal PhotoSwipe - Responsive JavaScript Modal Image Gallery allows Stored XSS. This issue affects PhotoSwipe - Responsive JavaScript Modal Image Gallery versions: from 0.0.0 to 5.0.9.

Incorrect Authorization vulnerability in Drupal Unpublished Node Permissions allows Forceful Browsing. This issue affects Unpublished Node Permissions versions: from 0.0.0 to 1.8.0.

Missing Authorization vulnerability in Drupal Webform Submissions Delete allows Forceful Browsing. This issue affects Webform Submissions Delete versions: from 0.0.0 to 1.2.0.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal amazee.ai Private AI Provider allows SQL Injection. This issue affects amazee.ai Private AI Provider versions: from 0.0.0 to 1.3.7, from 1.4.0 to 1.4.3.

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal Central Authentication System (CAS) Server allows Fake the Source of Data. This issue affects Central Authentication System (CAS) Server versions: from 0.0.0 to 2.0.4, from 2.1.0 to 2.1.3.

CVE-2026-87938 is an SQL Injection vulnerability in the Drupal CSP log component. It affects versions from 0.0.0 up to but not including 1.0.2. This vulnerability arises from improper neutralization of special elements in SQL commands, classified under CWE-89. No CVSS score or vendor patch information is currently available.

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Feed Block allows Stored XSS. This issue affects Feed Block versions: from 0.0.0 to 2.0.2, from 3.0.0 to 3.0.2.

Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Key auth allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Key auth versions: from 0.0.0 to 2.2.4.