Threat database

A Cross-Site Scripting (XSS) vulnerability exists in the Drupal Stage File Proxy module due to improper neutralization of input during web page generation. This affects versions from 0.0.0 to 3.1.7 and from 4.0.0 to 4.0.1. The vulnerability allows injection of malicious scripts into web pages generated by the module.

A missing authorization vulnerability in the Drupal Xray Audit module allows forceful browsing, potentially enabling unauthorized access to resources. This affects multiple versions of the module, specifically from 0.0.0 to 1.6.3, 2.0.0 to 2.0.4, and 3.0.0 to 3.1.1.

An incorrect authorization vulnerability in the Drupal Field Permissions module allows unauthorized users to perform forceful browsing. This affects versions from 0.0.0 up to and including 1.6.0 of the module.

A stored cross-site scripting (XSS) vulnerability exists in the Drupal Signature pad widget. This flaw is due to improper neutralization of input during web page generation, allowing malicious scripts to be stored and executed in users' browsers. The vulnerability affects Signature pad widget versions from 0.0.0 up to and including 1.15.0.

An authentication bypass vulnerability exists in the Drupal CAPTCHA module, allowing functionality bypass via an alternate path or channel. This affects CAPTCHA versions from 0.0.0 to 1.18.0 and from 2.0.0 to 2.0.11. The vulnerability is identified as CWE-288 and was published on October 30, 2026.

The Export and Import Users and Customers plugin for WordPress contains a privilege escalation vulnerability in all versions up to and including 2.7.5. This flaw arises from a mismatch in CSV escape characters between the export and import functions, allowing an attacker with Subscriber-level access to create an arbitrary Administrator account by injecting crafted CSV data during the export-import workflow.

A missing authorization vulnerability in the Drupal OAuth2 Token Manager component allows forceful browsing. This affects versions from 0.0.0 up to 1.2.0. The flaw could enable unauthorized access to resources due to lack of proper authorization checks.

An authentication bypass vulnerability exists in the Drupal OAuth Login - OAuth OIDC SSO module, allowing attackers to bypass authentication using an alternate path or channel. This affects versions from 0.0.0 up to 3.1.1 of the module.

An insecure storage vulnerability in Drupal Content Sync (content-sync.io) versions up to 3.2.2 allows retrieval of embedded sensitive data. This vulnerability could expose sensitive information stored by the application.

A Cross-Site Request Forgery (CSRF) vulnerability exists in the Drupal Fasttoggle module, affecting versions from 0.0.0 up to 4.1.1. This vulnerability allows an attacker to perform unauthorized actions on behalf of an authenticated user without their consent.

A vulnerability in Drupal Media Alias Display allows sensitive information to be stored in the web browser cache due to incorrectly configured access control security levels. This affects versions from 0.0.0 to 2.1.3 and from 3.0.0 to 3.0.3. The issue could lead to exposure of sensitive data through the browser cache.

An incorrect authorization vulnerability in the Drupal Fasttoggle module allows forceful browsing. This affects Fasttoggle versions from 0.0.0 up to and including 4.1.1. The vulnerability is classified under CWE-863, which relates to improper authorization. No CVSS score or patch information is currently available.

A vulnerability in Drupal Commerce Stripe allows improper verification of cryptographic signatures, leading to potential signature spoofing. This affects Commerce Stripe versions from 0.0.0 to 1.4 and from 2.0.0 to 2.2.3. No CVSS score or patch information is currently available.

A path traversal vulnerability exists in the Drupal Single Content Sync module, allowing external control of file names or paths. This affects versions from 0.0.0 up to 1.4.19. The vulnerability could allow an attacker to manipulate file paths, potentially leading to unauthorized file access or modification.

A Cross-Site Scripting (XSS) vulnerability exists in Drupal Commerce Stripe versions 2.0.0 through 2.2.3 due to improper neutralization of input during web page generation. This flaw could allow an attacker to inject malicious scripts into web pages viewed by other users.

A vulnerability has been identified in the PayUmoney module for Drupal Commerce. The issue affects all versions of this module. No further technical details or impact information are provided.

A vulnerability has been identified in the Drupal CacheFlush module. The issue affects all versions of CacheFlush. No further technical details, impact, or remediation information are provided in the available data.

An Incorrect Authorization vulnerability in the Drupal Bulk Update User Roles module allows forceful browsing. This affects versions from 0.0.0 up to 1.0.5. The vulnerability could permit unauthorized access to functionality or data by bypassing intended authorization checks.

A vulnerability has been identified in the integration of Drupal GroupEx PRO (Daxko). The issue affects all versions of the GroupEx PRO (Daxko) integration. No further technical details, impact specifics, or exploit information are currently available.

A deserialization of untrusted data vulnerability in the Drupal Single Content Sync module allows object injection. This affects versions from 0.0.0 up to 1.4.19. No CVSS score or patch information is provided.