[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fQhjIe8_U2M_Yupv9UGNiAAbrqKptegvOX9blkzGy4Hw":3},{"success":4,"data":5},true,{"vendor":6,"topVulnerabilitiesByEpss":558,"kevVulnerabilities":618,"topProductsByCves":664,"seoMetadata":675,"meta":684},{"vendorId":7,"vendorName":8,"productCount":9,"cveCount":10,"kevCount":11,"versionCount":12,"lastCveUpdate":13,"firstLetter":14,"products":15,"description":557},8567,"drupal",143,850,7,1168,"2025-04-09","d",[16,21,27,33,39,44,49,53,58,62,67,71,75,79,83,86,90,95,99,103,108,112,116,119,123,127,132,137,140,144,148,152,156,160,164,168,172,176,180,183,186,190,194,197,201,204,208,211,215,218,221,224,228,232,235,239,242,246,250,254,257,260,263,267,270,274,277,280,283,286,289,293,297,300,304,308,312,316,320,324,328,331,335,339,343,347,351,355,359,362,365,369,373,378,382,386,389,392,395,398,402,405,408,411,415,418,421,425,428,431,434,438,442,445,448,451,454,457,460,464,468,473,476,480,483,487,491,494,498,502,505,509,512,516,521,525,528,532,536,540,544,549,553],{"id":17,"product_name":8,"version_count":18,"cve_count":19,"kev_count":11,"last_cve_update":20},39729,489,721,"2025-03-31",{"id":22,"product_name":23,"version_count":24,"cve_count":24,"kev_count":25,"last_cve_update":26},39797,"project_issue_tracking_module",6,0,"2008-02-05",{"id":28,"product_name":29,"version_count":30,"cve_count":31,"kev_count":25,"last_cve_update":32},39792,"print",55,5,"2014-10-09",{"id":34,"product_name":35,"version_count":36,"cve_count":37,"kev_count":25,"last_cve_update":38},39703,"aggregation_module",8,4,"2008-07-03",{"id":40,"product_name":41,"version_count":42,"cve_count":37,"kev_count":25,"last_cve_update":43},39742,"everyblog",2,"2009-02-14",{"id":45,"product_name":46,"version_count":47,"cve_count":37,"kev_count":25,"last_cve_update":48},39832,"ubercart_module",1,"2008-04-27",{"id":50,"product_name":51,"version_count":11,"cve_count":37,"kev_count":25,"last_cve_update":52},39795,"project","2007-08-20",{"id":54,"product_name":55,"version_count":47,"cve_count":56,"kev_count":25,"last_cve_update":57},39811,"shindig-integrator",3,"2008-10-17",{"id":59,"product_name":60,"version_count":11,"cve_count":56,"kev_count":25,"last_cve_update":61},39736,"drupal_project_issue_tracking","2007-10-05",{"id":63,"product_name":64,"version_count":65,"cve_count":56,"kev_count":25,"last_cve_update":66},39721,"content_construction_kit",17,"2009-03-26",{"id":68,"product_name":69,"version_count":31,"cve_count":42,"kev_count":25,"last_cve_update":70},39821,"talk","2008-09-24",{"id":72,"product_name":73,"version_count":47,"cve_count":42,"kev_count":25,"last_cve_update":74},39725,"data","2020-01-14",{"id":76,"product_name":77,"version_count":47,"cve_count":42,"kev_count":25,"last_cve_update":78},39823,"taxonomy_autotagger_module","2008-07-09",{"id":80,"product_name":81,"version_count":42,"cve_count":42,"kev_count":25,"last_cve_update":82},39726,"database_administration_module","2007-04-22",{"id":84,"product_name":85,"version_count":24,"cve_count":42,"kev_count":25,"last_cve_update":20},39706,"artificial_intelligence",{"id":87,"product_name":88,"version_count":47,"cve_count":42,"kev_count":25,"last_cve_update":89},39717,"chatroom_module","2006-12-14",{"id":91,"product_name":92,"version_count":93,"cve_count":42,"kev_count":25,"last_cve_update":94},39761,"localization_client",11,"2009-04-20",{"id":96,"product_name":97,"version_count":24,"cve_count":42,"kev_count":25,"last_cve_update":98},39830,"trailscout_module","2008-06-25",{"id":100,"product_name":101,"version_count":25,"cve_count":42,"kev_count":25,"last_cve_update":102},39763,"logintoboggan_module","2007-07-17",{"id":104,"product_name":105,"version_count":106,"cve_count":42,"kev_count":25,"last_cve_update":107},39834,"user_karma_module",13,"2009-02-25",{"id":109,"product_name":110,"version_count":24,"cve_count":42,"kev_count":25,"last_cve_update":111},39836,"views","2009-06-16",{"id":113,"product_name":114,"version_count":37,"cve_count":42,"kev_count":25,"last_cve_update":115},39731,"drupal_easylinks_module","2006-08-27",{"id":117,"product_name":118,"version_count":42,"cve_count":42,"kev_count":25,"last_cve_update":26},39808,"secure_site_module",{"id":120,"product_name":121,"version_count":25,"cve_count":42,"kev_count":25,"last_cve_update":122},39712,"bibliography_module","2006-08-14",{"id":124,"product_name":125,"version_count":47,"cve_count":42,"kev_count":25,"last_cve_update":126},39704,"ajax_checklist","2009-01-28",{"id":128,"product_name":129,"version_count":130,"cve_count":42,"kev_count":25,"last_cve_update":131},39714,"brilliant_gallery",25,"2008-10-09",{"id":133,"product_name":134,"version_count":135,"cve_count":42,"kev_count":25,"last_cve_update":136},39723,"custom_search_module",28,"2014-10-13",{"id":138,"product_name":139,"version_count":25,"cve_count":42,"kev_count":25,"last_cve_update":89},39753,"help_tip_module",{"id":141,"product_name":142,"version_count":25,"cve_count":42,"kev_count":25,"last_cve_update":143},39754,"imce_module","2007-03-05",{"id":145,"product_name":146,"version_count":47,"cve_count":42,"kev_count":25,"last_cve_update":147},39702,"activity","2019-11-22",{"id":149,"product_name":150,"version_count":42,"cve_count":47,"kev_count":25,"last_cve_update":151},39746,"feedapi_mapper","2009-04-06",{"id":153,"product_name":154,"version_count":42,"cve_count":47,"kev_count":25,"last_cve_update":155},39747,"fileshare_module","2008-01-15",{"id":157,"product_name":158,"version_count":25,"cve_count":47,"kev_count":25,"last_cve_update":159},39748,"form_mail_module","2006-07-10",{"id":161,"product_name":162,"version_count":25,"cve_count":47,"kev_count":25,"last_cve_update":163},39749,"forward_module","2007-07-11",{"id":165,"product_name":166,"version_count":25,"cve_count":47,"kev_count":25,"last_cve_update":167},39750,"fullname_field_for_cck","2007-10-22",{"id":169,"product_name":170,"version_count":47,"cve_count":47,"kev_count":25,"last_cve_update":171},39751,"getid3","2007-02-21",{"id":173,"product_name":174,"version_count":47,"cve_count":47,"kev_count":25,"last_cve_update":175},39752,"header_image","2008-02-19",{"id":177,"product_name":178,"version_count":47,"cve_count":47,"kev_count":25,"last_cve_update":179},39755,"internationalization","2009-02-02",{"id":181,"product_name":182,"version_count":25,"cve_count":47,"kev_count":25,"last_cve_update":167},39756,"invite_module",{"id":184,"product_name":185,"version_count":47,"cve_count":47,"kev_count":25,"last_cve_update":122},39757,"job_search",{"id":187,"product_name":188,"version_count":37,"cve_count":47,"kev_count":25,"last_cve_update":189},39758,"jquery_ui_checkboxradio","2022-07-20",{"id":191,"product_name":192,"version_count":47,"cve_count":47,"kev_count":25,"last_cve_update":193},39759,"link_module","2009-02-16",{"id":195,"product_name":196,"version_count":47,"cve_count":47,"kev_count":25,"last_cve_update":70},39760,"link_to_us",{"id":198,"product_name":199,"version_count":31,"cve_count":47,"kev_count":25,"last_cve_update":200},39762,"localization_server","2009-02-19",{"id":202,"product_name":203,"version_count":31,"cve_count":47,"kev_count":25,"last_cve_update":136},39764,"maestro",{"id":205,"product_name":206,"version_count":47,"cve_count":47,"kev_count":25,"last_cve_update":207},39765,"magic_tabs_module","2008-06-18",{"id":209,"product_name":210,"version_count":36,"cve_count":47,"kev_count":25,"last_cve_update":70},39766,"mailhandler",{"id":212,"product_name":213,"version_count":214,"cve_count":47,"kev_count":25,"last_cve_update":70},39767,"mailsave",9,{"id":216,"product_name":217,"version_count":56,"cve_count":47,"kev_count":25,"last_cve_update":32},39768,"mayo",{"id":219,"product_name":220,"version_count":25,"cve_count":47,"kev_count":25,"last_cve_update":171},39769,"mediafield_module",{"id":222,"product_name":223,"version_count":25,"cve_count":47,"kev_count":25,"last_cve_update":155},39770,"meta_tags_module",{"id":225,"product_name":226,"version_count":214,"cve_count":47,"kev_count":25,"last_cve_update":227},39771,"modal_frame","2014-10-16",{"id":229,"product_name":230,"version_count":25,"cve_count":47,"kev_count":25,"last_cve_update":231},39772,"mrbs_module","2014-10-22",{"id":233,"product_name":234,"version_count":214,"cve_count":47,"kev_count":25,"last_cve_update":32},39773,"newsflash",{"id":236,"product_name":237,"version_count":42,"cve_count":47,"kev_count":25,"last_cve_update":238},39774,"news_page","2009-05-01",{"id":240,"product_name":241,"version_count":93,"cve_count":47,"kev_count":25,"last_cve_update":136},39775,"nivo_slider",{"id":243,"product_name":244,"version_count":245,"cve_count":47,"kev_count":25,"last_cve_update":238},39776,"nodeaccess_userreference",14,{"id":247,"product_name":248,"version_count":11,"cve_count":47,"kev_count":25,"last_cve_update":249},39777,"node_clone","2008-10-21",{"id":251,"product_name":252,"version_count":47,"cve_count":47,"kev_count":25,"last_cve_update":253},39778,"nodefamily","2007-03-08",{"id":255,"product_name":256,"version_count":42,"cve_count":47,"kev_count":25,"last_cve_update":207},39779,"node_hierarchy_module",{"id":258,"product_name":259,"version_count":106,"cve_count":47,"kev_count":25,"last_cve_update":111},39780,"nodequeue",{"id":261,"product_name":262,"version_count":25,"cve_count":47,"kev_count":25,"last_cve_update":167},39781,"node_relativity_module",{"id":264,"product_name":265,"version_count":25,"cve_count":47,"kev_count":25,"last_cve_update":266},39782,"obfuscate","2025-04-02",{"id":268,"product_name":269,"version_count":47,"cve_count":47,"kev_count":25,"last_cve_update":26},39783,"openid",{"id":271,"product_name":272,"version_count":42,"cve_count":47,"kev_count":25,"last_cve_update":273},39784,"organic_groups_menu","2014-11-12",{"id":275,"product_name":276,"version_count":42,"cve_count":47,"kev_count":25,"last_cve_update":78},39785,"organic_groups_module",{"id":278,"product_name":279,"version_count":47,"cve_count":47,"kev_count":25,"last_cve_update":78},39786,"outline_designer_module",{"id":281,"product_name":282,"version_count":25,"cve_count":47,"kev_count":25,"last_cve_update":13},39787,"panels",{"id":284,"product_name":285,"version_count":25,"cve_count":47,"kev_count":25,"last_cve_update":167},39788,"pathauto_module",{"id":287,"product_name":288,"version_count":25,"cve_count":47,"kev_count":25,"last_cve_update":167},39789,"paypal_node_module",{"id":290,"product_name":291,"version_count":37,"cve_count":47,"kev_count":25,"last_cve_update":292},39790,"petition_node_module","2011-11-28",{"id":294,"product_name":295,"version_count":214,"cve_count":47,"kev_count":25,"last_cve_update":296},39791,"plus1","2009-03-20",{"id":298,"product_name":299,"version_count":25,"cve_count":47,"kev_count":25,"last_cve_update":163},39793,"print_module",{"id":301,"product_name":302,"version_count":303,"cve_count":47,"kev_count":25,"last_cve_update":32},39794,"professional_theme",16,{"id":305,"product_name":306,"version_count":245,"cve_count":47,"kev_count":25,"last_cve_update":307},39796,"project_issue_file_review","2014-10-14",{"id":309,"product_name":310,"version_count":214,"cve_count":47,"kev_count":25,"last_cve_update":311},39798,"protected_node_module","2009-03-05",{"id":313,"product_name":314,"version_count":36,"cve_count":47,"kev_count":25,"last_cve_update":315},39799,"quick_tabs","2019-11-21",{"id":317,"product_name":318,"version_count":24,"cve_count":47,"kev_count":25,"last_cve_update":319},39800,"quiz","2009-06-05",{"id":321,"product_name":322,"version_count":42,"cve_count":47,"kev_count":25,"last_cve_update":323},39801,"randomizer","2010-01-12",{"id":325,"product_name":326,"version_count":47,"cve_count":47,"kev_count":25,"last_cve_update":327},39802,"realname","2012-08-14",{"id":329,"product_name":330,"version_count":25,"cve_count":47,"kev_count":25,"last_cve_update":122},39803,"recipe_module",{"id":332,"product_name":333,"version_count":47,"cve_count":47,"kev_count":25,"last_cve_update":334},39804,"responsive_menus","2023-05-01",{"id":336,"product_name":337,"version_count":37,"cve_count":47,"kev_count":25,"last_cve_update":338},39806,"saml_sp_2.0_single_sign_on","2022-06-03",{"id":340,"product_name":341,"version_count":56,"cve_count":47,"kev_count":25,"last_cve_update":342},39807,"search_keyword_module","2006-09-23",{"id":344,"product_name":345,"version_count":25,"cve_count":47,"kev_count":25,"last_cve_update":346},39809,"semantically_interconnected_online_communities","2009-02-18",{"id":348,"product_name":349,"version_count":47,"cve_count":47,"kev_count":25,"last_cve_update":350},39810,"services_module_for_drupal","2009-06-12",{"id":352,"product_name":353,"version_count":25,"cve_count":47,"kev_count":25,"last_cve_update":354},39812,"shoutbox","2007-12-10",{"id":356,"product_name":357,"version_count":47,"cve_count":47,"kev_count":25,"last_cve_update":358},39813,"simplecorp","2014-10-08",{"id":360,"product_name":361,"version_count":25,"cve_count":47,"kev_count":25,"last_cve_update":342},39814,"site_profile_directory_module",{"id":363,"product_name":364,"version_count":42,"cve_count":47,"kev_count":25,"last_cve_update":136},39815,"skeleton_theme",{"id":366,"product_name":367,"version_count":47,"cve_count":47,"kev_count":25,"last_cve_update":368},39816,"stock_module","2008-10-23",{"id":370,"product_name":371,"version_count":11,"cve_count":47,"kev_count":25,"last_cve_update":372},39817,"storage_api","2018-03-29",{"id":374,"product_name":375,"version_count":376,"cve_count":47,"kev_count":25,"last_cve_update":377},39818,"storm",33,"2009-03-02",{"id":379,"product_name":380,"version_count":47,"cve_count":47,"kev_count":25,"last_cve_update":381},39819,"suggested_terms_module","2008-08-06",{"id":383,"product_name":384,"version_count":11,"cve_count":47,"kev_count":25,"last_cve_update":385},39820,"svg_sanitizer","2019-11-11",{"id":387,"product_name":388,"version_count":25,"cve_count":47,"kev_count":25,"last_cve_update":296},39822,"tasklist",{"id":390,"product_name":391,"version_count":42,"cve_count":47,"kev_count":25,"last_cve_update":207},39824,"taxonomy_image_module",{"id":393,"product_name":394,"version_count":31,"cve_count":47,"kev_count":25,"last_cve_update":111},39825,"taxonomy_manager",{"id":396,"product_name":397,"version_count":25,"cve_count":47,"kev_count":25,"last_cve_update":311},39826,"taxonomy_theme_module",{"id":399,"product_name":400,"version_count":42,"cve_count":47,"kev_count":25,"last_cve_update":401},39827,"textimage","2007-02-01",{"id":403,"product_name":404,"version_count":47,"cve_count":47,"kev_count":25,"last_cve_update":78},39828,"tinytax_taxonomy_block_module",{"id":406,"product_name":407,"version_count":25,"cve_count":47,"kev_count":25,"last_cve_update":167},39829,"token_module",{"id":409,"product_name":410,"version_count":56,"cve_count":47,"kev_count":25,"last_cve_update":32},39831,"tribune",{"id":412,"product_name":413,"version_count":25,"cve_count":47,"kev_count":25,"last_cve_update":414},39833,"upload_module","2008-08-27",{"id":416,"product_name":417,"version_count":42,"cve_count":47,"kev_count":25,"last_cve_update":26},39835,"userpoints_module",{"id":419,"product_name":420,"version_count":36,"cve_count":47,"kev_count":25,"last_cve_update":358},39843,"zen",{"id":422,"product_name":423,"version_count":25,"cve_count":47,"kev_count":25,"last_cve_update":424},39705,"archive_module","2008-01-25",{"id":426,"product_name":427,"version_count":25,"cve_count":47,"kev_count":25,"last_cve_update":167},39707,"asin_field_module",{"id":429,"product_name":430,"version_count":25,"cve_count":47,"kev_count":25,"last_cve_update":155},39708,"atom_module",{"id":432,"product_name":433,"version_count":25,"cve_count":47,"kev_count":25,"last_cve_update":171},39709,"audio_module",{"id":435,"product_name":436,"version_count":106,"cve_count":47,"kev_count":25,"last_cve_update":437},39710,"authenticated_user_page_caching","2020-02-18",{"id":439,"product_name":440,"version_count":47,"cve_count":47,"kev_count":25,"last_cve_update":441},39711,"avatar_uploader","2018-04-04",{"id":443,"product_name":444,"version_count":47,"cve_count":47,"kev_count":25,"last_cve_update":358},39713,"bluemasters",{"id":446,"product_name":447,"version_count":25,"cve_count":47,"kev_count":25,"last_cve_update":155},39715,"bueditor",{"id":449,"product_name":450,"version_count":42,"cve_count":47,"kev_count":25,"last_cve_update":94},39716,"cck_comment_reference",{"id":452,"product_name":453,"version_count":56,"cve_count":47,"kev_count":25,"last_cve_update":377},39718,"comment_mail",{"id":455,"product_name":456,"version_count":42,"cve_count":47,"kev_count":25,"last_cve_update":26},39719,"comment_upload_module",{"id":458,"product_name":459,"version_count":24,"cve_count":47,"kev_count":25,"last_cve_update":136},39720,"commons",{"id":461,"product_name":462,"version_count":42,"cve_count":47,"kev_count":25,"last_cve_update":463},39722,"context_form_alteration_module","2014-10-06",{"id":465,"product_name":466,"version_count":42,"cve_count":47,"kev_count":25,"last_cve_update":467},39724,"cvs_management_and_tracker","2006-12-08",{"id":469,"product_name":470,"version_count":471,"cve_count":47,"kev_count":25,"last_cve_update":472},39727,"devel_module",23,"2010-08-16",{"id":474,"product_name":475,"version_count":42,"cve_count":47,"kev_count":25,"last_cve_update":136},39728,"doubleclick_for_publishers",{"id":477,"product_name":478,"version_count":56,"cve_count":47,"kev_count":25,"last_cve_update":479},39730,"drupal_docker_images","2020-12-17",{"id":481,"product_name":482,"version_count":47,"cve_count":47,"kev_count":25,"last_cve_update":115},39732,"drupal_e-commerce_module",{"id":484,"product_name":485,"version_count":42,"cve_count":47,"kev_count":25,"last_cve_update":486},39733,"drupal_mysite","2006-12-20",{"id":488,"product_name":489,"version_count":42,"cve_count":47,"kev_count":25,"last_cve_update":490},39734,"drupal_pathauto_module","2006-09-08",{"id":492,"product_name":493,"version_count":31,"cve_count":47,"kev_count":25,"last_cve_update":486},39735,"drupal_project",{"id":495,"product_name":496,"version_count":42,"cve_count":47,"kev_count":25,"last_cve_update":497},39737,"drupal_pubcookie_module","2006-09-12",{"id":499,"product_name":500,"version_count":47,"cve_count":47,"kev_count":25,"last_cve_update":501},39738,"drupal_userreview_module","2006-09-15",{"id":503,"product_name":504,"version_count":25,"cve_count":47,"kev_count":25,"last_cve_update":167},39739,"e-commerce_module",{"id":506,"product_name":507,"version_count":37,"cve_count":47,"kev_count":25,"last_cve_update":508},39740,"entity_embed","2022-02-11",{"id":510,"product_name":511,"version_count":25,"cve_count":47,"kev_count":25,"last_cve_update":48},39741,"e-publish",{"id":513,"product_name":514,"version_count":47,"cve_count":47,"kev_count":25,"last_cve_update":515},39743,"extended_tracker","2006-10-30",{"id":517,"product_name":518,"version_count":519,"cve_count":47,"kev_count":25,"last_cve_update":520},39744,"faq",15,"2012-09-25",{"id":522,"product_name":523,"version_count":42,"cve_count":47,"kev_count":25,"last_cve_update":524},39745,"feature_module","2007-12-12",{"id":526,"product_name":527,"version_count":25,"cve_count":47,"kev_count":25,"last_cve_update":424},39842,"workflow",{"id":529,"product_name":530,"version_count":42,"cve_count":47,"kev_count":25,"last_cve_update":531},39701,"acidfree","2007-01-26",{"id":533,"product_name":534,"version_count":36,"cve_count":47,"kev_count":25,"last_cve_update":535},39837,"views_builk_operations","2019-11-25",{"id":537,"product_name":538,"version_count":214,"cve_count":47,"kev_count":25,"last_cve_update":539},39838,"views_bulk_operations","2009-02-13",{"id":541,"product_name":542,"version_count":24,"cve_count":47,"kev_count":25,"last_cve_update":543},39839,"views_dynamic_field","2019-12-16",{"id":545,"product_name":546,"version_count":547,"cve_count":47,"kev_count":25,"last_cve_update":548},39840,"webform_module",12,"2008-04-15",{"id":550,"product_name":551,"version_count":65,"cve_count":25,"kev_count":25,"last_cve_update":552},39805,"restful",null,{"id":554,"product_name":555,"version_count":556,"cve_count":25,"kev_count":25,"last_cve_update":552},39841,"web_links",41,"Drupal is a technology vendor with 143 tracked products and 850 known security vulnerabilities. Get comprehensive security analysis, vulnerability tracking, and threat intelligence for this vendor.",[559,566,574,581,586,592,597,602,608,613],{"cveId":560,"description":561,"publishedDate":372,"cvssScore":562,"cvssVersion":563,"severity":564,"isKev":4,"epssScore":565},"CVE-2018-7600","Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because of an issue affecting multiple subsystems with default or common module configurations.",9.8,"v3.1","Critical",0.99991,{"cveId":567,"description":568,"publishedDate":227,"cvssScore":569,"cvssVersion":570,"severity":571,"isKev":572,"epssScore":573},"CVE-2014-3704","The expandArguments function in the database abstraction API in Drupal core 7.x before 7.32 does not properly construct prepared statements, which allows remote attackers to conduct SQL injection attacks via an array containing crafted keys.",7.5,"v2","High",false,0.99974,{"cveId":575,"description":576,"publishedDate":577,"cvssScore":578,"cvssVersion":563,"severity":579,"isKev":572,"epssScore":580},"CVE-2020-11022","In jQuery versions greater than or equal to 1.2 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.","2020-04-29",6.1,"Medium",0.99215,{"cveId":582,"description":583,"publishedDate":584,"cvssScore":562,"cvssVersion":563,"severity":564,"isKev":4,"epssScore":585},"CVE-2018-7602","A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result in the site being compromised. This vulnerability is related to Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-002. Both SA-CORE-2018-002 and this vulnerability are being exploited in the wild.","2018-07-19",0.99172,{"cveId":587,"description":588,"publishedDate":589,"cvssScore":590,"cvssVersion":563,"severity":571,"isKev":4,"epssScore":591},"CVE-2019-6340","Some field types do not properly sanitize data from non-form sources in Drupal 8.5.x before 8.5.11 and Drupal 8.6.x before 8.6.10. This can lead to arbitrary PHP code execution in some cases. A site is only affected by this if one of the following conditions is met: The site has the Drupal 8 core RESTful Web Services (rest) module enabled and allows PATCH or POST requests, or the site has another web services module enabled, like JSON:API in Drupal 8, or Services or RESTful Web Services in Drupal 7. (Note: The Drupal 7 Services module itself does not require an update at this time, but you should apply other contributed updates associated with this advisory if Services is in use.)","2019-02-21",8.1,0.92017,{"cveId":593,"description":594,"publishedDate":595,"cvssScore":578,"cvssVersion":563,"severity":579,"isKev":572,"epssScore":596},"CVE-2019-11358","jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype.","2019-04-20",0.8682,{"cveId":598,"description":599,"publishedDate":577,"cvssScore":600,"cvssVersion":563,"severity":579,"isKev":4,"epssScore":601},"CVE-2020-11023","In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing \u003Coption> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.",6.9,0.84887,{"cveId":603,"description":604,"publishedDate":605,"cvssScore":606,"cvssVersion":563,"severity":571,"isKev":4,"epssScore":607},"CVE-2020-28949","Archive_Tar through 1.4.10 has :\u002F\u002F filename sanitization only to address phar attacks, and thus any other stream-wrapper attack (such as file:\u002F\u002F to overwrite files) can still succeed.","2020-11-19",7.8,0.84554,{"cveId":609,"description":610,"publishedDate":611,"cvssScore":31,"cvssVersion":570,"severity":579,"isKev":572,"epssScore":612},"CVE-2014-9016","The password hashing API in Drupal 7.x before 7.34 and the Secure Password Hashes (aka phpass) module 6.x-2.x before 6.x-2.1 for Drupal allows remote attackers to cause a denial of service (CPU and memory consumption) via a crafted request.","2014-11-24",0.82234,{"cveId":614,"description":615,"publishedDate":616,"cvssScore":569,"cvssVersion":570,"severity":571,"isKev":572,"epssScore":617},"CVE-2005-1921","Eval injection vulnerability in PEAR XML_RPC 1.3.0 and earlier (aka XML-RPC or xmlrpc) and PHPXMLRPC (aka XML-RPC For PHP or php-xmlrpc) 1.1 and earlier, as used in products such as (1) WordPress, (2) Serendipity, (3) Drupal, (4) egroupware, (5) MailWatch, (6) TikiWiki, (7) phpWebSite, (8) Ampache, and others, allows remote attackers to execute arbitrary PHP code via an XML file, which is not properly sanitized before being used in an eval statement.","2005-07-05",0.79071,[619,628,633,638,645,649,652,661],{"cveId":620,"description":621,"publishedDate":622,"cvssScore":562,"cvssVersion":563,"severity":564,"isKev":4,"epssScore":623,"cisaVulnName":624,"cisaDateAdded":625,"cisaShortDescription":626,"cisaRequiredAction":627},"CVE-2026-9082","Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Drupal core allows SQL Injection.\n\nThis issue affects Drupal core: from 8.9.0 before 10.4.10, from 10.5.0 before 10.5.10, from 10.6.0 before 10.6.9, from 11.0.0 before 11.1.10, from 11.2.0 before 11.2.12, from 11.3.0 before 11.3.10.","2026-05-20",0.15701,"Drupal Core SQL Injection Vulnerability","2026-05-22","Drupal Core contains a SQL injection vulnerability that could allow for privilege escalation and remote code execution via specially crafted requests sent with the database abstraction API.","Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",{"cveId":598,"description":599,"publishedDate":577,"cvssScore":600,"cvssVersion":563,"severity":579,"isKev":4,"epssScore":601,"cisaVulnName":629,"cisaDateAdded":630,"cisaShortDescription":631,"cisaRequiredAction":632},"JQuery Cross-Site Scripting (XSS) Vulnerability","2025-01-23","JQuery contains a persistent cross-site scripting (XSS) vulnerability. When passing maliciously formed, untrusted input enclosed in HTML tags, JQuery's DOM manipulators can execute untrusted code in the context of the user's browser.","Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.",{"cveId":603,"description":604,"publishedDate":605,"cvssScore":606,"cvssVersion":563,"severity":571,"isKev":4,"epssScore":607,"cisaVulnName":634,"cisaDateAdded":635,"cisaShortDescription":636,"cisaRequiredAction":637},"PEAR Archive_Tar Deserialization of Untrusted Data Vulnerability","2022-08-25","PEAR Archive_Tar allows an unserialization attack because phar: is blocked but PHAR: is not blocked. PEAR stands for PHP Extension and Application Repository and it is an open-source framework and distribution system for reusable PHP components with known usage in third-party products such as Drupal Core and Red Hat Linux.","Apply updates per vendor instructions.",{"cveId":639,"description":640,"publishedDate":641,"cvssScore":569,"cvssVersion":563,"severity":571,"isKev":4,"epssScore":642,"cisaVulnName":643,"cisaDateAdded":635,"cisaShortDescription":644,"cisaRequiredAction":637},"CVE-2020-36193","Tar.php in Archive_Tar through 1.4.11 allows write operations with Directory Traversal due to inadequate checking of symbolic links, a related issue to CVE-2020-28948.","2021-01-18",0.70595,"PEAR Archive_Tar Improper Link Resolution Vulnerability","PEAR Archive_Tar Tar.php allows write operations with directory traversal due to inadequate checking of symbolic links. PEAR stands for PHP Extension and Application Repository and it is an open-source framework and distribution system for reusable PHP components with known usage in third-party products such as Drupal Core and Red Hat Linux.",{"cveId":582,"description":583,"publishedDate":584,"cvssScore":562,"cvssVersion":563,"severity":564,"isKev":4,"epssScore":585,"cisaVulnName":646,"cisaDateAdded":647,"cisaShortDescription":648,"cisaRequiredAction":637},"Drupal Core Remote Code Execution Vulnerability","2022-04-13","A remote code execution vulnerability exists within multiple subsystems of Drupal that can allow attackers to exploit multiple attack vectors on a Drupal site.",{"cveId":587,"description":588,"publishedDate":589,"cvssScore":590,"cvssVersion":563,"severity":571,"isKev":4,"epssScore":591,"cisaVulnName":646,"cisaDateAdded":650,"cisaShortDescription":651,"cisaRequiredAction":637},"2022-03-25","In Drupal Core, some field types do not properly sanitize data from non-form sources. This can lead to arbitrary PHP code execution in some cases.",{"cveId":653,"description":654,"publishedDate":655,"cvssScore":656,"cvssVersion":563,"severity":571,"isKev":4,"epssScore":657,"cisaVulnName":658,"cisaDateAdded":659,"cisaShortDescription":660,"cisaRequiredAction":637},"CVE-2020-13671","Drupal core does not properly sanitize certain filenames on uploaded files, which can lead to files being interpreted as the incorrect extension and served as the wrong MIME type or executed as PHP for certain hosting configurations. This issue affects: Drupal Drupal Core 9.0 versions prior to 9.0.8, 8.9 versions prior to 8.9.9, 8.8 versions prior to 8.8.11, and 7 versions prior to 7.74.","2020-11-20",8.8,0.36167,"Drupal core Un-restricted Upload of File","2022-01-18","Improper sanitization in the extension file names is present in Drupal core.",{"cveId":560,"description":561,"publishedDate":372,"cvssScore":562,"cvssVersion":563,"severity":564,"isKev":4,"epssScore":565,"cisaVulnName":646,"cisaDateAdded":662,"cisaShortDescription":663,"cisaRequiredAction":637},"2021-11-03","Drupal Core contains a remote code execution vulnerability that could allow an attacker to exploit multiple attack vectors on a Drupal site, resulting in complete site compromise.",[665,666,667,668,669,670,671,672,673,674],{"id":17,"product_name":8,"version_count":18,"cve_count":19,"kev_count":11,"last_cve_update":20},{"id":22,"product_name":23,"version_count":24,"cve_count":24,"kev_count":25,"last_cve_update":26},{"id":28,"product_name":29,"version_count":30,"cve_count":31,"kev_count":25,"last_cve_update":32},{"id":34,"product_name":35,"version_count":36,"cve_count":37,"kev_count":25,"last_cve_update":38},{"id":40,"product_name":41,"version_count":42,"cve_count":37,"kev_count":25,"last_cve_update":43},{"id":45,"product_name":46,"version_count":47,"cve_count":37,"kev_count":25,"last_cve_update":48},{"id":50,"product_name":51,"version_count":11,"cve_count":37,"kev_count":25,"last_cve_update":52},{"id":54,"product_name":55,"version_count":47,"cve_count":56,"kev_count":25,"last_cve_update":57},{"id":59,"product_name":60,"version_count":11,"cve_count":56,"kev_count":25,"last_cve_update":61},{"id":63,"product_name":64,"version_count":65,"cve_count":56,"kev_count":25,"last_cve_update":66},{"title":676,"metaDescription":677,"keywords":678,"structuredData":679},"Drupal - Security Vulnerabilities & Analysis | Precursor Intelligence","Comprehensive security analysis for Drupal covering 143 products with 850 tracked vulnerabilities including 3 critical and 4 high-severity issues and 7 CISA KEV vulnerabilities. Real-time threat intelligence, CVE tracking, and security recommendations.","Drupal vulnerabilities, Drupal security, Drupal CVE, Drupal threat intelligence, vendor security analysis, cybersecurity threats, vulnerability management, CVE tracking, Drupal KEV, Drupal exploited vulnerabilities",{"@context":680,"@type":681,"name":682,"description":677,"url":683},"https:\u002F\u002Fschema.org","Organization","Drupal","https:\u002F\u002Fprecursorintelligence.com\u002Fvendors\u002Fdrupal",{"totalProducts":9,"totalVulnerabilities":10,"kevVulnerabilities":11,"lastUpdated":13,"generatedAt":685,"apiVersion":686},"2026-10-19T15:58:11.868Z","3.0"]