Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS).This issue affects Drupal core: from 8.0.0 before 10.3.13, from 10.4.0 before 10.4.3, from 11.0.0 before 11.0.12, from 11.1.0 before 11.1.3.
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
| Vendor | Product | Versions | |
|---|---|---|---|
| drupal | drupal | 8.0.0 – < 10.3.13 | |
| Drupal | Drupal core | 8.0.0 – < 10.3.13, 10.4.0 – < 10.4.3, 11.0.0 – < 11.0.12, 11.1.0 – < 11.1.3 |
cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:* ≥ 8.0.0 < 10.3.13cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:* ≥ 10.4.0 < 10.4.3cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:* ≥ 11.0.0 < 11.0.12cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:* ≥ 11.1.0 < 11.1.3Two free tools, one defence: the Sensor catches whoever probes your server; Shield stops known attackers before they reach your site.
Install it and your daily API quota goes to 30,000 lookups — nothing to apply for.