5.4Orta

CVE-2025-31675Drupal core - Moderately critical - Cross Site Scripting - SA-CORE-2025-004

Drupal Drupal core; Drupal Link Yayım: 2025-04-01 00:35 (1 yıl önce)

Açıklama

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS).This issue affects Drupal core: from 8.0.0 before 10.3.14, from 10.4.0 before 10.4.5, from 11.0.0 before 11.0.13, from 11.1.0 before 11.1.5. It also affects the Drupal 7 module from versions 7.x-1.0 through 7.x-1.12.

Zayıflık türü (CWE): CWE-79

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

Üretici	Ürün	Sürümler
drupal	drupal	8.0.0 – < 10.3.14
Drupal	Drupal core	8.0.0 – < 10.3.14, 10.4.0 – < 10.4.5, 11.0.0 – < 11.0.13, 11.1.0 – < 11.1.5
Drupal	Link	7.x-1.0 – ≤ 7.x-1.12

Kaynaklar ve yamalar

https://www.drupal.org/sa-core-2025-004 vendor-advisoryVendor Advisory
https://www.herodevs.com/vulnerability-directory/cve-2025-31675 third-party-advisory
https://d7es.tag1.com/security-advisories/link-moderately-critical-cross-site-scripting-sa-core-2025-004 third-party-advisory

CPE eşleşmeleri (NVD) (4)

cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:* ≥ 8.0.0 < 10.3.14
cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:* ≥ 10.4.0 < 10.4.5
cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:* ≥ 11.0.0 < 11.0.13
cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:* ≥ 11.1.0 < 11.1.5

CVSS puanı

5.4Orta

Kaynak: CISA-ADP · CVSS 3.1

Saldırı yolu: Ağ
Karmaşıklık: Düşük
Gereken yetki: Düşük
Kullanıcı etkileşimi: Gerekir
Kapsam: Değişir
Gizlilik: Düşük
Bütünlük: Düşük
Erişilebilirlik: Yok

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Tüm puanlar (2)

CISA-ADP	CVSS 3.1	5.4Orta
134c704f-9b21-4f2e-91b3-4a467353bcc0	CVSS 3.1	5.4Orta

EPSS (30 günde istismar olasılığı)

0.50%

tüm CVE'lerin %44'inden yüksek

CISA değerlendirmesi (SSVC)

İstismar: none
Otomatikleştirilebilir: no
Teknik etki: partial

Zaman çizelgesi

Numara ayrıldı2025-03-31
Yayımlandı2025-04-01 00:35
IP-DB'ye ulaştı2026-10-25 00:02
Son güncelleme2026-06-17 12:10

Numarayı veren (CNA): drupal
NVD durumu: Modified

Kaynakta görüntüle: CVE.org · NVD

Bu ürünlerde yeni bir açık çıktığında haber alın

E-posta uyarılarını aç

Ücretsiz · üyelikle · istediğiniz an kapatılır

Aynı üründe son açıklar — Drupal

8.1Yüksek

CVE-2026-108097 16 gün önce

Drupal core - Critical - Remote code execution - SA-CORE-2026-014

Drupal Drupal core

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Drupal Drupal core allows Reflection Injection. This issue affects Drupal core versions: from 8.9.0 to 10.6.19, from 11.0.0 to 11.3.19, from 11.4.0 to 11.4.10,…

6.5Orta

CVE-2026-108515 16 gün önce

Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-015

Drupal Drupal core

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects Drupal core versions: from 8.9.0 to 10.6.19, from 11.0.0 to 11.3.19, from 11.4.0 to …

6.5Orta

CVE-2026-108514 16 gün önce

Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-016

Drupal Drupal core

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects Drupal core versions: from 10.3.0 to 10.6.19, from 11.0.0 to 11.3.19, from 11.4.0 to…

4.2Orta

CVE-2026-15916 2 ay önce

Drupal core - Moderately critical - Information disclosure - SA-CORE-2026-010

Drupal Drupal core

Missing Authorization vulnerability in Drupal Drupal core allows Forceful Browsing. This issue affects Drupal core versions: from 0.0.0 to 10.6.13, from 11.3.0 to 11.3.14, from 11.4.0 to 11.4.4, from 0.0.0 to 11.0.*, from 0.0.0 to 11.1.*, from 0.0.0 to 11.2.*.

4.7Orta

CVE-2026-15917 2 ay önce

Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-011

Drupal Drupal core

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects Drupal core versions: from 11.3.0 to 11.3.14, from 11.4.0 to 11.4.4, from 0.0.0 to 11.2.*.

5.4Orta

CVE-2026-55805 2 ay önce

Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-012

Drupal Drupal core

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Stored XSS. This issue affects Drupal core versions: from 0.0.0 to 10.6.13, from 11.3.0 to 11.3.14, from 11.4.0 to 11.4.4, from 0.0…