| CVE-2025-3057 | MOYENNE6.1 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS).This issue affects Drupal core: from 8.0.0 before 10.3.13, from 10.4.0 before 10.4.3, from 11.0.0 before 11.0.12, from 11.1.0 before 11.1.3. | 31/03/2025 |
| CVE-2025-31675 | MOYENNE5.4 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS).This issue affects Drupal core: from 8.0.0 before 10.3.14, from 10.4.0 before 10.4.5, from 11.0.0 before 11.0.13, from 11.1.0 before 11.1.5. It also affects the Drup | 31/03/2025 |
| CVE-2025-31674 | ÉLEVÉE7.5 | Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection.This issue affects Drupal core: from 8.0.0 before 10.3.13, from 10.4.0 before 10.4.3, from 11.0.0 before 11.0.12, from 11.1.0 before 11.1.3. | 31/03/2025 |
| CVE-2025-31673 | MOYENNE4.6 | Incorrect Authorization vulnerability in Drupal Drupal core allows Forceful Browsing.This issue affects Drupal core: from 8.0.0 before 10.3.13, from 10.4.0 before 10.4.3, from 11.0.0 before 11.0.12, from 11.1.0 before 11.1.3. | 31/03/2025 |
| CVE-2024-55638 | CRITIQUE9.8 | Deserialization of Untrusted Data vulnerability in Drupal Core allows Object Injection.This issue affects Drupal Core: from 7.0 before 7.102, from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9.
Drupal core contains a chain of methods that is exploitable when an insecure deserialization vulnerability exists on the si | 10/12/2024 |
| CVE-2024-55637 | CRITIQUE9.8 | Deserialization of Untrusted Data vulnerability in Drupal Core allows Object Injection.This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8.
Drupal core contains a chain of methods that is exploitable when an insecure deserialization vulnerability exists on th | 10/12/2024 |
| CVE-2024-55636 | CRITIQUE9.8 | Deserialization of Untrusted Data vulnerability in Drupal Core allows Object Injection.This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8.
Drupal core contains a chain of methods that is exploitable when an insecure deserialization vulnerability exists on th | 10/12/2024 |
| CVE-2024-55634 | ÉLEVÉE8.1 | A vulnerability in Drupal Core allows Privilege Escalation.This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8. | 10/12/2024 |
| CVE-2024-12393 | MOYENNE5.4 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Drupal Core allows Cross-Site Scripting (XSS).This issue affects Drupal Core: from 8.8.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8. | 10/12/2024 |
| CVE-2024-11942 | MOYENNE5.9 | A vulnerability in Drupal Core allows File Manipulation.This issue affects Drupal Core: from 10.0.0 before 10.2.10. | 05/12/2024 |
| CVE-2024-11941 | ÉLEVÉE7.5 | A vulnerability in Drupal Core allows Excessive Allocation.This issue affects Drupal Core: from 10.2.0 before 10.2.2, from 10.1.0 before 10.1.8. | 05/12/2024 |
| CVE-2024-45440 | MOYENNE5.3 | core/authorize.php in Drupal 11.x-dev allows Full Path Disclosure (even when error logging is None) if the value of hash_salt is file_get_contents of a file that does not exist. | 29/08/2024 |
| GHSA-vfgc-c76h-mwh4 | MOYENNE5.3 | Drupal core Cross-Site Scripting (XSS) vulnerabilities | 15/05/2024 |
| GHSA-gxxj-g9v8-w28p | ÉLEVÉE7.8 | Drupal core Arbitrary PHP code execution | 15/05/2024 |
| GHSA-6gf6-24h2-66j4 | MOYENNE4.3 | Drupal core Open Redirect vulnerability | 15/05/2024 |
| GHSA-v273-j5hq-26xp | MOYENNE4.2 | Drupal core uses a vulnerable Third-party library CKEditor | 15/05/2024 |
| GHSA-98h9-727m-44qv | ÉLEVÉE8.1 | Drupal core Multiple vulnerabilities due to the use of the third-party library Archive_Tar | 15/05/2024 |
| GHSA-mh4h-27gq-cxwj | MOYENNE4.3 | Drupal core Access bypass | 15/05/2024 |
| GHSA-7gwj-7fhm-vw4w | MOYENNE6.6 | Drupal core unrestricted file upload | 15/05/2024 |
| GHSA-pr99-c33p-fwf6 | MOYENNE5.3 | Drupal core Denial of Service | 15/05/2024 |