Vulnerabilidades em Drupal

576 resultados
Análise Vexday

O Drupal acumula 309 CVEs catalogadas, com 23 classificadas como críticas e 4 confirmadas em exploração ativa pelo catálogo KEV da CISA — uma taxa que é 2,9 vezes acima da média geral do catálogo, o que indica risco operacional concreto e não meramente teórico. A CVE mais perigosa em exploração ativa, CVE-2018-7602, apresenta EPSS de 0,9907, sinalizando altíssima probabilidade de exploração e exigindo atenção imediata em ambientes que ainda não aplicaram a correção correspondente. O tipo de falha mais frequente é CWE-79 (Cross-Site Scripting), padrão recorrente em plataformas de gerenciamento de conteúdo que requer controles rigorosos de sanitização de entrada e saída. As 14 CVEs surgidas nos últimos 90 dias e a existência de 6 vulnerabilidades com PoC pública reforçam a necessidade de ciclos de patching frequentes e monitoramento contínuo para instalações Drupal em produção.

CVE-2018-7602HIGHDrupal core - Highly critical - Remote Code Execution - SA-CORE-2018-004EPSS 99.2%KEVCVE-2019-6340HIGHDrupal core - Highly critical - Remote Code ExecutionEPSS 92.0%KEVCVE-2026-9082CRITICALDrupal core - Highly critical - SQL injection - SA-CORE-2026-004EPSS 89.4%KEVCVE-2020-13671HIGHDrupal core does not properly sanitize certain filenames on uploaded files, which can lead to files being interpreted as the incorrect extenEPSS 36.2%KEVCVE-2019-6339—PHAR stream wrapper Arbitrary PHP code executionEPSS 35.9%CVE-2019-6341—Drupal core - Moderately critical - Cross Site Scripting - SA-CORE-2019-004EPSS 12.2%CVE-2024-45440MEDIUMcore/authorize.php in Drupal 11.x-dev allows Full Path Disclosure (even when error logging is None) if the value of hash_salt is file_get_coEPSS 9.3%CVE-2017-6381—A 3rd party development library including with Drupal 8 development dependencies is vulnerable to remote code execution. This is mitigated bEPSS 3.9%CVE-2020-13664—Arbitrary PHP code execution vulnerability in Drupal Core under certain circumstances. An attacker could trick an administrator into visitinEPSS 3.0%CVE-2020-13666—Cross-site scripting vulnerability in Drupal Core. Drupal AJAX API does not disable JSONP by default, allowing for an XSS attack. This issueEPSS 2.9%CVE-2019-6342—Drupal core - Critical - Access bypass - SA-CORE-2019-008EPSS 2.2%CVE-2026-10768CRITICALLocalGov Workflows - Moderately critical - Information disclosure - SA-CONTRIB-2026-039EPSS 2.1%CVE-2019-6338—third-party PEAR Archive_Tar library updatesEPSS 2.1%CVE-2017-6924—REST API can bypass comment approval - Access Bypass - Moderately CriticalEPSS 2.1%CVE-2017-6923—Access bypass in Drupal 8 viewsEPSS 2.0%CVE-2017-6922—Files uploaded by anonymous users into a private file system can be accessed by other anonymous usersEPSS 1.9%CVE-2017-6377—When adding a private file via the editor in Drupal 8.2.x before 8.2.7, the editor will not correctly check access for the file being attachEPSS 1.9%CVE-2017-6921—File REST resource does not properly validateEPSS 1.8%CVE-2022-25277HIGHDrupal core sanitizes filenames with dangerous extensions upon upload (reference: SA-CORE-2020-012) and strips leading and trailing dots froEPSS 1.4%CVE-2020-13675—Drupal's JSON:API and REST/File modules allow file uploads through their HTTP APIs. The modules do not correctly run all file validation, whEPSS 1.4%