{"url":"http://public2.vulnerablecode.io/api/packages/168262?format=json","purl":"pkg:composer/drupal/drupal@8.4.0-rc1","type":"composer","namespace":"drupal","name":"drupal","version":"8.4.0-rc1","qualifiers":{},"subpath":"","is_vulnerable":true,"next_non_vulnerable_version":"10.2.11","latest_non_vulnerable_version":"11.0.8","affected_by_vulnerabilities":[{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/10639?format=json","vulnerability_id":"VCID-349d-w26k-mqfw","summary":"Moderately critical - Third-party libraries - SA-CORE-2019-007\nThe `PharStreamWrapper` (aka `phar-stream-wrapper`) package does not prevent directory traversal, which allows attackers to bypass a deserialization protection mechanism, as demonstrated by a `phar:///path/bad.phar/../good.phar` URL.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2019-11831","reference_id":"","reference_type":"","scores":[{"value":"0.09656","scoring_system":"epss","scoring_elements":"0.92901","published_at":"2026-04-13T12:55:00Z"},{"value":"0.09656","scoring_system":"epss","scoring_elements":"0.929","published_at":"2026-04-12T12:55:00Z"},{"value":"0.09656","scoring_system":"epss","scoring_elements":"0.92902","published_at":"2026-04-11T12:55:00Z"},{"value":"0.09656","scoring_system":"epss","scoring_elements":"0.92897","published_at":"2026-04-09T12:55:00Z"},{"value":"0.10327","scoring_system":"epss","scoring_elements":"0.93164","published_at":"2026-04-02T12:55:00Z"},{"value":"0.10327","scoring_system":"epss","scoring_elements":"0.93155","published_at":"2026-04-01T12:55:00Z"},{"value":"0.10327","scoring_system":"epss","scoring_elements":"0.93175","published_at":"2026-04-08T12:55:00Z"},{"value":"0.10327","scoring_system":"epss","scoring_elements":"0.93167","published_at":"2026-04-07T12:55:00Z"},{"value":"0.10327","scoring_system":"epss","scoring_elements":"0.93168","published_at":"2026-04-04T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2019-11831"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11831","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11831"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2019-11831.yaml","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2019-11831.yaml"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2019-11831.yaml","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2019-11831.yaml"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/phar-stream-wrapper/CVE-2019-11831.yaml","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/phar-stream-wrapper/CVE-2019-11831.yaml"},{"reference_url":"https://github.com/TYPO3/phar-stream-wrapper","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/TYPO3/phar-stream-wrapper"},{"reference_url":"https://github.com/TYPO3/phar-stream-wrapper/releases/tag/v2.1.1","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/TYPO3/phar-stream-wrapper/releases/tag/v2.1.1"},{"reference_url":"https://github.com/TYPO3/phar-stream-wrapper/releases/tag/v3.1.1","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/TYPO3/phar-stream-wrapper/releases/tag/v3.1.1"},{"reference_url":"https://lists.debian.org/debian-lts-announce/2019/05/msg00029.html","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.debian.org/debian-lts-announce/2019/05/msg00029.html"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/65ODQHDHWR74L6TCAPAQR5FQHG6MCXAW","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/65ODQHDHWR74L6TCAPAQR5FQHG6MCXAW"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/65ODQHDHWR74L6TCAPAQR5FQHG6MCXAW/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/65ODQHDHWR74L6TCAPAQR5FQHG6MCXAW/"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6QDJVUJPUW3RZ4746SC6BX4F4T6ZXNBH","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6QDJVUJPUW3RZ4746SC6BX4F4T6ZXNBH"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6QDJVUJPUW3RZ4746SC6BX4F4T6ZXNBH/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6QDJVUJPUW3RZ4746SC6BX4F4T6ZXNBH/"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AUEXS4HRI4XZ2DTZMWAVQBYBTFSJ34AR","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AUEXS4HRI4XZ2DTZMWAVQBYBTFSJ34AR"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AUEXS4HRI4XZ2DTZMWAVQBYBTFSJ34AR/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AUEXS4HRI4XZ2DTZMWAVQBYBTFSJ34AR/"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E3NUKPG7V4QEM6QXRMHYR4ABFMW5MM2P","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E3NUKPG7V4QEM6QXRMHYR4ABFMW5MM2P"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E3NUKPG7V4QEM6QXRMHYR4ABFMW5MM2P/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E3NUKPG7V4QEM6QXRMHYR4ABFMW5MM2P/"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U6JX7WR6DPMKCZQP7EYFACYXSGJ3K523","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U6JX7WR6DPMKCZQP7EYFACYXSGJ3K523"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U6JX7WR6DPMKCZQP7EYFACYXSGJ3K523/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U6JX7WR6DPMKCZQP7EYFACYXSGJ3K523/"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z246UWBXBEKTQUDTLRJTC7XYBIO4IBE4","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z246UWBXBEKTQUDTLRJTC7XYBIO4IBE4"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z246UWBXBEKTQUDTLRJTC7XYBIO4IBE4/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z246UWBXBEKTQUDTLRJTC7XYBIO4IBE4/"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/65ODQHDHWR74L6TCAPAQR5FQHG6MCXAW","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/65ODQHDHWR74L6TCAPAQR5FQHG6MCXAW"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/65ODQHDHWR74L6TCAPAQR5FQHG6MCXAW/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/65ODQHDHWR74L6TCAPAQR5FQHG6MCXAW/"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6QDJVUJPUW3RZ4746SC6BX4F4T6ZXNBH","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6QDJVUJPUW3RZ4746SC6BX4F4T6ZXNBH"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6QDJVUJPUW3RZ4746SC6BX4F4T6ZXNBH/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6QDJVUJPUW3RZ4746SC6BX4F4T6ZXNBH/"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AUEXS4HRI4XZ2DTZMWAVQBYBTFSJ34AR","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AUEXS4HRI4XZ2DTZMWAVQBYBTFSJ34AR"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AUEXS4HRI4XZ2DTZMWAVQBYBTFSJ34AR/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AUEXS4HRI4XZ2DTZMWAVQBYBTFSJ34AR/"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/E3NUKPG7V4QEM6QXRMHYR4ABFMW5MM2P","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/E3NUKPG7V4QEM6QXRMHYR4ABFMW5MM2P"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/E3NUKPG7V4QEM6QXRMHYR4ABFMW5MM2P/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/E3NUKPG7V4QEM6QXRMHYR4ABFMW5MM2P/"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U6JX7WR6DPMKCZQP7EYFACYXSGJ3K523","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U6JX7WR6DPMKCZQP7EYFACYXSGJ3K523"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U6JX7WR6DPMKCZQP7EYFACYXSGJ3K523/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U6JX7WR6DPMKCZQP7EYFACYXSGJ3K523/"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Z246UWBXBEKTQUDTLRJTC7XYBIO4IBE4","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Z246UWBXBEKTQUDTLRJTC7XYBIO4IBE4"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Z246UWBXBEKTQUDTLRJTC7XYBIO4IBE4/","reference_id":"","reference_type":"","scores":[],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Z246UWBXBEKTQUDTLRJTC7XYBIO4IBE4/"},{"reference_url":"https://seclists.org/bugtraq/2019/May/36","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://seclists.org/bugtraq/2019/May/36"},{"reference_url":"https://typo3.org/security/advisory/typo3-psa-2019-007","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://typo3.org/security/advisory/typo3-psa-2019-007"},{"reference_url":"https://typo3.org/security/advisory/typo3-psa-2019-007/","reference_id":"","reference_type":"","scores":[],"url":"https://typo3.org/security/advisory/typo3-psa-2019-007/"},{"reference_url":"https://www.debian.org/security/2019/dsa-4445","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.debian.org/security/2019/dsa-4445"},{"reference_url":"https://www.drupal.org/sa-core-2019-007","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.drupal.org/sa-core-2019-007"},{"reference_url":"https://www.drupal.org/SA-CORE-2019-007","reference_id":"","reference_type":"","scores":[],"url":"https://www.drupal.org/SA-CORE-2019-007"},{"reference_url":"https://www.synology.com/security/advisory/Synology_SA_19_22","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.synology.com/security/advisory/Synology_SA_19_22"},{"reference_url":"http://www.securityfocus.com/bid/108302","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://www.securityfocus.com/bid/108302"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2019-11831","reference_id":"CVE-2019-11831","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-11831"},{"reference_url":"https://github.com/advisories/GHSA-xv7v-rf6g-xwrc","reference_id":"GHSA-xv7v-rf6g-xwrc","reference_type":"","scores":[{"value":"CRITICAL","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-xv7v-rf6g-xwrc"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/36447?format=json","purl":"pkg:composer/drupal/drupal@8.6.16","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-jfq8-xxwa-mkd1"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kh51-g4cv-tqaw"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n119-gta2-kfg1"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-pk74-yy1n-8qck"},{"vulnerability":"VCID-r8pv-9upr-y7gd"},{"vulnerability":"VCID-ty3y-k9t2-qyba"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-uqcw-p8g2-cfd2"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-w3q4-838v-97ck"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-wbvy-zrtk-audw"},{"vulnerability":"VCID-ww44-hb2y-mfd5"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/drupal@8.6.16"},{"url":"http://public2.vulnerablecode.io/api/packages/36448?format=json","purl":"pkg:composer/drupal/drupal@8.7.1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-5618-53yg-8qh4"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-cvxp-ctj9-guej"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-jfq8-xxwa-mkd1"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kh51-g4cv-tqaw"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n119-gta2-kfg1"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-nj3a-eb59-jygs"},{"vulnerability":"VCID-pk74-yy1n-8qck"},{"vulnerability":"VCID-r8pv-9upr-y7gd"},{"vulnerability":"VCID-ty3y-k9t2-qyba"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-uqcw-p8g2-cfd2"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-w3q4-838v-97ck"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-wbvy-zrtk-audw"},{"vulnerability":"VCID-ww44-hb2y-mfd5"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/drupal@8.7.1"}],"aliases":["CVE-2019-11831","GHSA-xv7v-rf6g-xwrc"],"risk_score":4.5,"exploitability":"0.5","weighted_severity":"9.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-349d-w26k-mqfw"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/10233?format=json","vulnerability_id":"VCID-3fka-y25d-m7a3","summary":"Improper Input Validation\nA remote code execution vulnerability exists in PHP's built-in phar stream wrapper when performing file operations on an untrusted `phar://` URI. Some Drupal code (core, contrib, and custom) may be performing file operations on insufficiently validated user input, thereby being exposed to this vulnerability. This vulnerability is mitigated by the fact that such code paths typically require access to an administrative permission or an atypical configuration.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2019-6339","reference_id":"","reference_type":"","scores":[{"value":"0.76091","scoring_system":"epss","scoring_elements":"0.98913","published_at":"2026-04-02T12:55:00Z"},{"value":"0.76091","scoring_system":"epss","scoring_elements":"0.98921","published_at":"2026-04-13T12:55:00Z"},{"value":"0.76091","scoring_system":"epss","scoring_elements":"0.9892","published_at":"2026-04-11T12:55:00Z"},{"value":"0.76091","scoring_system":"epss","scoring_elements":"0.98918","published_at":"2026-04-09T12:55:00Z"},{"value":"0.76091","scoring_system":"epss","scoring_elements":"0.98919","published_at":"2026-04-08T12:55:00Z"},{"value":"0.76091","scoring_system":"epss","scoring_elements":"0.98917","published_at":"2026-04-07T12:55:00Z"},{"value":"0.76091","scoring_system":"epss","scoring_elements":"0.98912","published_at":"2026-04-01T12:55:00Z"},{"value":"0.76091","scoring_system":"epss","scoring_elements":"0.98915","published_at":"2026-04-04T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2019-6339"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-6338","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-6338"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-6339","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-6339"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2019-6339.yaml","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2019-6339.yaml"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2019-6339.yaml","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2019-6339.yaml"},{"reference_url":"https://lists.debian.org/debian-lts-announce/2019/02/msg00004.html","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.debian.org/debian-lts-announce/2019/02/msg00004.html"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2019-6339","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv2","scoring_elements":"AV:N/AC:L/Au:N/C:P/I:P/A:P"},{"value":"9.8","scoring_system":"cvssv3","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-6339"},{"reference_url":"https://www.debian.org/security/2019/dsa-4370","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.debian.org/security/2019/dsa-4370"},{"reference_url":"https://www.drupal.org/sa-core-2019-002","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.drupal.org/sa-core-2019-002"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*","reference_id":"cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*","reference_id":"cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*"},{"reference_url":"https://github.com/advisories/GHSA-8cw5-rv98-5c46","reference_id":"GHSA-8cw5-rv98-5c46","reference_type":"","scores":[{"value":"CRITICAL","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-8cw5-rv98-5c46"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/78855?format=json","purl":"pkg:composer/drupal/drupal@8.5.9","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-349d-w26k-mqfw"},{"vulnerability":"VCID-3fka-y25d-m7a3"},{"vulnerability":"VCID-565p-mgqe-gkfc"},{"vulnerability":"VCID-636u-5bdw-puh4"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-cucx-jfqf-pkd1"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-djgn-ezxp-37eu"},{"vulnerability":"VCID-jfq8-xxwa-mkd1"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kh51-g4cv-tqaw"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n119-gta2-kfg1"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-pk74-yy1n-8qck"},{"vulnerability":"VCID-r8pv-9upr-y7gd"},{"vulnerability":"VCID-rhj7-dy7q-jkhw"},{"vulnerability":"VCID-ty3y-k9t2-qyba"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-uqcw-p8g2-cfd2"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-w3q4-838v-97ck"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-wbvy-zrtk-audw"},{"vulnerability":"VCID-ww44-hb2y-mfd5"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/drupal@8.5.9"},{"url":"http://public2.vulnerablecode.io/api/packages/34658?format=json","purl":"pkg:composer/drupal/drupal@8.6.6","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-349d-w26k-mqfw"},{"vulnerability":"VCID-565p-mgqe-gkfc"},{"vulnerability":"VCID-636u-5bdw-puh4"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-djgn-ezxp-37eu"},{"vulnerability":"VCID-jfq8-xxwa-mkd1"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kh51-g4cv-tqaw"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n119-gta2-kfg1"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-pk74-yy1n-8qck"},{"vulnerability":"VCID-r8pv-9upr-y7gd"},{"vulnerability":"VCID-rhj7-dy7q-jkhw"},{"vulnerability":"VCID-ty3y-k9t2-qyba"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-uqcw-p8g2-cfd2"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-w3q4-838v-97ck"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-wbvy-zrtk-audw"},{"vulnerability":"VCID-ww44-hb2y-mfd5"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/drupal@8.6.6"}],"aliases":["CVE-2019-6339","GHSA-8cw5-rv98-5c46"],"risk_score":4.5,"exploitability":"0.5","weighted_severity":"9.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-3fka-y25d-m7a3"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/8826?format=json","vulnerability_id":"VCID-48ut-ykkc-83fx","summary":"Comment reply form allows access to restricted content\nUsers with permission to post comments are able to view content and comments they do not have access to, and are also able to add comments to this content. This vulnerability is mitigated by the fact that the comment system must be enabled and the attacker must have permission to post comments.","references":[{"reference_url":"http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6926","reference_id":"","reference_type":"","scores":[],"url":"http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6926"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2017-6926","reference_id":"","reference_type":"","scores":[{"value":"0.00366","scoring_system":"epss","scoring_elements":"0.58547","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00366","scoring_system":"epss","scoring_elements":"0.58437","published_at":"2026-04-01T12:55:00Z"},{"value":"0.00366","scoring_system":"epss","scoring_elements":"0.58522","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00366","scoring_system":"epss","scoring_elements":"0.58542","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00366","scoring_system":"epss","scoring_elements":"0.58512","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00366","scoring_system":"epss","scoring_elements":"0.58564","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00366","scoring_system":"epss","scoring_elements":"0.58571","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00366","scoring_system":"epss","scoring_elements":"0.58587","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00366","scoring_system":"epss","scoring_elements":"0.58567","published_at":"2026-04-12T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2017-6926"},{"reference_url":"https://github.com/drupal/core","reference_id":"","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2017-6926.yaml","reference_id":"","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2017-6926.yaml"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2017-6926.yaml","reference_id":"","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2017-6926.yaml"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2017-6926","reference_id":"","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-6926"},{"reference_url":"https://www.drupal.org/sa-core-2018-001","reference_id":"","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.drupal.org/sa-core-2018-001"},{"reference_url":"https://www.drupal.org/SA-CORE-2018-001","reference_id":"","reference_type":"","scores":[],"url":"https://www.drupal.org/SA-CORE-2018-001"},{"reference_url":"https://github.com/advisories/GHSA-2p28-5mvp-2j2r","reference_id":"GHSA-2p28-5mvp-2j2r","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-2p28-5mvp-2j2r"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/26565?format=json","purl":"pkg:composer/drupal/drupal@8.4.5","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-349d-w26k-mqfw"},{"vulnerability":"VCID-3fka-y25d-m7a3"},{"vulnerability":"VCID-4aer-46u2-23f6"},{"vulnerability":"VCID-565p-mgqe-gkfc"},{"vulnerability":"VCID-5tqs-qmqn-gug5"},{"vulnerability":"VCID-636u-5bdw-puh4"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-8nda-kjr2-ufd4"},{"vulnerability":"VCID-9vdz-1jpq-kue3"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-c9dm-17vt-4bbc"},{"vulnerability":"VCID-cucx-jfqf-pkd1"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-ga35-289v-vqhr"},{"vulnerability":"VCID-gzcu-sbks-wyfa"},{"vulnerability":"VCID-jfq8-xxwa-mkd1"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kh51-g4cv-tqaw"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n119-gta2-kfg1"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-nc36-atc6-yua6"},{"vulnerability":"VCID-nd8n-5dsu-2fbp"},{"vulnerability":"VCID-pk74-yy1n-8qck"},{"vulnerability":"VCID-r8pv-9upr-y7gd"},{"vulnerability":"VCID-rhj7-dy7q-jkhw"},{"vulnerability":"VCID-rr4q-f5cv-nkah"},{"vulnerability":"VCID-t84c-8r34-57b9"},{"vulnerability":"VCID-ty3y-k9t2-qyba"},{"vulnerability":"VCID-u1xx-aazv-bkg5"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-uqcw-p8g2-cfd2"},{"vulnerability":"VCID-utyg-huhu-2ucq"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vq5y-hdw3-nucj"},{"vulnerability":"VCID-w3q4-838v-97ck"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-wbvy-zrtk-audw"},{"vulnerability":"VCID-ww44-hb2y-mfd5"},{"vulnerability":"VCID-wwvq-399y-rfhc"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/drupal@8.4.5"}],"aliases":["CVE-2017-6926","GHSA-2p28-5mvp-2j2r"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-48ut-ykkc-83fx"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/8983?format=json","vulnerability_id":"VCID-4aer-46u2-23f6","summary":"Cross-site Scripting\nCross-site scripting (XSS) vulnerability in the Enhanced Image plugin for CKEditor.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2018-9861","reference_id":"","reference_type":"","scores":[{"value":"0.00369","scoring_system":"epss","scoring_elements":"0.5884","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00369","scoring_system":"epss","scoring_elements":"0.58802","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00369","scoring_system":"epss","scoring_elements":"0.58821","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00369","scoring_system":"epss","scoring_elements":"0.58698","published_at":"2026-04-01T12:55:00Z"},{"value":"0.00369","scoring_system":"epss","scoring_elements":"0.58772","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00369","scoring_system":"epss","scoring_elements":"0.58794","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00369","scoring_system":"epss","scoring_elements":"0.58763","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00369","scoring_system":"epss","scoring_elements":"0.58815","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00369","scoring_system":"epss","scoring_elements":"0.58822","published_at":"2026-04-09T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2018-9861"},{"reference_url":"https://github.com/ckeditor/ckeditor-dev/blob/master/CHANGES.md","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/ckeditor/ckeditor-dev/blob/master/CHANGES.md"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2018-9861.yaml","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2018-9861.yaml"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2018-9861.yaml","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2018-9861.yaml"},{"reference_url":"https://www.drupal.org/sa-core-2018-003","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.drupal.org/sa-core-2018-003"},{"reference_url":"https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"},{"reference_url":"http://www.securityfocus.com/bid/103924","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://www.securityfocus.com/bid/103924"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:ckeditor:enhanced_image:*:*:*:*:*:ckeditor:*:*","reference_id":"cpe:2.3:a:ckeditor:enhanced_image:*:*:*:*:*:ckeditor:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:ckeditor:enhanced_image:*:*:*:*:*:ckeditor:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2018-9861","reference_id":"CVE-2018-9861","reference_type":"","scores":[{"value":"4.3","scoring_system":"cvssv2","scoring_elements":"AV:N/AC:M/Au:N/C:N/I:P/A:N"},{"value":"6.1","scoring_system":"cvssv3","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-9861"},{"reference_url":"https://github.com/advisories/GHSA-g78h-pf65-46rv","reference_id":"GHSA-g78h-pf65-46rv","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-g78h-pf65-46rv"},{"reference_url":"https://usn.ubuntu.com/5340-1/","reference_id":"USN-5340-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/5340-1/"},{"reference_url":"https://usn.ubuntu.com/USN-5340-2/","reference_id":"USN-USN-5340-2","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/USN-5340-2/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/26993?format=json","purl":"pkg:composer/drupal/drupal@8.4.7","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-349d-w26k-mqfw"},{"vulnerability":"VCID-3fka-y25d-m7a3"},{"vulnerability":"VCID-565p-mgqe-gkfc"},{"vulnerability":"VCID-5tqs-qmqn-gug5"},{"vulnerability":"VCID-636u-5bdw-puh4"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-8nda-kjr2-ufd4"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-c9dm-17vt-4bbc"},{"vulnerability":"VCID-cucx-jfqf-pkd1"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-gzcu-sbks-wyfa"},{"vulnerability":"VCID-jfq8-xxwa-mkd1"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kh51-g4cv-tqaw"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n119-gta2-kfg1"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-nd8n-5dsu-2fbp"},{"vulnerability":"VCID-pk74-yy1n-8qck"},{"vulnerability":"VCID-r8pv-9upr-y7gd"},{"vulnerability":"VCID-rhj7-dy7q-jkhw"},{"vulnerability":"VCID-rr4q-f5cv-nkah"},{"vulnerability":"VCID-t84c-8r34-57b9"},{"vulnerability":"VCID-ty3y-k9t2-qyba"},{"vulnerability":"VCID-u1xx-aazv-bkg5"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-uqcw-p8g2-cfd2"},{"vulnerability":"VCID-utyg-huhu-2ucq"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vq5y-hdw3-nucj"},{"vulnerability":"VCID-w3q4-838v-97ck"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-wbvy-zrtk-audw"},{"vulnerability":"VCID-ww44-hb2y-mfd5"},{"vulnerability":"VCID-wwvq-399y-rfhc"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/drupal@8.4.7"},{"url":"http://public2.vulnerablecode.io/api/packages/26995?format=json","purl":"pkg:composer/drupal/drupal@8.5.2","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-349d-w26k-mqfw"},{"vulnerability":"VCID-3fka-y25d-m7a3"},{"vulnerability":"VCID-565p-mgqe-gkfc"},{"vulnerability":"VCID-5tqs-qmqn-gug5"},{"vulnerability":"VCID-636u-5bdw-puh4"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-8nda-kjr2-ufd4"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-c9dm-17vt-4bbc"},{"vulnerability":"VCID-cucx-jfqf-pkd1"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-djgn-ezxp-37eu"},{"vulnerability":"VCID-gzcu-sbks-wyfa"},{"vulnerability":"VCID-jfq8-xxwa-mkd1"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kh51-g4cv-tqaw"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n119-gta2-kfg1"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-nd8n-5dsu-2fbp"},{"vulnerability":"VCID-pk74-yy1n-8qck"},{"vulnerability":"VCID-r8pv-9upr-y7gd"},{"vulnerability":"VCID-rhj7-dy7q-jkhw"},{"vulnerability":"VCID-rr4q-f5cv-nkah"},{"vulnerability":"VCID-t84c-8r34-57b9"},{"vulnerability":"VCID-ty3y-k9t2-qyba"},{"vulnerability":"VCID-u1xx-aazv-bkg5"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-uqcw-p8g2-cfd2"},{"vulnerability":"VCID-utyg-huhu-2ucq"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vq5y-hdw3-nucj"},{"vulnerability":"VCID-w3q4-838v-97ck"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-wbvy-zrtk-audw"},{"vulnerability":"VCID-ww44-hb2y-mfd5"},{"vulnerability":"VCID-wwvq-399y-rfhc"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/drupal@8.5.2"}],"aliases":["CVE-2018-9861","GHSA-g78h-pf65-46rv"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-4aer-46u2-23f6"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/10460?format=json","vulnerability_id":"VCID-565p-mgqe-gkfc","summary":"Cross-site Scripting vulnerability in drupal.","references":[{"reference_url":"https://www.drupal.org/sa-core-2019-004","reference_id":"","reference_type":"","scores":[],"url":"https://www.drupal.org/sa-core-2019-004"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/35387?format=json","purl":"pkg:composer/drupal/drupal@8.6.12","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-349d-w26k-mqfw"},{"vulnerability":"VCID-636u-5bdw-puh4"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-djgn-ezxp-37eu"},{"vulnerability":"VCID-jfq8-xxwa-mkd1"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kh51-g4cv-tqaw"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n119-gta2-kfg1"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-pk74-yy1n-8qck"},{"vulnerability":"VCID-r8pv-9upr-y7gd"},{"vulnerability":"VCID-ty3y-k9t2-qyba"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-uqcw-p8g2-cfd2"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-w3q4-838v-97ck"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-wbvy-zrtk-audw"},{"vulnerability":"VCID-ww44-hb2y-mfd5"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/drupal@8.6.12"}],"aliases":["2019-03-20"],"risk_score":null,"exploitability":"0.5","weighted_severity":"0.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-565p-mgqe-gkfc"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/19508?format=json","vulnerability_id":"VCID-5tqs-qmqn-gug5","summary":"Drupal Core Insufficient Contextual Links validation leads to Remote Code Execution\nThe Contextual Links module doesn't sufficiently validate the requested contextual links.\nThis vulnerability is mitigated by the fact that an attacker must have a role with the permission \"access contextual links\".","references":[{"reference_url":"https://github.com/drupal/drupal","reference_id":"","reference_type":"","scores":[{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/drupal"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/2018-10-17-5.yaml","reference_id":"","reference_type":"","scores":[{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/2018-10-17-5.yaml"},{"reference_url":"https://www.drupal.org/sa-core-2018-006","reference_id":"","reference_type":"","scores":[{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.drupal.org/sa-core-2018-006"},{"reference_url":"https://github.com/advisories/GHSA-jjx7-8462-w4m4","reference_id":"GHSA-jjx7-8462-w4m4","reference_type":"","scores":[{"value":"CRITICAL","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-jjx7-8462-w4m4"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/59990?format=json","purl":"pkg:composer/drupal/drupal@8.5.8","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-349d-w26k-mqfw"},{"vulnerability":"VCID-3fka-y25d-m7a3"},{"vulnerability":"VCID-565p-mgqe-gkfc"},{"vulnerability":"VCID-636u-5bdw-puh4"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-c9dm-17vt-4bbc"},{"vulnerability":"VCID-cucx-jfqf-pkd1"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-djgn-ezxp-37eu"},{"vulnerability":"VCID-gzcu-sbks-wyfa"},{"vulnerability":"VCID-jfq8-xxwa-mkd1"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kh51-g4cv-tqaw"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n119-gta2-kfg1"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-nd8n-5dsu-2fbp"},{"vulnerability":"VCID-pk74-yy1n-8qck"},{"vulnerability":"VCID-r8pv-9upr-y7gd"},{"vulnerability":"VCID-rhj7-dy7q-jkhw"},{"vulnerability":"VCID-rr4q-f5cv-nkah"},{"vulnerability":"VCID-ty3y-k9t2-qyba"},{"vulnerability":"VCID-u1xx-aazv-bkg5"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-uqcw-p8g2-cfd2"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-w3q4-838v-97ck"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-wbvy-zrtk-audw"},{"vulnerability":"VCID-ww44-hb2y-mfd5"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/drupal@8.5.8"},{"url":"http://public2.vulnerablecode.io/api/packages/32217?format=json","purl":"pkg:composer/drupal/drupal@8.6.2","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-349d-w26k-mqfw"},{"vulnerability":"VCID-3fka-y25d-m7a3"},{"vulnerability":"VCID-565p-mgqe-gkfc"},{"vulnerability":"VCID-636u-5bdw-puh4"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-cucx-jfqf-pkd1"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-djgn-ezxp-37eu"},{"vulnerability":"VCID-jfq8-xxwa-mkd1"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kh51-g4cv-tqaw"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n119-gta2-kfg1"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-pk74-yy1n-8qck"},{"vulnerability":"VCID-r8pv-9upr-y7gd"},{"vulnerability":"VCID-rhj7-dy7q-jkhw"},{"vulnerability":"VCID-ty3y-k9t2-qyba"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-uqcw-p8g2-cfd2"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-w3q4-838v-97ck"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-wbvy-zrtk-audw"},{"vulnerability":"VCID-ww44-hb2y-mfd5"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/drupal@8.6.2"}],"aliases":["GHSA-jjx7-8462-w4m4"],"risk_score":4.5,"exploitability":"0.5","weighted_severity":"9.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-5tqs-qmqn-gug5"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/10652?format=json","vulnerability_id":"VCID-636u-5bdw-puh4","summary":"Cross-site Scripting\nIn Symfony, validation messages are not escaped, which can lead to XSS when user input is included.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2019-10909","reference_id":"","reference_type":"","scores":[{"value":"0.00369","scoring_system":"epss","scoring_elements":"0.58747","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00369","scoring_system":"epss","scoring_elements":"0.58776","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00369","scoring_system":"epss","scoring_elements":"0.58814","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00369","scoring_system":"epss","scoring_elements":"0.58795","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00369","scoring_system":"epss","scoring_elements":"0.58788","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00369","scoring_system":"epss","scoring_elements":"0.58736","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00369","scoring_system":"epss","scoring_elements":"0.58768","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00369","scoring_system":"epss","scoring_elements":"0.58663","published_at":"2026-04-01T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2019-10909"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14773","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14773"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-19789","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-19789"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-19790","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-19790"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10909","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10909"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10910","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10910"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10911","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10911"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10912","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10912"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10913","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10913"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2019-10909.yaml","reference_id":"","reference_type":"","scores":[{"value":"5.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2019-10909.yaml"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2019-10909.yaml","reference_id":"","reference_type":"","scores":[{"value":"5.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2019-10909.yaml"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/framework-bundle/CVE-2019-10909.yaml","reference_id":"","reference_type":"","scores":[{"value":"5.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/framework-bundle/CVE-2019-10909.yaml"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2019-10909.yaml","reference_id":"","reference_type":"","scores":[{"value":"5.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2019-10909.yaml"},{"reference_url":"https://github.com/symfony/symfony/commit/ab4d05358c3d0dd1a36fc8c306829f68e3dd84e2","reference_id":"","reference_type":"","scores":[{"value":"5.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/symfony/symfony/commit/ab4d05358c3d0dd1a36fc8c306829f68e3dd84e2"},{"reference_url":"https://www.drupal.org/sa-core-2019-005","reference_id":"","reference_type":"","scores":[{"value":"5.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.drupal.org/sa-core-2019-005"},{"reference_url":"https://www.synology.com/security/advisory/Synology_SA_19_19","reference_id":"","reference_type":"","scores":[{"value":"5.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.synology.com/security/advisory/Synology_SA_19_19"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2019-10909","reference_id":"CVE-2019-10909","reference_type":"","scores":[{"value":"5.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-10909"},{"reference_url":"https://symfony.com/cve-2019-10909","reference_id":"CVE-2019-10909","reference_type":"","scores":[{"value":"5.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://symfony.com/cve-2019-10909"},{"reference_url":"https://symfony.com/blog/cve-2019-10909-escape-validation-messages-in-the-php-templating-engine","reference_id":"CVE-2019-10909-ESCAPE-VALIDATION-MESSAGES-IN-THE-PHP-TEMPLATING-ENGINE","reference_type":"","scores":[{"value":"5.4","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://symfony.com/blog/cve-2019-10909-escape-validation-messages-in-the-php-templating-engine"},{"reference_url":"https://github.com/advisories/GHSA-g996-q5r8-w7g2","reference_id":"GHSA-g996-q5r8-w7g2","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-g996-q5r8-w7g2"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/36482?format=json","purl":"pkg:composer/drupal/drupal@8.5.15","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-349d-w26k-mqfw"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-jfq8-xxwa-mkd1"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kh51-g4cv-tqaw"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n119-gta2-kfg1"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-pk74-yy1n-8qck"},{"vulnerability":"VCID-r8pv-9upr-y7gd"},{"vulnerability":"VCID-ty3y-k9t2-qyba"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-uqcw-p8g2-cfd2"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-w3q4-838v-97ck"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-wbvy-zrtk-audw"},{"vulnerability":"VCID-ww44-hb2y-mfd5"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/drupal@8.5.15"},{"url":"http://public2.vulnerablecode.io/api/packages/36483?format=json","purl":"pkg:composer/drupal/drupal@8.6.15","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-349d-w26k-mqfw"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-jfq8-xxwa-mkd1"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kh51-g4cv-tqaw"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n119-gta2-kfg1"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-pk74-yy1n-8qck"},{"vulnerability":"VCID-r8pv-9upr-y7gd"},{"vulnerability":"VCID-ty3y-k9t2-qyba"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-uqcw-p8g2-cfd2"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-w3q4-838v-97ck"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-wbvy-zrtk-audw"},{"vulnerability":"VCID-ww44-hb2y-mfd5"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/drupal@8.6.15"}],"aliases":["CVE-2019-10909","GHSA-g996-q5r8-w7g2"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-636u-5bdw-puh4"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/17391?format=json","vulnerability_id":"VCID-6ck5-9e5b-w3ay","summary":"Improper access control\nIn some situations, the Image module does not correctly check access to image files not stored in the standard public files directory when generating derivative images using the image styles system. Access to a non-public file is checked only if it is stored in the \"private\" file system. However, some contributed modules provide additional file systems, or schemes, which may lead to this vulnerability. This vulnerability is mitigated by the fact that it only applies when the site sets (Drupal 9) $config['image.settings']['allow_insecure_derivatives'] or (Drupal 7) $conf['image_allow_insecure_derivatives'] to TRUE. The recommended and default setting is FALSE, and Drupal core does not provide a way to change that in the admin UI. Some sites may require configuration changes following this security release. Review the release notes for your Drupal version if you have issues accessing files or image styles after updating.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2022-25275","reference_id":"","reference_type":"","scores":[{"value":"0.00375","scoring_system":"epss","scoring_elements":"0.59084","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00375","scoring_system":"epss","scoring_elements":"0.59071","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00375","scoring_system":"epss","scoring_elements":"0.59107","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00375","scoring_system":"epss","scoring_elements":"0.59144","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00375","scoring_system":"epss","scoring_elements":"0.59126","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00375","scoring_system":"epss","scoring_elements":"0.59123","published_at":"2026-04-08T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2022-25275"},{"reference_url":"https://github.com/drupal/core","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core"},{"reference_url":"https://github.com/drupal/core/commit/2d5f47fc8a166115f56c2330a81e83abe22445cf","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core/commit/2d5f47fc8a166115f56c2330a81e83abe22445cf"},{"reference_url":"https://github.com/drupal/core/commit/e2fbf63700819cb470a1be425798f1a3f2020116","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core/commit/e2fbf63700819cb470a1be425798f1a3f2020116"},{"reference_url":"https://www.drupal.org/sa-core-2022-012","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-02-03T18:45:46Z/"}],"url":"https://www.drupal.org/sa-core-2022-012"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2022-25275","reference_id":"CVE-2022-25275","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-25275"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2022-25275.yaml","reference_id":"CVE-2022-25275.YAML","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2022-25275.yaml"},{"reference_url":"https://github.com/advisories/GHSA-xh3v-6f9j-wxw3","reference_id":"GHSA-xh3v-6f9j-wxw3","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-xh3v-6f9j-wxw3"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/57338?format=json","purl":"pkg:composer/drupal/drupal@9.3.19","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1nf6-3q5b-gqfm"},{"vulnerability":"VCID-2s8m-ujzb-skd1"},{"vulnerability":"VCID-q4qx-7s1y-q3hc"},{"vulnerability":"VCID-rdgr-yuu7-xkey"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-vevm-4sfk-f7gq"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/drupal@9.3.19"},{"url":"http://public2.vulnerablecode.io/api/packages/57339?format=json","purl":"pkg:composer/drupal/drupal@9.4.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1nf6-3q5b-gqfm"},{"vulnerability":"VCID-2s8m-ujzb-skd1"},{"vulnerability":"VCID-bk92-66re-dkc5"},{"vulnerability":"VCID-q4qx-7s1y-q3hc"},{"vulnerability":"VCID-rdgr-yuu7-xkey"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-vevm-4sfk-f7gq"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/drupal@9.4.3"}],"aliases":["CVE-2022-25275","GHSA-xh3v-6f9j-wxw3","GMS-2022-3362"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-6ck5-9e5b-w3ay"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/11348?format=json","vulnerability_id":"VCID-6m8x-cfzp-tkf4","summary":"Drupal core Unrestricted Upload of File with Dangerous Type\nDrupal core does not properly sanitize certain filenames on uploaded files, which can lead to files being interpreted as the incorrect extension and served as the wrong MIME type or executed as PHP for certain hosting configurations. This issue affects: Drupal Drupal Core 9.0 versions prior to 9.0.8, 8.9 versions prior to 8.9.9, 8.8 versions prior to 8.8.11, and 7 versions prior to 7.74.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2020-13671","reference_id":"","reference_type":"","scores":[{"value":"0.04504","scoring_system":"epss","scoring_elements":"0.89078","published_at":"2026-04-01T12:55:00Z"},{"value":"0.04504","scoring_system":"epss","scoring_elements":"0.89133","published_at":"2026-04-13T12:55:00Z"},{"value":"0.04504","scoring_system":"epss","scoring_elements":"0.89135","published_at":"2026-04-12T12:55:00Z"},{"value":"0.04504","scoring_system":"epss","scoring_elements":"0.89138","published_at":"2026-04-11T12:55:00Z"},{"value":"0.04504","scoring_system":"epss","scoring_elements":"0.89127","published_at":"2026-04-09T12:55:00Z"},{"value":"0.04504","scoring_system":"epss","scoring_elements":"0.89122","published_at":"2026-04-08T12:55:00Z"},{"value":"0.04504","scoring_system":"epss","scoring_elements":"0.89105","published_at":"2026-04-07T12:55:00Z"},{"value":"0.04504","scoring_system":"epss","scoring_elements":"0.89102","published_at":"2026-04-04T12:55:00Z"},{"value":"0.04504","scoring_system":"epss","scoring_elements":"0.89087","published_at":"2026-04-02T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2020-13671"},{"reference_url":"https://github.com/drupal/core","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5KSFM672XW3X6BR7TVKRD63SLZGKK437","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5KSFM672XW3X6BR7TVKRD63SLZGKK437"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KWM4CTMEGAC4I2CHYNJVSROY4CVXVEUT","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KWM4CTMEGAC4I2CHYNJVSROY4CVXVEUT"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5KSFM672XW3X6BR7TVKRD63SLZGKK437","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5KSFM672XW3X6BR7TVKRD63SLZGKK437"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KWM4CTMEGAC4I2CHYNJVSROY4CVXVEUT","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KWM4CTMEGAC4I2CHYNJVSROY4CVXVEUT"},{"reference_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-13671","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-13671"},{"reference_url":"https://www.drupal.org/sa-core-2020-012","reference_id":"","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:H"},{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Attend","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2025-02-07T12:38:31Z/"}],"url":"https://www.drupal.org/sa-core-2020-012"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5KSFM672XW3X6BR7TVKRD63SLZGKK437/","reference_id":"5KSFM672XW3X6BR7TVKRD63SLZGKK437","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"value":"Attend","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2025-02-07T12:38:31Z/"}],"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5KSFM672XW3X6BR7TVKRD63SLZGKK437/"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2020-13671","reference_id":"CVE-2020-13671","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-13671"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2020-13671.yaml","reference_id":"CVE-2020-13671.YAML","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2020-13671.yaml"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2020-13671.yaml","reference_id":"CVE-2020-13671.YAML","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2020-13671.yaml"},{"reference_url":"https://github.com/advisories/GHSA-68jc-v27h-vhmw","reference_id":"GHSA-68jc-v27h-vhmw","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-68jc-v27h-vhmw"},{"reference_url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KWM4CTMEGAC4I2CHYNJVSROY4CVXVEUT/","reference_id":"KWM4CTMEGAC4I2CHYNJVSROY4CVXVEUT","reference_type":"","scores":[{"value":"8.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"value":"Attend","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2025-02-07T12:38:31Z/"}],"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KWM4CTMEGAC4I2CHYNJVSROY4CVXVEUT/"},{"reference_url":"https://usn.ubuntu.com/6981-1/","reference_id":"USN-6981-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/6981-1/"},{"reference_url":"https://usn.ubuntu.com/6981-2/","reference_id":"USN-6981-2","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/6981-2/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/40771?format=json","purl":"pkg:composer/drupal/drupal@8.8.11","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1nf6-3q5b-gqfm"},{"vulnerability":"VCID-2s8m-ujzb-skd1"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-gbz5-5frj-hber"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-q4qx-7s1y-q3hc"},{"vulnerability":"VCID-r8pv-9upr-y7gd"},{"vulnerability":"VCID-rdgr-yuu7-xkey"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-v9v6-ae3e-g3hk"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-wbvy-zrtk-audw"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/drupal@8.8.11"},{"url":"http://public2.vulnerablecode.io/api/packages/40772?format=json","purl":"pkg:composer/drupal/drupal@8.9.9","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1nf6-3q5b-gqfm"},{"vulnerability":"VCID-2s8m-ujzb-skd1"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-gbz5-5frj-hber"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kc7d-5k6x-77bp"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-q4qx-7s1y-q3hc"},{"vulnerability":"VCID-r8pv-9upr-y7gd"},{"vulnerability":"VCID-rdgr-yuu7-xkey"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-v9v6-ae3e-g3hk"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-wbvy-zrtk-audw"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/drupal@8.9.9"},{"url":"http://public2.vulnerablecode.io/api/packages/40773?format=json","purl":"pkg:composer/drupal/drupal@9.0.8","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1nf6-3q5b-gqfm"},{"vulnerability":"VCID-2s8m-ujzb-skd1"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-gbz5-5frj-hber"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kc7d-5k6x-77bp"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-q4qx-7s1y-q3hc"},{"vulnerability":"VCID-r8pv-9upr-y7gd"},{"vulnerability":"VCID-rdgr-yuu7-xkey"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-v9v6-ae3e-g3hk"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-wbvy-zrtk-audw"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/drupal@9.0.8"}],"aliases":["CVE-2020-13671","GHSA-68jc-v27h-vhmw"],"risk_score":10.0,"exploitability":"2.0","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-6m8x-cfzp-tkf4"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/19063?format=json","vulnerability_id":"VCID-8nda-kjr2-ufd4","summary":"Drupal core Remote Code Execution\nIn Drupal core, when sending email some variables were not being sanitized for shell arguments in `DefaultMailSystem::mail()`, which could lead to remote code execution.","references":[{"reference_url":"https://github.com/drupal/drupal","reference_id":"","reference_type":"","scores":[{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/drupal"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/2018-10-17-4.yaml","reference_id":"","reference_type":"","scores":[{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/2018-10-17-4.yaml"},{"reference_url":"https://www.drupal.org/sa-core-2018-006","reference_id":"","reference_type":"","scores":[{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.drupal.org/sa-core-2018-006"},{"reference_url":"https://github.com/advisories/GHSA-jf8c-36vw-98x4","reference_id":"GHSA-jf8c-36vw-98x4","reference_type":"","scores":[{"value":"CRITICAL","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-jf8c-36vw-98x4"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/59990?format=json","purl":"pkg:composer/drupal/drupal@8.5.8","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-349d-w26k-mqfw"},{"vulnerability":"VCID-3fka-y25d-m7a3"},{"vulnerability":"VCID-565p-mgqe-gkfc"},{"vulnerability":"VCID-636u-5bdw-puh4"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-c9dm-17vt-4bbc"},{"vulnerability":"VCID-cucx-jfqf-pkd1"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-djgn-ezxp-37eu"},{"vulnerability":"VCID-gzcu-sbks-wyfa"},{"vulnerability":"VCID-jfq8-xxwa-mkd1"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kh51-g4cv-tqaw"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n119-gta2-kfg1"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-nd8n-5dsu-2fbp"},{"vulnerability":"VCID-pk74-yy1n-8qck"},{"vulnerability":"VCID-r8pv-9upr-y7gd"},{"vulnerability":"VCID-rhj7-dy7q-jkhw"},{"vulnerability":"VCID-rr4q-f5cv-nkah"},{"vulnerability":"VCID-ty3y-k9t2-qyba"},{"vulnerability":"VCID-u1xx-aazv-bkg5"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-uqcw-p8g2-cfd2"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-w3q4-838v-97ck"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-wbvy-zrtk-audw"},{"vulnerability":"VCID-ww44-hb2y-mfd5"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/drupal@8.5.8"},{"url":"http://public2.vulnerablecode.io/api/packages/32217?format=json","purl":"pkg:composer/drupal/drupal@8.6.2","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-349d-w26k-mqfw"},{"vulnerability":"VCID-3fka-y25d-m7a3"},{"vulnerability":"VCID-565p-mgqe-gkfc"},{"vulnerability":"VCID-636u-5bdw-puh4"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-cucx-jfqf-pkd1"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-djgn-ezxp-37eu"},{"vulnerability":"VCID-jfq8-xxwa-mkd1"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kh51-g4cv-tqaw"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n119-gta2-kfg1"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-pk74-yy1n-8qck"},{"vulnerability":"VCID-r8pv-9upr-y7gd"},{"vulnerability":"VCID-rhj7-dy7q-jkhw"},{"vulnerability":"VCID-ty3y-k9t2-qyba"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-uqcw-p8g2-cfd2"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-w3q4-838v-97ck"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-wbvy-zrtk-audw"},{"vulnerability":"VCID-ww44-hb2y-mfd5"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/drupal@8.6.2"}],"aliases":["GHSA-jf8c-36vw-98x4"],"risk_score":4.5,"exploitability":"0.5","weighted_severity":"9.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-8nda-kjr2-ufd4"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/8827?format=json","vulnerability_id":"VCID-9f24-vqyt-r7dq","summary":"Language fallback can be incorrect on multilingual sites with node access restrictions\nWhen using node access controls with a multilingual site, Drupal marks the untranslated version of a node as the default fallback for access queries. This fallback is used for languages that do not yet have a translated version of the created node. This can result in an access bypass vulnerability. This issue is mitigated by the fact that it only applies to sites that a) use the Content Translation module; and b) use a node access module such as Domain Access which implement hook_node_access_records(). Note that the update will mark the node access tables as needing a rebuild, which will take a long time on sites with a large number of nodes.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2017-6930","reference_id":"","reference_type":"","scores":[{"value":"0.00424","scoring_system":"epss","scoring_elements":"0.6218","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00424","scoring_system":"epss","scoring_elements":"0.62065","published_at":"2026-04-01T12:55:00Z"},{"value":"0.00424","scoring_system":"epss","scoring_elements":"0.62125","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00424","scoring_system":"epss","scoring_elements":"0.62156","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00424","scoring_system":"epss","scoring_elements":"0.62126","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00424","scoring_system":"epss","scoring_elements":"0.62176","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00424","scoring_system":"epss","scoring_elements":"0.62194","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00424","scoring_system":"epss","scoring_elements":"0.62211","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00424","scoring_system":"epss","scoring_elements":"0.62201","published_at":"2026-04-12T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2017-6930"},{"reference_url":"https://github.com/drupal/core","reference_id":"","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2017-6930.yaml","reference_id":"","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2017-6930.yaml"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2017-6930.yaml","reference_id":"","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2017-6930.yaml"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2017-6930","reference_id":"","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-6930"},{"reference_url":"https://www.drupal.org/sa-core-2018-001","reference_id":"","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.drupal.org/sa-core-2018-001"},{"reference_url":"https://www.drupal.org/SA-CORE-2018-001","reference_id":"","reference_type":"","scores":[],"url":"https://www.drupal.org/SA-CORE-2018-001"},{"reference_url":"http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2017-6930","reference_id":"","reference_type":"","scores":[],"url":"http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2017-6930"},{"reference_url":"https://github.com/advisories/GHSA-3327-jr93-7hq3","reference_id":"GHSA-3327-jr93-7hq3","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-3327-jr93-7hq3"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/26565?format=json","purl":"pkg:composer/drupal/drupal@8.4.5","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-349d-w26k-mqfw"},{"vulnerability":"VCID-3fka-y25d-m7a3"},{"vulnerability":"VCID-4aer-46u2-23f6"},{"vulnerability":"VCID-565p-mgqe-gkfc"},{"vulnerability":"VCID-5tqs-qmqn-gug5"},{"vulnerability":"VCID-636u-5bdw-puh4"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-8nda-kjr2-ufd4"},{"vulnerability":"VCID-9vdz-1jpq-kue3"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-c9dm-17vt-4bbc"},{"vulnerability":"VCID-cucx-jfqf-pkd1"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-ga35-289v-vqhr"},{"vulnerability":"VCID-gzcu-sbks-wyfa"},{"vulnerability":"VCID-jfq8-xxwa-mkd1"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kh51-g4cv-tqaw"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n119-gta2-kfg1"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-nc36-atc6-yua6"},{"vulnerability":"VCID-nd8n-5dsu-2fbp"},{"vulnerability":"VCID-pk74-yy1n-8qck"},{"vulnerability":"VCID-r8pv-9upr-y7gd"},{"vulnerability":"VCID-rhj7-dy7q-jkhw"},{"vulnerability":"VCID-rr4q-f5cv-nkah"},{"vulnerability":"VCID-t84c-8r34-57b9"},{"vulnerability":"VCID-ty3y-k9t2-qyba"},{"vulnerability":"VCID-u1xx-aazv-bkg5"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-uqcw-p8g2-cfd2"},{"vulnerability":"VCID-utyg-huhu-2ucq"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vq5y-hdw3-nucj"},{"vulnerability":"VCID-w3q4-838v-97ck"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-wbvy-zrtk-audw"},{"vulnerability":"VCID-ww44-hb2y-mfd5"},{"vulnerability":"VCID-wwvq-399y-rfhc"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/drupal@8.4.5"}],"aliases":["CVE-2017-6930","GHSA-3327-jr93-7hq3"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-9f24-vqyt-r7dq"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/8967?format=json","vulnerability_id":"VCID-9vdz-1jpq-kue3","summary":"Cross-site Scripting\nXSS vulnerabiltiy in drupal.","references":[{"reference_url":"https://www.drupal.org/sa-core-2018-003","reference_id":"","reference_type":"","scores":[],"url":"https://www.drupal.org/sa-core-2018-003"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/26993?format=json","purl":"pkg:composer/drupal/drupal@8.4.7","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-349d-w26k-mqfw"},{"vulnerability":"VCID-3fka-y25d-m7a3"},{"vulnerability":"VCID-565p-mgqe-gkfc"},{"vulnerability":"VCID-5tqs-qmqn-gug5"},{"vulnerability":"VCID-636u-5bdw-puh4"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-8nda-kjr2-ufd4"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-c9dm-17vt-4bbc"},{"vulnerability":"VCID-cucx-jfqf-pkd1"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-gzcu-sbks-wyfa"},{"vulnerability":"VCID-jfq8-xxwa-mkd1"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kh51-g4cv-tqaw"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n119-gta2-kfg1"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-nd8n-5dsu-2fbp"},{"vulnerability":"VCID-pk74-yy1n-8qck"},{"vulnerability":"VCID-r8pv-9upr-y7gd"},{"vulnerability":"VCID-rhj7-dy7q-jkhw"},{"vulnerability":"VCID-rr4q-f5cv-nkah"},{"vulnerability":"VCID-t84c-8r34-57b9"},{"vulnerability":"VCID-ty3y-k9t2-qyba"},{"vulnerability":"VCID-u1xx-aazv-bkg5"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-uqcw-p8g2-cfd2"},{"vulnerability":"VCID-utyg-huhu-2ucq"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vq5y-hdw3-nucj"},{"vulnerability":"VCID-w3q4-838v-97ck"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-wbvy-zrtk-audw"},{"vulnerability":"VCID-ww44-hb2y-mfd5"},{"vulnerability":"VCID-wwvq-399y-rfhc"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/drupal@8.4.7"},{"url":"http://public2.vulnerablecode.io/api/packages/168767?format=json","purl":"pkg:composer/drupal/drupal@8.5.0-alpha1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-349d-w26k-mqfw"},{"vulnerability":"VCID-3fka-y25d-m7a3"},{"vulnerability":"VCID-565p-mgqe-gkfc"},{"vulnerability":"VCID-5tqs-qmqn-gug5"},{"vulnerability":"VCID-636u-5bdw-puh4"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-8nda-kjr2-ufd4"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-c9dm-17vt-4bbc"},{"vulnerability":"VCID-cucx-jfqf-pkd1"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-gzcu-sbks-wyfa"},{"vulnerability":"VCID-jfq8-xxwa-mkd1"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kh51-g4cv-tqaw"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n119-gta2-kfg1"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-nc36-atc6-yua6"},{"vulnerability":"VCID-nd8n-5dsu-2fbp"},{"vulnerability":"VCID-pk74-yy1n-8qck"},{"vulnerability":"VCID-r8pv-9upr-y7gd"},{"vulnerability":"VCID-rhj7-dy7q-jkhw"},{"vulnerability":"VCID-rr4q-f5cv-nkah"},{"vulnerability":"VCID-t84c-8r34-57b9"},{"vulnerability":"VCID-ty3y-k9t2-qyba"},{"vulnerability":"VCID-u1xx-aazv-bkg5"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-uqcw-p8g2-cfd2"},{"vulnerability":"VCID-utyg-huhu-2ucq"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vq5y-hdw3-nucj"},{"vulnerability":"VCID-w3q4-838v-97ck"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-wbvy-zrtk-audw"},{"vulnerability":"VCID-ww44-hb2y-mfd5"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/drupal@8.5.0-alpha1"},{"url":"http://public2.vulnerablecode.io/api/packages/26995?format=json","purl":"pkg:composer/drupal/drupal@8.5.2","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-349d-w26k-mqfw"},{"vulnerability":"VCID-3fka-y25d-m7a3"},{"vulnerability":"VCID-565p-mgqe-gkfc"},{"vulnerability":"VCID-5tqs-qmqn-gug5"},{"vulnerability":"VCID-636u-5bdw-puh4"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-8nda-kjr2-ufd4"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-c9dm-17vt-4bbc"},{"vulnerability":"VCID-cucx-jfqf-pkd1"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-djgn-ezxp-37eu"},{"vulnerability":"VCID-gzcu-sbks-wyfa"},{"vulnerability":"VCID-jfq8-xxwa-mkd1"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kh51-g4cv-tqaw"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n119-gta2-kfg1"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-nd8n-5dsu-2fbp"},{"vulnerability":"VCID-pk74-yy1n-8qck"},{"vulnerability":"VCID-r8pv-9upr-y7gd"},{"vulnerability":"VCID-rhj7-dy7q-jkhw"},{"vulnerability":"VCID-rr4q-f5cv-nkah"},{"vulnerability":"VCID-t84c-8r34-57b9"},{"vulnerability":"VCID-ty3y-k9t2-qyba"},{"vulnerability":"VCID-u1xx-aazv-bkg5"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-uqcw-p8g2-cfd2"},{"vulnerability":"VCID-utyg-huhu-2ucq"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vq5y-hdw3-nucj"},{"vulnerability":"VCID-w3q4-838v-97ck"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-wbvy-zrtk-audw"},{"vulnerability":"VCID-ww44-hb2y-mfd5"},{"vulnerability":"VCID-wwvq-399y-rfhc"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/drupal@8.5.2"}],"aliases":["2018-04-18"],"risk_score":null,"exploitability":"0.5","weighted_severity":"0.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-9vdz-1jpq-kue3"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/17402?format=json","vulnerability_id":"VCID-bbzr-hbhv-yyee","summary":"Improper Input Validation\nDrupal core's form API has a vulnerability where certain contributed or custom modules' forms may be vulnerable to improper input validation. This could allow an attacker to inject disallowed values or overwrite data. Affected forms are uncommon, but in certain cases an attacker could alter critical or sensitive data.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2022-25273","reference_id":"","reference_type":"","scores":[{"value":"0.00282","scoring_system":"epss","scoring_elements":"0.51563","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00282","scoring_system":"epss","scoring_elements":"0.51586","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00282","scoring_system":"epss","scoring_elements":"0.51603","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00282","scoring_system":"epss","scoring_elements":"0.51577","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00282","scoring_system":"epss","scoring_elements":"0.51523","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00282","scoring_system":"epss","scoring_elements":"0.51624","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00282","scoring_system":"epss","scoring_elements":"0.51574","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00282","scoring_system":"epss","scoring_elements":"0.51536","published_at":"2026-04-02T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2022-25273"},{"reference_url":"https://github.com/drupal/core","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core"},{"reference_url":"https://www.drupal.org/sa-core-2022-008","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-02-03T19:19:11Z/"}],"url":"https://www.drupal.org/sa-core-2022-008"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2022-25273","reference_id":"CVE-2022-25273","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-25273"},{"reference_url":"https://github.com/advisories/GHSA-g36h-4jr6-qmm9","reference_id":"GHSA-g36h-4jr6-qmm9","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-g36h-4jr6-qmm9"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/57361?format=json","purl":"pkg:composer/drupal/drupal@9.2.18","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1nf6-3q5b-gqfm"},{"vulnerability":"VCID-2s8m-ujzb-skd1"},{"vulnerability":"VCID-674z-nf4t-b7ez"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-q4qx-7s1y-q3hc"},{"vulnerability":"VCID-rdgr-yuu7-xkey"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-vevm-4sfk-f7gq"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/drupal@9.2.18"},{"url":"http://public2.vulnerablecode.io/api/packages/57351?format=json","purl":"pkg:composer/drupal/drupal@9.3.12","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1nf6-3q5b-gqfm"},{"vulnerability":"VCID-2s8m-ujzb-skd1"},{"vulnerability":"VCID-674z-nf4t-b7ez"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-q4qx-7s1y-q3hc"},{"vulnerability":"VCID-rdgr-yuu7-xkey"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-vevm-4sfk-f7gq"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/drupal@9.3.12"}],"aliases":["CVE-2022-25273","GHSA-g36h-4jr6-qmm9"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-bbzr-hbhv-yyee"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/9962?format=json","vulnerability_id":"VCID-c9dm-17vt-4bbc","summary":"Improper Access Control in drupal.","references":[{"reference_url":"https://www.drupal.org/sa-core-2018-006","reference_id":"","reference_type":"","scores":[],"url":"https://www.drupal.org/sa-core-2018-006"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/32217?format=json","purl":"pkg:composer/drupal/drupal@8.6.2","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-349d-w26k-mqfw"},{"vulnerability":"VCID-3fka-y25d-m7a3"},{"vulnerability":"VCID-565p-mgqe-gkfc"},{"vulnerability":"VCID-636u-5bdw-puh4"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-cucx-jfqf-pkd1"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-djgn-ezxp-37eu"},{"vulnerability":"VCID-jfq8-xxwa-mkd1"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kh51-g4cv-tqaw"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n119-gta2-kfg1"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-pk74-yy1n-8qck"},{"vulnerability":"VCID-r8pv-9upr-y7gd"},{"vulnerability":"VCID-rhj7-dy7q-jkhw"},{"vulnerability":"VCID-ty3y-k9t2-qyba"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-uqcw-p8g2-cfd2"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-w3q4-838v-97ck"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-wbvy-zrtk-audw"},{"vulnerability":"VCID-ww44-hb2y-mfd5"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/drupal@8.6.2"}],"aliases":["2018-10-17-1"],"risk_score":null,"exploitability":"0.5","weighted_severity":"0.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-c9dm-17vt-4bbc"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/10229?format=json","vulnerability_id":"VCID-cucx-jfqf-pkd1","summary":"Deserialization of Untrusted Data\nDrupal core uses the third-party PEAR `Archive_Tar` library. This library has released a security update which impacts some Drupal configurations. Refer to CVE-2018-1000888 for details.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2019-6338","reference_id":"","reference_type":"","scores":[{"value":"0.01047","scoring_system":"epss","scoring_elements":"0.77449","published_at":"2026-04-01T12:55:00Z"},{"value":"0.01047","scoring_system":"epss","scoring_elements":"0.77504","published_at":"2026-04-13T12:55:00Z"},{"value":"0.01047","scoring_system":"epss","scoring_elements":"0.77507","published_at":"2026-04-12T12:55:00Z"},{"value":"0.01047","scoring_system":"epss","scoring_elements":"0.77526","published_at":"2026-04-11T12:55:00Z"},{"value":"0.01047","scoring_system":"epss","scoring_elements":"0.775","published_at":"2026-04-09T12:55:00Z"},{"value":"0.01047","scoring_system":"epss","scoring_elements":"0.77491","published_at":"2026-04-08T12:55:00Z"},{"value":"0.01047","scoring_system":"epss","scoring_elements":"0.77461","published_at":"2026-04-07T12:55:00Z"},{"value":"0.01047","scoring_system":"epss","scoring_elements":"0.7748","published_at":"2026-04-04T12:55:00Z"},{"value":"0.01047","scoring_system":"epss","scoring_elements":"0.77455","published_at":"2026-04-02T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2019-6338"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-6338","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-6338"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-6339","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-6339"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2019-6338.yaml","reference_id":"","reference_type":"","scores":[{"value":"8.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2019-6338.yaml"},{"reference_url":"https://lists.debian.org/debian-lts-announce/2019/02/msg00032.html","reference_id":"","reference_type":"","scores":[{"value":"8.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.debian.org/debian-lts-announce/2019/02/msg00032.html"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2019-6338","reference_id":"","reference_type":"","scores":[{"value":"6.0","scoring_system":"cvssv2","scoring_elements":"AV:N/AC:M/Au:S/C:P/I:P/A:P"},{"value":"8.0","scoring_system":"cvssv3","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"},{"value":"8.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-6338"},{"reference_url":"https://www.debian.org/security/2019/dsa-4370","reference_id":"","reference_type":"","scores":[{"value":"8.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.debian.org/security/2019/dsa-4370"},{"reference_url":"https://www.drupal.org/sa-core-2019-001","reference_id":"","reference_type":"","scores":[{"value":"8.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.drupal.org/sa-core-2019-001"},{"reference_url":"http://www.securityfocus.com/bid/106706","reference_id":"","reference_type":"","scores":[{"value":"8.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://www.securityfocus.com/bid/106706"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*","reference_id":"cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*","reference_id":"cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*"},{"reference_url":"https://github.com/advisories/GHSA-6rmq-x2hv-vxpp","reference_id":"GHSA-6rmq-x2hv-vxpp","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-6rmq-x2hv-vxpp"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/78855?format=json","purl":"pkg:composer/drupal/drupal@8.5.9","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-349d-w26k-mqfw"},{"vulnerability":"VCID-3fka-y25d-m7a3"},{"vulnerability":"VCID-565p-mgqe-gkfc"},{"vulnerability":"VCID-636u-5bdw-puh4"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-cucx-jfqf-pkd1"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-djgn-ezxp-37eu"},{"vulnerability":"VCID-jfq8-xxwa-mkd1"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kh51-g4cv-tqaw"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n119-gta2-kfg1"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-pk74-yy1n-8qck"},{"vulnerability":"VCID-r8pv-9upr-y7gd"},{"vulnerability":"VCID-rhj7-dy7q-jkhw"},{"vulnerability":"VCID-ty3y-k9t2-qyba"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-uqcw-p8g2-cfd2"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-w3q4-838v-97ck"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-wbvy-zrtk-audw"},{"vulnerability":"VCID-ww44-hb2y-mfd5"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/drupal@8.5.9"},{"url":"http://public2.vulnerablecode.io/api/packages/34658?format=json","purl":"pkg:composer/drupal/drupal@8.6.6","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-349d-w26k-mqfw"},{"vulnerability":"VCID-565p-mgqe-gkfc"},{"vulnerability":"VCID-636u-5bdw-puh4"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-djgn-ezxp-37eu"},{"vulnerability":"VCID-jfq8-xxwa-mkd1"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kh51-g4cv-tqaw"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n119-gta2-kfg1"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-pk74-yy1n-8qck"},{"vulnerability":"VCID-r8pv-9upr-y7gd"},{"vulnerability":"VCID-rhj7-dy7q-jkhw"},{"vulnerability":"VCID-ty3y-k9t2-qyba"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-uqcw-p8g2-cfd2"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-w3q4-838v-97ck"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-wbvy-zrtk-audw"},{"vulnerability":"VCID-ww44-hb2y-mfd5"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/drupal@8.6.6"}],"aliases":["CVE-2019-6338","GHSA-6rmq-x2hv-vxpp"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-cucx-jfqf-pkd1"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/17394?format=json","vulnerability_id":"VCID-dgjq-y5zj-cud1","summary":"Improper Access Control\nUnder certain circumstances, the Drupal core form API evaluates form element access incorrectly. This may lead to a user being able to alter data they should not have access to. No forms provided by Drupal core are known to be vulnerable. However, forms added through contributed or custom modules or themes may be affected.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2022-25278","reference_id":"","reference_type":"","scores":[{"value":"0.00452","scoring_system":"epss","scoring_elements":"0.63732","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00452","scoring_system":"epss","scoring_elements":"0.63711","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00452","scoring_system":"epss","scoring_elements":"0.63737","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00452","scoring_system":"epss","scoring_elements":"0.63697","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00452","scoring_system":"epss","scoring_elements":"0.63749","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00452","scoring_system":"epss","scoring_elements":"0.63766","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00452","scoring_system":"epss","scoring_elements":"0.6378","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00452","scoring_system":"epss","scoring_elements":"0.63765","published_at":"2026-04-12T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2022-25278"},{"reference_url":"https://github.com/drupal/core","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core"},{"reference_url":"https://www.drupal.org/sa-core-2022-013","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-02-03T18:39:47Z/"}],"url":"https://www.drupal.org/sa-core-2022-013"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2022-25278","reference_id":"CVE-2022-25278","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-25278"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2022-25278.yaml","reference_id":"CVE-2022-25278.YAML","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2022-25278.yaml"},{"reference_url":"https://github.com/advisories/GHSA-cfh2-7f6h-3m85","reference_id":"GHSA-cfh2-7f6h-3m85","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-cfh2-7f6h-3m85"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/57338?format=json","purl":"pkg:composer/drupal/drupal@9.3.19","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1nf6-3q5b-gqfm"},{"vulnerability":"VCID-2s8m-ujzb-skd1"},{"vulnerability":"VCID-q4qx-7s1y-q3hc"},{"vulnerability":"VCID-rdgr-yuu7-xkey"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-vevm-4sfk-f7gq"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/drupal@9.3.19"},{"url":"http://public2.vulnerablecode.io/api/packages/57339?format=json","purl":"pkg:composer/drupal/drupal@9.4.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1nf6-3q5b-gqfm"},{"vulnerability":"VCID-2s8m-ujzb-skd1"},{"vulnerability":"VCID-bk92-66re-dkc5"},{"vulnerability":"VCID-q4qx-7s1y-q3hc"},{"vulnerability":"VCID-rdgr-yuu7-xkey"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-vevm-4sfk-f7gq"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/drupal@9.4.3"}],"aliases":["CVE-2022-25278","GHSA-cfh2-7f6h-3m85"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-dgjq-y5zj-cud1"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/8828?format=json","vulnerability_id":"VCID-g1rp-twzp-63e1","summary":"Cross-site Scripting\nA jQuery cross site scripting vulnerability is present when making Ajax requests to untrusted domains. This vulnerability is mitigated by the fact that it requires contributed or custom modules in order to exploit.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2017-6929","reference_id":"","reference_type":"","scores":[{"value":"0.00603","scoring_system":"epss","scoring_elements":"0.69505","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00603","scoring_system":"epss","scoring_elements":"0.69559","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00603","scoring_system":"epss","scoring_elements":"0.69573","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00603","scoring_system":"epss","scoring_elements":"0.69588","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00603","scoring_system":"epss","scoring_elements":"0.69567","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00603","scoring_system":"epss","scoring_elements":"0.6955","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00603","scoring_system":"epss","scoring_elements":"0.695","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00603","scoring_system":"epss","scoring_elements":"0.6952","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00603","scoring_system":"epss","scoring_elements":"0.69494","published_at":"2026-04-01T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2017-6929"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6927","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6927"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6928","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6928"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6929","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6929"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6932","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6932"},{"reference_url":"https://github.com/drupal/core","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2017-6929.yaml","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2017-6929.yaml"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2017-6929.yaml","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2017-6929.yaml"},{"reference_url":"https://lists.debian.org/debian-lts-announce/2018/02/msg00030.html","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.debian.org/debian-lts-announce/2018/02/msg00030.html"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2017-6929","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-6929"},{"reference_url":"https://www.debian.org/security/2018/dsa-4123","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.debian.org/security/2018/dsa-4123"},{"reference_url":"https://www.drupal.org/sa-core-2018-001","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.drupal.org/sa-core-2018-001"},{"reference_url":"https://www.drupal.org/SA-CORE-2018-001","reference_id":"","reference_type":"","scores":[],"url":"https://www.drupal.org/SA-CORE-2018-001"},{"reference_url":"https://github.com/advisories/GHSA-5vpr-v24w-mmjj","reference_id":"GHSA-5vpr-v24w-mmjj","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-5vpr-v24w-mmjj"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/26578?format=json","purl":"pkg:composer/drupal/drupal@8.4.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-349d-w26k-mqfw"},{"vulnerability":"VCID-3fka-y25d-m7a3"},{"vulnerability":"VCID-48ut-ykkc-83fx"},{"vulnerability":"VCID-4aer-46u2-23f6"},{"vulnerability":"VCID-565p-mgqe-gkfc"},{"vulnerability":"VCID-5tqs-qmqn-gug5"},{"vulnerability":"VCID-636u-5bdw-puh4"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-8nda-kjr2-ufd4"},{"vulnerability":"VCID-9f24-vqyt-r7dq"},{"vulnerability":"VCID-9vdz-1jpq-kue3"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-c9dm-17vt-4bbc"},{"vulnerability":"VCID-cucx-jfqf-pkd1"},{"vulnerability":"VCID-cuk6-hskr-yyau"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-g1rp-twzp-63e1"},{"vulnerability":"VCID-ga35-289v-vqhr"},{"vulnerability":"VCID-gzcu-sbks-wyfa"},{"vulnerability":"VCID-jfq8-xxwa-mkd1"},{"vulnerability":"VCID-jnu7-1j9c-dqck"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kh51-g4cv-tqaw"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n119-gta2-kfg1"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-nc36-atc6-yua6"},{"vulnerability":"VCID-nd8n-5dsu-2fbp"},{"vulnerability":"VCID-pk74-yy1n-8qck"},{"vulnerability":"VCID-r8pv-9upr-y7gd"},{"vulnerability":"VCID-rhj7-dy7q-jkhw"},{"vulnerability":"VCID-rr4q-f5cv-nkah"},{"vulnerability":"VCID-s9kv-9qfu-gbdq"},{"vulnerability":"VCID-t84c-8r34-57b9"},{"vulnerability":"VCID-ty3y-k9t2-qyba"},{"vulnerability":"VCID-u1xx-aazv-bkg5"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-uqcw-p8g2-cfd2"},{"vulnerability":"VCID-utyg-huhu-2ucq"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vq5y-hdw3-nucj"},{"vulnerability":"VCID-w3q4-838v-97ck"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-wbvy-zrtk-audw"},{"vulnerability":"VCID-ww44-hb2y-mfd5"},{"vulnerability":"VCID-wwvq-399y-rfhc"},{"vulnerability":"VCID-yare-57j9-j7cs"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/drupal@8.4.0"},{"url":"http://public2.vulnerablecode.io/api/packages/26565?format=json","purl":"pkg:composer/drupal/drupal@8.4.5","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-349d-w26k-mqfw"},{"vulnerability":"VCID-3fka-y25d-m7a3"},{"vulnerability":"VCID-4aer-46u2-23f6"},{"vulnerability":"VCID-565p-mgqe-gkfc"},{"vulnerability":"VCID-5tqs-qmqn-gug5"},{"vulnerability":"VCID-636u-5bdw-puh4"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-8nda-kjr2-ufd4"},{"vulnerability":"VCID-9vdz-1jpq-kue3"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-c9dm-17vt-4bbc"},{"vulnerability":"VCID-cucx-jfqf-pkd1"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-ga35-289v-vqhr"},{"vulnerability":"VCID-gzcu-sbks-wyfa"},{"vulnerability":"VCID-jfq8-xxwa-mkd1"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kh51-g4cv-tqaw"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n119-gta2-kfg1"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-nc36-atc6-yua6"},{"vulnerability":"VCID-nd8n-5dsu-2fbp"},{"vulnerability":"VCID-pk74-yy1n-8qck"},{"vulnerability":"VCID-r8pv-9upr-y7gd"},{"vulnerability":"VCID-rhj7-dy7q-jkhw"},{"vulnerability":"VCID-rr4q-f5cv-nkah"},{"vulnerability":"VCID-t84c-8r34-57b9"},{"vulnerability":"VCID-ty3y-k9t2-qyba"},{"vulnerability":"VCID-u1xx-aazv-bkg5"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-uqcw-p8g2-cfd2"},{"vulnerability":"VCID-utyg-huhu-2ucq"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vq5y-hdw3-nucj"},{"vulnerability":"VCID-w3q4-838v-97ck"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-wbvy-zrtk-audw"},{"vulnerability":"VCID-ww44-hb2y-mfd5"},{"vulnerability":"VCID-wwvq-399y-rfhc"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/drupal@8.4.5"}],"aliases":["CVE-2017-6929","GHSA-5vpr-v24w-mmjj"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-g1rp-twzp-63e1"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/9964?format=json","vulnerability_id":"VCID-gzcu-sbks-wyfa","summary":"URL Redirection to Untrusted Site ('Open Redirect')\nExternal URL injection through URL aliases in drupal.","references":[{"reference_url":"https://www.drupal.org/sa-core-2018-006","reference_id":"","reference_type":"","scores":[],"url":"https://www.drupal.org/sa-core-2018-006"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/32217?format=json","purl":"pkg:composer/drupal/drupal@8.6.2","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-349d-w26k-mqfw"},{"vulnerability":"VCID-3fka-y25d-m7a3"},{"vulnerability":"VCID-565p-mgqe-gkfc"},{"vulnerability":"VCID-636u-5bdw-puh4"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-cucx-jfqf-pkd1"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-djgn-ezxp-37eu"},{"vulnerability":"VCID-jfq8-xxwa-mkd1"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kh51-g4cv-tqaw"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n119-gta2-kfg1"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-pk74-yy1n-8qck"},{"vulnerability":"VCID-r8pv-9upr-y7gd"},{"vulnerability":"VCID-rhj7-dy7q-jkhw"},{"vulnerability":"VCID-ty3y-k9t2-qyba"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-uqcw-p8g2-cfd2"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-w3q4-838v-97ck"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-wbvy-zrtk-audw"},{"vulnerability":"VCID-ww44-hb2y-mfd5"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/drupal@8.6.2"}],"aliases":["2018-10-17-2"],"risk_score":null,"exploitability":"0.5","weighted_severity":"0.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-gzcu-sbks-wyfa"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/19542?format=json","vulnerability_id":"VCID-jfq8-xxwa-mkd1","summary":"Drupal core Multiple vulnerabilities due to the use of the third-party library Archive_Tar\nThe Drupal project uses the third-party library [Archive_Tar](https://pear.php.net/package/Archive_Tar/), which has released a security improvement that is needed to protect some Drupal configurations.\n\nMultiple vulnerabilities are possible if Drupal is configured to allow .tar, .tar.gz, .bz2 or .tlz file uploads and processes them.\n\nThe latest versions of Drupal update Archive_Tar to 1.4.9 to mitigate the file processing vulnerabilities.","references":[{"reference_url":"https://github.com/drupal/drupal","reference_id":"","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/drupal"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/2019-12-18-4.yaml","reference_id":"","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/2019-12-18-4.yaml"},{"reference_url":"https://www.drupal.org/sa-core-2019-012","reference_id":"","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.drupal.org/sa-core-2019-012"},{"reference_url":"https://github.com/advisories/GHSA-m9fv-whq2-6wmc","reference_id":"GHSA-m9fv-whq2-6wmc","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-m9fv-whq2-6wmc"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/59854?format=json","purl":"pkg:composer/drupal/drupal@8.7.11","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-5618-53yg-8qh4"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-cvxp-ctj9-guej"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kh51-g4cv-tqaw"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n119-gta2-kfg1"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-nj3a-eb59-jygs"},{"vulnerability":"VCID-r8pv-9upr-y7gd"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-uqcw-p8g2-cfd2"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-wbvy-zrtk-audw"},{"vulnerability":"VCID-ww44-hb2y-mfd5"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/drupal@8.7.11"},{"url":"http://public2.vulnerablecode.io/api/packages/59855?format=json","purl":"pkg:composer/drupal/drupal@8.8.1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1nf6-3q5b-gqfm"},{"vulnerability":"VCID-2s8m-ujzb-skd1"},{"vulnerability":"VCID-5618-53yg-8qh4"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-cvxp-ctj9-guej"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-gbz5-5frj-hber"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kh51-g4cv-tqaw"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-mhk6-9qdy-83f3"},{"vulnerability":"VCID-n119-gta2-kfg1"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-nj3a-eb59-jygs"},{"vulnerability":"VCID-q4qx-7s1y-q3hc"},{"vulnerability":"VCID-r8pv-9upr-y7gd"},{"vulnerability":"VCID-rdgr-yuu7-xkey"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-uqcw-p8g2-cfd2"},{"vulnerability":"VCID-v9v6-ae3e-g3hk"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-wbvy-zrtk-audw"},{"vulnerability":"VCID-ww44-hb2y-mfd5"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/drupal@8.8.1"}],"aliases":["GHSA-m9fv-whq2-6wmc"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-jfq8-xxwa-mkd1"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/8836?format=json","vulnerability_id":"VCID-jnu7-1j9c-dqck","summary":"JavaScript cross-site scripting prevention is incomplete\nDrupal has a Drupal.checkPlain() JavaScript function which is used to escape potentially dangerous text before outputting it to HTML (as JavaScript output is not auto-escaped by either Drupal 7 or Drupal 8). This function does not correctly handle all methods of injecting malicious HTML, leading to a cross-site scripting vulnerability under certain circumstances. The PHP functions which Drupal provides for HTML escaping are not affected.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2017-6927","reference_id":"","reference_type":"","scores":[{"value":"0.0139","scoring_system":"epss","scoring_elements":"0.80305","published_at":"2026-04-02T12:55:00Z"},{"value":"0.0139","scoring_system":"epss","scoring_elements":"0.80325","published_at":"2026-04-04T12:55:00Z"},{"value":"0.0139","scoring_system":"epss","scoring_elements":"0.80297","published_at":"2026-04-01T12:55:00Z"},{"value":"0.0139","scoring_system":"epss","scoring_elements":"0.8035","published_at":"2026-04-13T12:55:00Z"},{"value":"0.0139","scoring_system":"epss","scoring_elements":"0.80356","published_at":"2026-04-12T12:55:00Z"},{"value":"0.0139","scoring_system":"epss","scoring_elements":"0.80371","published_at":"2026-04-11T12:55:00Z"},{"value":"0.0139","scoring_system":"epss","scoring_elements":"0.80352","published_at":"2026-04-09T12:55:00Z"},{"value":"0.0139","scoring_system":"epss","scoring_elements":"0.80341","published_at":"2026-04-08T12:55:00Z"},{"value":"0.0139","scoring_system":"epss","scoring_elements":"0.80313","published_at":"2026-04-07T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2017-6927"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6927","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6927"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6928","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6928"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6929","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6929"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6932","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6932"},{"reference_url":"https://github.com/drupal/core","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2017-6927.yaml","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2017-6927.yaml"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2017-6927.yaml","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2017-6927.yaml"},{"reference_url":"https://lists.debian.org/debian-lts-announce/2018/02/msg00030.html","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.debian.org/debian-lts-announce/2018/02/msg00030.html"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2017-6927","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-6927"},{"reference_url":"https://www.debian.org/security/2018/dsa-4123","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.debian.org/security/2018/dsa-4123"},{"reference_url":"https://www.drupal.org/sa-core-2018-001","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.drupal.org/sa-core-2018-001"},{"reference_url":"https://www.drupal.org/SA-CORE-2018-001","reference_id":"","reference_type":"","scores":[],"url":"https://www.drupal.org/SA-CORE-2018-001"},{"reference_url":"http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2017-6927","reference_id":"","reference_type":"","scores":[],"url":"http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2017-6927"},{"reference_url":"http://www.securityfocus.com/bid/103138","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://www.securityfocus.com/bid/103138"},{"reference_url":"https://github.com/advisories/GHSA-585j-5449-mf5m","reference_id":"GHSA-585j-5449-mf5m","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-585j-5449-mf5m"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/26565?format=json","purl":"pkg:composer/drupal/drupal@8.4.5","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-349d-w26k-mqfw"},{"vulnerability":"VCID-3fka-y25d-m7a3"},{"vulnerability":"VCID-4aer-46u2-23f6"},{"vulnerability":"VCID-565p-mgqe-gkfc"},{"vulnerability":"VCID-5tqs-qmqn-gug5"},{"vulnerability":"VCID-636u-5bdw-puh4"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-8nda-kjr2-ufd4"},{"vulnerability":"VCID-9vdz-1jpq-kue3"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-c9dm-17vt-4bbc"},{"vulnerability":"VCID-cucx-jfqf-pkd1"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-ga35-289v-vqhr"},{"vulnerability":"VCID-gzcu-sbks-wyfa"},{"vulnerability":"VCID-jfq8-xxwa-mkd1"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kh51-g4cv-tqaw"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n119-gta2-kfg1"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-nc36-atc6-yua6"},{"vulnerability":"VCID-nd8n-5dsu-2fbp"},{"vulnerability":"VCID-pk74-yy1n-8qck"},{"vulnerability":"VCID-r8pv-9upr-y7gd"},{"vulnerability":"VCID-rhj7-dy7q-jkhw"},{"vulnerability":"VCID-rr4q-f5cv-nkah"},{"vulnerability":"VCID-t84c-8r34-57b9"},{"vulnerability":"VCID-ty3y-k9t2-qyba"},{"vulnerability":"VCID-u1xx-aazv-bkg5"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-uqcw-p8g2-cfd2"},{"vulnerability":"VCID-utyg-huhu-2ucq"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vq5y-hdw3-nucj"},{"vulnerability":"VCID-w3q4-838v-97ck"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-wbvy-zrtk-audw"},{"vulnerability":"VCID-ww44-hb2y-mfd5"},{"vulnerability":"VCID-wwvq-399y-rfhc"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/drupal@8.4.5"}],"aliases":["CVE-2017-6927","GHSA-585j-5449-mf5m"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-jnu7-1j9c-dqck"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/12878?format=json","vulnerability_id":"VCID-k1gx-nznx-7qd6","summary":"Drupal core Cross-site Scripting (XSS) vulnerability\nCross-site Scripting (XSS) vulnerability in Drupal core's sanitization API fails to properly filter cross-site scripting under certain circumstances. This issue affects: Drupal Core 9.1.x versions prior to 9.1.7; 9.0.x versions prior to 9.0.12; 8.9.x versions prior to 8.9.14; 7.x versions prior to 7.80.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2020-13672","reference_id":"","reference_type":"","scores":[{"value":"0.00564","scoring_system":"epss","scoring_elements":"0.68347","published_at":"2026-04-01T12:55:00Z"},{"value":"0.00564","scoring_system":"epss","scoring_elements":"0.68413","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00564","scoring_system":"epss","scoring_elements":"0.68446","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00564","scoring_system":"epss","scoring_elements":"0.68458","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00564","scoring_system":"epss","scoring_elements":"0.68431","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00564","scoring_system":"epss","scoring_elements":"0.68414","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00564","scoring_system":"epss","scoring_elements":"0.68363","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00564","scoring_system":"epss","scoring_elements":"0.68387","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00564","scoring_system":"epss","scoring_elements":"0.68367","published_at":"2026-04-02T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2020-13672"},{"reference_url":"https://github.com/drupal/core","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core"},{"reference_url":"https://www.drupal.org/sa-core-2021-002","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.drupal.org/sa-core-2021-002"},{"reference_url":"https://security.archlinux.org/AVG-1463","reference_id":"AVG-1463","reference_type":"","scores":[{"value":"Critical","scoring_system":"archlinux","scoring_elements":""}],"url":"https://security.archlinux.org/AVG-1463"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2020-13672","reference_id":"CVE-2020-13672","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-13672"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2020-13672.yaml","reference_id":"CVE-2020-13672.YAML","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2020-13672.yaml"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2020-13672.yaml","reference_id":"CVE-2020-13672.YAML","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2020-13672.yaml"},{"reference_url":"https://github.com/advisories/GHSA-3m36-mjwj-352c","reference_id":"GHSA-3m36-mjwj-352c","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-3m36-mjwj-352c"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/46134?format=json","purl":"pkg:composer/drupal/drupal@8.9.14","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1nf6-3q5b-gqfm"},{"vulnerability":"VCID-2s8m-ujzb-skd1"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-q4qx-7s1y-q3hc"},{"vulnerability":"VCID-r8pv-9upr-y7gd"},{"vulnerability":"VCID-rdgr-yuu7-xkey"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-wbuz-qcp3-43aq"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/drupal@8.9.14"},{"url":"http://public2.vulnerablecode.io/api/packages/46136?format=json","purl":"pkg:composer/drupal/drupal@9.0.12","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1nf6-3q5b-gqfm"},{"vulnerability":"VCID-2s8m-ujzb-skd1"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-q4qx-7s1y-q3hc"},{"vulnerability":"VCID-r8pv-9upr-y7gd"},{"vulnerability":"VCID-rdgr-yuu7-xkey"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-wbuz-qcp3-43aq"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/drupal@9.0.12"},{"url":"http://public2.vulnerablecode.io/api/packages/46137?format=json","purl":"pkg:composer/drupal/drupal@9.1.7","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1nf6-3q5b-gqfm"},{"vulnerability":"VCID-2s8m-ujzb-skd1"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-q4qx-7s1y-q3hc"},{"vulnerability":"VCID-r8pv-9upr-y7gd"},{"vulnerability":"VCID-rdgr-yuu7-xkey"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-wbuz-qcp3-43aq"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/drupal@9.1.7"}],"aliases":["CVE-2020-13672","GHSA-3m36-mjwj-352c"],"risk_score":4.5,"exploitability":"0.5","weighted_severity":"9.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-k1gx-nznx-7qd6"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/19395?format=json","vulnerability_id":"VCID-kh51-g4cv-tqaw","summary":"Drupal core uses a vulnerable Third-party library CKEditor\nThe Drupal project uses the third-party library [CKEditor](https://github.com/ckeditor/ckeditor4), which has released a [security improvement](https://ckeditor.com/blog/CKEditor-4.14-with-Paste-from-LibreOffice-released/#security-issues-fixed) that is needed to protect some Drupal configurations.\n\nVulnerabilities are possible if Drupal is configured to use the WYSIWYG CKEditor for your site's users. An attacker that can create or edit content may be able to exploit this Cross Site Scripting (XSS) vulnerability to target users with access to the WYSIWYG CKEditor, and this may include site admins with privileged access.\n\nThe latest versions of Drupal update CKEditor to 4.14 to mitigate the vulnerabilities.","references":[{"reference_url":"https://github.com/drupal/drupal","reference_id":"","reference_type":"","scores":[{"value":"4.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/drupal"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/2020-03-18.yaml","reference_id":"","reference_type":"","scores":[{"value":"4.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/2020-03-18.yaml"},{"reference_url":"https://www.drupal.org/sa-core-2020-001","reference_id":"","reference_type":"","scores":[{"value":"4.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.drupal.org/sa-core-2020-001"},{"reference_url":"https://github.com/advisories/GHSA-337w-fxpq-5m34","reference_id":"GHSA-337w-fxpq-5m34","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-337w-fxpq-5m34"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/60491?format=json","purl":"pkg:composer/drupal/drupal@8.7.12","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-5618-53yg-8qh4"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-cvxp-ctj9-guej"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n119-gta2-kfg1"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-r8pv-9upr-y7gd"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-uqcw-p8g2-cfd2"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-wbvy-zrtk-audw"},{"vulnerability":"VCID-ww44-hb2y-mfd5"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/drupal@8.7.12"},{"url":"http://public2.vulnerablecode.io/api/packages/60492?format=json","purl":"pkg:composer/drupal/drupal@8.8.4","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1nf6-3q5b-gqfm"},{"vulnerability":"VCID-2s8m-ujzb-skd1"},{"vulnerability":"VCID-5618-53yg-8qh4"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-cvxp-ctj9-guej"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-gbz5-5frj-hber"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-mhk6-9qdy-83f3"},{"vulnerability":"VCID-n119-gta2-kfg1"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-q4qx-7s1y-q3hc"},{"vulnerability":"VCID-r8pv-9upr-y7gd"},{"vulnerability":"VCID-rdgr-yuu7-xkey"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-uqcw-p8g2-cfd2"},{"vulnerability":"VCID-v9v6-ae3e-g3hk"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-wbvy-zrtk-audw"},{"vulnerability":"VCID-ww44-hb2y-mfd5"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/drupal@8.8.4"}],"aliases":["GHSA-337w-fxpq-5m34"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-kh51-g4cv-tqaw"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/17401?format=json","vulnerability_id":"VCID-mapb-hsvc-2khc","summary":"Unrestricted Upload of File with Dangerous Type\nDrupal core sanitizes filenames with dangerous extensions upon upload (reference: SA-CORE-2020-012) and strips leading and trailing dots from filenames to prevent uploading server configuration files (reference: SA-CORE-2019-010). However, the protections for these two vulnerabilities previously does not work correctly together. As a result, if the site were configured to allow the upload of files with an htaccess extension, these files' filenames would not be properly sanitized. This could allow bypassing the protections provided by Drupal core's default .htaccess files and possible remote code execution on Apache web servers. This issue is mitigated by the fact that it requires a field administrator to explicitly configure a file field to allow htaccess as an extension (a restricted permission), or a contributed module or custom code that overrides allowed file uploads.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2022-25277","reference_id":"","reference_type":"","scores":[{"value":"0.00294","scoring_system":"epss","scoring_elements":"0.5268","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00294","scoring_system":"epss","scoring_elements":"0.52734","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00294","scoring_system":"epss","scoring_elements":"0.5275","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00294","scoring_system":"epss","scoring_elements":"0.52766","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00294","scoring_system":"epss","scoring_elements":"0.52716","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00294","scoring_system":"epss","scoring_elements":"0.52722","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00294","scoring_system":"epss","scoring_elements":"0.52671","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00294","scoring_system":"epss","scoring_elements":"0.52706","published_at":"2026-04-04T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2022-25277"},{"reference_url":"https://github.com/drupal/core","reference_id":"","reference_type":"","scores":[{"value":"7.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core"},{"reference_url":"https://github.com/drupal/core/commit/1cd1830d79f221cc8490f53c2bb487dd07094f17","reference_id":"","reference_type":"","scores":[{"value":"7.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core/commit/1cd1830d79f221cc8490f53c2bb487dd07094f17"},{"reference_url":"https://github.com/drupal/core/commit/5d464ea4407c50e40dcf6cb5ee376e7b8dd36f3a","reference_id":"","reference_type":"","scores":[{"value":"7.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core/commit/5d464ea4407c50e40dcf6cb5ee376e7b8dd36f3a"},{"reference_url":"https://www.drupal.org/sa-core-2022-014","reference_id":"","reference_type":"","scores":[{"value":"7.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-02-03T18:41:13Z/"}],"url":"https://www.drupal.org/sa-core-2022-014"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2022-25277","reference_id":"CVE-2022-25277","reference_type":"","scores":[{"value":"7.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-25277"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2022-25277.yaml","reference_id":"CVE-2022-25277.YAML","reference_type":"","scores":[{"value":"7.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2022-25277.yaml"},{"reference_url":"https://github.com/advisories/GHSA-6955-67hm-vjjq","reference_id":"GHSA-6955-67hm-vjjq","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-6955-67hm-vjjq"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/57338?format=json","purl":"pkg:composer/drupal/drupal@9.3.19","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1nf6-3q5b-gqfm"},{"vulnerability":"VCID-2s8m-ujzb-skd1"},{"vulnerability":"VCID-q4qx-7s1y-q3hc"},{"vulnerability":"VCID-rdgr-yuu7-xkey"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-vevm-4sfk-f7gq"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/drupal@9.3.19"},{"url":"http://public2.vulnerablecode.io/api/packages/57339?format=json","purl":"pkg:composer/drupal/drupal@9.4.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1nf6-3q5b-gqfm"},{"vulnerability":"VCID-2s8m-ujzb-skd1"},{"vulnerability":"VCID-bk92-66re-dkc5"},{"vulnerability":"VCID-q4qx-7s1y-q3hc"},{"vulnerability":"VCID-rdgr-yuu7-xkey"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-vevm-4sfk-f7gq"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/drupal@9.4.3"}],"aliases":["CVE-2022-25277","GHSA-6955-67hm-vjjq","GMS-2022-3361"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-mapb-hsvc-2khc"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/12877?format=json","vulnerability_id":"VCID-n119-gta2-kfg1","summary":"Drupal core Cross-site Scripting (XSS) vulnerability in ckeditor\nCross-site Scripting (XSS) vulnerability in ckeditor of Drupal Core allows attacker to inject XSS. This issue affects: Drupal Core 8.8.x versions prior to 8.8.10.; 8.9.x versions prior to 8.9.6; 9.0.x versions prior to 9.0.6.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2020-13669","reference_id":"","reference_type":"","scores":[{"value":"0.00204","scoring_system":"epss","scoring_elements":"0.42418","published_at":"2026-04-01T12:55:00Z"},{"value":"0.00204","scoring_system":"epss","scoring_elements":"0.42471","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00204","scoring_system":"epss","scoring_elements":"0.42501","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00204","scoring_system":"epss","scoring_elements":"0.42538","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00204","scoring_system":"epss","scoring_elements":"0.42516","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00204","scoring_system":"epss","scoring_elements":"0.42506","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00204","scoring_system":"epss","scoring_elements":"0.42455","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00204","scoring_system":"epss","scoring_elements":"0.42518","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00204","scoring_system":"epss","scoring_elements":"0.42489","published_at":"2026-04-02T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2020-13669"},{"reference_url":"https://github.com/drupal/core","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core"},{"reference_url":"https://www.drupal.org/sa-core-2020-010","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.drupal.org/sa-core-2020-010"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2020-13669","reference_id":"CVE-2020-13669","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-13669"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2020-13669.yaml","reference_id":"CVE-2020-13669.YAML","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2020-13669.yaml"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2020-13669.yaml","reference_id":"CVE-2020-13669.YAML","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2020-13669.yaml"},{"reference_url":"https://github.com/advisories/GHSA-c533-c843-67h8","reference_id":"GHSA-c533-c843-67h8","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-c533-c843-67h8"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/46124?format=json","purl":"pkg:composer/drupal/drupal@8.8.10","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1nf6-3q5b-gqfm"},{"vulnerability":"VCID-2s8m-ujzb-skd1"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-gbz5-5frj-hber"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-q4qx-7s1y-q3hc"},{"vulnerability":"VCID-r8pv-9upr-y7gd"},{"vulnerability":"VCID-rdgr-yuu7-xkey"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-v9v6-ae3e-g3hk"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-wbvy-zrtk-audw"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/drupal@8.8.10"},{"url":"http://public2.vulnerablecode.io/api/packages/46125?format=json","purl":"pkg:composer/drupal/drupal@8.9.6","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1nf6-3q5b-gqfm"},{"vulnerability":"VCID-2s8m-ujzb-skd1"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-gbz5-5frj-hber"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kc7d-5k6x-77bp"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-q4qx-7s1y-q3hc"},{"vulnerability":"VCID-r8pv-9upr-y7gd"},{"vulnerability":"VCID-rdgr-yuu7-xkey"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-v9v6-ae3e-g3hk"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-wbvy-zrtk-audw"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/drupal@8.9.6"},{"url":"http://public2.vulnerablecode.io/api/packages/46126?format=json","purl":"pkg:composer/drupal/drupal@9.0.6","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1nf6-3q5b-gqfm"},{"vulnerability":"VCID-2s8m-ujzb-skd1"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-gbz5-5frj-hber"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kc7d-5k6x-77bp"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-q4qx-7s1y-q3hc"},{"vulnerability":"VCID-r8pv-9upr-y7gd"},{"vulnerability":"VCID-rdgr-yuu7-xkey"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-v9v6-ae3e-g3hk"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-wbvy-zrtk-audw"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/drupal@9.0.6"}],"aliases":["CVE-2020-13669","GHSA-c533-c843-67h8"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-n119-gta2-kfg1"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/17393?format=json","vulnerability_id":"VCID-n7un-zgqv-jfef","summary":"Lack of domain validation in Druple core\nThe Media oEmbed iframe route does not properly validate the iframe domain setting, which allows embeds to be displayed in the context of the primary domain. Under certain circumstances, this could lead to cross-site scripting, leaked cookies, or other vulnerabilities.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2022-25276","reference_id":"","reference_type":"","scores":[{"value":"0.01256","scoring_system":"epss","scoring_elements":"0.79371","published_at":"2026-04-13T12:55:00Z"},{"value":"0.01256","scoring_system":"epss","scoring_elements":"0.7933","published_at":"2026-04-02T12:55:00Z"},{"value":"0.01256","scoring_system":"epss","scoring_elements":"0.79353","published_at":"2026-04-04T12:55:00Z"},{"value":"0.01256","scoring_system":"epss","scoring_elements":"0.79339","published_at":"2026-04-07T12:55:00Z"},{"value":"0.01256","scoring_system":"epss","scoring_elements":"0.79365","published_at":"2026-04-08T12:55:00Z"},{"value":"0.01256","scoring_system":"epss","scoring_elements":"0.79374","published_at":"2026-04-09T12:55:00Z"},{"value":"0.01256","scoring_system":"epss","scoring_elements":"0.79397","published_at":"2026-04-11T12:55:00Z"},{"value":"0.01256","scoring_system":"epss","scoring_elements":"0.79382","published_at":"2026-04-12T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2022-25276"},{"reference_url":"https://github.com/drupal/core","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core"},{"reference_url":"https://www.drupal.org/sa-core-2022-015","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.drupal.org/sa-core-2022-015"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2022-25276","reference_id":"CVE-2022-25276","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-25276"},{"reference_url":"https://github.com/advisories/GHSA-4wfq-jc9h-vpcx","reference_id":"GHSA-4wfq-jc9h-vpcx","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-4wfq-jc9h-vpcx"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/57338?format=json","purl":"pkg:composer/drupal/drupal@9.3.19","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1nf6-3q5b-gqfm"},{"vulnerability":"VCID-2s8m-ujzb-skd1"},{"vulnerability":"VCID-q4qx-7s1y-q3hc"},{"vulnerability":"VCID-rdgr-yuu7-xkey"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-vevm-4sfk-f7gq"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/drupal@9.3.19"},{"url":"http://public2.vulnerablecode.io/api/packages/57339?format=json","purl":"pkg:composer/drupal/drupal@9.4.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1nf6-3q5b-gqfm"},{"vulnerability":"VCID-2s8m-ujzb-skd1"},{"vulnerability":"VCID-bk92-66re-dkc5"},{"vulnerability":"VCID-q4qx-7s1y-q3hc"},{"vulnerability":"VCID-rdgr-yuu7-xkey"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-vevm-4sfk-f7gq"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/drupal@9.4.3"}],"aliases":["CVE-2022-25276","GHSA-4wfq-jc9h-vpcx"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-n7un-zgqv-jfef"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/8893?format=json","vulnerability_id":"VCID-nc36-atc6-yua6","summary":"XSS Vulnerability\nCKEditor, a third-party JavaScript library included in Drupal core, is affected by a cross-site scripting (XSS) vulnerability. It's possible to execute XSS inside CKEditor when using the `image2` plugin.","references":[{"reference_url":"https://www.drupal.org/sa-core-2018-003","reference_id":"","reference_type":"","scores":[],"url":"https://www.drupal.org/sa-core-2018-003"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/26993?format=json","purl":"pkg:composer/drupal/drupal@8.4.7","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-349d-w26k-mqfw"},{"vulnerability":"VCID-3fka-y25d-m7a3"},{"vulnerability":"VCID-565p-mgqe-gkfc"},{"vulnerability":"VCID-5tqs-qmqn-gug5"},{"vulnerability":"VCID-636u-5bdw-puh4"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-8nda-kjr2-ufd4"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-c9dm-17vt-4bbc"},{"vulnerability":"VCID-cucx-jfqf-pkd1"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-gzcu-sbks-wyfa"},{"vulnerability":"VCID-jfq8-xxwa-mkd1"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kh51-g4cv-tqaw"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n119-gta2-kfg1"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-nd8n-5dsu-2fbp"},{"vulnerability":"VCID-pk74-yy1n-8qck"},{"vulnerability":"VCID-r8pv-9upr-y7gd"},{"vulnerability":"VCID-rhj7-dy7q-jkhw"},{"vulnerability":"VCID-rr4q-f5cv-nkah"},{"vulnerability":"VCID-t84c-8r34-57b9"},{"vulnerability":"VCID-ty3y-k9t2-qyba"},{"vulnerability":"VCID-u1xx-aazv-bkg5"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-uqcw-p8g2-cfd2"},{"vulnerability":"VCID-utyg-huhu-2ucq"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vq5y-hdw3-nucj"},{"vulnerability":"VCID-w3q4-838v-97ck"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-wbvy-zrtk-audw"},{"vulnerability":"VCID-ww44-hb2y-mfd5"},{"vulnerability":"VCID-wwvq-399y-rfhc"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/drupal@8.4.7"},{"url":"http://public2.vulnerablecode.io/api/packages/26995?format=json","purl":"pkg:composer/drupal/drupal@8.5.2","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-349d-w26k-mqfw"},{"vulnerability":"VCID-3fka-y25d-m7a3"},{"vulnerability":"VCID-565p-mgqe-gkfc"},{"vulnerability":"VCID-5tqs-qmqn-gug5"},{"vulnerability":"VCID-636u-5bdw-puh4"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-8nda-kjr2-ufd4"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-c9dm-17vt-4bbc"},{"vulnerability":"VCID-cucx-jfqf-pkd1"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-djgn-ezxp-37eu"},{"vulnerability":"VCID-gzcu-sbks-wyfa"},{"vulnerability":"VCID-jfq8-xxwa-mkd1"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kh51-g4cv-tqaw"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n119-gta2-kfg1"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-nd8n-5dsu-2fbp"},{"vulnerability":"VCID-pk74-yy1n-8qck"},{"vulnerability":"VCID-r8pv-9upr-y7gd"},{"vulnerability":"VCID-rhj7-dy7q-jkhw"},{"vulnerability":"VCID-rr4q-f5cv-nkah"},{"vulnerability":"VCID-t84c-8r34-57b9"},{"vulnerability":"VCID-ty3y-k9t2-qyba"},{"vulnerability":"VCID-u1xx-aazv-bkg5"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-uqcw-p8g2-cfd2"},{"vulnerability":"VCID-utyg-huhu-2ucq"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vq5y-hdw3-nucj"},{"vulnerability":"VCID-w3q4-838v-97ck"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-wbvy-zrtk-audw"},{"vulnerability":"VCID-ww44-hb2y-mfd5"},{"vulnerability":"VCID-wwvq-399y-rfhc"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/drupal@8.5.2"}],"aliases":["SA-CORE-2018-003"],"risk_score":null,"exploitability":"0.5","weighted_severity":"0.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-nc36-atc6-yua6"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/9971?format=json","vulnerability_id":"VCID-nd8n-5dsu-2fbp","summary":"Code Injection\nInjection in `DefaultMailSystem::mail()`.","references":[{"reference_url":"https://www.drupal.org/sa-core-2018-006","reference_id":"","reference_type":"","scores":[],"url":"https://www.drupal.org/sa-core-2018-006"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/32217?format=json","purl":"pkg:composer/drupal/drupal@8.6.2","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-349d-w26k-mqfw"},{"vulnerability":"VCID-3fka-y25d-m7a3"},{"vulnerability":"VCID-565p-mgqe-gkfc"},{"vulnerability":"VCID-636u-5bdw-puh4"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-cucx-jfqf-pkd1"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-djgn-ezxp-37eu"},{"vulnerability":"VCID-jfq8-xxwa-mkd1"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kh51-g4cv-tqaw"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n119-gta2-kfg1"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-pk74-yy1n-8qck"},{"vulnerability":"VCID-r8pv-9upr-y7gd"},{"vulnerability":"VCID-rhj7-dy7q-jkhw"},{"vulnerability":"VCID-ty3y-k9t2-qyba"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-uqcw-p8g2-cfd2"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-w3q4-838v-97ck"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-wbvy-zrtk-audw"},{"vulnerability":"VCID-ww44-hb2y-mfd5"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/drupal@8.6.2"}],"aliases":["2018-10-17-4"],"risk_score":null,"exploitability":"0.5","weighted_severity":"0.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-nd8n-5dsu-2fbp"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/19997?format=json","vulnerability_id":"VCID-pk74-yy1n-8qck","summary":"Drupal core Access control bypass\nThe Media Library module has a security vulnerability whereby it doesn't sufficiently restrict access to media items in certain configurations.\n\n### Solution: \nIf you are using Drupal 8.7.x, you should upgrade to Drupal 8.7.11.\nIf you are using Drupal 8.8.x, you should upgrade to Drupal 8.8.1.\nVersions of Drupal 8 prior to 8.7.x are end-of-life and do not receive security coverage.\n\nAlternatively, you may mitigate this vulnerability by unchecking the \"Enable advanced UI\" checkbox on `/admin/config/media/media-library`. (This mitigation is not available in 8.7.x.)","references":[{"reference_url":"https://github.com/drupal/drupal","reference_id":"","reference_type":"","scores":[{"value":"4.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/drupal"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/2019-12-18-3.yaml","reference_id":"","reference_type":"","scores":[{"value":"4.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/2019-12-18-3.yaml"},{"reference_url":"https://www.drupal.org/sa-core-2019-011","reference_id":"","reference_type":"","scores":[{"value":"4.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.drupal.org/sa-core-2019-011"},{"reference_url":"https://github.com/advisories/GHSA-5x28-3f32-x523","reference_id":"GHSA-5x28-3f32-x523","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-5x28-3f32-x523"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/59854?format=json","purl":"pkg:composer/drupal/drupal@8.7.11","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-5618-53yg-8qh4"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-cvxp-ctj9-guej"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kh51-g4cv-tqaw"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n119-gta2-kfg1"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-nj3a-eb59-jygs"},{"vulnerability":"VCID-r8pv-9upr-y7gd"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-uqcw-p8g2-cfd2"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-wbvy-zrtk-audw"},{"vulnerability":"VCID-ww44-hb2y-mfd5"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/drupal@8.7.11"},{"url":"http://public2.vulnerablecode.io/api/packages/59855?format=json","purl":"pkg:composer/drupal/drupal@8.8.1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1nf6-3q5b-gqfm"},{"vulnerability":"VCID-2s8m-ujzb-skd1"},{"vulnerability":"VCID-5618-53yg-8qh4"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-cvxp-ctj9-guej"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-gbz5-5frj-hber"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kh51-g4cv-tqaw"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-mhk6-9qdy-83f3"},{"vulnerability":"VCID-n119-gta2-kfg1"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-nj3a-eb59-jygs"},{"vulnerability":"VCID-q4qx-7s1y-q3hc"},{"vulnerability":"VCID-r8pv-9upr-y7gd"},{"vulnerability":"VCID-rdgr-yuu7-xkey"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-uqcw-p8g2-cfd2"},{"vulnerability":"VCID-v9v6-ae3e-g3hk"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-wbvy-zrtk-audw"},{"vulnerability":"VCID-ww44-hb2y-mfd5"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/drupal@8.8.1"}],"aliases":["GHSA-5x28-3f32-x523"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-pk74-yy1n-8qck"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/19057?format=json","vulnerability_id":"VCID-r8pv-9upr-y7gd","summary":"Drupal Cross-Site Scripting (XSS) affecting CKEditor Third-party library\nThe Drupal project uses the CKEditor, library for WYSIWYG editing. CKEditor has released a security update that impacts Drupal.\n\nVulnerabilities are possible if Drupal is configured to allow use of the CKEditor library for WYSIWYG editing. An attacker that can create or edit content (even without access to CKEditor themselves) may be able to exploit one or more Cross-Site Scripting (XSS) vulnerabilities to target users with access to the WYSIWYG CKEditor, including site admins with privileged access.","references":[{"reference_url":"https://github.com/drupal/drupal","reference_id":"","reference_type":"","scores":[{"value":"4.6","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/drupal"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/2021-05-26.yaml","reference_id":"","reference_type":"","scores":[{"value":"4.6","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/2021-05-26.yaml"},{"reference_url":"https://www.drupal.org/sa-core-2021-005","reference_id":"","reference_type":"","scores":[{"value":"4.6","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.drupal.org/sa-core-2021-005"},{"reference_url":"https://github.com/advisories/GHSA-qf65-hph9-453r","reference_id":"GHSA-qf65-hph9-453r","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-qf65-hph9-453r"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/59977?format=json","purl":"pkg:composer/drupal/drupal@8.9.16","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1nf6-3q5b-gqfm"},{"vulnerability":"VCID-2s8m-ujzb-skd1"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-q4qx-7s1y-q3hc"},{"vulnerability":"VCID-rdgr-yuu7-xkey"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-wbuz-qcp3-43aq"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/drupal@8.9.16"},{"url":"http://public2.vulnerablecode.io/api/packages/59981?format=json","purl":"pkg:composer/drupal/drupal@9.1.12","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1nf6-3q5b-gqfm"},{"vulnerability":"VCID-2s8m-ujzb-skd1"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-q4qx-7s1y-q3hc"},{"vulnerability":"VCID-rdgr-yuu7-xkey"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-wbuz-qcp3-43aq"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/drupal@9.1.12"},{"url":"http://public2.vulnerablecode.io/api/packages/59982?format=json","purl":"pkg:composer/drupal/drupal@9.2.4","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1nf6-3q5b-gqfm"},{"vulnerability":"VCID-2s8m-ujzb-skd1"},{"vulnerability":"VCID-674z-nf4t-b7ez"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-b4yh-gyrx-3yhh"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-gypk-ukbc-7qe3"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-q4qx-7s1y-q3hc"},{"vulnerability":"VCID-rdgr-yuu7-xkey"},{"vulnerability":"VCID-sbmj-9trz-2ybf"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-zw3u-6ue7-efdf"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/drupal@9.2.4"}],"aliases":["GHSA-qf65-hph9-453r"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-r8pv-9upr-y7gd"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/14777?format=json","vulnerability_id":"VCID-rhj7-dy7q-jkhw","summary":"Drupal Core Remote Code Execution Vulnerability\nSome field types do not properly sanitize data from non-form sources in Drupal 8.5.x before 8.5.11 and Drupal 8.6.x before 8.6.10. This can lead to arbitrary PHP code execution in some cases. A site is only affected by this if one of the following conditions is met: The site has the Drupal 8 core RESTful Web Services (rest) module enabled and allows PATCH or POST requests, or the site has another web services module enabled, like JSON:API in Drupal 8, or Services or RESTful Web Services in Drupal 7. (Note: The Drupal 7 Services module itself does not require an update at this time, but you should apply other contributed updates associated with this advisory if Services is in use.)","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2019-6340","reference_id":"","reference_type":"","scores":[{"value":"0.94436","scoring_system":"epss","scoring_elements":"0.99988","published_at":"2026-04-04T12:55:00Z"},{"value":"0.94436","scoring_system":"epss","scoring_elements":"0.99987","published_at":"2026-04-13T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2019-6340"},{"reference_url":"https://github.com/drupal/drupal","reference_id":"","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/drupal"},{"reference_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-6340","reference_id":"","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-6340"},{"reference_url":"https://www.drupal.org/sa-core-2019-003","reference_id":"","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Attend","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2025-02-07T12:38:47Z/"}],"url":"https://www.drupal.org/sa-core-2019-003"},{"reference_url":"https://www.exploit-db.com/exploits/46452","reference_id":"","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.exploit-db.com/exploits/46452"},{"reference_url":"https://www.exploit-db.com/exploits/46452/","reference_id":"","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"Attend","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2025-02-07T12:38:47Z/"}],"url":"https://www.exploit-db.com/exploits/46452/"},{"reference_url":"https://www.exploit-db.com/exploits/46459","reference_id":"","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.exploit-db.com/exploits/46459"},{"reference_url":"https://www.exploit-db.com/exploits/46459/","reference_id":"","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"Attend","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2025-02-07T12:38:47Z/"}],"url":"https://www.exploit-db.com/exploits/46459/"},{"reference_url":"https://www.exploit-db.com/exploits/46510","reference_id":"","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.exploit-db.com/exploits/46510"},{"reference_url":"https://www.exploit-db.com/exploits/46510/","reference_id":"","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"Attend","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2025-02-07T12:38:47Z/"}],"url":"https://www.exploit-db.com/exploits/46510/"},{"reference_url":"https://www.synology.com/security/advisory/Synology_SA_19_09","reference_id":"","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H"},{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Attend","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2025-02-07T12:38:47Z/"}],"url":"https://www.synology.com/security/advisory/Synology_SA_19_09"},{"reference_url":"http://www.securityfocus.com/bid/107106","reference_id":"","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"Attend","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2025-02-07T12:38:47Z/"}],"url":"http://www.securityfocus.com/bid/107106"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*"},{"reference_url":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/php/remote/46510.rb","reference_id":"CVE-2019-6340","reference_type":"exploit","scores":[],"url":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/php/remote/46510.rb"},{"reference_url":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/php/webapps/46452.txt","reference_id":"CVE-2019-6340","reference_type":"exploit","scores":[],"url":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/php/webapps/46452.txt"},{"reference_url":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/php/webapps/46459.py","reference_id":"CVE-2019-6340","reference_type":"exploit","scores":[],"url":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/php/webapps/46459.py"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2019-6340","reference_id":"CVE-2019-6340","reference_type":"","scores":[{"value":"6.8","scoring_system":"cvssv2","scoring_elements":"AV:N/AC:M/Au:N/C:P/I:P/A:P"},{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H"},{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-6340"},{"reference_url":"https://raw.githubusercontent.com/rapid7/metasploit-framework/6ff18828c0273b7170469939a49e4b063d561799/modules/exploits/unix/webapp/drupal_restws_unserialize.rb","reference_id":"CVE-2019-6340","reference_type":"exploit","scores":[],"url":"https://raw.githubusercontent.com/rapid7/metasploit-framework/6ff18828c0273b7170469939a49e4b063d561799/modules/exploits/unix/webapp/drupal_restws_unserialize.rb"},{"reference_url":"https://www.ambionics.io/blog/drupal8-rce","reference_id":"CVE-2019-6340","reference_type":"exploit","scores":[],"url":"https://www.ambionics.io/blog/drupal8-rce"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2019-6340.yaml","reference_id":"CVE-2019-6340.YAML","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2019-6340.yaml"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2019-6340.yaml","reference_id":"CVE-2019-6340.YAML","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2019-6340.yaml"},{"reference_url":"https://github.com/advisories/GHSA-3gx6-h57h-rm27","reference_id":"GHSA-3gx6-h57h-rm27","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-3gx6-h57h-rm27"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/53812?format=json","purl":"pkg:composer/drupal/drupal@8.5.11","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-349d-w26k-mqfw"},{"vulnerability":"VCID-565p-mgqe-gkfc"},{"vulnerability":"VCID-636u-5bdw-puh4"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-djgn-ezxp-37eu"},{"vulnerability":"VCID-jfq8-xxwa-mkd1"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kh51-g4cv-tqaw"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n119-gta2-kfg1"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-pk74-yy1n-8qck"},{"vulnerability":"VCID-r8pv-9upr-y7gd"},{"vulnerability":"VCID-ty3y-k9t2-qyba"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-uqcw-p8g2-cfd2"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-w3q4-838v-97ck"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-wbvy-zrtk-audw"},{"vulnerability":"VCID-ww44-hb2y-mfd5"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/drupal@8.5.11"},{"url":"http://public2.vulnerablecode.io/api/packages/53813?format=json","purl":"pkg:composer/drupal/drupal@8.6.10","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-349d-w26k-mqfw"},{"vulnerability":"VCID-565p-mgqe-gkfc"},{"vulnerability":"VCID-636u-5bdw-puh4"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-djgn-ezxp-37eu"},{"vulnerability":"VCID-jfq8-xxwa-mkd1"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kh51-g4cv-tqaw"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n119-gta2-kfg1"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-pk74-yy1n-8qck"},{"vulnerability":"VCID-r8pv-9upr-y7gd"},{"vulnerability":"VCID-ty3y-k9t2-qyba"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-uqcw-p8g2-cfd2"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-w3q4-838v-97ck"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-wbvy-zrtk-audw"},{"vulnerability":"VCID-ww44-hb2y-mfd5"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/drupal@8.6.10"}],"aliases":["CVE-2019-6340","GHSA-3gx6-h57h-rm27"],"risk_score":10.0,"exploitability":"2.0","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-rhj7-dy7q-jkhw"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/9976?format=json","vulnerability_id":"VCID-rr4q-f5cv-nkah","summary":"URL Redirection to Untrusted Site ('Open Redirect')\nAnonymous Open Redirect in drupal.","references":[{"reference_url":"https://www.drupal.org/sa-core-2018-006","reference_id":"","reference_type":"","scores":[],"url":"https://www.drupal.org/sa-core-2018-006"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/32217?format=json","purl":"pkg:composer/drupal/drupal@8.6.2","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-349d-w26k-mqfw"},{"vulnerability":"VCID-3fka-y25d-m7a3"},{"vulnerability":"VCID-565p-mgqe-gkfc"},{"vulnerability":"VCID-636u-5bdw-puh4"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-cucx-jfqf-pkd1"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-djgn-ezxp-37eu"},{"vulnerability":"VCID-jfq8-xxwa-mkd1"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kh51-g4cv-tqaw"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n119-gta2-kfg1"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-pk74-yy1n-8qck"},{"vulnerability":"VCID-r8pv-9upr-y7gd"},{"vulnerability":"VCID-rhj7-dy7q-jkhw"},{"vulnerability":"VCID-ty3y-k9t2-qyba"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-uqcw-p8g2-cfd2"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-w3q4-838v-97ck"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-wbvy-zrtk-audw"},{"vulnerability":"VCID-ww44-hb2y-mfd5"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/drupal@8.6.2"}],"aliases":["2018-10-17-3"],"risk_score":null,"exploitability":"0.5","weighted_severity":"0.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-rr4q-f5cv-nkah"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/8830?format=json","vulnerability_id":"VCID-s9kv-9qfu-gbdq","summary":"Incorrect Permission Assignment for Critical Resource\nWhen using Drupal's private file system, Drupal will check to make sure a user has access to a file before allowing the user to view or download it. This check fails under certain conditions in which one module is trying to grant access to the file and another is trying to deny it, leading to an access bypass vulnerability. This vulnerability is mitigated by the fact that it only occurs for unusual site configurations.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2017-6928","reference_id":"","reference_type":"","scores":[{"value":"0.00277","scoring_system":"epss","scoring_elements":"0.51075","published_at":"2026-04-01T12:55:00Z"},{"value":"0.00277","scoring_system":"epss","scoring_elements":"0.5117","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00277","scoring_system":"epss","scoring_elements":"0.51185","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00277","scoring_system":"epss","scoring_elements":"0.51207","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00277","scoring_system":"epss","scoring_elements":"0.51162","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00277","scoring_system":"epss","scoring_elements":"0.51166","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00277","scoring_system":"epss","scoring_elements":"0.5111","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00277","scoring_system":"epss","scoring_elements":"0.51153","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00277","scoring_system":"epss","scoring_elements":"0.51129","published_at":"2026-04-02T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2017-6928"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6927","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6927"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6928","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6928"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6929","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6929"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6932","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6932"},{"reference_url":"https://github.com/drupal/core","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2017-6928.yaml","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2017-6928.yaml"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2017-6928.yaml","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2017-6928.yaml"},{"reference_url":"https://lists.debian.org/debian-lts-announce/2018/02/msg00030.html","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.debian.org/debian-lts-announce/2018/02/msg00030.html"},{"reference_url":"https://www.debian.org/security/2018/dsa-4123","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.debian.org/security/2018/dsa-4123"},{"reference_url":"https://www.drupal.org/sa-core-2018-001","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.drupal.org/sa-core-2018-001"},{"reference_url":"https://www.drupal.org/SA-CORE-2018-001","reference_id":"","reference_type":"","scores":[],"url":"https://www.drupal.org/SA-CORE-2018-001"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2017-6928","reference_id":"CVE-2017-6928","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-6928"},{"reference_url":"https://github.com/advisories/GHSA-66mv-q8r2-hj8w","reference_id":"GHSA-66mv-q8r2-hj8w","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-66mv-q8r2-hj8w"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/26565?format=json","purl":"pkg:composer/drupal/drupal@8.4.5","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-349d-w26k-mqfw"},{"vulnerability":"VCID-3fka-y25d-m7a3"},{"vulnerability":"VCID-4aer-46u2-23f6"},{"vulnerability":"VCID-565p-mgqe-gkfc"},{"vulnerability":"VCID-5tqs-qmqn-gug5"},{"vulnerability":"VCID-636u-5bdw-puh4"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-8nda-kjr2-ufd4"},{"vulnerability":"VCID-9vdz-1jpq-kue3"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-c9dm-17vt-4bbc"},{"vulnerability":"VCID-cucx-jfqf-pkd1"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-ga35-289v-vqhr"},{"vulnerability":"VCID-gzcu-sbks-wyfa"},{"vulnerability":"VCID-jfq8-xxwa-mkd1"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kh51-g4cv-tqaw"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n119-gta2-kfg1"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-nc36-atc6-yua6"},{"vulnerability":"VCID-nd8n-5dsu-2fbp"},{"vulnerability":"VCID-pk74-yy1n-8qck"},{"vulnerability":"VCID-r8pv-9upr-y7gd"},{"vulnerability":"VCID-rhj7-dy7q-jkhw"},{"vulnerability":"VCID-rr4q-f5cv-nkah"},{"vulnerability":"VCID-t84c-8r34-57b9"},{"vulnerability":"VCID-ty3y-k9t2-qyba"},{"vulnerability":"VCID-u1xx-aazv-bkg5"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-uqcw-p8g2-cfd2"},{"vulnerability":"VCID-utyg-huhu-2ucq"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vq5y-hdw3-nucj"},{"vulnerability":"VCID-w3q4-838v-97ck"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-wbvy-zrtk-audw"},{"vulnerability":"VCID-ww44-hb2y-mfd5"},{"vulnerability":"VCID-wwvq-399y-rfhc"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/drupal@8.4.5"}],"aliases":["CVE-2017-6928","GHSA-66mv-q8r2-hj8w"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-s9kv-9qfu-gbdq"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/19375?format=json","vulnerability_id":"VCID-t84c-8r34-57b9","summary":"Drupal Content moderation Access bypass\nIn some conditions, drupal content moderation fails to check a users access to use certain transitions, leading to an access bypass.","references":[{"reference_url":"https://github.com/drupal/drupal","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/drupal"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/2018-10-17-1.yaml","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/2018-10-17-1.yaml"},{"reference_url":"https://www.drupal.org/sa-core-2018-006","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.drupal.org/sa-core-2018-006"},{"reference_url":"https://github.com/advisories/GHSA-86xw-vmcx-9mj4","reference_id":"GHSA-86xw-vmcx-9mj4","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-86xw-vmcx-9mj4"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/59990?format=json","purl":"pkg:composer/drupal/drupal@8.5.8","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-349d-w26k-mqfw"},{"vulnerability":"VCID-3fka-y25d-m7a3"},{"vulnerability":"VCID-565p-mgqe-gkfc"},{"vulnerability":"VCID-636u-5bdw-puh4"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-c9dm-17vt-4bbc"},{"vulnerability":"VCID-cucx-jfqf-pkd1"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-djgn-ezxp-37eu"},{"vulnerability":"VCID-gzcu-sbks-wyfa"},{"vulnerability":"VCID-jfq8-xxwa-mkd1"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kh51-g4cv-tqaw"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n119-gta2-kfg1"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-nd8n-5dsu-2fbp"},{"vulnerability":"VCID-pk74-yy1n-8qck"},{"vulnerability":"VCID-r8pv-9upr-y7gd"},{"vulnerability":"VCID-rhj7-dy7q-jkhw"},{"vulnerability":"VCID-rr4q-f5cv-nkah"},{"vulnerability":"VCID-ty3y-k9t2-qyba"},{"vulnerability":"VCID-u1xx-aazv-bkg5"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-uqcw-p8g2-cfd2"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-w3q4-838v-97ck"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-wbvy-zrtk-audw"},{"vulnerability":"VCID-ww44-hb2y-mfd5"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/drupal@8.5.8"},{"url":"http://public2.vulnerablecode.io/api/packages/32217?format=json","purl":"pkg:composer/drupal/drupal@8.6.2","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-349d-w26k-mqfw"},{"vulnerability":"VCID-3fka-y25d-m7a3"},{"vulnerability":"VCID-565p-mgqe-gkfc"},{"vulnerability":"VCID-636u-5bdw-puh4"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-cucx-jfqf-pkd1"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-djgn-ezxp-37eu"},{"vulnerability":"VCID-jfq8-xxwa-mkd1"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kh51-g4cv-tqaw"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n119-gta2-kfg1"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-pk74-yy1n-8qck"},{"vulnerability":"VCID-r8pv-9upr-y7gd"},{"vulnerability":"VCID-rhj7-dy7q-jkhw"},{"vulnerability":"VCID-ty3y-k9t2-qyba"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-uqcw-p8g2-cfd2"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-w3q4-838v-97ck"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-wbvy-zrtk-audw"},{"vulnerability":"VCID-ww44-hb2y-mfd5"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/drupal@8.6.2"}],"aliases":["GHSA-86xw-vmcx-9mj4"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-t84c-8r34-57b9"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/19000?format=json","vulnerability_id":"VCID-ty3y-k9t2-qyba","summary":"Drupal Malicious file upload with filenames stating with dot\nDrupal 8 core's file_save_upload() function does not strip the leading and trailing dot ('.') from filenames, like Drupal 7 did.\n\nUsers with the ability to upload files with any extension in conjunction with contributed modules may be able to use this to upload system files such as .htaccess in order to bypass protections afforded by Drupal's default .htaccess file.\n\nAfter this fix, file_save_upload() now trims leading and trailing dots from filenames.","references":[{"reference_url":"https://github.com/drupal/drupal","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/drupal"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/2019-12-18-2.yaml","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/2019-12-18-2.yaml"},{"reference_url":"https://www.drupal.org/sa-core-2019-010","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.drupal.org/sa-core-2019-010"},{"reference_url":"https://github.com/advisories/GHSA-58xv-7h9r-mx3c","reference_id":"GHSA-58xv-7h9r-mx3c","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-58xv-7h9r-mx3c"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/59854?format=json","purl":"pkg:composer/drupal/drupal@8.7.11","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-5618-53yg-8qh4"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-cvxp-ctj9-guej"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kh51-g4cv-tqaw"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n119-gta2-kfg1"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-nj3a-eb59-jygs"},{"vulnerability":"VCID-r8pv-9upr-y7gd"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-uqcw-p8g2-cfd2"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-wbvy-zrtk-audw"},{"vulnerability":"VCID-ww44-hb2y-mfd5"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/drupal@8.7.11"},{"url":"http://public2.vulnerablecode.io/api/packages/59855?format=json","purl":"pkg:composer/drupal/drupal@8.8.1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1nf6-3q5b-gqfm"},{"vulnerability":"VCID-2s8m-ujzb-skd1"},{"vulnerability":"VCID-5618-53yg-8qh4"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-cvxp-ctj9-guej"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-gbz5-5frj-hber"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kh51-g4cv-tqaw"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-mhk6-9qdy-83f3"},{"vulnerability":"VCID-n119-gta2-kfg1"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-nj3a-eb59-jygs"},{"vulnerability":"VCID-q4qx-7s1y-q3hc"},{"vulnerability":"VCID-r8pv-9upr-y7gd"},{"vulnerability":"VCID-rdgr-yuu7-xkey"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-uqcw-p8g2-cfd2"},{"vulnerability":"VCID-v9v6-ae3e-g3hk"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-wbvy-zrtk-audw"},{"vulnerability":"VCID-ww44-hb2y-mfd5"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/drupal@8.8.1"}],"aliases":["GHSA-58xv-7h9r-mx3c"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-ty3y-k9t2-qyba"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/9966?format=json","vulnerability_id":"VCID-u1xx-aazv-bkg5","summary":"Improper Access Control\nIn some conditions, content moderation fails to check a users access to use certain transitions, leading to an access bypass.","references":[{"reference_url":"https://www.drupal.org/sa-core-2018-006","reference_id":"","reference_type":"","scores":[],"url":"https://www.drupal.org/sa-core-2018-006"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/32217?format=json","purl":"pkg:composer/drupal/drupal@8.6.2","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-349d-w26k-mqfw"},{"vulnerability":"VCID-3fka-y25d-m7a3"},{"vulnerability":"VCID-565p-mgqe-gkfc"},{"vulnerability":"VCID-636u-5bdw-puh4"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-cucx-jfqf-pkd1"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-djgn-ezxp-37eu"},{"vulnerability":"VCID-jfq8-xxwa-mkd1"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kh51-g4cv-tqaw"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n119-gta2-kfg1"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-pk74-yy1n-8qck"},{"vulnerability":"VCID-r8pv-9upr-y7gd"},{"vulnerability":"VCID-rhj7-dy7q-jkhw"},{"vulnerability":"VCID-ty3y-k9t2-qyba"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-uqcw-p8g2-cfd2"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-w3q4-838v-97ck"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-wbvy-zrtk-audw"},{"vulnerability":"VCID-ww44-hb2y-mfd5"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/drupal@8.6.2"}],"aliases":["2018-10-17-5"],"risk_score":null,"exploitability":"0.5","weighted_severity":"0.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-u1xx-aazv-bkg5"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/15838?format=json","vulnerability_id":"VCID-u4w3-usvb-jyf6","summary":"Drupal Full Path Disclosure\n`core/authorize.php` in Drupal 11.x-dev allows Full Path Disclosure (even when error logging is None) if the value of `hash_salt` is `file_get_contents` of a file that does not exist.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2024-45440","reference_id":"","reference_type":"","scores":[{"value":"0.86443","scoring_system":"epss","scoring_elements":"0.99404","published_at":"2026-04-02T12:55:00Z"},{"value":"0.86443","scoring_system":"epss","scoring_elements":"0.99405","published_at":"2026-04-04T12:55:00Z"},{"value":"0.87227","scoring_system":"epss","scoring_elements":"0.99449","published_at":"2026-04-13T12:55:00Z"},{"value":"0.87227","scoring_system":"epss","scoring_elements":"0.99448","published_at":"2026-04-11T12:55:00Z"},{"value":"0.87227","scoring_system":"epss","scoring_elements":"0.99447","published_at":"2026-04-09T12:55:00Z"},{"value":"0.87227","scoring_system":"epss","scoring_elements":"0.99445","published_at":"2026-04-07T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2024-45440"},{"reference_url":"https://github.com/drupal/drupal","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"6.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/drupal"},{"reference_url":"https://github.com/github/advisory-database/pull/4827","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"6.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/github/advisory-database/pull/4827"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2024-45440","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"6.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-45440"},{"reference_url":"https://senscybersecurity.nl/CVE-2024-45440-Explained","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"6.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://senscybersecurity.nl/CVE-2024-45440-Explained"},{"reference_url":"https://www.drupal.org/project/drupal/issues/3457781","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"6.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-08-29T13:18:23Z/"}],"url":"https://www.drupal.org/project/drupal/issues/3457781"},{"reference_url":"https://www.drupal.org/project/drupal/releases/10.2.9","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"6.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.drupal.org/project/drupal/releases/10.2.9"},{"reference_url":"https://www.drupal.org/project/drupal/releases/10.3.6","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"6.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.drupal.org/project/drupal/releases/10.3.6"},{"reference_url":"https://www.drupal.org/project/drupal/releases/11.0.5","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"6.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.drupal.org/project/drupal/releases/11.0.5"},{"reference_url":"https://www.exploit-db.com/exploits/52266","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"6.3","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.exploit-db.com/exploits/52266"},{"reference_url":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/php/webapps/52266.py","reference_id":"CVE-2024-45440","reference_type":"exploit","scores":[],"url":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/php/webapps/52266.py"},{"reference_url":"https://senscybersecurity.nl/CVE-2024-45440-Explained/","reference_id":"CVE-2024-45440-Explained","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-08-29T13:18:23Z/"}],"url":"https://senscybersecurity.nl/CVE-2024-45440-Explained/"},{"reference_url":"https://github.com/advisories/GHSA-mg8j-w93w-xjgc","reference_id":"GHSA-mg8j-w93w-xjgc","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-mg8j-w93w-xjgc"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/55107?format=json","purl":"pkg:composer/drupal/drupal@10.2.9","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1nf6-3q5b-gqfm"},{"vulnerability":"VCID-2s8m-ujzb-skd1"},{"vulnerability":"VCID-q4qx-7s1y-q3hc"},{"vulnerability":"VCID-rdgr-yuu7-xkey"},{"vulnerability":"VCID-vevm-4sfk-f7gq"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/drupal@10.2.9"},{"url":"http://public2.vulnerablecode.io/api/packages/703873?format=json","purl":"pkg:composer/drupal/drupal@10.3.0-beta1","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/drupal@10.3.0-beta1"},{"url":"http://public2.vulnerablecode.io/api/packages/55097?format=json","purl":"pkg:composer/drupal/drupal@10.3.6","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1nf6-3q5b-gqfm"},{"vulnerability":"VCID-2s8m-ujzb-skd1"},{"vulnerability":"VCID-q4qx-7s1y-q3hc"},{"vulnerability":"VCID-rdgr-yuu7-xkey"},{"vulnerability":"VCID-vevm-4sfk-f7gq"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/drupal@10.3.6"},{"url":"http://public2.vulnerablecode.io/api/packages/703876?format=json","purl":"pkg:composer/drupal/drupal@11.0.0-alpha1","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/drupal@11.0.0-alpha1"},{"url":"http://public2.vulnerablecode.io/api/packages/55099?format=json","purl":"pkg:composer/drupal/drupal@11.0.5","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1nf6-3q5b-gqfm"},{"vulnerability":"VCID-2s8m-ujzb-skd1"},{"vulnerability":"VCID-q4qx-7s1y-q3hc"},{"vulnerability":"VCID-vevm-4sfk-f7gq"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/drupal@11.0.5"}],"aliases":["CVE-2024-45440","GHSA-mg8j-w93w-xjgc"],"risk_score":10.0,"exploitability":"2.0","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-u4w3-usvb-jyf6"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/12881?format=json","vulnerability_id":"VCID-uqcw-p8g2-cfd2","summary":"Exposure of Resource to Wrong Sphere\nInformation Disclosure vulnerability in file module of Drupal Core allows an attacker to gain access to the file metadata of a permanent private file that they do not have access to by guessing the ID of the file. This issue affects: Drupal Core 8.8.x versions prior to 8.8.10; 8.9.x versions prior to 8.9.6; 9.0.x versions prior to 9.0.6.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2020-13670","reference_id":"","reference_type":"","scores":[{"value":"0.00427","scoring_system":"epss","scoring_elements":"0.62226","published_at":"2026-04-01T12:55:00Z"},{"value":"0.00427","scoring_system":"epss","scoring_elements":"0.62313","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00427","scoring_system":"epss","scoring_elements":"0.62283","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00427","scoring_system":"epss","scoring_elements":"0.62334","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00427","scoring_system":"epss","scoring_elements":"0.62355","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00427","scoring_system":"epss","scoring_elements":"0.62366","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00427","scoring_system":"epss","scoring_elements":"0.62346","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00427","scoring_system":"epss","scoring_elements":"0.62329","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00427","scoring_system":"epss","scoring_elements":"0.62279","published_at":"2026-04-07T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2020-13670"},{"reference_url":"https://github.com/drupal/core","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core"},{"reference_url":"https://github.com/drupal/core/commit/f93a37b713b59f8d24e826bc74378099853eef3d","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core/commit/f93a37b713b59f8d24e826bc74378099853eef3d"},{"reference_url":"https://www.drupal.org/sa-core-2020-011","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.drupal.org/sa-core-2020-011"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2020-13670","reference_id":"CVE-2020-13670","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-13670"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2020-13670.yaml","reference_id":"CVE-2020-13670.YAML","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2020-13670.yaml"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2020-13670.yaml","reference_id":"CVE-2020-13670.YAML","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2020-13670.yaml"},{"reference_url":"https://github.com/advisories/GHSA-mmjr-5q74-p3m4","reference_id":"GHSA-mmjr-5q74-p3m4","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-mmjr-5q74-p3m4"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/46124?format=json","purl":"pkg:composer/drupal/drupal@8.8.10","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1nf6-3q5b-gqfm"},{"vulnerability":"VCID-2s8m-ujzb-skd1"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-gbz5-5frj-hber"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-q4qx-7s1y-q3hc"},{"vulnerability":"VCID-r8pv-9upr-y7gd"},{"vulnerability":"VCID-rdgr-yuu7-xkey"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-v9v6-ae3e-g3hk"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-wbvy-zrtk-audw"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/drupal@8.8.10"},{"url":"http://public2.vulnerablecode.io/api/packages/46125?format=json","purl":"pkg:composer/drupal/drupal@8.9.6","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1nf6-3q5b-gqfm"},{"vulnerability":"VCID-2s8m-ujzb-skd1"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-gbz5-5frj-hber"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kc7d-5k6x-77bp"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-q4qx-7s1y-q3hc"},{"vulnerability":"VCID-r8pv-9upr-y7gd"},{"vulnerability":"VCID-rdgr-yuu7-xkey"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-v9v6-ae3e-g3hk"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-wbvy-zrtk-audw"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/drupal@8.9.6"},{"url":"http://public2.vulnerablecode.io/api/packages/46126?format=json","purl":"pkg:composer/drupal/drupal@9.0.6","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1nf6-3q5b-gqfm"},{"vulnerability":"VCID-2s8m-ujzb-skd1"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-gbz5-5frj-hber"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kc7d-5k6x-77bp"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-q4qx-7s1y-q3hc"},{"vulnerability":"VCID-r8pv-9upr-y7gd"},{"vulnerability":"VCID-rdgr-yuu7-xkey"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-v9v6-ae3e-g3hk"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-wbvy-zrtk-audw"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/drupal@9.0.6"}],"aliases":["CVE-2020-13670","GHSA-mmjr-5q74-p3m4"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-uqcw-p8g2-cfd2"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/19987?format=json","vulnerability_id":"VCID-utyg-huhu-2ucq","summary":"Drupal External URL injection through URL aliases leading to Open Redirect\nThe path module in Drupal allows users with the 'administer paths' to create pretty URLs for content.\nIn certain circumstances the user can enter a particular path that triggers an open redirect to a malicious url.","references":[{"reference_url":"https://github.com/drupal/drupal","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/drupal"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/2018-10-17-2.yaml","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/2018-10-17-2.yaml"},{"reference_url":"https://www.drupal.org/sa-core-2018-006","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.drupal.org/sa-core-2018-006"},{"reference_url":"https://github.com/advisories/GHSA-r67r-42wx-c8r7","reference_id":"GHSA-r67r-42wx-c8r7","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-r67r-42wx-c8r7"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/59990?format=json","purl":"pkg:composer/drupal/drupal@8.5.8","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-349d-w26k-mqfw"},{"vulnerability":"VCID-3fka-y25d-m7a3"},{"vulnerability":"VCID-565p-mgqe-gkfc"},{"vulnerability":"VCID-636u-5bdw-puh4"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-c9dm-17vt-4bbc"},{"vulnerability":"VCID-cucx-jfqf-pkd1"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-djgn-ezxp-37eu"},{"vulnerability":"VCID-gzcu-sbks-wyfa"},{"vulnerability":"VCID-jfq8-xxwa-mkd1"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kh51-g4cv-tqaw"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n119-gta2-kfg1"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-nd8n-5dsu-2fbp"},{"vulnerability":"VCID-pk74-yy1n-8qck"},{"vulnerability":"VCID-r8pv-9upr-y7gd"},{"vulnerability":"VCID-rhj7-dy7q-jkhw"},{"vulnerability":"VCID-rr4q-f5cv-nkah"},{"vulnerability":"VCID-ty3y-k9t2-qyba"},{"vulnerability":"VCID-u1xx-aazv-bkg5"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-uqcw-p8g2-cfd2"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-w3q4-838v-97ck"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-wbvy-zrtk-audw"},{"vulnerability":"VCID-ww44-hb2y-mfd5"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/drupal@8.5.8"},{"url":"http://public2.vulnerablecode.io/api/packages/32217?format=json","purl":"pkg:composer/drupal/drupal@8.6.2","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-349d-w26k-mqfw"},{"vulnerability":"VCID-3fka-y25d-m7a3"},{"vulnerability":"VCID-565p-mgqe-gkfc"},{"vulnerability":"VCID-636u-5bdw-puh4"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-cucx-jfqf-pkd1"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-djgn-ezxp-37eu"},{"vulnerability":"VCID-jfq8-xxwa-mkd1"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kh51-g4cv-tqaw"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n119-gta2-kfg1"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-pk74-yy1n-8qck"},{"vulnerability":"VCID-r8pv-9upr-y7gd"},{"vulnerability":"VCID-rhj7-dy7q-jkhw"},{"vulnerability":"VCID-ty3y-k9t2-qyba"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-uqcw-p8g2-cfd2"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-w3q4-838v-97ck"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-wbvy-zrtk-audw"},{"vulnerability":"VCID-ww44-hb2y-mfd5"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/drupal@8.6.2"}],"aliases":["GHSA-r67r-42wx-c8r7"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-utyg-huhu-2ucq"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/14839?format=json","vulnerability_id":"VCID-vevm-4sfk-f7gq","summary":"Drupal core Access bypass\nDrupal's uniqueness checking for certain user fields is inconsistent depending on the database engine and its collation. As a result, a user may be able to register with the same email address as another user. This may lead to data integrity issues. This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2024-55634","reference_id":"","reference_type":"","scores":[{"value":"0.00848","scoring_system":"epss","scoring_elements":"0.74805","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00848","scoring_system":"epss","scoring_elements":"0.74846","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00848","scoring_system":"epss","scoring_elements":"0.74856","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00848","scoring_system":"epss","scoring_elements":"0.74877","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00848","scoring_system":"epss","scoring_elements":"0.74853","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00848","scoring_system":"epss","scoring_elements":"0.74806","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00848","scoring_system":"epss","scoring_elements":"0.74833","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00848","scoring_system":"epss","scoring_elements":"0.74839","published_at":"2026-04-08T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2024-55634"},{"reference_url":"https://github.com/drupal/core","reference_id":"","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core"},{"reference_url":"https://github.com/drupal/core/commit/7ae0e8f1824e15f8b2b06e4da09836250e85e934","reference_id":"","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core/commit/7ae0e8f1824e15f8b2b06e4da09836250e85e934"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2024-55634","reference_id":"","reference_type":"","scores":[{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-55634"},{"reference_url":"https://www.drupal.org/sa-core-2024-004","reference_id":"","reference_type":"","scores":[{"value":"8.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"},{"value":"6.9","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-12-11T16:38:29Z/"}],"url":"https://www.drupal.org/sa-core-2024-004"},{"reference_url":"https://github.com/advisories/GHSA-7cwc-fjqm-8vh8","reference_id":"GHSA-7cwc-fjqm-8vh8","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-7cwc-fjqm-8vh8"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/51098?format=json","purl":"pkg:composer/drupal/drupal@10.2.11","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/drupal@10.2.11"},{"url":"http://public2.vulnerablecode.io/api/packages/51103?format=json","purl":"pkg:composer/drupal/drupal@10.3.9","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/drupal@10.3.9"},{"url":"http://public2.vulnerablecode.io/api/packages/51164?format=json","purl":"pkg:composer/drupal/drupal@11.0.8","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/drupal@11.0.8"}],"aliases":["CVE-2024-55634","GHSA-7cwc-fjqm-8vh8"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-vevm-4sfk-f7gq"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/19347?format=json","vulnerability_id":"VCID-vq5y-hdw3-nucj","summary":"Drupal Anonymous Open Redirect\nDrupal core and contributed modules frequently use a \"destination\" query string parameter in URLs to redirect users to a new destination after completing an action on the current page. Under certain circumstances, malicious users can use this parameter to construct a URL that will trick users into being redirected to a 3rd party website, thereby exposing the users to potential social engineering attacks.","references":[{"reference_url":"https://github.com/drupal/drupal","reference_id":"","reference_type":"","scores":[{"value":"5.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/drupal"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/2018-10-17-3.yaml","reference_id":"","reference_type":"","scores":[{"value":"5.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/2018-10-17-3.yaml"},{"reference_url":"https://www.drupal.org/sa-core-2018-006","reference_id":"","reference_type":"","scores":[{"value":"5.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.drupal.org/sa-core-2018-006"},{"reference_url":"https://github.com/advisories/GHSA-x6v2-xmrq-574j","reference_id":"GHSA-x6v2-xmrq-574j","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-x6v2-xmrq-574j"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/59990?format=json","purl":"pkg:composer/drupal/drupal@8.5.8","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-349d-w26k-mqfw"},{"vulnerability":"VCID-3fka-y25d-m7a3"},{"vulnerability":"VCID-565p-mgqe-gkfc"},{"vulnerability":"VCID-636u-5bdw-puh4"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-c9dm-17vt-4bbc"},{"vulnerability":"VCID-cucx-jfqf-pkd1"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-djgn-ezxp-37eu"},{"vulnerability":"VCID-gzcu-sbks-wyfa"},{"vulnerability":"VCID-jfq8-xxwa-mkd1"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kh51-g4cv-tqaw"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n119-gta2-kfg1"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-nd8n-5dsu-2fbp"},{"vulnerability":"VCID-pk74-yy1n-8qck"},{"vulnerability":"VCID-r8pv-9upr-y7gd"},{"vulnerability":"VCID-rhj7-dy7q-jkhw"},{"vulnerability":"VCID-rr4q-f5cv-nkah"},{"vulnerability":"VCID-ty3y-k9t2-qyba"},{"vulnerability":"VCID-u1xx-aazv-bkg5"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-uqcw-p8g2-cfd2"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-w3q4-838v-97ck"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-wbvy-zrtk-audw"},{"vulnerability":"VCID-ww44-hb2y-mfd5"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/drupal@8.5.8"},{"url":"http://public2.vulnerablecode.io/api/packages/32217?format=json","purl":"pkg:composer/drupal/drupal@8.6.2","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-349d-w26k-mqfw"},{"vulnerability":"VCID-3fka-y25d-m7a3"},{"vulnerability":"VCID-565p-mgqe-gkfc"},{"vulnerability":"VCID-636u-5bdw-puh4"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-cucx-jfqf-pkd1"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-djgn-ezxp-37eu"},{"vulnerability":"VCID-jfq8-xxwa-mkd1"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kh51-g4cv-tqaw"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n119-gta2-kfg1"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-pk74-yy1n-8qck"},{"vulnerability":"VCID-r8pv-9upr-y7gd"},{"vulnerability":"VCID-rhj7-dy7q-jkhw"},{"vulnerability":"VCID-ty3y-k9t2-qyba"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-uqcw-p8g2-cfd2"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-w3q4-838v-97ck"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-wbvy-zrtk-audw"},{"vulnerability":"VCID-ww44-hb2y-mfd5"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/drupal@8.6.2"}],"aliases":["GHSA-x6v2-xmrq-574j"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-vq5y-hdw3-nucj"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/19320?format=json","vulnerability_id":"VCID-w3q4-838v-97ck","summary":"Drupal core Denial of Service\nA visit to install.php can cause cached data to become corrupted. This could cause a site to be impaired until caches are rebuilt.","references":[{"reference_url":"https://github.com/drupal/drupal","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/drupal"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/2019-12-18-1.yaml","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/2019-12-18-1.yaml"},{"reference_url":"https://www.drupal.org/sa-core-2019-009","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.drupal.org/sa-core-2019-009"},{"reference_url":"https://github.com/advisories/GHSA-w333-5f96-mjrr","reference_id":"GHSA-w333-5f96-mjrr","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-w333-5f96-mjrr"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/59854?format=json","purl":"pkg:composer/drupal/drupal@8.7.11","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-5618-53yg-8qh4"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-cvxp-ctj9-guej"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kh51-g4cv-tqaw"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n119-gta2-kfg1"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-nj3a-eb59-jygs"},{"vulnerability":"VCID-r8pv-9upr-y7gd"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-uqcw-p8g2-cfd2"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-wbvy-zrtk-audw"},{"vulnerability":"VCID-ww44-hb2y-mfd5"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/drupal@8.7.11"},{"url":"http://public2.vulnerablecode.io/api/packages/59855?format=json","purl":"pkg:composer/drupal/drupal@8.8.1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1nf6-3q5b-gqfm"},{"vulnerability":"VCID-2s8m-ujzb-skd1"},{"vulnerability":"VCID-5618-53yg-8qh4"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-cvxp-ctj9-guej"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-gbz5-5frj-hber"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kh51-g4cv-tqaw"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-mhk6-9qdy-83f3"},{"vulnerability":"VCID-n119-gta2-kfg1"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-nj3a-eb59-jygs"},{"vulnerability":"VCID-q4qx-7s1y-q3hc"},{"vulnerability":"VCID-r8pv-9upr-y7gd"},{"vulnerability":"VCID-rdgr-yuu7-xkey"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-uqcw-p8g2-cfd2"},{"vulnerability":"VCID-v9v6-ae3e-g3hk"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-wbvy-zrtk-audw"},{"vulnerability":"VCID-ww44-hb2y-mfd5"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/drupal@8.8.1"}],"aliases":["GHSA-w333-5f96-mjrr"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-w3q4-838v-97ck"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/13472?format=json","vulnerability_id":"VCID-wbuz-qcp3-43aq","summary":"Improper Input Validation\nguzzlehttp/psr7 is a PSR-7 HTTP message library used in drupal. Versions prior to 1.8.4 and 2.1.1 is vulnerable to improper header parsing. An attacker could sneak in a new line character and pass untrusted values.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2022-24775","reference_id":"","reference_type":"","scores":[{"value":"0.00933","scoring_system":"epss","scoring_elements":"0.76084","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00933","scoring_system":"epss","scoring_elements":"0.7614","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00933","scoring_system":"epss","scoring_elements":"0.76143","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00933","scoring_system":"epss","scoring_elements":"0.76167","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00933","scoring_system":"epss","scoring_elements":"0.76142","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00933","scoring_system":"epss","scoring_elements":"0.76128","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00933","scoring_system":"epss","scoring_elements":"0.76095","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00933","scoring_system":"epss","scoring_elements":"0.76116","published_at":"2026-04-04T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2022-24775"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24775","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24775"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/guzzlehttp/psr7/CVE-2022-24775.yaml","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/guzzlehttp/psr7/CVE-2022-24775.yaml"},{"reference_url":"https://github.com/guzzle/psr7","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/guzzle/psr7"},{"reference_url":"https://github.com/guzzle/psr7/pull/485/commits/e55afaa3fc138c89adf3b55a8ba20dc60d17f1f1","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"},{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-23T15:56:31Z/"}],"url":"https://github.com/guzzle/psr7/pull/485/commits/e55afaa3fc138c89adf3b55a8ba20dc60d17f1f1"},{"reference_url":"https://github.com/guzzle/psr7/pull/486/commits/9a96d9db668b485361ed9de7b5bf1e54895df1dc","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"},{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-23T15:56:31Z/"}],"url":"https://github.com/guzzle/psr7/pull/486/commits/9a96d9db668b485361ed9de7b5bf1e54895df1dc"},{"reference_url":"https://www.drupal.org/sa-core-2022-006","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"},{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-23T15:56:31Z/"}],"url":"https://www.drupal.org/sa-core-2022-006"},{"reference_url":"https://www.rfc-editor.org/rfc/rfc7230#section-3.2.4","reference_id":"","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.rfc-editor.org/rfc/rfc7230#section-3.2.4"},{"reference_url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1008236","reference_id":"1008236","reference_type":"","scores":[],"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1008236"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2022-24775","reference_id":"CVE-2022-24775","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-24775"},{"reference_url":"https://github.com/advisories/GHSA-q7rv-6hp3-vh96","reference_id":"GHSA-q7rv-6hp3-vh96","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-q7rv-6hp3-vh96"},{"reference_url":"https://github.com/guzzle/psr7/security/advisories/GHSA-q7rv-6hp3-vh96","reference_id":"GHSA-q7rv-6hp3-vh96","reference_type":"","scores":[{"value":"5.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"},{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"},{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-23T15:56:31Z/"}],"url":"https://github.com/guzzle/psr7/security/advisories/GHSA-q7rv-6hp3-vh96"},{"reference_url":"https://usn.ubuntu.com/6670-1/","reference_id":"USN-6670-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/6670-1/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/48007?format=json","purl":"pkg:composer/drupal/drupal@9.2.16","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1nf6-3q5b-gqfm"},{"vulnerability":"VCID-2s8m-ujzb-skd1"},{"vulnerability":"VCID-674z-nf4t-b7ez"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-q4qx-7s1y-q3hc"},{"vulnerability":"VCID-rdgr-yuu7-xkey"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-vevm-4sfk-f7gq"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/drupal@9.2.16"},{"url":"http://public2.vulnerablecode.io/api/packages/290666?format=json","purl":"pkg:composer/drupal/drupal@9.3.0-alpha1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1nf6-3q5b-gqfm"},{"vulnerability":"VCID-2s8m-ujzb-skd1"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-q4qx-7s1y-q3hc"},{"vulnerability":"VCID-rdgr-yuu7-xkey"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-vevm-4sfk-f7gq"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/drupal@9.3.0-alpha1"},{"url":"http://public2.vulnerablecode.io/api/packages/48009?format=json","purl":"pkg:composer/drupal/drupal@9.3.9","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1nf6-3q5b-gqfm"},{"vulnerability":"VCID-1qgc-gjdn-9fhk"},{"vulnerability":"VCID-2s8m-ujzb-skd1"},{"vulnerability":"VCID-674z-nf4t-b7ez"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-q4qx-7s1y-q3hc"},{"vulnerability":"VCID-rdgr-yuu7-xkey"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-vevm-4sfk-f7gq"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/drupal@9.3.9"},{"url":"http://public2.vulnerablecode.io/api/packages/290669?format=json","purl":"pkg:composer/drupal/drupal@10.0.0-alpha1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1nf6-3q5b-gqfm"},{"vulnerability":"VCID-2s8m-ujzb-skd1"},{"vulnerability":"VCID-q4qx-7s1y-q3hc"},{"vulnerability":"VCID-rdgr-yuu7-xkey"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-vevm-4sfk-f7gq"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/drupal@10.0.0-alpha1"}],"aliases":["CVE-2022-24775","GHSA-q7rv-6hp3-vh96"],"risk_score":3.4,"exploitability":"0.5","weighted_severity":"6.8","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-wbuz-qcp3-43aq"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/19335?format=json","vulnerability_id":"VCID-wbvy-zrtk-audw","summary":"Drupal core Arbitrary PHP code execution\nThe Drupal project uses the PEAR Archive_Tar library. The PEAR Archive_Tar library has released a security update that impacts Drupal. For more information please see:\nCVE-2020-28948\nCVE-2020-28949\n\nMultiple vulnerabilities are possible if Drupal is configured to allow .tar, .tar.gz, .bz2, or .tlz file uploads and processes them.\n\nTo mitigate this issue, prevent untrusted users from uploading .tar, .tar.gz, .bz2, or .tlz files.","references":[{"reference_url":"https://github.com/drupal/drupal","reference_id":"","reference_type":"","scores":[{"value":"7.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/drupal"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/2020-11-25.yaml","reference_id":"","reference_type":"","scores":[{"value":"7.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/2020-11-25.yaml"},{"reference_url":"https://www.drupal.org/sa-core-2020-013","reference_id":"","reference_type":"","scores":[{"value":"7.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.drupal.org/sa-core-2020-013"},{"reference_url":"https://github.com/advisories/GHSA-j66p-fvp2-fxhj","reference_id":"GHSA-j66p-fvp2-fxhj","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-j66p-fvp2-fxhj"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/60400?format=json","purl":"pkg:composer/drupal/drupal@8.8.12","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1nf6-3q5b-gqfm"},{"vulnerability":"VCID-2s8m-ujzb-skd1"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-q4qx-7s1y-q3hc"},{"vulnerability":"VCID-r8pv-9upr-y7gd"},{"vulnerability":"VCID-rdgr-yuu7-xkey"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-wbuz-qcp3-43aq"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/drupal@8.8.12"},{"url":"http://public2.vulnerablecode.io/api/packages/60401?format=json","purl":"pkg:composer/drupal/drupal@8.9.10","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1nf6-3q5b-gqfm"},{"vulnerability":"VCID-2s8m-ujzb-skd1"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kc7d-5k6x-77bp"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-q4qx-7s1y-q3hc"},{"vulnerability":"VCID-r8pv-9upr-y7gd"},{"vulnerability":"VCID-rdgr-yuu7-xkey"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-wbuz-qcp3-43aq"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/drupal@8.9.10"},{"url":"http://public2.vulnerablecode.io/api/packages/60402?format=json","purl":"pkg:composer/drupal/drupal@9.0.9","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1nf6-3q5b-gqfm"},{"vulnerability":"VCID-2s8m-ujzb-skd1"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kc7d-5k6x-77bp"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-q4qx-7s1y-q3hc"},{"vulnerability":"VCID-r8pv-9upr-y7gd"},{"vulnerability":"VCID-rdgr-yuu7-xkey"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-wbuz-qcp3-43aq"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/drupal@9.0.9"}],"aliases":["GHSA-j66p-fvp2-fxhj"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-wbvy-zrtk-audw"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/12885?format=json","vulnerability_id":"VCID-ww44-hb2y-mfd5","summary":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')\nAccess Bypass vulnerability in Drupal Core allows for an attacker to leverage the way that HTML is rendered for affected forms in order to exploit the vulnerability. This issue affects: Drupal Core 8.8.x versions prior to 8.8.10; 8.9.x versions prior to 8.9.6; 9.0.x versions prior to 9.0.6.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2020-13668","reference_id":"","reference_type":"","scores":[{"value":"0.00223","scoring_system":"epss","scoring_elements":"0.44824","published_at":"2026-04-01T12:55:00Z"},{"value":"0.00223","scoring_system":"epss","scoring_elements":"0.44927","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00223","scoring_system":"epss","scoring_elements":"0.44907","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00223","scoring_system":"epss","scoring_elements":"0.44913","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00223","scoring_system":"epss","scoring_elements":"0.44911","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00223","scoring_system":"epss","scoring_elements":"0.44943","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00223","scoring_system":"epss","scoring_elements":"0.44922","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00223","scoring_system":"epss","scoring_elements":"0.4492","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00223","scoring_system":"epss","scoring_elements":"0.44868","published_at":"2026-04-07T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2020-13668"},{"reference_url":"https://github.com/drupal/core","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core"},{"reference_url":"https://github.com/drupal/core/commit/3184fa4b2f3b65b44884b5e858cdc7794d34b4c8","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core/commit/3184fa4b2f3b65b44884b5e858cdc7794d34b4c8"},{"reference_url":"https://github.com/drupal/core/commit/58330ba58d1ac6f1a0a549e8dbde8a3e094bf4fb","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core/commit/58330ba58d1ac6f1a0a549e8dbde8a3e094bf4fb"},{"reference_url":"https://github.com/drupal/core/commit/d4be028d81fb6b067513d788b60c3e6fc8fbd0a2","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core/commit/d4be028d81fb6b067513d788b60c3e6fc8fbd0a2"},{"reference_url":"https://www.drupal.org/sa-core-2020-009","reference_id":"","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.drupal.org/sa-core-2020-009"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2020-13668","reference_id":"CVE-2020-13668","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-13668"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2020-13668.yaml","reference_id":"CVE-2020-13668.YAML","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2020-13668.yaml"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2020-13668.yaml","reference_id":"CVE-2020-13668.YAML","reference_type":"","scores":[{"value":"6.1","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2020-13668.yaml"},{"reference_url":"https://github.com/advisories/GHSA-m6q5-wv4x-fv6h","reference_id":"GHSA-m6q5-wv4x-fv6h","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-m6q5-wv4x-fv6h"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/46124?format=json","purl":"pkg:composer/drupal/drupal@8.8.10","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1nf6-3q5b-gqfm"},{"vulnerability":"VCID-2s8m-ujzb-skd1"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-gbz5-5frj-hber"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-q4qx-7s1y-q3hc"},{"vulnerability":"VCID-r8pv-9upr-y7gd"},{"vulnerability":"VCID-rdgr-yuu7-xkey"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-v9v6-ae3e-g3hk"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-wbvy-zrtk-audw"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/drupal@8.8.10"},{"url":"http://public2.vulnerablecode.io/api/packages/46125?format=json","purl":"pkg:composer/drupal/drupal@8.9.6","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1nf6-3q5b-gqfm"},{"vulnerability":"VCID-2s8m-ujzb-skd1"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-gbz5-5frj-hber"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kc7d-5k6x-77bp"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-q4qx-7s1y-q3hc"},{"vulnerability":"VCID-r8pv-9upr-y7gd"},{"vulnerability":"VCID-rdgr-yuu7-xkey"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-v9v6-ae3e-g3hk"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-wbvy-zrtk-audw"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/drupal@8.9.6"},{"url":"http://public2.vulnerablecode.io/api/packages/46126?format=json","purl":"pkg:composer/drupal/drupal@9.0.6","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-1nf6-3q5b-gqfm"},{"vulnerability":"VCID-2s8m-ujzb-skd1"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-gbz5-5frj-hber"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kc7d-5k6x-77bp"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-q4qx-7s1y-q3hc"},{"vulnerability":"VCID-r8pv-9upr-y7gd"},{"vulnerability":"VCID-rdgr-yuu7-xkey"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-v9v6-ae3e-g3hk"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-wbvy-zrtk-audw"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/drupal@9.0.6"}],"aliases":["CVE-2020-13668","GHSA-m6q5-wv4x-fv6h"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-ww44-hb2y-mfd5"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/12831?format=json","vulnerability_id":"VCID-wwvq-399y-rfhc","summary":"Drupal Core Remote Code Execution Vulnerability\nA remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result in the site being compromised. This vulnerability is related to Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-002. Both SA-CORE-2018-002 and this vulnerability are being exploited in the wild.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2018-7602","reference_id":"","reference_type":"","scores":[{"value":"0.94385","scoring_system":"epss","scoring_elements":"0.9997","published_at":"2026-04-13T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2018-7602"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7602","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7602"},{"reference_url":"https://github.com/drupal/core","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2018-7602.yaml","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2018-7602.yaml"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2018-7602.yaml","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2018-7602.yaml"},{"reference_url":"https://lists.debian.org/debian-lts-announce/2018/04/msg00030.html","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H"},{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""},{"value":"Act","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-07T12:39:15Z/"}],"url":"https://lists.debian.org/debian-lts-announce/2018/04/msg00030.html"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2018-7602","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv2","scoring_elements":"AV:N/AC:L/Au:N/C:P/I:P/A:P"},{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-7602"},{"reference_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-7602","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-7602"},{"reference_url":"https://www.debian.org/security/2018/dsa-4180","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""},{"value":"Act","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-07T12:39:15Z/"}],"url":"https://www.debian.org/security/2018/dsa-4180"},{"reference_url":"https://www.drupal.org/sa-core-2018-004","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""},{"value":"Act","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-07T12:39:15Z/"}],"url":"https://www.drupal.org/sa-core-2018-004"},{"reference_url":"https://www.exploit-db.com/exploits/44542","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.exploit-db.com/exploits/44542"},{"reference_url":"https://www.exploit-db.com/exploits/44542/","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"Act","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-07T12:39:15Z/"}],"url":"https://www.exploit-db.com/exploits/44542/"},{"reference_url":"https://www.exploit-db.com/exploits/44557","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.exploit-db.com/exploits/44557"},{"reference_url":"https://www.exploit-db.com/exploits/44557/","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"Act","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-07T12:39:15Z/"}],"url":"https://www.exploit-db.com/exploits/44557/"},{"reference_url":"http://www.securityfocus.com/bid/103985","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"Act","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-07T12:39:15Z/"}],"url":"http://www.securityfocus.com/bid/103985"},{"reference_url":"http://www.securitytracker.com/id/1040754","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"Act","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-02-07T12:39:15Z/"}],"url":"http://www.securitytracker.com/id/1040754"},{"reference_url":"https://security.archlinux.org/ASA-201804-10","reference_id":"ASA-201804-10","reference_type":"","scores":[],"url":"https://security.archlinux.org/ASA-201804-10"},{"reference_url":"https://security.archlinux.org/AVG-679","reference_id":"AVG-679","reference_type":"","scores":[{"value":"Critical","scoring_system":"archlinux","scoring_elements":""}],"url":"https://security.archlinux.org/AVG-679"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*","reference_id":"cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*","reference_id":"cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*","reference_id":"cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*"},{"reference_url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*","reference_id":"cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*"},{"reference_url":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/php/webapps/44557.rb","reference_id":"CVE-2018-7602","reference_type":"exploit","scores":[],"url":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/php/webapps/44557.rb"},{"reference_url":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/php/webapps/44542.txt","reference_id":"CVE-2018-7602;SA-CORE-2018-004","reference_type":"exploit","scores":[],"url":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/php/webapps/44542.txt"},{"reference_url":"https://pastebin.com/pRM8nmwj","reference_id":"CVE-2018-7602;SA-CORE-2018-004","reference_type":"exploit","scores":[],"url":"https://pastebin.com/pRM8nmwj"},{"reference_url":"https://github.com/advisories/GHSA-297x-j9pm-xjgg","reference_id":"GHSA-297x-j9pm-xjgg","reference_type":"","scores":[{"value":"CRITICAL","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-297x-j9pm-xjgg"},{"reference_url":"https://usn.ubuntu.com/USN-4773-1/","reference_id":"USN-USN-4773-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/USN-4773-1/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/46015?format=json","purl":"pkg:composer/drupal/drupal@8.4.8","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-349d-w26k-mqfw"},{"vulnerability":"VCID-3fka-y25d-m7a3"},{"vulnerability":"VCID-565p-mgqe-gkfc"},{"vulnerability":"VCID-5tqs-qmqn-gug5"},{"vulnerability":"VCID-636u-5bdw-puh4"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-8nda-kjr2-ufd4"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-c9dm-17vt-4bbc"},{"vulnerability":"VCID-cucx-jfqf-pkd1"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-gzcu-sbks-wyfa"},{"vulnerability":"VCID-jfq8-xxwa-mkd1"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kh51-g4cv-tqaw"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n119-gta2-kfg1"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-nd8n-5dsu-2fbp"},{"vulnerability":"VCID-pk74-yy1n-8qck"},{"vulnerability":"VCID-r8pv-9upr-y7gd"},{"vulnerability":"VCID-rhj7-dy7q-jkhw"},{"vulnerability":"VCID-rr4q-f5cv-nkah"},{"vulnerability":"VCID-t84c-8r34-57b9"},{"vulnerability":"VCID-ty3y-k9t2-qyba"},{"vulnerability":"VCID-u1xx-aazv-bkg5"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-uqcw-p8g2-cfd2"},{"vulnerability":"VCID-utyg-huhu-2ucq"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vq5y-hdw3-nucj"},{"vulnerability":"VCID-w3q4-838v-97ck"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-wbvy-zrtk-audw"},{"vulnerability":"VCID-ww44-hb2y-mfd5"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/drupal@8.4.8"},{"url":"http://public2.vulnerablecode.io/api/packages/46016?format=json","purl":"pkg:composer/drupal/drupal@8.5.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-349d-w26k-mqfw"},{"vulnerability":"VCID-3fka-y25d-m7a3"},{"vulnerability":"VCID-565p-mgqe-gkfc"},{"vulnerability":"VCID-5tqs-qmqn-gug5"},{"vulnerability":"VCID-636u-5bdw-puh4"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-8nda-kjr2-ufd4"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-c9dm-17vt-4bbc"},{"vulnerability":"VCID-cucx-jfqf-pkd1"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-djgn-ezxp-37eu"},{"vulnerability":"VCID-gzcu-sbks-wyfa"},{"vulnerability":"VCID-jfq8-xxwa-mkd1"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kh51-g4cv-tqaw"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n119-gta2-kfg1"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-nd8n-5dsu-2fbp"},{"vulnerability":"VCID-pk74-yy1n-8qck"},{"vulnerability":"VCID-r8pv-9upr-y7gd"},{"vulnerability":"VCID-rhj7-dy7q-jkhw"},{"vulnerability":"VCID-rr4q-f5cv-nkah"},{"vulnerability":"VCID-t84c-8r34-57b9"},{"vulnerability":"VCID-ty3y-k9t2-qyba"},{"vulnerability":"VCID-u1xx-aazv-bkg5"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-uqcw-p8g2-cfd2"},{"vulnerability":"VCID-utyg-huhu-2ucq"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vq5y-hdw3-nucj"},{"vulnerability":"VCID-w3q4-838v-97ck"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-wbvy-zrtk-audw"},{"vulnerability":"VCID-ww44-hb2y-mfd5"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/drupal@8.5.3"}],"aliases":["CVE-2018-7602","GHSA-297x-j9pm-xjgg"],"risk_score":10.0,"exploitability":"2.0","weighted_severity":"9.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-wwvq-399y-rfhc"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/8834?format=json","vulnerability_id":"VCID-yare-57j9-j7cs","summary":"URL Redirection to Untrusted Site (Open Redirect)\nDrupal core has an external link injection vulnerability when the language switcher block is used. A similar vulnerability exists in various custom and contributed modules. This vulnerability could allow an attacker to trick users into unwillingly navigating to an external site.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2017-6932","reference_id":"","reference_type":"","scores":[{"value":"0.00383","scoring_system":"epss","scoring_elements":"0.595","published_at":"2026-04-01T12:55:00Z"},{"value":"0.00383","scoring_system":"epss","scoring_elements":"0.59614","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00383","scoring_system":"epss","scoring_elements":"0.59634","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00383","scoring_system":"epss","scoring_elements":"0.5965","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00383","scoring_system":"epss","scoring_elements":"0.59631","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00383","scoring_system":"epss","scoring_elements":"0.59618","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00383","scoring_system":"epss","scoring_elements":"0.59567","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00383","scoring_system":"epss","scoring_elements":"0.59598","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00383","scoring_system":"epss","scoring_elements":"0.59573","published_at":"2026-04-02T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2017-6932"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6927","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6927"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6928","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6928"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6929","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6929"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6932","reference_id":"","reference_type":"","scores":[],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6932"},{"reference_url":"https://github.com/drupal/core","reference_id":"","reference_type":"","scores":[{"value":"4.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/drupal/core"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2017-6932.yaml","reference_id":"","reference_type":"","scores":[{"value":"4.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2017-6932.yaml"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2017-6932.yaml","reference_id":"","reference_type":"","scores":[{"value":"4.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2017-6932.yaml"},{"reference_url":"https://lists.debian.org/debian-lts-announce/2018/02/msg00030.html","reference_id":"","reference_type":"","scores":[{"value":"4.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://lists.debian.org/debian-lts-announce/2018/02/msg00030.html"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2017-6932","reference_id":"","reference_type":"","scores":[{"value":"4.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-6932"},{"reference_url":"https://www.debian.org/security/2018/dsa-4123","reference_id":"","reference_type":"","scores":[{"value":"4.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.debian.org/security/2018/dsa-4123"},{"reference_url":"https://www.drupal.org/sa-core-2018-001","reference_id":"","reference_type":"","scores":[{"value":"4.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.drupal.org/sa-core-2018-001"},{"reference_url":"https://www.drupal.org/SA-CORE-2018-001","reference_id":"","reference_type":"","scores":[],"url":"https://www.drupal.org/SA-CORE-2018-001"},{"reference_url":"https://github.com/advisories/GHSA-wm86-w3cf-h6vm","reference_id":"GHSA-wm86-w3cf-h6vm","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-wm86-w3cf-h6vm"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/26565?format=json","purl":"pkg:composer/drupal/drupal@8.4.5","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-349d-w26k-mqfw"},{"vulnerability":"VCID-3fka-y25d-m7a3"},{"vulnerability":"VCID-4aer-46u2-23f6"},{"vulnerability":"VCID-565p-mgqe-gkfc"},{"vulnerability":"VCID-5tqs-qmqn-gug5"},{"vulnerability":"VCID-636u-5bdw-puh4"},{"vulnerability":"VCID-6ck5-9e5b-w3ay"},{"vulnerability":"VCID-6m8x-cfzp-tkf4"},{"vulnerability":"VCID-8nda-kjr2-ufd4"},{"vulnerability":"VCID-9vdz-1jpq-kue3"},{"vulnerability":"VCID-bbzr-hbhv-yyee"},{"vulnerability":"VCID-c9dm-17vt-4bbc"},{"vulnerability":"VCID-cucx-jfqf-pkd1"},{"vulnerability":"VCID-dgjq-y5zj-cud1"},{"vulnerability":"VCID-ga35-289v-vqhr"},{"vulnerability":"VCID-gzcu-sbks-wyfa"},{"vulnerability":"VCID-jfq8-xxwa-mkd1"},{"vulnerability":"VCID-k1gx-nznx-7qd6"},{"vulnerability":"VCID-kh51-g4cv-tqaw"},{"vulnerability":"VCID-mapb-hsvc-2khc"},{"vulnerability":"VCID-n119-gta2-kfg1"},{"vulnerability":"VCID-n7un-zgqv-jfef"},{"vulnerability":"VCID-nc36-atc6-yua6"},{"vulnerability":"VCID-nd8n-5dsu-2fbp"},{"vulnerability":"VCID-pk74-yy1n-8qck"},{"vulnerability":"VCID-r8pv-9upr-y7gd"},{"vulnerability":"VCID-rhj7-dy7q-jkhw"},{"vulnerability":"VCID-rr4q-f5cv-nkah"},{"vulnerability":"VCID-t84c-8r34-57b9"},{"vulnerability":"VCID-ty3y-k9t2-qyba"},{"vulnerability":"VCID-u1xx-aazv-bkg5"},{"vulnerability":"VCID-u4w3-usvb-jyf6"},{"vulnerability":"VCID-uqcw-p8g2-cfd2"},{"vulnerability":"VCID-utyg-huhu-2ucq"},{"vulnerability":"VCID-vevm-4sfk-f7gq"},{"vulnerability":"VCID-vq5y-hdw3-nucj"},{"vulnerability":"VCID-w3q4-838v-97ck"},{"vulnerability":"VCID-wbuz-qcp3-43aq"},{"vulnerability":"VCID-wbvy-zrtk-audw"},{"vulnerability":"VCID-ww44-hb2y-mfd5"},{"vulnerability":"VCID-wwvq-399y-rfhc"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/drupal@8.4.5"}],"aliases":["CVE-2017-6932","GHSA-wm86-w3cf-h6vm"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-yare-57j9-j7cs"}],"fixing_vulnerabilities":[],"risk_score":"10.0","resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/drupal/drupal@8.4.0-rc1"}