Search for packages
| purl | pkg:composer/drupal/core@11.0.0-alpha1 |
| Next non-vulnerable version | 11.1.0-beta1 |
| Latest non-vulnerable version | 11.1.0-beta1 |
| Risk | 10.0 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-azrn-adcp-aaas
Aliases: GHSA-6gf6-24h2-66j4 |
Drupal core Open Redirect vulnerability | There are no reported fixed by versions. |
|
VCID-y3g8-ayqw-5fer
Aliases: CVE-2024-45440 GHSA-mg8j-w93w-xjgc |
core/authorize.php in Drupal 11.x-dev allows Full Path Disclosure (even when error logging is None) if the value of hash_salt is file_get_contents of a file that does not exist. |
Affected by 8 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| VCID-nhhw-dxca-eqhr | Incorrect Authorization vulnerability in Drupal Drupal core allows Forceful Browsing.This issue affects Drupal core: from 8.0.0 before 10.3.13, from 10.4.0 before 10.4.3, from 11.0.0 before 11.0.12, from 11.1.0 before 11.1.3. |
CVE-2025-31673
GHSA-wpp8-fjgf-pwc7 |
| VCID-v81n-gjq6-fycy | Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection.This issue affects Drupal core: from 8.0.0 before 10.3.13, from 10.4.0 before 10.4.3, from 11.0.0 before 11.0.12, from 11.1.0 before 11.1.3. |
CVE-2025-31674
GHSA-2qph-q8xw-gv7q |
| VCID-vsp2-5z41-2bbz | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS).This issue affects Drupal core: from 8.0.0 before 10.3.14, from 10.4.0 before 10.4.5, from 11.0.0 before 11.0.13, from 11.1.0 before 11.1.5. |
CVE-2025-31675
GHSA-m4wj-hhwj-47qp |
| VCID-xja8-hukq-qub7 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS).This issue affects Drupal core: from 8.0.0 before 10.3.13, from 10.4.0 before 10.4.3, from 11.0.0 before 11.0.12, from 11.1.0 before 11.1.3. |
CVE-2025-3057
GHSA-39g6-x4x8-5jcm |
| VCID-y3g8-ayqw-5fer | core/authorize.php in Drupal 11.x-dev allows Full Path Disclosure (even when error logging is None) if the value of hash_salt is file_get_contents of a file that does not exist. |
CVE-2024-45440
GHSA-mg8j-w93w-xjgc |