DeutschShown in its original language — a full translation is planned for a future version.
Drupal: Mehrere Schwachstellen
view advisory published 2026-06-24
Ein Angreifer kann mehrere Schwachstellen in Drupal ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um einen Cross-Site Scripting Angriff durchzuführen, um Informationen offenzulegen, um einen SQL-Injection Angriff durchzuführen, und um Daten zu manipulieren.
01
describes (14)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-13244US | — | — | ||
Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Tealium iQ Tag Management allows Object Injection. This issue affects Tealium… | ||||
| CVE-2026-13243US | — | — | ||
Cross-Site Request Forgery (CSRF) vulnerability in Drupal Salesforce Suite allows Cross Site Request Forgery. This issue affects Salesforce Suite versions: from 0.0.0 to 5.1.3. | ||||
| CVE-2026-13242US | — | — | ||
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Geolocation Field allows SQL Injection. This issue affects Geolocation… | ||||
| CVE-2026-13241US | —OT elevated | — | ||
Missing Authorization vulnerability in Drupal Paragraphs allows Forceful Browsing. This issue affects Paragraphs versions: from 0.0.0 to 1.21.0. | ||||
| CVE-2026-13240US | —OT elevated | — | ||
Missing Authorization vulnerability in Drupal Paragraphs allows Forceful Browsing. This issue affects Paragraphs versions: from 0.0.0 to 1.21.0. | ||||
| CVE-2026-13239US | —OT elevated | — | ||
Missing Authorization vulnerability in Drupal WissKI allows Forceful Browsing. This issue affects WissKI versions: from 0.0.0 to 4.2.0. | ||||
| CVE-2026-13238US | —OT elevated | — | ||
Incorrect Authorization vulnerability in Drupal Commerce Realex / Global Payments allows Forceful Browsing. This issue affects Commerce Realex / Global Payments versions: from 0.0.… | ||||
| CVE-2026-13237US | —OT elevated | — | ||
Incorrect Authorization vulnerability in Drupal AI Agents allows Forceful Browsing. This issue affects AI Agents versions: from 0.0.0 to 1.1.4, from 1.2.0 to 1.2.5, from 1.3.0 to 1… | ||||
| CVE-2026-13236US | —OT elevated | — | ||
Missing Authorization vulnerability in Drupal AI Agents allows Forceful Browsing. This issue affects AI Agents versions: from 0.0.0 to 1.1.4, from 1.2.0 to 1.2.5, from 1.3.0 to 1.3… | ||||
| CVE-2026-13235US | —OT elevated | — | ||
Missing Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Forceful Browsing. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.2.17,… | ||||
| CVE-2026-13234US | — | — | ||
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Cross-Site Scripting (XSS). This is… | ||||
| CVE-2026-13233US | — | Exploit | ||
Server-Side Request Forgery (SSRF) vulnerability in Drupal OpenAI Provider allows Server Side Request Forgery. This issue affects OpenAI Provider versions: from 0.0.0 to 1.1.1, fro… | ||||
| CVE-2026-13232US | —OT elevated | — | ||
Incorrect Authorization vulnerability in Drupal Advanced Content Feedback (aka admin_feedback) allows Forceful Browsing. This issue affects Advanced Content Feedback (aka admin_fee… | ||||
| CVE-2026-13231US | — | — | ||
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Advanced Content Feedback (aka admin_feedback) allows Stored XSS. This… | ||||
02
references
External citations — patches, advisories, analysis.
- WID-SEC-W-2026-2080 - CSAF Versionself
- WID-SEC-2026-2080 - Portal Versionself
- Drupal Security Advisory sa-contrib-2026-051 vom 2026-06-24external
- Drupal Security Advisory sa-contrib-2026-052 vom 2026-06-24external
- Drupal Security Advisory sa-contrib-2026-053 vom 2026-06-24external
- Drupal Security Advisory sa-contrib-2026-054 vom 2026-06-24external
- Drupal Security Advisory sa-contrib-2026-055 vom 2026-06-24external
- Drupal Security Advisory sa-contrib-2026-056 vom 2026-06-24external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan