WID-SEC-W-2026-2181

DeutschShown in its original language — a full translation is planned for a future version.

Drupal Extensions: Mehrere Schwachstellen

view advisory published 2026-07-01

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Drupal ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen, Sicherheitsmaßnahmen zu umgehen und Daten zu manipulieren.

describes (5)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2026-58591US	—	0.23% (13th)	—	2026-07-10
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Colorbox allows Cross-Site Scripting (XSS). This issue affects Colorbox…
CVE-2026-58590US	—OT elevated	0.23% (13th)	—	2026-07-10
Missing Authorization vulnerability in Drupal FlowDrop allows Forceful Browsing. This issue affects FlowDrop versions: from 0.0.0 to 1.6.0.
CVE-2026-58589US	—OT elevated	0.23% (13th)	—	2026-07-10
Missing Authorization vulnerability in Drupal FlowDrop allows Forceful Browsing. This issue affects FlowDrop versions: from 0.0.0 to 1.6.0.
CVE-2026-58588US	—	0.26% (16th)	—	2026-07-10
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal Canvas allows Cross-Site Scripting (XSS). This issue affects Dru…
CVE-2026-58587US	—	0.26% (16th)	—	2026-07-10
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal Canvas allows Cross-Site Scripting (XSS). This issue affects Dru…

references

External citations — patches, advisories, analysis.

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan