mlhess@drupal.org
organization01
roles
Roles this identity holds.
02
references
Other names and identifiers for this entity.
nvdUS mlhess@drupal.org
03
assessed vulnerabilities (12)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-6816US | low3.8 | — | ||
An access bypass vulnerability in Drupal TFA Basic Plugins allows users with the administer users permission to view or generate recovery codes for other users.
This issue affect… | ||||
| CVE-2026-4929US | medium5.4 | — | ||
Simple Hierarchical Select (SHS) for Drupal 7 contains cross-site scripting risk due to improper output escaping of term-derived text. Confirmed affected paths include field format… | ||||
| CVE-2026-4093US | medium5.4 | — | ||
In the Drupal 7 Term Reference Tree module, two stored XSS vectors exist in the widget/formatter rendering pipeline.
Vector A (token display templates): When the Token module is e… | ||||
| CVE-2026-9082US | —OT critical | KEV | ||
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Drupal core allows SQL Injection.
This issue affects Drupal core: from… | ||||
| CVE-2026-1556US | medium6.5 | — | ||
Information disclosure in the file URI processing of File (Field) Paths in Drupal File (Field) Paths 7.x prior to 7.1.3 on Drupal 7.x allows authenticated users to disclose other u… | ||||
| CVE-2026-0748US | medium4.3OT elevated | — | ||
In the Drupal 7 Internationalization (i18n) module, the i18n_node submodule allows a user with both "Translate content" and "Administer content translations" permissions to view an… | ||||
| CVE-2026-0750US | high7.5 | — | ||
Improper Verification of Cryptographic Signature vulnerability in Drupal Drupal Commerce Paybox Commerce Paybox on Drupal 7.X allows Authentication Bypass.This issue affects Drupal… | ||||
| CVE-2026-0749US | medium6.1 | — | ||
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Form Builder allows Cross-Site Scripting (XSS).This issue affects Drupa… | ||||
| CVE-2025-14557US | medium4.8 | — | ||
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Drupal Facebook Pixel facebook_pixel allows Stored XSS.This issue affec… | ||||
| CVE-2025-14556US | medium5.4 | — | ||
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Drupal Flag allows Cross-Site Scripting (XSS).This issue affects Flag:… | ||||
| CVE-2025-12848US | medium6.1 | — | ||
Webform Multiple File Upload module for Drupal 7.x contains a cross-site scripting (XSS) vulnerability in the file name renderer. An unauthenticated attacker can exploit this vulne… | ||||
| CVE-2022-26493US | high8.8 | — | ||
Xecurify's miniOrange Premium, Standard, and Enterprise Drupal SAML SP modules possess an authentication and authorization bypass vulnerability. An attacker with access to a HTTP-r… | ||||