Software Detail
Title
CVE
CRITICAL
HIGH
MEDIUM
LOW
CWE
Number of items displayed
Drupal Number Of NVD 254 CRITICAL 12 HIGH 57 MEDIUM 162 LOW 23
URL https://www.drupal.org/
Explanation Drupal is an open source Content Management System (CMS).
Compared to WordPress and Joomla, it is said to be faster in displaying pages.
Tag
  • オープンソース
  • GPL v2
  • GPL v3
Add Information URL
No Type Name URL
1 https://www.drupal.org/download
2 https://www.drupal.org/project/drupal/releases
3 https://github.com/drupal/drupal
4 https://www.drupal.org/about/drupal6-eol
5 https://www.drupal.org/blog/drupal-7-8-and-9
List Of Product  [ Click to show release history and vulnerability information ]
No Name Latest Version Release date Initial release Normal Support Security Support
Service Pack Support		 Extended
for a fee		 Critical High Medium Low
111 Drupal 10 10.6.0-beta1 Nov. 25, 2025 Dec. 15, 2022 1 1 5 1
112 Drupal 9 9.5.11 Sept. 20, 2023 June 3, 2020 3 20 23 1
113 Drupal 8 8.9.20 Nov. 17, 2021 June 3, 2020 Nov. 30, 2021 11 29 39 1
114 Drupal 7 7.103 Dec. 4, 2024 Jan. 5, 2011 Nov. 30, 2021 4 18 68 8
115 Drupal 6 6.38 Feb. 24, 2016 Feb. 13, 2008 Feb. 24, 2016 2 10 61 14
116 Drupal 5 5.23 Aug. 11, 2010 Jan. 15, 2007 Jan. 6, 2011 1 5 43 8
117 Drupal 4 4.7.11 Jan. 10, 2008 June 15, 2002 Jan. 1, 1900 1 7 37 7
NVD Vulnerability Information
  • CRITICAL
  • HIGH
  • MEDIUM
  • LOW
No CVSS3
CVSS2		 Level
Attach Vector		 Title CWE CVE cpe23Uri or higher or less more than less than Update date
Published date		 Show Affected Exploit
PoC
Search
111 7.4
6.4 		HIGH
Network 		Open redirect vulnerability in the drupal_goto function in Drupal 6.x before 6.38, when used with PHP before 5.4.7, allows remote attackers to redirect users to arbitrary web sites and conduct phishi… NVD-CWE-Other
CVE-2016-3167 cpe:2.3:a:drupal:drupal:6.9:*
cpe:2.3:a:drupal:drupal:6.8:*
cpe:2.3:a:drupal:drupal:6.7:*
cpe:2.3:a:drupal:dru… 		2024-11-21 11:49
2016-04-13 		Show GitHub Exploit DB Packet Storm
112 5.9
4.3 		MEDIUM
Network 		CRLF injection vulnerability in the drupal_set_header function in Drupal 6.x before 6.38, when used with PHP before 5.1.2, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP re… NVD-CWE-Other
CVE-2016-3166 cpe:2.3:a:drupal:drupal:6.9:*
cpe:2.3:a:drupal:drupal:6.8:*
cpe:2.3:a:drupal:drupal:6.7:*
cpe:2.3:a:drupal:dru… 		2024-11-21 11:49
2016-04-13 		Show GitHub Exploit DB Packet Storm
113 7.5
5.0 		HIGH
Network 		The Form API in Drupal 6.x before 6.38 ignores access restrictions on submit buttons, which might allow remote attackers to bypass intended access restrictions by leveraging permission to submit a fo… CWE-284
Improper Access Control 		CVE-2016-3165 cpe:2.3:a:drupal:drupal:6.9:*
cpe:2.3:a:drupal:drupal:6.8:*
cpe:2.3:a:drupal:drupal:6.7:*
cpe:2.3:a:drupal:dru… 		2024-11-21 11:49
2016-04-13 		Show GitHub Exploit DB Packet Storm
114 7.4
5.8 		HIGH
Network 		Drupal 6.x before 6.38, 7.x before 7.43, and 8.x before 8.0.4 might allow remote attackers to conduct open redirect attacks by leveraging (1) custom code or (2) a form shown on a 404 error page, rela… NVD-CWE-Other
CVE-2016-3164 cpe:2.3:a:drupal:drupal:8.0.3:*
cpe:2.3:a:drupal:drupal:8.0.2:*
cpe:2.3:a:drupal:drupal:8.0.1:*
cpe:2.3:a:drup… 		2024-11-21 11:49
2016-04-13 		Show GitHub Exploit DB Packet Storm
115 7.5
5.0 		HIGH
Network 		The XML-RPC system in Drupal 6.x before 6.38 and 7.x before 7.43 might make it easier for remote attackers to conduct brute-force attacks via a large number of calls made at once to the same method. CWE-254
 7PK - Security Features 		CVE-2016-3163 cpe:2.3:a:drupal:drupal:7.x-dev:*
cpe:2.3:a:drupal:drupal:7.9:*
cpe:2.3:a:drupal:drupal:7.8:*
cpe:2.3:a:drupal… 		2024-11-21 11:49
2016-04-13 		Show GitHub Exploit DB Packet Storm
116 8.1
6.5 		HIGH
Network 		The File module in Drupal 7.x before 7.43 and 8.x before 8.0.4 allows remote authenticated users to bypass access restrictions and read, delete, or substitute a link to a file uploaded to an unproces… CWE-284
Improper Access Control 		CVE-2016-3162 cpe:2.3:a:drupal:drupal:8.0.3:*
cpe:2.3:a:drupal:drupal:8.0.2:*
cpe:2.3:a:drupal:drupal:8.0.1:*
cpe:2.3:a:drup… 		2024-11-21 11:49
2016-04-13 		Show GitHub Exploit DB Packet Storm
117 -
4.3 		MEDIUM Cross-site scripting (XSS) vulnerability in the Ajax handler in Drupal 7.x before 7.39 and the Ctools module 6.x-1.x before 6.x-1.14 for Drupal allows remote attackers to inject arbitrary web script … CWE-79
Cross-site Scripting 		CVE-2015-6665 cpe:2.3:a:drupal:drupal:7.x-dev:*
cpe:2.3:a:drupal:drupal:7.9:*
cpe:2.3:a:drupal:drupal:7.8:*
cpe:2.3:a:drupal… 		2024-11-21 11:35
2015-08-24 		Show GitHub Exploit DB Packet Storm
118 -
5.0 		MEDIUM Drupal 6.x before 6.37 and 7.x before 7.39 allows remote attackers to obtain sensitive node titles by reading the menu. CWE-200
Information Exposure 		CVE-2015-6661 cpe:2.3:a:drupal:drupal:7.x-dev:*
cpe:2.3:a:drupal:drupal:7.9:*
cpe:2.3:a:drupal:drupal:7.8:*
cpe:2.3:a:drupal… 		2024-11-21 11:35
2015-08-24 		Show GitHub Exploit DB Packet Storm
119 -
6.8 		MEDIUM The Form API in Drupal 6.x before 6.37 and 7.x before 7.39 does not properly validate the form token, which allows remote attackers to conduct CSRF attacks that upload files in a different user's acc… CWE-352
 Origin Validation Error 		CVE-2015-6660 cpe:2.3:a:drupal:drupal:7.x-dev:*
cpe:2.3:a:drupal:drupal:7.9:*
cpe:2.3:a:drupal:drupal:7.8:*
cpe:2.3:a:drupal… 		2024-11-21 11:35
2015-08-24 		Show GitHub Exploit DB Packet Storm
120 -
7.5 		HIGH SQL injection vulnerability in the SQL comment filtering system in the Database API in Drupal 7.x before 7.39 allows remote attackers to execute arbitrary SQL commands via an SQL comment. CWE-89
SQL Injection 		CVE-2015-6659 cpe:2.3:a:drupal:drupal:7.x-dev:*
cpe:2.3:a:drupal:drupal:7.9:*
cpe:2.3:a:drupal:drupal:7.8:*
cpe:2.3:a:drupal… 		2024-11-21 11:35
2015-08-24 		Show GitHub Exploit DB Packet Storm