|
211
|
-
3.5
|
LOW
|
Multiple cross-site scripting (XSS) vulnerabilities in the Token module before 4.7.x-1.5, and 5.x before 5.x-1.9, for Drupal; as used by the ASIN Field, e-Commerce, Fullname field for CCK, Invite, No…
|
CWE-79
Cross-site Scripting
|
CVE-2007-5621
|
cpe:2.3:a:drupal:drupal:5.2:*
cpe:2.3:a:drupal:drupal:5.1:*
cpe:2.3:a:drupal:drupal:5.0:*
cpe:2.3:a:drupal:dru…
|
|
|
|
|
2026-04-23 09:35
2007-10-23
|
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
212
|
-
6.8
|
MEDIUM
|
install.php in Drupal 5.x before 5.3, when the configured database server is not reachable, allows remote attackers to execute arbitrary code via vectors that cause settings.php to be modified.
|
CWE-94
Code Injection
|
CVE-2007-5593
|
cpe:2.3:a:drupal:drupal:*:*
|
5.0
|
|
|
5.3
|
2026-04-23 09:35
2007-10-20
|
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
213
|
-
4.3
|
MEDIUM
|
Drupal 5.x before 5.3 does not apply its Drupal Forms API protection against the user deletion form, which allows remote attackers to delete users via a cross-site request forgery (CSRF) attack.
|
CWE-352
Origin Validation Error
|
CVE-2007-5594
|
cpe:2.3:a:drupal:drupal:*:*
|
5.0
|
|
|
5.3
|
2026-04-23 09:35
2007-10-20
|
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
214
|
-
5.1
|
MEDIUM
|
CRLF injection vulnerability in the drupal_goto function in includes/common.inc Drupal 4.7.x before 4.7.8 and 5.x before 5.3 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP …
|
CWE-113
HTTP Response Splitting
|
CVE-2007-5595
|
cpe:2.3:a:drupal:drupal:*:*
|
4.7.0
5.0
|
|
|
4.7.8
5.3
|
2026-04-23 09:35
2007-10-20
|
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
215
|
-
4.3
|
MEDIUM
|
The core Upload module in Drupal 4.7.x before 4.7.8 and 5.x before 5.3 places the .html extension on a whitelist, which allows remote attackers to conduct cross-site scripting (XSS) attacks by upload…
|
CWE-79
Cross-site Scripting
|
CVE-2007-5596
|
cpe:2.3:a:drupal:drupal:*:*
|
4.7.0
5.0
|
|
|
4.7.8
5.3
|
2026-04-23 09:35
2007-10-20
|
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
216
|
-
4.3
|
MEDIUM
|
The hook_comments API in Drupal 4.7.x before 4.7.8 and 5.x before 5.3 does not pass publication status, which might allow attackers to bypass access restrictions and trigger e-mail with unpublished c…
|
CWE-264
Permissions, Privileges, and Access Controls
|
CVE-2007-5597
|
cpe:2.3:a:drupal:drupal:*:*
|
4.7.0
5.0
|
|
|
4.7.8
5.3
|
2026-04-23 09:35
2007-10-20
|
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
217
|
-
6.8
|
MEDIUM
|
Drupal 5.2 and earlier does not properly unset variables when the input data includes a numeric parameter with a value matching an alphanumeric parameter's hash value, which allows remote attackers t…
|
CWE-189
Numeric Errors
|
CVE-2007-5416
|
cpe:2.3:a:drupal:drupal:*:*
|
|
5.2
|
|
|
2026-04-23 09:35
2007-10-13
|
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
218
|
-
4.3
|
MEDIUM
|
Multiple cross-site request forgery (CSRF) vulnerabilities in Drupal 5.x before 5.2 allow remote attackers to (1) delete comments, (2) delete content revisions, and (3) disable menu items as privileg…
|
NVD-CWE-Other
|
CVE-2007-4063
|
cpe:2.3:a:drupal:drupal:5.1_rev1.1:*
cpe:2.3:a:drupal:drupal:5.1:*
cpe:2.3:a:drupal:drupal:5.0:*
|
|
|
|
|
2026-04-23 09:35
2007-07-31
|
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
219
|
-
4.3
|
MEDIUM
|
Multiple cross-site scripting (XSS) vulnerabilities in Drupal 5.x before 5.2, and 4.7.x before 4.7.7, (1) allow remote attackers to inject arbitrary web script or HTML via "some server variables," in…
|
CWE-79
Cross-site Scripting
|
CVE-2007-4064
|
cpe:2.3:a:drupal:drupal:5.1:*
cpe:2.3:a:drupal:drupal:5.0:*
cpe:2.3:a:drupal:drupal:4.7_rev1.15:*
cpe:2.3:a:dr…
|
|
|
|
|
2026-04-23 09:35
2007-07-31
|
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
220
|
-
5.0
|
MEDIUM
|
The (1) Textimage 4.7.x before 4.7-1.2 and 5.x before 5.x-1.1 module for Drupal and the (2) Captcha 4.7.x before 4.7-1.2 and 5.x before 5.x-1.1 module for Drupal allow remote attackers to bypass the …
|
NVD-CWE-Other
|
CVE-2007-0658
|
cpe:2.3:a:drupal:drupal:5.1:*
cpe:2.3:a:drupal:drupal:5.0:*
cpe:2.3:a:drupal:drupal:4.7_rev1.15:*
cpe:2.3:a:dr…
|
|
|
|
|
2026-04-23 09:35
2007-02-2
|
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|