Software Detail
Title
CVE
CRITICAL
HIGH
MEDIUM
LOW
CWE
Number of items displayed
Drupal Number Of NVD 248 CRITICAL 11 HIGH 57 MEDIUM 158 LOW 22
URL https://www.drupal.org/
Explanation Drupal is an open source Content Management System (CMS).
Compared to WordPress and Joomla, it is said to be faster in displaying pages.
Tag
  • GPL v2
  • GPL v3
  • オープンソース
Add Information URL
No Type Name URL
1 https://www.drupal.org/download
2 https://www.drupal.org/project/drupal/releases
3 https://github.com/drupal/drupal
4 https://www.drupal.org/about/drupal6-eol
5 https://www.drupal.org/blog/drupal-7-8-and-9
List Of Product  [ Click to show release history and vulnerability information ]
No Name Latest Version Release date Initial release Normal Support Security Support
Service Pack Support		 Extended
for a fee		 Critical High Medium Low
231 Drupal 10 10.6.0-beta1 Nov. 25, 2025 Dec. 15, 2022 0 1 1 0
232 Drupal 9 9.5.11 Sept. 20, 2023 June 3, 2020 2 20 19 0
233 Drupal 8 8.9.20 Nov. 17, 2021 June 3, 2020 Nov. 30, 2021 10 29 35 0
234 Drupal 7 7.103 Dec. 4, 2024 Jan. 5, 2011 Nov. 30, 2021 4 18 64 7
235 Drupal 6 6.38 Feb. 24, 2016 Feb. 13, 2008 Feb. 24, 2016 2 10 57 13
236 Drupal 5 5.23 Aug. 11, 2010 Jan. 15, 2007 Jan. 6, 2011 1 5 39 7
237 Drupal 4 4.7.11 Jan. 10, 2008 June 15, 2002 Jan. 1, 1900 1 7 33 6
NVD Vulnerability Information
  • CRITICAL
  • HIGH
  • MEDIUM
  • LOW
No CVSS3
CVSS2		 Level
Attach Vector		 Title CWE CVE cpe23Uri or higher or less more than less than Update date
Published date		 Show Affected Exploit
PoC
Search
231 -
2.6 		LOW Cross-site scripting (XSS) vulnerability in the upload module (upload.module) in Drupal 4.6.x before 4.6.8 and 4.7.x before 4.7.2 allows remote attackers to inject arbitrary web script or HTML via th… NVD-CWE-Other
CVE-2006-2832 cpe:2.3:a:drupal:drupal:4.7.1:*
cpe:2.3:a:drupal:drupal:4.7.0:*
cpe:2.3:a:drupal:drupal:4.6:*
cpe:2.3:a:drupal… 		2018-10-19 01:43
2006-06-6 		Show GitHub Exploit DB Packet Storm
232 -
2.6 		LOW Cross-site scripting (XSS) vulnerability in the taxonomy module in Drupal 4.6.8 and 4.7.2 allows remote attackers to inject arbitrary web script or HTML via inputs that are not properly validated whe… NVD-CWE-Other
CVE-2006-2833 cpe:2.3:a:drupal:drupal:4.7.2:*
cpe:2.3:a:drupal:drupal:4.6.8:* 		2018-10-19 01:43
2006-06-6 		Show GitHub Exploit DB Packet Storm
233 -
7.5 		HIGH SQL injection vulnerability in Drupal 4.6.x before 4.6.7 and 4.7.0 allows remote attackers to execute arbitrary SQL commands via the (1) count and (2) from variables to (a) database.mysql.inc, (b) da… NVD-CWE-Other
CVE-2006-2742 cpe:2.3:a:drupal:drupal:4.7.0:*
cpe:2.3:a:drupal:drupal:4.6:*
cpe:2.3:a:drupal:drupal:4.6.6:*
cpe:2.3:a:drupal… 		2018-10-19 01:41
2006-06-1 		Show GitHub Exploit DB Packet Storm
234 -
5.1 		MEDIUM Drupal 4.6.x before 4.6.7 and 4.7.0, when running on Apache with mod_mime, does not properly handle files with multiple extensions, which allows remote attackers to upload, modify, or execute arbitra… NVD-CWE-Other
CVE-2006-2743 cpe:2.3:a:drupal:drupal:4.7.0:*
cpe:2.3:a:drupal:drupal:4.6:*
cpe:2.3:a:drupal:drupal:4.6.6:*
cpe:2.3:a:drupal… 		2018-10-19 01:41
2006-06-1 		Show GitHub Exploit DB Packet Storm
235 -
4.3 		MEDIUM Cross-site scripting (XSS) vulnerability in the project module (project.module) in Drupal 4.5 and 4.6 allows remote attackers to inject arbitrary web script or HTML via unknown attack vectors. NVD-CWE-Other
CVE-2006-2260 cpe:2.3:a:drupal:drupal:4.6:*
cpe:2.3:a:drupal:drupal:4.6.3:*
cpe:2.3:a:drupal:drupal:4.6.2:*
cpe:2.3:a:drupal… 		2017-07-20 10:31
2006-05-9 		Show GitHub Exploit DB Packet Storm
236 -
5.0 		MEDIUM CRLF injection vulnerability in Drupal 4.5.x before 4.5.8 and 4.6.x before 4.5.8 allows remote attackers to inject headers of outgoing e-mail messages and use Drupal as a spam proxy. NVD-CWE-Other
CVE-2006-1225 cpe:2.3:a:drupal:drupal:4.6.1:*
cpe:2.3:a:drupal:drupal:4.6.0:*
cpe:2.3:a:drupal:drupal:4.5.3:*
cpe:2.3:a:drup… 		2018-10-19 01:31
2006-03-15 		Show GitHub Exploit DB Packet Storm
237 -
4.3 		MEDIUM Cross-site scripting (XSS) vulnerability in Drupal 4.5.x before 4.5.8 and 4.6.x before 4.5.8 allows remote attackers to inject arbitrary web script or HTML via unknown attack vectors. NVD-CWE-Other
CVE-2006-1226 cpe:2.3:a:drupal:drupal:4.6.1:*
cpe:2.3:a:drupal:drupal:4.6.0:*
cpe:2.3:a:drupal:drupal:4.5.3:*
cpe:2.3:a:drup… 		2018-10-19 01:31
2006-03-15 		Show GitHub Exploit DB Packet Storm
238 -
4.6 		MEDIUM Drupal 4.5.x before 4.5.8 and 4.6.x before 4.5.8, when menu.module is used to create a menu item, does not implement access control for the page that is referenced, which might allow remote attackers… NVD-CWE-Other
CVE-2006-1227 cpe:2.3:a:drupal:drupal:4.6.5:*
cpe:2.3:a:drupal:drupal:4.6.4:*
cpe:2.3:a:drupal:drupal:4.6.3:*
cpe:2.3:a:drup… 		2018-10-19 01:31
2006-03-15 		Show GitHub Exploit DB Packet Storm
239 -
5.1 		MEDIUM Session fixation vulnerability in Drupal 4.5.x before 4.5.8 and 4.6.x before 4.5.8 allows remote attackers to gain privileges by tricking a user to click on a URL that fixes the session identifier. CWE-287
Improper Authentication 		CVE-2006-1228 cpe:2.3:a:drupal:drupal:4.6.1:*
cpe:2.3:a:drupal:drupal:4.6.0:*
cpe:2.3:a:drupal:drupal:4.5.3:*
cpe:2.3:a:drup… 		2018-10-19 01:31
2006-03-15 		Show GitHub Exploit DB Packet Storm
240 -
4.3 		MEDIUM Drupal allows remote attackers to conduct cross-site scripting (XSS) attacks via an IMG tag with an unusual encoded Javascript function name, as demonstrated using variations of the alert() function.… NVD-CWE-Other
CVE-2006-0070 cpe:2.3:a:drupal:drupal:4.6.4:*
cpe:2.3:a:drupal:drupal:4.5.6:* 		2024-08-8 02:15
2006-01-4 		Show GitHub Exploit DB Packet Storm