Software Detail
Title
CVE
CRITICAL
HIGH
MEDIUM
LOW
CWE
Number of items displayed
Drupal Number Of NVD 254 CRITICAL 12 HIGH 57 MEDIUM 162 LOW 23
URL https://www.drupal.org/
Explanation Drupal is an open source Content Management System (CMS).
Compared to WordPress and Joomla, it is said to be faster in displaying pages.
Tag
  • GPL v3
  • オープンソース
  • GPL v2
Add Information URL
No Type Name URL
1 https://www.drupal.org/download
2 https://www.drupal.org/project/drupal/releases
3 https://github.com/drupal/drupal
4 https://www.drupal.org/about/drupal6-eol
5 https://www.drupal.org/blog/drupal-7-8-and-9
List Of Product  [ Click to show release history and vulnerability information ]
No Name Latest Version Release date Initial release Normal Support Security Support
Service Pack Support		 Extended
for a fee		 Critical High Medium Low
241 Drupal 10 10.6.0-beta1 Nov. 25, 2025 Dec. 15, 2022 1 1 5 1
242 Drupal 9 9.5.11 Sept. 20, 2023 June 3, 2020 3 20 23 1
243 Drupal 8 8.9.20 Nov. 17, 2021 June 3, 2020 Nov. 30, 2021 11 29 39 1
244 Drupal 7 7.103 Dec. 4, 2024 Jan. 5, 2011 Nov. 30, 2021 4 18 68 8
245 Drupal 6 6.38 Feb. 24, 2016 Feb. 13, 2008 Feb. 24, 2016 2 10 61 14
246 Drupal 5 5.23 Aug. 11, 2010 Jan. 15, 2007 Jan. 6, 2011 1 5 43 8
247 Drupal 4 4.7.11 Jan. 10, 2008 June 15, 2002 Jan. 1, 1900 1 7 37 7
NVD Vulnerability Information
  • CRITICAL
  • HIGH
  • MEDIUM
  • LOW
No CVSS3
CVSS2		 Level
Attach Vector		 Title CWE CVE cpe23Uri or higher or less more than less than Update date
Published date		 Show Affected Exploit
PoC
Search
241 -
4.3 		MEDIUM Cross-site scripting (XSS) vulnerability in the project module (project.module) in Drupal 4.5 and 4.6 allows remote attackers to inject arbitrary web script or HTML via unknown attack vectors. NVD-CWE-Other
CVE-2006-2260 cpe:2.3:a:drupal:drupal:4.6:*
cpe:2.3:a:drupal:drupal:4.6.3:*
cpe:2.3:a:drupal:drupal:4.6.2:*
cpe:2.3:a:drupal… 		2017-07-20 10:31
2006-05-9 		Show GitHub Exploit DB Packet Storm
242 -
5.0 		MEDIUM CRLF injection vulnerability in Drupal 4.5.x before 4.5.8 and 4.6.x before 4.5.8 allows remote attackers to inject headers of outgoing e-mail messages and use Drupal as a spam proxy. NVD-CWE-Other
CVE-2006-1225 cpe:2.3:a:drupal:drupal:4.6.1:*
cpe:2.3:a:drupal:drupal:4.6.0:*
cpe:2.3:a:drupal:drupal:4.5.3:*
cpe:2.3:a:drup… 		2018-10-19 01:31
2006-03-15 		Show GitHub Exploit DB Packet Storm
243 -
4.3 		MEDIUM Cross-site scripting (XSS) vulnerability in Drupal 4.5.x before 4.5.8 and 4.6.x before 4.5.8 allows remote attackers to inject arbitrary web script or HTML via unknown attack vectors. NVD-CWE-Other
CVE-2006-1226 cpe:2.3:a:drupal:drupal:4.6.1:*
cpe:2.3:a:drupal:drupal:4.6.0:*
cpe:2.3:a:drupal:drupal:4.5.3:*
cpe:2.3:a:drup… 		2018-10-19 01:31
2006-03-15 		Show GitHub Exploit DB Packet Storm
244 -
4.6 		MEDIUM Drupal 4.5.x before 4.5.8 and 4.6.x before 4.5.8, when menu.module is used to create a menu item, does not implement access control for the page that is referenced, which might allow remote attackers… NVD-CWE-Other
CVE-2006-1227 cpe:2.3:a:drupal:drupal:4.6.5:*
cpe:2.3:a:drupal:drupal:4.6.4:*
cpe:2.3:a:drupal:drupal:4.6.3:*
cpe:2.3:a:drup… 		2018-10-19 01:31
2006-03-15 		Show GitHub Exploit DB Packet Storm
245 -
5.1 		MEDIUM Session fixation vulnerability in Drupal 4.5.x before 4.5.8 and 4.6.x before 4.5.8 allows remote attackers to gain privileges by tricking a user to click on a URL that fixes the session identifier. CWE-287
Improper Authentication 		CVE-2006-1228 cpe:2.3:a:drupal:drupal:4.6.1:*
cpe:2.3:a:drupal:drupal:4.6.0:*
cpe:2.3:a:drupal:drupal:4.5.3:*
cpe:2.3:a:drup… 		2018-10-19 01:31
2006-03-15 		Show GitHub Exploit DB Packet Storm
246 -
4.3 		MEDIUM Drupal allows remote attackers to conduct cross-site scripting (XSS) attacks via an IMG tag with an unusual encoded Javascript function name, as demonstrated using variations of the alert() function.… NVD-CWE-Other
CVE-2006-0070 cpe:2.3:a:drupal:drupal:4.6.4:*
cpe:2.3:a:drupal:drupal:4.5.6:* 		2024-08-8 02:15
2006-01-4 		Show GitHub Exploit DB Packet Storm
247 -
4.3 		MEDIUM Multiple cross-site scripting (XSS) vulnerabilities in Drupal 4.5.0 through 4.5.5 and 4.6.0 through 4.6.3 allow remote attackers to inject arbitrary web script or HTML via various HTML tags and value… NVD-CWE-Other
CVE-2005-3973 cpe:2.3:a:drupal:drupal:4.6.3:*
cpe:2.3:a:drupal:drupal:4.6.2:*
cpe:2.3:a:drupal:drupal:4.6.1:*
cpe:2.3:a:drup… 		2018-10-20 00:39
2005-12-4 		Show GitHub Exploit DB Packet Storm
248 -
6.4 		MEDIUM Drupal 4.5.0 through 4.5.5 and 4.6.0 through 4.6.3, when running on PHP5, does not correctly enforce user privileges, which allows remote attackers to bypass the "access user profiles" permission. NVD-CWE-Other
CVE-2005-3974 cpe:2.3:a:drupal:drupal:4.6:*
cpe:2.3:a:drupal:drupal:4.6.3:*
cpe:2.3:a:drupal:drupal:4.6.2:*
cpe:2.3:a:drupal… 		2018-10-20 00:39
2005-12-4 		Show GitHub Exploit DB Packet Storm
249 -
4.0 		MEDIUM Interpretation conflict in file.inc in Drupal 4.5.0 through 4.5.5 and 4.6.0 through 4.6.3 allows remote authenticated users to inject arbitrary web script or HTML via HTML in a file with a GIF or JPE… NVD-CWE-Other
CVE-2005-3975 cpe:2.3:a:drupal:drupal:4.6.3:*
cpe:2.3:a:drupal:drupal:4.6.2:*
cpe:2.3:a:drupal:drupal:4.6.1:*
cpe:2.3:a:drup… 		2018-10-20 00:39
2005-12-4 		Show GitHub Exploit DB Packet Storm
250 -
5.0 		MEDIUM Unknown vulnerability in Drupal 4.5.0 through 4.5.3, 4.6.0, and 4.6.1 allows remote attackers to execute arbitrary PHP code via a public comment or posting. NVD-CWE-Other
CVE-2005-2106 cpe:2.3:a:drupal:drupal:4.6.1:*
cpe:2.3:a:drupal:drupal:4.6.0:*
cpe:2.3:a:drupal:drupal:4.5.3:*
cpe:2.3:a:drup… 		2016-10-18 12:24
2005-07-5 		Show GitHub Exploit DB Packet Storm