Software Detail

Software Informaton Top

->

->

Software Detail

Drupal

Number Of NVD

248

CRITICAL

11

HIGH

57

MEDIUM

158

LOW

22

URL	https://www.drupal.org/
Explanation	Drupal is an open source Content Management System (CMS). Compared to WordPress and Joomla, it is said to be faster in displaying pages.
Tag	GPL v2 GPL v3 オープンソース

Add Information URL

No	Type	Name	URL
1			https://www.drupal.org/download
2			https://www.drupal.org/project/drupal/releases
3			https://github.com/drupal/drupal
4			https://www.drupal.org/about/drupal6-eol
5			https://www.drupal.org/blog/drupal-7-8-and-9

List Of Product [ Click to show release history and vulnerability information ]

No	Name	Latest Version	Release date	Initial release	Normal Support	Security Support Service Pack Support	Extended for a fee	Critical	High	Medium	Low
241	Drupal 10	10.6.0-beta1	Nov. 25, 2025	Dec. 15, 2022				0	1	1	0
242	Drupal 9	9.5.11	Sept. 20, 2023	June 3, 2020				2	20	19	0
243	Drupal 8	8.9.20	Nov. 17, 2021	June 3, 2020	Nov. 30, 2021			10	29	35	0
244	Drupal 7	7.103	Dec. 4, 2024	Jan. 5, 2011	Nov. 30, 2021			4	18	64	7
245	Drupal 6	6.38	Feb. 24, 2016	Feb. 13, 2008	Feb. 24, 2016			2	10	57	13
246	Drupal 5	5.23	Aug. 11, 2010	Jan. 15, 2007	Jan. 6, 2011			1	5	39	7
247	Drupal 4	4.7.11	Jan. 10, 2008	June 15, 2002	Jan. 1, 1900			1	7	33	6

NVD Vulnerability Information

CRITICAL
HIGH
MEDIUM
LOW

No	CVSS3 CVSS2	Level Attach Vector	Title	CWE	CVE	cpe23Uri	or higher	or less	more than	less than	Update date Published date	Show Affected	Exploit PoC Search
241	- 4.3	MEDIUM	Multiple cross-site scripting (XSS) vulnerabilities in Drupal 4.5.0 through 4.5.5 and 4.6.0 through 4.6.3 allow remote attackers to inject arbitrary web script or HTML via various HTML tags and value…	NVD-CWE-Other	CVE-2005-3973	cpe:2.3:a:drupal:drupal:4.6.3:* cpe:2.3:a:drupal:drupal:4.6.2:* cpe:2.3:a:drupal:drupal:4.6.1:* cpe:2.3:a:drup…					2018-10-20 00:39 2005-12-4	Show	GitHub Exploit DB Packet Storm

242	- 6.4	MEDIUM	Drupal 4.5.0 through 4.5.5 and 4.6.0 through 4.6.3, when running on PHP5, does not correctly enforce user privileges, which allows remote attackers to bypass the "access user profiles" permission.	NVD-CWE-Other	CVE-2005-3974	cpe:2.3:a:drupal:drupal:4.6:* cpe:2.3:a:drupal:drupal:4.6.3:* cpe:2.3:a:drupal:drupal:4.6.2:* cpe:2.3:a:drupal…					2018-10-20 00:39 2005-12-4	Show	GitHub Exploit DB Packet Storm

243	- 4.0	MEDIUM	Interpretation conflict in file.inc in Drupal 4.5.0 through 4.5.5 and 4.6.0 through 4.6.3 allows remote authenticated users to inject arbitrary web script or HTML via HTML in a file with a GIF or JPE…	NVD-CWE-Other	CVE-2005-3975	cpe:2.3:a:drupal:drupal:4.6.3:* cpe:2.3:a:drupal:drupal:4.6.2:* cpe:2.3:a:drupal:drupal:4.6.1:* cpe:2.3:a:drup…					2018-10-20 00:39 2005-12-4	Show	GitHub Exploit DB Packet Storm

244	- 5.0	MEDIUM	Unknown vulnerability in Drupal 4.5.0 through 4.5.3, 4.6.0, and 4.6.1 allows remote attackers to execute arbitrary PHP code via a public comment or posting.	NVD-CWE-Other	CVE-2005-2106	cpe:2.3:a:drupal:drupal:4.6.1:* cpe:2.3:a:drupal:drupal:4.6.0:* cpe:2.3:a:drupal:drupal:4.5.3:* cpe:2.3:a:drup…					2016-10-18 12:24 2005-07-5	Show	GitHub Exploit DB Packet Storm

245	- 7.5	HIGH	Eval injection vulnerability in PEAR XML_RPC 1.3.0 and earlier (aka XML-RPC or xmlrpc) and PHPXMLRPC (aka XML-RPC For PHP or php-xmlrpc) 1.1 and earlier, as used in products such as (1) WordPress, (2…	CWE-94 Code Injection	CVE-2005-1921	cpe:2.3:a:drupal:drupal::	4.6.0			4.6.2 4.5.4	2024-02-15 00:41 2005-07-5	Show	GitHub Exploit DB Packet Storm

246	- 7.5	HIGH	Unknown vulnerability in the privilege system in Drupal 4.4.0 through 4.6.0, when public registration is enabled, allows remote attackers to gain privileges, due to an "input check" that "is not impl…	NVD-CWE-Other	CVE-2005-1871	cpe:2.3:a:drupal:drupal:4.6.0:* cpe:2.3:a:drupal:drupal:4.5.2:* cpe:2.3:a:drupal:drupal:4.5.1:* cpe:2.3:a:drup…					2016-10-18 12:23 2005-06-9	Show	GitHub Exploit DB Packet Storm

247	- 4.3	MEDIUM	Cross-site scripting (XSS) vulnerability in common.inc in Drupal before 4.5.2 allows remote attackers to inject arbitrary web script or HTML via certain inputs.	NVD-CWE-Other	CVE-2005-0682	cpe:2.3:a:drupal:drupal:4.5.1:* cpe:2.3:a:drupal:drupal:4.5.0:* cpe:2.3:a:drupal:drupal:4.4.2:* cpe:2.3:a:drup…					2008-09-6 05:47 2005-05-2	Show	GitHub Exploit DB Packet Storm

248	- 4.3	MEDIUM	Cross-site scripting (XSS) vulnerability in Drupal 4.0.0 allows remote attackers to inject arbitrary web script or HTML via Javascript in an IMG tag.	NVD-CWE-Other	CVE-2002-1806	cpe:2.3:a:drupal:drupal:4.0.0:*					2008-09-6 05:31 2002-12-31	Show	GitHub Exploit DB Packet Storm