Software Detail
Title
CVE
CRITICAL
HIGH
MEDIUM
LOW
CWE
Number of items displayed
Drupal Number Of NVD 254 CRITICAL 12 HIGH 57 MEDIUM 162 LOW 23
URL https://www.drupal.org/
Explanation Drupal is an open source Content Management System (CMS).
Compared to WordPress and Joomla, it is said to be faster in displaying pages.
Tag
  • GPL v3
  • オープンソース
  • GPL v2
Add Information URL
No Type Name URL
1 https://www.drupal.org/download
2 https://www.drupal.org/project/drupal/releases
3 https://github.com/drupal/drupal
4 https://www.drupal.org/about/drupal6-eol
5 https://www.drupal.org/blog/drupal-7-8-and-9
List Of Product  [ Click to show release history and vulnerability information ]
No Name Latest Version Release date Initial release Normal Support Security Support
Service Pack Support		 Extended
for a fee		 Critical High Medium Low
31 Drupal 10 10.6.0-beta1 Nov. 25, 2025 Dec. 15, 2022 1 1 5 1
32 Drupal 9 9.5.11 Sept. 20, 2023 June 3, 2020 3 20 23 1
33 Drupal 8 8.9.20 Nov. 17, 2021 June 3, 2020 Nov. 30, 2021 11 29 39 1
34 Drupal 7 7.103 Dec. 4, 2024 Jan. 5, 2011 Nov. 30, 2021 4 18 68 8
35 Drupal 6 6.38 Feb. 24, 2016 Feb. 13, 2008 Feb. 24, 2016 2 10 61 14
36 Drupal 5 5.23 Aug. 11, 2010 Jan. 15, 2007 Jan. 6, 2011 1 5 43 8
37 Drupal 4 4.7.11 Jan. 10, 2008 June 15, 2002 Jan. 1, 1900 1 7 37 7
NVD Vulnerability Information
  • CRITICAL
  • HIGH
  • MEDIUM
  • LOW
No CVSS3
CVSS2		 Level
Attach Vector		 Title CWE CVE cpe23Uri or higher or less more than less than Update date
Published date		 Show Affected Exploit
PoC
Search
31 7.5
5.0 		HIGH
Network 		Information Disclosure vulnerability in file module of Drupal Core allows an attacker to gain access to the file metadata of a permanent private file that they do not have access to by guessing the I… CWE-668
 Exposure of Resource to Wrong Sphere 		CVE-2020-13670 cpe:2.3:a:drupal:drupal:*:* 9.0.0
8.9.0
8.8.0



9.0.6
8.9.6
8.8.10 		2024-11-21 14:01
2022-02-12 		Show GitHub Exploit DB Packet Storm
32 6.1
4.3 		MEDIUM
Network 		Cross-site Scripting (XSS) vulnerability in ckeditor of Drupal Core allows attacker to inject XSS. This issue affects: Drupal Core 8.8.x versions prior to 8.8.10.; 8.9.x versions prior to 8.9.6; 9.0.… CWE-79
Cross-site Scripting 		CVE-2020-13669 cpe:2.3:a:drupal:drupal:*:* 9.0.0
8.9.0
8.8.0



9.0.6
8.9.6
8.8.10 		2024-11-21 14:01
2022-02-12 		Show GitHub Exploit DB Packet Storm
33 6.1
4.3 		MEDIUM
Network 		Access Bypass vulnerability in Drupal Core allows for an attacker to leverage the way that HTML is rendered for affected forms in order to exploit the vulnerability. This issue affects: Drupal Core 8… CWE-79
Cross-site Scripting 		CVE-2020-13668 cpe:2.3:a:drupal:drupal:*:* 9.0.0
8.9.0
8.8.0



9.0.6
8.9.6
8.8.10 		2024-11-21 14:01
2022-02-12 		Show GitHub Exploit DB Packet Storm
34 5.4
3.5 		MEDIUM
Network 		CKEditor4 is an open source WYSIWYG HTML editor. In affected version a vulnerability has been discovered in the core HTML processing module and may affect all plugins used by CKEditor 4. The vulnerab… - CVE-2021-41165 cpe:2.3:a:drupal:drupal:*:* 9.2.0
9.1.0
8.9.0



9.2.9
9.1.14
8.9.20 		2024-11-21 15:25
2021-11-18 		Show GitHub Exploit DB Packet Storm
35 5.4
3.5 		MEDIUM
Network 		CKEditor4 is an open source WYSIWYG HTML editor. In affected versions a vulnerability has been discovered in the Advanced Content Filter (ACF) module and may affect all plugins used by CKEditor 4. Th… - CVE-2021-41164 cpe:2.3:a:drupal:drupal:*:* 9.2.0
9.1.0
8.9.0



9.2.9
9.1.14
8.9.20 		2024-11-21 15:25
2021-11-18 		Show GitHub Exploit DB Packet Storm
36 6.1
4.3 		MEDIUM
Network 		jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `of` option of the `.position()` util from untrusted sources may execute untrusted code. T… - CVE-2021-41184 cpe:2.3:a:drupal:drupal:*:* 9.3.0
9.2.0
7.0



9.3.3
9.2.11
7.86 		2024-11-21 15:25
2021-10-27 		Show GitHub Exploit DB Packet Storm
37 6.1
4.3 		MEDIUM
Network 		jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of various `*Text` options of the Datepicker widget from untrusted sources may execute untrusted … - CVE-2021-41183 cpe:2.3:a:drupal:drupal:*:* 9.3.0
9.2.0
7.0



9.3.3
9.2.11
7.86 		2024-11-21 15:25
2021-10-27 		Show GitHub Exploit DB Packet Storm
38 6.1
4.3 		MEDIUM
Network 		jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `altField` option of the Datepicker widget from untrusted sources may execute untrusted co… - CVE-2021-41182 cpe:2.3:a:drupal:drupal:*:* 7.0 7.86 2024-11-21 15:25
2021-10-27 		Show GitHub Exploit DB Packet Storm
39 8.8
6.8 		HIGH
Network 		Cross Site Request Forgery vulnerability in Drupal Core Form API does not properly handle certain form input from cross-site requests, which can lead to other vulnerabilities. CWE-352
 Origin Validation Error 		CVE-2020-13663 cpe:2.3:a:drupal:drupal:*:* 9.0.0
8.9.0
8.8.0
7.0





9.0.1
8.9.1
8.8.8
7.72 		2024-11-21 14:01
2021-06-12 		Show GitHub Exploit DB Packet Storm
40 6.1
4.3 		MEDIUM
Network 		Cross-site scripting vulnerability in l Drupal Core allows an attacker could leverage the way that HTML is rendered for affected forms in order to exploit the vulnerability. This issue affects: Drupa… CWE-79
Cross-site Scripting 		CVE-2020-13688 cpe:2.3:a:drupal:drupal:*:* 9.0.0
8.9.0
8.8.0



9.0.6
8.9.6
8.8.10 		2024-11-21 14:01
2021-06-12 		Show GitHub Exploit DB Packet Storm