Most recent entries from all

DRUPAL-CONTRIB-2026-175

2026-10-23T01:16:11.058831+00:00

Affected: Packagist:https://packages.drupal.org/8: drupal/webform

The Webform module allows site builders to create forms, collect submissions, and render submitted values in configurable formats.

Webform does not sufficiently exclude certain format templates from token replacement. This can allow an attacker to submit data that is evaluated as template code when a submission is rendered. Depending on the site configuration and enabled modules, this may lead to information disclosure, stored cross-site scripting, or remote code execution.

This vulnerability is mitigated by the fact that an affected webform must be configured with a custom multiple-value item format that includes submission-value tokens. Some impacts may also depend on additional enabled modules or site-specific configuration.

fkie_cve-2026-96355

2026-10-23T01:16:11.058969+00:00

Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal Webform allows Code Injection. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.

GHSA-4cxr-j7h5-h594

2026-10-23T01:16:11.059041+00:00

WID-SEC-W-2026-3554 — Drupal Erweiterungen: Mehrere Schwachstellen

2026-10-23T01:16:11.059066+00:00

Ein Angreifer kann mehrere Schwachstellen in Drupal ausnutzen, um beliebigen Programmcode auszuführen, erweiterte Berechtigungen zu erlangen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren und offenzulegen oder Cross-Site-Scripting-Angriffe durchzuführen.