https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 22 Oct 2026 21:50:09 +0000 https://db.gcve.eu/vuln/drupal-contrib-2026-147 <p><strong>Affected:</strong> Packagist:https://packages.drupal.org/8: drupal/miniorange_saml</p> <p>This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider.</p> <p>The module does not sufficiently sanitize certain values derived from SAML assertions before displaying them to users. A malicious identity provider or an attacker able to supply crafted SAML attributes, leading to a cross-site scripting (XSS) vulnerability.</p> <p><strong>Affected:</strong> Packagist:https://packages.drupal.org/8: drupal/miniorange_saml</p> <p>This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider.</p> <p>The module does not sufficiently sanitize certain values derived from SAML assertions before displaying them to users. A malicious identity provider or an attacker able to supply crafted SAML attributes, leading to a cross-site scripting (XSS) vulnerability.</p> https://db.gcve.eu/vuln/drupal-contrib-2026-147 https://db.gcve.eu/vuln/fkie_cve-2026-87949 <p>Improper Neutralization of Input During Web Page Generation (&#34;Cross-site Scripting&#34;) vulnerability in Drupal SAML SSO - Service Provider allows Cross-Site Scripting (XSS). This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.</p> <p>Improper Neutralization of Input During Web Page Generation (&#34;Cross-site Scripting&#34;) vulnerability in Drupal SAML SSO - Service Provider allows Cross-Site Scripting (XSS). This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.</p> https://db.gcve.eu/vuln/fkie_cve-2026-87949 https://db.gcve.eu/vuln/ghsa-68wf-6pf7-533v <p>Improper Neutralization of Input During Web Page Generation (&#34;Cross-site Scripting&#34;) vulnerability in Drupal SAML SSO - Service Provider allows Cross-Site Scripting (XSS). This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.</p> <p>Improper Neutralization of Input During Web Page Generation (&#34;Cross-site Scripting&#34;) vulnerability in Drupal SAML SSO - Service Provider allows Cross-Site Scripting (XSS). This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.</p> https://db.gcve.eu/vuln/ghsa-68wf-6pf7-533v https://db.gcve.eu/vuln/wid-sec-w-2026-3284 <p>Ein Angreifer kann mehrere Schwachstellen in Drupal ausnutzen, um Datenbankinhalte zu manipulieren oder auszulesen, Zugriffsbeschränkungen und Authentifizierungsmechanismen zu umgehen, vertrauliche Informationen offenzulegen, Cross Site Scripting Angriffe auszuführen, Benutzer auf manipulierte Webseiten umzuleiten, SAML-Authentifizierungen zu beeinflussen oder wiederzuverwenden, interne Ressourcen über SSRF anzusprechen sowie unberechtigt Dateien auf den Server hochzuladen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in Drupal ausnutzen, um Datenbankinhalte zu manipulieren oder auszulesen, Zugriffsbeschränkungen und Authentifizierungsmechanismen zu umgehen, vertrauliche Informationen offenzulegen, Cross Site Scripting Angriffe auszuführen, Benutzer auf manipulierte Webseiten umzuleiten, SAML-Authentifizierungen zu beeinflussen oder wiederzuverwenden, interne Ressourcen über SSRF anzusprechen sowie unberechtigt Dateien auf den Server hochzuladen.</p> https://db.gcve.eu/vuln/wid-sec-w-2026-3284