Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

20 records

Release: Drupal Webform 6.2.12, 6.3.1 Clear all filters
TI-2026-79108 CVE-2026-96360 · GHSA-wmg8-83xq-9c4x

Cross-site scripting in Drupal Webform

Priority LOW 16

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Cross-Site Scripting (XSS).

CVSS 3.1LOW 3.5 Network High privileges User interaction EPSS 0.00234 Published 2026-10-22 Fixed in 6.2.12, 6.3.1 CWE-79
TI-2026-79109 CVE-2026-96361 · GHSA-8v5q-mq8w-3h29

Cross-site scripting in Drupal Webform

Priority LOW 21

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Cross-Site Scripting (XSS).

CVSS 3.1MEDIUM 4.6 Network Low privileges User interaction EPSS 0.00218 Published 2026-10-22 Fixed in 6.2.12, 6.3.1 CWE-79
TI-2026-79106 CVE-2026-96358 · GHSA-94gh-7cf2-wjgx

Cross-site scripting in Drupal Webform module

Priority LOW 21

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Cross-Site Scripting (XSS).

CVSS 3.1MEDIUM 4.6 Network Low privileges User interaction EPSS 0.00218 Published 2026-10-22 Fixed in 6.2.12, 6.3.1 CWE-79
TI-2026-79107 CVE-2026-96359 · GHSA-vc46-8rqj-39vr

Cross-site scripting in Drupal Webform

Priority LOW 21

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Cross-Site Scripting (XSS).

CVSS 3.1MEDIUM 4.6 Network Low privileges User interaction EPSS 0.00223 Published 2026-10-22 Fixed in 6.2.12, 6.3.1 CWE-79
TI-2026-79110 CVE-2026-96362 · GHSA-m74g-4qxv-frv9

Cross-site scripting in Drupal Webform

Priority LOW 19

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Cross-Site Scripting (XSS).

CVSS 3.1MEDIUM 4.2 Network No auth User interaction EPSS 0.00203 Published 2026-10-22 Fixed in 6.2.12, 6.3.1 CWE-79
TI-2026-79111 CVE-2026-96363 · GHSA-xx89-f5q9-6mw6

Stored cross-site scripting in Drupal Webform module

Priority LOW 15

Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS.

CVSS 3.1LOW 3.1 Network High privileges User interaction EPSS 0.00243 Published 2026-10-22 Fixed in 6.2.12, 6.3.1 CWE-267
TI-2026-79115 CVE-2026-96367 · GHSA-g3q7-664r-q32h

Stored cross-site scripting in Drupal Webform

Priority LOW 21

Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS.

CVSS 3.1MEDIUM 4.6 Network Low privileges User interaction EPSS 0.00259 Published 2026-10-22 Fixed in 6.2.12, 6.3.1 CWE-267
TI-2026-79116 CVE-2026-96368 · GHSA-4cw4-c7h2-2m73

Stored cross-site scripting in Drupal Webform

Priority LOW 20

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Stored XSS.

CVSS 3.1MEDIUM 4.6 Network Low privileges User interaction EPSS 0.00173 Published 2026-10-22 Fixed in 6.2.12, 6.3.1 CWE-79
TI-2026-79117 CVE-2026-96369 · GHSA-ppjw-xgvp-2p32

Sensitive information cached by browser in Drupal Webform module

Priority LOW 15

Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Webform allows Exploiting Incorrectly Configured Access Control Security Levels.

CVSS 3.1LOW 3.1 Network Low privileges No interaction EPSS 0.00209 Published 2026-10-22 Fixed in 6.2.12, 6.3.1 CWE-525
TI-2026-79119 CVE-2026-96371 · GHSA-g5g7-698p-7f3r

Stored cross-site scripting in Drupal Webform module

Priority LOW 24

Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00237 Published 2026-10-22 Fixed in 6.2.12, 6.3.1 CWE-267
TI-2026-79114 CVE-2026-96366 · GHSA-2mhr-gxgf-94fj

Webform access bypass via forceful browsing

Priority LOW 30

Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00397 Published 2026-10-22 Fixed in 6.2.12, 6.3.1 CWE-863
TI-2026-79112 CVE-2026-96364 · GHSA-m769-crqj-8pp9

Improper interaction frequency control in Drupal Webform

Priority LOW 30

Improper Control of Interaction Frequency vulnerability in Drupal Webform allows Functionality Misuse.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00287 Published 2026-10-22 Fixed in 6.2.12, 6.3.1 CWE-799
TI-2026-79105 CVE-2026-96357 · GHSA-hpx7-h5hv-mf6f

Stored cross-site scripting in Drupal Webform

Priority LOW 21

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Stored XSS.

CVSS 3.1MEDIUM 4.6 Network Low privileges User interaction EPSS 0.00218 Published 2026-10-22 Fixed in 6.2.12, 6.3.1 CWE-79
TI-2026-79103 CVE-2026-96355 · GHSA-4cxr-j7h5-h594

Template injection in Drupal Webform allows remote code execution

Priority MEDIUM 48

Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal Webform allows Code Injection.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00421 Published 2026-10-22 Fixed in 6.2.12, 6.3.1 CWE-1336