Exposición de Drupal

CMS
286
score de exposición
96.939
sitios usan
4
en explotación
9
críticos
Análisis Vexday

Com 84 CVEs catalogadas e 4 confirmadas em exploração ativa pelo CISA KEV, o Drupal apresenta uma taxa de exploração 10,6 vezes acima da média geral do catálogo, o que indica que vulnerabilidades nessa plataforma atraem atenção desproporcional de agentes maliciosos. A CVE mais perigosa atualmente ativa é a CVE-2018-7600, com score EPSS de 0,9999 — praticamente certeza estatística de tentativa de exploração —, sinalizando que falhas antigas nessa base de código permanecem alvos prioritários mesmo anos após sua divulgação. O tipo de falha mais comum é CWE-79 (Cross-Site Scripting), enquanto 8 CVEs atingem severidade crítica e 5 surgiram nos últimos 90 dias, evidenciando uma superfície de ataque ainda ativa. Equipes responsáveis por instâncias Drupal devem tratar a aplicação de patches como prioridade contínua, com atenção especial a vulnerabilidades mais antigas que ainda não foram remediadas no ambiente.

CVEs

93 resultados
CVE-2025-13080MEDIUMDrupal core - Moderately critical - Denial of Service - SA-CORE-2025-005EPSS 0.3%CVE-2024-55635MEDIUMDrupal core - Critical - Cross Site Scripting - SA-CORE-2024-005EPSS 0.3%CVE-2026-9726CRITICALDrupal AlternativeCommerce (Basket) - Highly critical - Arbitrary PHP code execution - SA-CONTRIB-2026-038EPSS 0.3%CVE-2025-3739MEDIUMDrupal 8 Google Optimize Hide Page - Critical - Unsupported - SA-CONTRIB-2025-040EPSS 0.3%CVE-2025-31673MEDIUMDrupal core - Moderately critical - Access bypass - SA-CORE-2025-002EPSS 0.3%CVE-2026-0750HIGHPayment bypass in Commerce PayboxEPSS 0.3%CVE-2025-3057MEDIUMDrupal core - Critical - Cross site scripting - SA-CORE-2025-001EPSS 0.3%CVE-2026-3216MEDIUMDrupal Canvas - Moderately critical - Server-side request forgery, Information disclosure - SA-CONTRIB-2026-017EPSS 0.3%CVE-2024-24837MEDIUMCross-Site Request Forgery (CSRF) vulnerability in FG PrestaShop, FG Drupal and FG Joomla WordPress pluginsEPSS 0.3%CVE-2025-13083LOWDrupal core - Moderately critical - Information disclosure - SA-CORE-2025-008EPSS 0.3%CVE-2025-47706MEDIUMEnterprise MFA - TFA for Drupal - Moderately critical - Access bypass - SA-CONTRIB-2025-052EPSS 0.3%CVE-2025-13081MEDIUMDrupal core - Moderately critical - Gadget chain - SA-CORE-2025-006EPSS 0.3%CVE-2026-6365MEDIUMDrupal core - Critical - Cross-site scripting - SA-CORE-2026-001EPSS 0.2%CVE-2026-8492LOWTranslate Drupal with GTranslate - Less critical - DOM clobbering / link manipulation - SA-CONTRIB-2026-035EPSS 0.2%CVE-2025-7716MEDIUMReal-time SEO for Drupal - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-091EPSS 0.2%CVE-2025-47709MEDIUMEnterprise MFA - TFA for Drupal - Critical - Access bypass - SA-CONTRIB-2025-055EPSS 0.2%CVE-2025-13082MEDIUMDrupal core - Moderately critical - Defacement - SA-CORE-2025-007EPSS 0.2%CVE-2026-55804MEDIUMDrupal core - Moderately critical - Gadget chain - SA-CORE-2026-006EPSS 0.2%CVE-2026-55803MEDIUMDrupal core - Critical - PHP object injection - SA-CORE-2026-005EPSS 0.2%CVE-2026-55806MEDIUMDrupal core - Less critical - Cache poisoning and open redirect - SA-CORE-2026-007EPSS 0.2%