According to its self-reported version, the instance of Drupal running on the remote web server is 11.1.x prior to 11.1.5, 11.0.x prior to 11.0.13, 10.4.x prior to 10.4.5 or 8.x prior to 10.3.14. Drupal core Link field attributes are not sufficiently sanitized, which can lead to a Cross-Site Scripting vulnerability (XSS).

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version, the instance of Drupal running on the remote web server is 10.3.x prior to 10.3.14, 10.4.x prior to 10.4.5, 11.x prior to 11.0.13, or 11.1.x prior to 11.1.5. It is, therefore, affected by a vulnerability.

  - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in     Drupal Drupal core allows Cross-Site Scripting (XSS).This issue affects Drupal core: from 8.0.0 before     10.3.14, from 10.4.0 before 10.4.5, from 11.0.0 before 11.0.13, from 11.1.0 before 11.1.5.
    (CVE-2025-31675)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
114679	Drupal 8.0.x < 10.3.14 Cross-Site Scripting	Web App Scanning	Component Vulnerability	3/24/2025	3/24/2025	medium
114677	Drupal 11.0.x < 11.0.13 Cross-Site Scripting	Web App Scanning	Component Vulnerability	3/24/2025	3/24/2025	medium
114676	Drupal 11.1.x < 11.1.5 Cross-Site Scripting	Web App Scanning	Component Vulnerability	3/24/2025	3/24/2025	medium
114678	Drupal 10.4.x < 10.4.5 Cross-Site Scripting	Web App Scanning	Component Vulnerability	3/24/2025	3/24/2025	medium
232982	Drupal 10.3.x < 10.3.14 / 10.4.x < 10.4.5 / 11.x < 11.0.13 / 11.1.x < 11.1.5 Drupal Vulnerability (SA-CORE-2025-004)	Nessus	CGI abuses	3/20/2025	4/4/2025	medium

Detections

Analytics

Plugins Search

medium

medium

medium

medium

medium