CVE-2025-3057

State: PUBLISHED · Published: 2025-03-31 · Updated: 2025-04-01 · Assigner: drupal

Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS).This issue affects Drupal core: from 8.0.0 before 10.3.13, from 10.4.0 before 10.4.3, from 11.0.0 before 11.0.12, from 11.1.0 before 11.1.3.

CWE

CWE-79 — CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected

Drupal / Drupal core — v=8.0.0 <10.3.13 [affected]; v=10.4.0 <10.4.3 [affected]; v=11.0.0 <11.0.12 [affected]; v=11.1.0 <11.1.3 [affected]

CVSS

(none)

References

https://www.drupal.org/sa-core-2025-001

Source

cvelistV5-main/cves/2025/3xxx/CVE-2025-3057.json