CVE-2025-3057

score

<0.1

cvss

6.1

epss

0.3%

published

2025-03-31

kev added

—

first seen

2026-10-21

Drupal core versions from 8.0.0 before 10.3.13, 10.4.0 before 10.4.3, 11.0.0 before 11.0.12, and 11.1.0 before 11.1.3 contain a cross-site scripting caused by improper neutralization of input during web page generation, letting attackers execute malicious scripts in users' browsers, exploit requires attacker to craft malicious input.