CVE-2025-31675

score

<0.1

cvss

5.4

epss

0.5%

published

2025-03-31

kev added

—

first seen

2026-10-21

Drupal core from versions 8.0.0 before 10.3.14, 10.4.0 before 10.4.5, 11.0.0 before 11.0.13, and 11.1.0 before 11.1.5 contains a cross-site scripting caused by improper neutralization of input during web page generation, letting attackers execute malicious scripts in users' browsers, exploit requires attacker to craft malicious input.