Refine your search

3 vulnerabilities found for Single Content Sync by Drupal

CVE-2026-118561 (GCVE-0-2026-118561)
Vulnerability from cvelistv5
Published
2026-10-30 03:08
Modified
2026-10-30 03:08
Severity ?
CWE
  • CWE-73 - External Control of File Name or Path
Summary
External Control of File Name or Path vulnerability in Drupal Single Content Sync allows Path Traversal. This issue affects Single Content Sync versions: from 0.0.0 to 1.4.19.
References
Impacted products
Vendor Product Version
Drupal Single Content Sync Version: 0.0.0   ≤
Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://www.drupal.org/project/single_content_sync",
          "product": "Single Content Sync",
          "repo": "https://git.drupalcode.org/project/single_content_sync",
          "vendor": "Drupal",
          "versions": [
            {
              "lessThan": "1.4.19",
              "status": "affected",
              "version": "0.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "jvdkolk"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "killianacc"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "K\u00c3\u00a9vin Le lostec (klelostec)"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "nicocha30"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "killianacc"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Oleksandr Kuzava (nginex)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Swan Kalata (akalata)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Greg Knaddison (greggles)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Juraj Nemec (poker10)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Jess  (xjm)"
        }
      ],
      "datePublic": "2026-10-28T17:17:30.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "External Control of File Name or Path vulnerability in Drupal Single Content Sync allows Path Traversal. This issue affects Single Content Sync versions: from 0.0.0 to 1.4.19."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-126",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-126 Path Traversal"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-73",
              "description": "CWE-73 External Control of File Name or Path",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-30T03:08:51.799Z",
        "orgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
        "shortName": "drupal"
      },
      "references": [
        {
          "url": "https://www.drupal.org/sa-contrib-2026-274"
        }
      ],
      "title": "Single Content Sync - Critical - External control of file name or path - SA-CONTRIB-2026-274"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
    "assignerShortName": "drupal",
    "cveId": "CVE-2026-118561",
    "datePublished": "2026-10-30T03:08:51.799Z",
    "dateReserved": "2026-10-28T15:50:46.719Z",
    "dateUpdated": "2026-10-30T03:08:51.799Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-118562 (GCVE-0-2026-118562)
Vulnerability from cvelistv5
Published
2026-10-30 03:08
Modified
2026-10-30 03:08
Severity ?
CWE
  • CWE-502 - Deserialization of Untrusted Data
Summary
Deserialization of Untrusted Data vulnerability in Drupal Single Content Sync allows Object Injection. This issue affects Single Content Sync versions: from 0.0.0 to 1.4.19.
References
Impacted products
Vendor Product Version
Drupal Single Content Sync Version: 0.0.0   ≤
Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://www.drupal.org/project/single_content_sync",
          "product": "Single Content Sync",
          "repo": "https://git.drupalcode.org/project/single_content_sync",
          "vendor": "Drupal",
          "versions": [
            {
              "lessThan": "1.4.19",
              "status": "affected",
              "version": "0.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Drew Webber (mcdruid)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Drew Webber (mcdruid)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Oleksandr Kuzava (nginex)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Swan Kalata (akalata)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Greg Knaddison (greggles)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Lee Rowlands (larowlan)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Drew Webber (mcdruid)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Juraj Nemec (poker10)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Jess  (xjm)"
        }
      ],
      "datePublic": "2026-10-28T17:17:38.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Deserialization of Untrusted Data vulnerability in Drupal Single Content Sync allows Object Injection. This issue affects Single Content Sync versions: from 0.0.0 to 1.4.19."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-586",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-586 Object Injection"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-502",
              "description": "CWE-502 Deserialization of Untrusted Data",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-30T03:08:50.773Z",
        "orgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
        "shortName": "drupal"
      },
      "references": [
        {
          "url": "https://www.drupal.org/sa-contrib-2026-275"
        }
      ],
      "title": "Single Content Sync - Critical - Remote code execution - SA-CONTRIB-2026-275"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
    "assignerShortName": "drupal",
    "cveId": "CVE-2026-118562",
    "datePublished": "2026-10-30T03:08:50.773Z",
    "dateReserved": "2026-10-28T15:50:46.719Z",
    "dateUpdated": "2026-10-30T03:08:50.773Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-48009 (GCVE-0-2025-48009)
Vulnerability from cvelistv5
Published
2025-05-21 16:22
Modified
2025-05-21 16:46
Severity ?
3.1 (Low) - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
CWE
Summary
Missing Authorization vulnerability in Drupal Single Content Sync allows Functionality Misuse.This issue affects Single Content Sync: from 0.0.0 before 1.4.12.
References
Impacted products
Vendor Product Version
Drupal Single Content Sync Version: 0.0.0   ≤
Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 3.1,
              "baseSeverity": "LOW",
              "confidentialityImpact": "LOW",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-48009",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-21T16:45:15.598273Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-21T16:46:08.881Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://www.drupal.org/project/single_content_sync",
          "defaultStatus": "unaffected",
          "product": "Single Content Sync",
          "repo": "https://git.drupalcode.org/project/single_content_sync",
          "vendor": "Drupal",
          "versions": [
            {
              "lessThan": "1.4.12",
              "status": "affected",
              "version": "0.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Dezs\u0151 Bicz\u00f3 (mxr576)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Dave Long (longwave)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Dezs\u0151 Bicz\u00f3 (mxr576)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Oleksandr Kuzava (nginex)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Greg Knaddison (greggles)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Juraj Nemec (poker10)"
        }
      ],
      "datePublic": "2025-05-14T18:05:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Missing Authorization vulnerability in Drupal Single Content Sync allows Functionality Misuse.\u003cp\u003eThis issue affects Single Content Sync: from 0.0.0 before 1.4.12.\u003c/p\u003e"
            }
          ],
          "value": "Missing Authorization vulnerability in Drupal Single Content Sync allows Functionality Misuse.This issue affects Single Content Sync: from 0.0.0 before 1.4.12."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-212",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-212 Functionality Misuse"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-21T16:22:45.494Z",
        "orgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
        "shortName": "drupal"
      },
      "references": [
        {
          "url": "https://www.drupal.org/sa-contrib-2025-060"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Single Content Sync - Moderately critical - Access bypass - SA-CONTRIB-2025-060",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
    "assignerShortName": "drupal",
    "cveId": "CVE-2025-48009",
    "datePublished": "2025-05-21T16:22:45.494Z",
    "dateReserved": "2025-05-14T17:45:12.225Z",
    "dateUpdated": "2025-05-21T16:46:08.881Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}