{"id":"drupal-security-6e0c52b833b6","seq":2025,"kind":"advisory","title":"Drupal core - Critical - Cross site scripting - SA-CORE-2025-001","url":"https://www.drupal.org/sa-core-2025-001","permalink":"https://vulnpulse.app/items/drupal-security-6e0c52b833b6","summary":"Project: Drupal core Project machine name: drupal Date: 2025-February-19 Security risk: Critical 17 ∕ 25 AC:Basic/A:None/CI:Some/II:Some/E:Proof/TD:All Vulnerability: Cross site scripting Affected versions: >= 8.0.0 < 10.3.13 || >= 10.4.0 < 10.4.3 || >= 11.0.0 < 11.0.12 || >= 11.1.0 < 11.1.3 CVE IDs: CVE-2025-3057 Description: Drupal core doesn't sufficiently filter error messages under certain circumstances, leading to a reflected Cross Site Scripting vulnerability (XSS). Sites are encouraged to update. There are not yet public documented steps to exploit this, but there may be soon given th…","severity":"critical","techs":["drupal","php"],"cves":["CVE-2025-3057"],"tags":["security"],"source":{"id":"drupal-security","name":"Drupal Security Advisories"},"published_at":"2025-02-19T16:49:28.000Z","fetched_at":"2026-10-21T16:17:45.699Z"}