Most recent entries from all

DRUPAL-CONTRIB-2025-111

Affected: Packagist:https://packages.drupal.org/8: drupal/reverse_proxy_header

This module allows you to specify an HTTP header name to determine the client's IP address.

The module doesn't sufficiently handle all cases under the scenario if Drupal Core settings `$settings['reverse_proxy']` is set to TRUE and `$settings['reverse_proxy_addresses']` is configured.

This vulnerability allows an attacker to spoof a request IP address (as Drupal sees it), potentially bypassing a variety of controls.

EUVD-2026-257172

fkie_cve-2025-10929

Improper Validation of Consistency within Input vulnerability in Drupal Reverse Proxy Header allows Manipulating User-Controlled Variables.This issue affects Reverse Proxy Header: from 0.0.0 before 1.1.2.

GHSA-fg8x-q69g-4qp3 — Drupal Reverse Proxy Header allows Manipulating User-Controlled Variables

Affected: Packagist: drupal/reverse_proxy_header

Improper Validation of Consistency within Input vulnerability in Drupal Reverse Proxy Header allows Manipulating User-Controlled Variables. This issue affects Reverse Proxy Header: from 0.0.0 before 1.1.2.

WID-SEC-W-2025-2126 — Drupal Module: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in Drupal Module ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen, um Sicherheitsvorkehrungen zu umgehen, und um falsche Informationen darzustellen.