drupal/facets vulnerabilities

Latest drupal/facets CVEs

Newest publication first

1. CVE-2025-9550 Facets - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-100

   Published 2025-10-10

   Medium·CVSS 6.1 EPSS 0.19%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Facets allows Cross-Site Scripting (XSS).This issue affects Facets: from 0.0.0 before 2.0.10, from 3.0.0 before 3.0.1.

2. CVE-2025-9549 Facets - Moderately critical - Information Disclosure - SA-CONTRIB-2025-099

   Published 2025-10-10

   Medium·CVSS 6.5 EPSS 0.20%

   Missing Authorization vulnerability in Drupal Facets allows Forceful Browsing.This issue affects Facets: from 0.0.0 before 2.0.10, from 3.0.0 before 3.0.1.

3. CVE-2024-13283 Facets - Critical - Cross Site Scripting - SA-CONTRIB-2024-047

   Published 2025-01-09

   Medium·CVSS 6.1 EPSS 0.24%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Facets allows Cross-Site Scripting (XSS).This issue affects Facets: from 0.0.0 before 2.0.9.

4. DRUPAL-CONTRIB-2021-008 This module enables you to add customizable facets on search pages, from core search or searches provided by Search API. The module doesn't sufficiently filter all output in certain circumstances. Thi...

   Published 2021-05-12

   Unknown

   This module enables you to add customizable facets on search pages, from core search or searches provided by Search API. The module doesn't sufficiently filter all output in certain circumstances. This vulnerability is mitigated by the fact that an attacker must have a role with...

5. DRUPAL-CONTRIB-2019-030 This module enables you to create facet-filters for results of a search query and exposes them as blocks The module doesn't sufficiently escape HTML under the scenario leading to a Cross Site Scriptin...

   Published 2019-02-27

   Unknown

   This module enables you to create facet-filters for results of a search query and exposes them as blocks The module doesn't sufficiently escape HTML under the scenario leading to a Cross Site Scripting (XSS) vulnerability. This vulnerability is mitigated by two factors. First, an...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.