Back to Codebase

Vulnerability Analysis Report

Drupal Core v4.7.0-beta-6

Scan ID: SCAN-DRUPAL-CORE-LZMfmJ • Hash: 70222949

Severity Score
High
Total Findings
5
Engine Version
ECOMGUARD-HYBRID-AST-1.5
Scan Duration
0.919s

Vulnerability Details

L23

Insecure DOM Manipulation (XSS) in progress.js

CWE-79
File Location: misc/progress.js:23
Security Score:
75 / 100
Needs Audit

Rule Engine Warning

Detected insecure pattern matching known vulnerability signatures. Medium Confidence (Fuzzy matcher overlap - minor review required). Please apply remediation steps matching the recommended patch format below.

Heuristics Diff
- this.element.innerHTML = '<div class="percentage"></div>'+
+ element.textContent = data; // Or use DOMPurify to sanitize HTML output
L40

Insecure DOM Manipulation (XSS) in progress.js

CWE-79
File Location: misc/progress.js:40
Security Score:
73 / 100
Needs Audit

Rule Engine Warning

Detected insecure pattern matching known vulnerability signatures. Medium Confidence (Fuzzy matcher overlap - minor review required). Please apply remediation steps matching the recommended patch format below.

Heuristics Diff
- divs[i].innerHTML = percentage + '%';
+ element.textContent = data; // Or use DOMPurify to sanitize HTML output
L333

Insecure DOM Manipulation (XSS) in drupal.js

CWE-79
File Location: misc/drupal.js:333
Security Score:
68 / 100
Needs Audit

Rule Engine Warning

Detected insecure pattern matching known vulnerability signatures. Medium Confidence (Fuzzy matcher overlap - minor review required). Please apply remediation steps matching the recommended patch format below.

Heuristics Diff
- div.innerHTML = '<iframe name="redirect-target" id="redirect-target" class="redirect" onload="window.iframeHandler();"></iframe>';
+ element.textContent = data; // Or use DOMPurify to sanitize HTML output
L142

Insecure DOM Manipulation (XSS) in drupal.js

CWE-79
File Location: misc/drupal.js:142
Security Score:
67 / 100
Needs Audit

Rule Engine Warning

Detected insecure pattern matching known vulnerability signatures. Medium Confidence (Fuzzy matcher overlap - minor review required). Please apply remediation steps matching the recommended patch format below.

Heuristics Diff
- response = (iframe.contentWindow || iframe.contentDocument || iframe).document.body.innerHTML;
+ element.textContent = data; // Or use DOMPurify to sanitize HTML output
L44

Insecure DOM Manipulation (XSS) in progress.js

CWE-79
File Location: misc/progress.js:44
Security Score:
67 / 100
Needs Audit

Rule Engine Warning

Detected insecure pattern matching known vulnerability signatures. Medium Confidence (Fuzzy matcher overlap - minor review required). Please apply remediation steps matching the recommended patch format below.

Heuristics Diff
- divs[i].innerHTML = message;
+ element.textContent = data; // Or use DOMPurify to sanitize HTML output