Back to Codebase

Vulnerability Analysis Report

Drupal Core v4.7.0-beta-3

Scan ID: SCAN-DRUPAL-CORE-y7x4mp • Hash: a0833c8a

Severity Score
High
Total Findings
5
Engine Version
ECOMGUARD-HYBRID-AST-1.5
Scan Duration
0.789s

Vulnerability Details

L37

Insecure DOM Manipulation (XSS) in progress.js

CWE-79
File Location: misc/progress.js:37
Security Score:
75 / 100
Needs Audit

Rule Engine Warning

Detected insecure pattern matching known vulnerability signatures. Medium Confidence (Fuzzy matcher overlap - minor review required). Please apply remediation steps matching the recommended patch format below.

Heuristics Diff
- divs[i].innerHTML = percentage + '%';
+ element.textContent = data; // Or use DOMPurify to sanitize HTML output
L204

Insecure DOM Manipulation (XSS) in autocomplete.js

CWE-79
File Location: misc/autocomplete.js:204
Security Score:
74 / 100
Needs Audit

Rule Engine Warning

Detected insecure pattern matching known vulnerability signatures. Medium Confidence (Fuzzy matcher overlap - minor review required). Please apply remediation steps matching the recommended patch format below.

Heuristics Diff
- div.innerHTML = matches[i][1];
+ element.textContent = data; // Or use DOMPurify to sanitize HTML output
L26

Insecure DOM Manipulation (XSS) in collapse.js

CWE-79
File Location: misc/collapse.js:26
Security Score:
71 / 100
Needs Audit

Rule Engine Warning

Detected insecure pattern matching known vulnerability signatures. Medium Confidence (Fuzzy matcher overlap - minor review required). Please apply remediation steps matching the recommended patch format below.

Heuristics Diff
- a.innerHTML = legend.innerHTML;
+ element.textContent = data; // Or use DOMPurify to sanitize HTML output
L41

Insecure DOM Manipulation (XSS) in progress.js

CWE-79
File Location: misc/progress.js:41
Security Score:
71 / 100
Needs Audit

Rule Engine Warning

Detected insecure pattern matching known vulnerability signatures. Medium Confidence (Fuzzy matcher overlap - minor review required). Please apply remediation steps matching the recommended patch format below.

Heuristics Diff
- divs[i].innerHTML = status;
+ element.textContent = data; // Or use DOMPurify to sanitize HTML output
L117

Insecure DOM Manipulation (XSS) in drupal.js

CWE-79
File Location: misc/drupal.js:117
Security Score:
69 / 100
Needs Audit

Rule Engine Warning

Detected insecure pattern matching known vulnerability signatures. Medium Confidence (Fuzzy matcher overlap - minor review required). Please apply remediation steps matching the recommended patch format below.

Heuristics Diff
- div.innerHTML = '<iframe name="redirect-target" id="redirect-target" class="redirect"></iframe>';
+ element.textContent = data; // Or use DOMPurify to sanitize HTML output