CVE-2025-3129

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Access code allows Brute Force.This issue affects Access code: from 0.0.0 before 2.0.4.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-307

Affected software

Vendor	Product	Versions
Drupal	Access code	>= 0.0.0, < 2.0.4

References

https://www.drupal.org/sa-contrib-2025-028Third Party Advisory

Timeline

Published: Apr 2, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-31305.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Obfuscate allows Stored XSS.Thi CVE-2025-31315.4Cross-Site Request Forgery (CSRF) vulnerability in Drupal ECA: Event - Condition - Action allows Cross Site Request Forgery.This issue affec CVE-2025-313249.8SAP NetWeaver Visual Composer Metadata Uploader is not protected with a proper authorization, allowing unauthenticated agent to upload poten CVE-2025-313255.8Due to a Cross-Site Scripting vulnerability in SAP NetWeaver (ABAP Keyword Documentation), an unauthenticated attacker could inject maliciou CVE-2025-313264.1SAP�BusinessObjects Business�Intelligence Platform (Web Intelligence) is vulnerable to HTML Injection, allowing an attacker with basic user CVE-2025-313274.3SAP Field Logistics Manage Logistics application OData meta-data property is vulnerable to data tampering, due to which certain fields could CVE-2025-313284.6SAP Learning Solution is vulnerable to Cross-Site Request Forgery (CSRF), allowing an attacker to trick authenticated user into sending unin CVE-2025-313296.2SAP NetWeaver is vulnerable to an Information Disclosure vulnerability caused by the injection of malicious instructions into user configura CVE-2025-313309.9SAP Landscape Transformation (SLT) allows an attacker with user privileges to exploit a vulnerability in the function module exposed via RFC CVE-2025-313314.3SAP NetWeaver allows an attacker to bypass authorization checks, enabling them to view portions of ABAP code that would normally require add CVE-2025-313327.1Due to insecure file permissions in SAP BusinessObjects Business Intelligence Platform, an attacker who has local access to the system could CVE-2025-313334.3SAP S4CORE OData meta-data property is vulnerable to data tampering, due to which entity set could be externally modified by an attacker cau