CVE-2025-3131

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

Cross-Site Request Forgery (CSRF) vulnerability in Drupal ECA: Event - Condition - Action allows Cross Site Request Forgery.This issue affects ECA: Event - Condition - Action: from 0.0.0 before 1.1.12, from 2.0.0 before 2.0.16, from 2.1.0 before 2.1.7, from 0.0.0 before 1.2.*.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-352

Affected software

No affected versions have been published.

Timeline

Published: Apr 9, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-313249.8SAP NetWeaver Visual Composer Metadata Uploader is not protected with a proper authorization, allowing unauthenticated agent to upload poten CVE-2025-313255.8Due to a Cross-Site Scripting vulnerability in SAP NetWeaver (ABAP Keyword Documentation), an unauthenticated attacker could inject maliciou CVE-2025-313264.1SAP�BusinessObjects Business�Intelligence Platform (Web Intelligence) is vulnerable to HTML Injection, allowing an attacker with basic user CVE-2025-313274.3SAP Field Logistics Manage Logistics application OData meta-data property is vulnerable to data tampering, due to which certain fields could CVE-2025-313284.6SAP Learning Solution is vulnerable to Cross-Site Request Forgery (CSRF), allowing an attacker to trick authenticated user into sending unin CVE-2025-313296.2SAP NetWeaver is vulnerable to an Information Disclosure vulnerability caused by the injection of malicious instructions into user configura CVE-2025-313309.9SAP Landscape Transformation (SLT) allows an attacker with user privileges to exploit a vulnerability in the function module exposed via RFC CVE-2025-313314.3SAP NetWeaver allows an attacker to bypass authorization checks, enabling them to view portions of ABAP code that would normally require add CVE-2025-313327.1Due to insecure file permissions in SAP BusinessObjects Business Intelligence Platform, an attacker who has local access to the system could CVE-2025-313334.3SAP S4CORE OData meta-data property is vulnerable to data tampering, due to which entity set could be externally modified by an attacker cau CVE-2025-313346.8Issue that bypasses the "Mark of the Web" security warning function for files when opening a symbolic link that points to an executable file CVE-2025-313354.0The OpenSAML C++ library before 3.3.1 allows forging of signed SAML messages via parameter manipulation (when using SAML bindings that rely