CVE-2025-3734

MediumCVSS 5.9/10Last modified Jun 17, 2026

Description

Allocation of Resources Without Limits or Throttling vulnerability in Drupal Stage File Proxy allows Flooding.This issue affects Stage File Proxy: from 0.0.0 before 3.1.5.

Metrics

CVSS 3.1 5.9/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-770

Affected software

Vendor	Product	Versions
Drupal	Stage File Proxy	>= 0.0.0, < 3.1.5

References

https://www.drupal.org/sa-contrib-2025-035Third Party Advisory

Timeline

Published: Apr 16, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-37355.9Vulnerability in Drupal Panelizer (obsolete).This issue affects Panelizer (obsolete): *.*.CVE-2025-37365.9Vulnerability in Drupal Simple GTM.This issue affects Simple GTM: *.*.CVE-2025-37375.9Vulnerability in Drupal Google Maps: Store Locator.This issue affects Google Maps: Store Locator: *.*.CVE-2025-37385.9Vulnerability in Drupal Google Optimize.This issue affects Google Optimize: *.*.CVE-2025-37395.9Vulnerability in Drupal Drupal 8 Google Optimize Hide Page.This issue affects Drupal 8 Google Optimize Hide Page: *.*.CVE-2025-37408.8The School Management System for Wordpress plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, CVE-2025-37426.8The Responsive Lightbox & Gallery WordPress plugin before 2.5.1 does not validate and escape some of its attributes before outputting them b CVE-2025-37435.3The Upsell Funnel Builder for WooCommerce plugin for WordPress is vulnerable to order manipulation in all versions up to, and including, 3.0 CVE-2025-37447.6Nomad Enterprise (“Nomad”) jobs using the policy override option are bypassing the mandatory sentinel policies. This vulnerability, identifi CVE-2025-37456.3The WP Lightbox 2 WordPress plugin before 3.0.6.8 does not correctly sanitize the value of the title attribute of links before using them, w CVE-2025-37469.8The OTP-less one tap Sign in plugin for WordPress is vulnerable to privilege escalation via account takeover in versions 2.0.14 to 2.0.59. T CVE-2025-37485.4The Taxonomy Chain Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's pn_chain_menu shortcode in all ve