CVE-2025-9551

MediumCVSS 6.5/10Last modified Oct 8, 2026

Description

Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Protected Pages allows Brute Force.This issue affects Protected Pages: from 0.0.0 before 1.8.0, from 7.X-1.0 before 7.X-2.5.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

Weakness enumeration

CWE-307

Affected software

Vendor	Product	Versions
Drupal	Protected Pages	>= 0.0.0, < 1.8.0; >= 7.x-1.0, < 7.x-2.5

References

Timeline

Published: Oct 10, 2025
Last modified: Oct 8, 2026
NVD status: Modified

Related CVEs from 2025

CVE-2025-95525.3Vulnerability in Drupal Synchronize composer.Json With Contrib Modules.This issue affects Synchronize composer.Json With Contrib Modules: *.CVE-2025-95535.3Vulnerability in Drupal API Key manager.This issue affects API Key manager: *.*.CVE-2025-95545.3Vulnerability in Drupal Owl Carousel 2.This issue affects Owl Carousel 2: *.*.CVE-2025-95569.8Langchaingo supports the use of jinja2 syntax when parsing prompts, which is in turn parsed using the gonja library v1.5.3. Gonja supports CVE-2025-95577.6‭An out-of-bound write can lead to an arbitrary code execution. Even on devices with some form of memory protection, this can still lead to‬CVE-2025-95587.6There is a potential OOB Write vulnerability in the gen_prov_start function in pb_adv.c. The full length of the received data is copied into CVE-2025-95596.5Pega Platform versions 8.7.5 to Infinity 24.2.2 are affected by a Insecure Direct Object Reference issue in a user interface component that CVE-2025-95606.4The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's colibri_newsletter shortcode in CVE-2025-95618.8The AP Background plugin for WordPress is vulnerable to arbitrary file uploads due to missing authorization and insufficient file validation CVE-2025-95626.4The Redirection for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's qs_date shortcode in a CVE-2025-95656.4The Blocksy Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's blocksy_newsletter_subscribe shortc CVE-2025-95668.1There's a vulnerability in podman where an attacker may use the kube play command to overwrite host files when the kube file container a Sec