CVE-2025-13083

Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Drupal core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Drupal core: from 8.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0 before 11.1.9, from 11.2.0 before 11.2.8, from 7.0 before 7.103.

Scoring

CVSS base score

0

EPSS probability

0.26%

CWE

CWE-525

Published

2025-11-18

Last modified

2026-03-13

Affected products

• Drupal Drupal core
• Drupal Drupal core
• Drupal Drupal core
• Drupal Drupal core
• Drupal Drupal core

Weakness type

• CWE-525

Related vulnerabilities

• CVE-2026-13697 — undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives
• CVE-2024-23571 — HCL Aftermarket EPC is vulnerable to attack since the application does not have an appropriate...
• CVE-2026-41918 — A vulnerability has been identified in RUGGEDCOM RST2428P (6GK6242-6PA00) (All versions < V4.0)....
• CVE-2026-41322 — @astrojs/node: Cache Poisoning due to incorrect error handling when if-match header is malformed
• CVE-2025-15554 — Admin Passwords Cached by Browsers in Truesec LAPSWebUI
• CVE-2025-36364 — IBM DevOps Plan REST APIs are vulnerable to exposure of sensitive data through request query parameters.
• CVE-2026-27514 — Tenda F3 Plaintext Credential Exposure in Configuration Download
• CVE-2026-24437 — Tenda W30E V2 Missing Cache Controls for Credential-bearing Pages

Markdown version · Browse all CVEs