CVE-2025-9551

6.5 MEDIUM

Published: October 10, 2025 Modified: March 26, 2026

Description

Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Protected Pages allows Brute Force.This issue affects Protected Pages: from 0.0.0 before 1.8.0, from 7.X-1.0 before 7.X-2.5.

AI Explanation

Get an AI-powered plain-language explanation of this vulnerability and remediation steps.

CVSS v3.x Details

0.0 Low Medium High Critical 10.0

Vector String

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

References to Advisories, Solutions, and Tools

Patch Vendor Advisory Exploit Third Party Advisory

https://d7es.tag1.com/security-advisories/protected-pages-moderately-critical-access-bypass-sa-contrib-2025-101

Source: mlhess@drupal.org

https://docs.herodevs.com/drupal/release-notes/protected-pages

Source: mlhess@drupal.org

https://www.drupal.org/sa-contrib-2025-101

Source: mlhess@drupal.org

Patch Vendor Advisory

3 reference(s) from NVD

Quick Stats

CVSS v3 Score

6.5 / 10.0

EPSS (Exploit Probability)

0.1%

21th percentile

Exploitation Status

Not in CISA KEV

Weaknesses (CWE)

CWE-307

Affected Vendors

protected_pages_project

Related CVEs