CVE-2025-7393— Mail Login - Critical - Access bypass - SA-CONTRIB-2025-088
Quick assessment
Affected
Drupal Mail Login
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Drupal Mail Login是Drupal社区的一个邮件地址登录的插件。 Drupal Mail Login 3.2.0之前版本和4.2.0之前版本存在安全漏洞，该漏洞源于认证尝试限制不当，可能导致暴力破解攻击。
Possible ATT&CK Techniques 1 AI
T1110 · Brute Force
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2025-7393
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Mail Login - Critical - Access bypass - SA-CONTRIB-2025-088
Source: CVE Program / CVE List V5
Vulnerability Description
Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Mail Login allows Brute Force.This issue affects Mail Login: from 3.0.0 before 3.2.0, from 4.0.0 before 4.2.0.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
过多认证尝试的限制不恰当
Source: CVE Program / CVE List V5
Vulnerability Title
Drupal Mail Login 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Drupal Mail Login是Drupal社区的一个邮件地址登录的插件。 Drupal Mail Login 3.2.0之前版本和4.2.0之前版本存在安全漏洞，该漏洞源于认证尝试限制不当，可能导致暴力破解攻击。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Drupal | Mail Login | 3.0.0 ~ 3.2.0 | - |
|
II. Public POCs for CVE-2025-7393
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-7393
请登录查看更多情报信息。
Same Patch Batch · Drupal · 2025-07-21 · 5 CVEs total
| CVE-2025-7717 | File Download - Moderately critical - Access bypass - SA-CONTRIB-2025-089 | |
| CVE-2025-7716 | Real-time SEO for Drupal - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-09 | |
| CVE-2025-7715 | Block Attributes - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-090 | |
| CVE-2025-7392 | Cookies Addons - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-087 |
IV. Related Vulnerabilities
Same vendor: Drupal
-
CVE-2026-16647
Disable Login Page - Moderately critical - Access bypass - S -
CVE-2026-18986
Entity Browser - Moderately critical - Cross site scripting -
CVE-2026-73475
Commerce PayPal - Moderately critical - Access bypass - SA-C -
CVE-2026-73478
Diff - Moderately critical - Access bypass - SA-CONTRIB-2026 -
CVE-2026-73474
Entity Share Websub - Moderately critical - Server-side requ
Same weakness: CWE-307
-
CVE-2026-110861
Better Auth drizzle-adapter 1.6.17 before 1.7.7 Rate Limit B -
CVE-2026-103977
FileRise: Session-scoped TOTP rate limiting permits repeated -
CVE-2026-69193
FileRise: Rate Limiting Bypass via Username Rotation Enables -
CVE-2026-110770
Databasus 3.7.0 through 3.61.0 Account Takeover via Password -
CVE-2026-93637
Zimbra Collaboration Suite GraphQL Batched Authentication By
V. Comments for CVE-2025-7393
No comments yet