Looking back at all security announcements that have been posted on drupal.org since 2005, you can see which are the most common types of vulnerabilities; the vulnerabilities by type for Drupal core that have been contributed since they were reported publicly are shown in Table 1-1. Cross-site scripting is the single most common issue. The ratio of problems is relatively consistent between core and contributed modules.
This table shows us that over time the most common problem has been cross-site scripting, which is also a very dangerous problem. Recent changes to Drupal core will help to reduce this problem somewhat, but it is still one of the biggest areas that need attention.
Comparing core versus contributed modules, it's clear that contributed modules are a source of a lot more occurrences—more than two times as many—although when you look at vulnerabilities per line of code, core has had more announced vulnerabilities than contributed modules. Of course, this analysis covers only the issues that were reported to the Drupal security team. There are many more issues that haven't been found yet or that a maintainer silently fixed.
3.16.135.225