Drupal references

Drupal is known for it’s large number of community contributed modules that add functionality to the bare bones core system. While the core system is actively maintained by the Drupal core security team, there is no such guarantee for the third party modules.

http://drupal.sh/vulnerable-drupal-contrib-module-puts-120000-sites-at-risk