This module enables you to create one or more multisites with highly granular page permissions.
The module doesn't sufficiently sanitize HTML code contained in the page name when displayed in the built-in tree browser. This results in a cross-site scripting vulnerability that may allow attackers to execute arbitrary JavaScript in the context of the user’s session.
This vulnerability is mitigated by the fact that an attacker must have the ability to create pages whose page title supports HTML.
This module enables users to authenticate using LDAP or Active Directory credentials.
The module does not sufficiently sanitize user-supplied input before incorporating it into an LDAP search filter. This allows an attacker to discover additional information they should not normally be able to.
The Entity PDF module can create a PDF from any entity based on any View mode.
This module does not check entity view access when fetching a PDF route. This could result in a user accessing a PDF of an entity that they should not be able to view.
The DXPR Builder module provides a visual / AI page builder for Drupal. The module uses a JSON Web Token for licensing, user license management, AI services, and subscription metadata.
The 2.x version of the module does not sufficiently restrict access to API credentials in JavaScript settings. When AI agent features are enabled, the token is exposed to all page visitors (including anonymous users) via drupalSettings.
This module enables you to disable access to the /user/login form unless a secret key is provided.
The module does not invalidate the relevant caches when login page access restrictions are enabled. As a result, previously cached login page responses may remain accessible until caches are cleared. An attacker may continue to access the login page despite the restriction having been enabled.
The Digital Signage Framework module provides a route that signage devices can call to refresh dynamic blocks on a display.
The route did not check whether the requester was a signage device, nor whether the requested block was one that the module delivers to displays. As a result, an anonymous visitor could read the rendered content of blocks they were not meant to see.
This vulnerability is mitigated by the fact that many block plugins perform their own access checks on the content they display, which limits what can be disclosed through this route.
This module enables you to store structured data in configurable fields and expose Data Field values through JSON endpoints.
The module doesn't sufficiently check access when returning Data Field values through its JSON endpoint. This may allow anonymous users to access field values belonging to entities they cannot otherwise view, including unpublished content.
The module provides a permission that allows users to configure email templates containing Twig code. This permission was not marked as restricted.
A site administrator might inadvertently grant this permission to less-trusted users. This would allow those users to execute Twig within email templates, and to gain access to functionality and information intended only for highly trusted administrators.
This module integrates Drupal Commerce with the CyberSource payment gateway.
The module does not correctly verify the integrity of data returned by the payment provider. A timing attack could allow an attacker to trick the site into registering that payment has been received even if it hasn't.
This issue only affects the Secure Acceptance Hosted Checkout gateway integration.
This module enables site administrators to require CAPTCHA confirmation on specific pages.
The module does not sufficiently validate its CAPTCHA verification cookies. Under certain circumstances, an unauthenticated user or automated bot can forge the cookie and bypass CAPTCHA verification entirely.
This module enables users to display a field of a target entity through a Blazy Filter plugin shortcode.
The module does not consistently check entity view access. If a user has access to a Blazy-enabled text format, this allows them to render a field from an entity they are not permitted to view.
The issue is mitigated by the fact that the shortcode does not expose the entire entity. Only fields that the shortcode can render are vulnerable.
The Address Suggestion module provides address autocomplete functionality using configured address providers.
The module doesn't sufficiently sanitize address suggestion data returned by configured providers, which can lead to a cross-site scripting (XSS) vulnerability.
This vulnerability is mitigated by the fact that an attacker must be able to inject malicious content into data returned by a configured address provider, and a user must perform a search that returns the malicious suggestion.
This module enables you to display content in tabs, where each tab renders a block, a node, a view, or another Quick Tabs instance.
The module did not correctly enforce access when rendering node and block tabs. It treated a neutral access result as a grant for node tabs and block plugins, and performed no access check for reusable custom blocks. Content that should have been denied was therefore rendered — for example, an unpublished node or unpublished reusable custom block could be shown to users without permission to view it.
This module enables you to authenticate Drupal users against external identity providers.
The module does not sufficiently ensure exact matching of externally supplied identity values when storing and looking up authentication mappings under certain database collation configurations.
This vulnerability is minimally mitigated by the fact that it affects only sites using impacted MySQL or MariaDB collation settings for the module’s authentication mapping storage. Affected collations are quite common so all sites are encouraged to upgrade.
This module enables you to pay for Commerce transactions using Paypal.
The module doesn't sufficiently validate the transaction result in certain circumstances, allowing a malicious user to mark transactions placed without payment.
This vulnerability only affects sites using the Payflow Link payment gateway.
The Entity Browser module allows you to select entities from entity reference fields using a custom entity browser widget.
The module doesn't sufficiently sanitize the the tab titles, resulting in a stored cross-site scripting (XSS) vulnerability.
The vulnerability is mitigated by the fact an attacker must be able to insert HTML with specific attributes on a page that is displaying an entity browser.
This module provides formatters to allow in-place editing in a View or other display (full content, teaser...).
The module doesn't sufficiently check access when editing entities. A malicious user could craft requests to allow them to modify any field on any entity.
This vulnerability is mitigated by the fact that an attacker must have a role with the permission "edit in place field editing permission".
The Token Content Access module enables site administrators to provide access to content using access tokens.
The module does not sufficiently protect access token comparison in some cases. This could allow a persistent attacker to use a timing attack to guess a valid access token and bypass access restrictions for content protected by this module.
The Photoswipe Drupal module provides integration for the widely used PhotoSwipe lightbox library to display / zoom images in lightbox galleries using the provided image formatters.
The module didn't sufficiently check access permissions, when viewing an image using the photoswipe image gallery display formatter, in versions < 3.0.4 (Drupal 8) or < 3.2.0 (Drupal 9 / Drupal 10).
QA Accounts enables you to login to a Drupal site using a well known username/password combination. When 1.0 was released, it also was marked for security coverage. The module prioritizes ease of use rather than security and is only intended to be used on sites that are not accessible on the internet (e.g. behind firewall or other protection). The maintainers are choosing to remove security coverage.
This module enables you to add autocomplete suggestions for search forms created with the Search API module.
The module ships with a test script that is accessible to anonymous users and doesn't sufficiently validate user input, leading to a Cross Site Scripting vulnerability.
This vulnerability is mitigated by the fact that the web server must be configured to display warning messages to users.
In a scenario of a multilingual website with different domain names per language, this module enables you to be automatically connected across the language domains if you are logged on the main language domain.
The module doesn't sufficiently validate a short-lived token, allowing an attacker to bypass access control and authenticate as a victim user.
This vulnerability is mitigated by the fact that an attacker must appear to originate from the same client IP as the victim.
This module provides a better UI for managing and selecting Media entities in a folder structure.
The module doesn't sufficiently sanitize the names and descriptions of media items and folders when they are displayed in the media browser, resulting in a stored cross-site scripting (XSS) vulnerability.
This vulnerability is mitigated by the fact that an attacker must have a role with permission to create or edit media items or folders.
The Layout Builder module doesn't sufficiently sanitize block labels in certain scenarios, which can lead to a cross-site scripting (XSS) vulnerability.
This is mitigated by the fact that both the attacker and the targeted user need to be using the Layout Builder editing interface.
The Image module allows you to define and configure image fields.
The module doesn't sufficiently check access to image style derivatives when those files are served via a file stream other than private://.
This vulnerability is mitigated by the fact that Drupal must be configured to use a contributed (non-core) file scheme to serve private derived images.
The AI SEO/GEO Analyzer module generates SEO/GEO analysis reports by sending content of an entity (including its comments) to an LLM, then converts the model's Markdown response to HTML and stores it for display to privileged users.
The generated HTML was rendered without passing through Drupal's filtering pipeline, so it relied on the LLM output being safe. Under certain circumstances a crafted prompt injection — planted in content that is included in the analysis — can cause the LLM to emit markup that results in stored Cross-site Scripting when the report is later viewed.
This module enables you to use Single Directory Components in site building (views, field formatters, blocks, layouts) and it improves the Developer Experience (DX) with SDC.
The module doesn't sufficiently sanitize the markup passed to components under certain scenarios.
This vulnerability is mitigated by the fact that an attacker must be able to create or update content rendered by UI Patterns.
The Events, Conditions, Actions (ECA) module's Render submodule enables you to build render arrays and render inline Twig templates as part of no-code ECA models.
The module doesn't sufficiently sanitize template code when rendering, which can lead to information disclosure.
This vulnerability is mitigated by the fact that a site must be running an ECA model that uses the "Render: Twig" action on a data flow.
The module doesn't sufficiently sanitize the Siteimprove Analytics identification code when inserting the JavaScript tracking code; this could be exploited to achieve Cross-Site Scripting (XSS).
This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer siteimprove_analytics".
