Threats Tagged 'packagist-https-packages-drupa'

The Examples for Developers project for Drupal includes an 'Email Example' feature in the email_example submodule that can be exploited to send illegitimate emails to arbitrary addresses. Due to this security issue, the email_example submodule has been removed until a secure version demonstrating best practices is available. Developers who have used this example to build new modules should review their code for potential vulnerabilities.

The Drupal module 'Permissions by term' allows restricting view access to nodes based on taxonomy terms. A vulnerability exists where, in 'Permission mode', access rights are not properly checked when a node references a deleted taxonomy term and is accessed via JSON:API. Exploitation requires a specific module configuration, the presence of references to deleted terms, and access through JSON:API. A patch is available for versions prior to 3.1.41.

The Freelinking module for Drupal allows configuration of a WIKI-like input filter to create links to site and external content. A vulnerability exists where the module does not sufficiently prevent page titles from being viewed for certain privately-accessible URLs. Exploitation requires an attacker to have access to a text format that uses the Freelinking plugin configured to allow crawling of privately-accessible external URLs. Site administrators are advised to consider disabling this functionality to assess risk. A patch is available for this issue.

The Drupal Xray Audit module has a vulnerability where it insufficiently checks entity access when rendering entities via the display-mode example route. This can allow attackers to view unpublished or access-restricted content. However, field-level access controls remain enforced, preventing disclosure of sensitive fields such as user emails or password hashes. A patch is available to address this issue.

The drupal/gutenberg module has a vulnerability due to insufficient entity access checks in several editor endpoints. Exploitation requires the attacker to have a role with the “use gutenberg” permission, which mitigates the risk. A patch is available to address this issue.

An observable timing discrepancy vulnerability exists in the Drupal Token Content Access module, allowing brute force attacks. This affects versions from 0.0.0 up to but not including 3.1.2. The vulnerability has a high severity with a CVSS score of 7.5, indicating network attack vector with low attack complexity and no privileges or user interaction required. The vulnerability impacts confidentiality but not integrity or availability.

A stored cross-site scripting (XSS) vulnerability exists in Drupal Media Folders due to improper neutralization of input during web page generation. This vulnerability affects Media Folders versions from 0.0.0 up to but not including 1.0.8. The flaw allows an attacker to inject malicious scripts that can be stored and executed in the context of a user's browser.

A reflected Cross-site Scripting (XSS) vulnerability exists in the Drupal Search API Autocomplete module. This vulnerability is due to improper neutralization of input during web page generation, allowing attackers to inject malicious scripts. It affects versions from 0.0.0 up to but not including 1.12.0. The vulnerability has a medium severity with a CVSS score of 6.1.

A critical vulnerability (CVE-2026-16641) exists in Drupal Commerce Elavon affecting all versions. The vulnerability has a CVSS score of 9.8, indicating it is remotely exploitable with no privileges or user interaction required, and can lead to complete confidentiality, integrity, and availability compromise.

A medium severity vulnerability (CVE-2026-16642) exists in the Drupal Email Login OTP module affecting all versions. The vulnerability has a CVSS score of 5.7 and involves high complexity and privileges required, with user interaction needed. It impacts confidentiality and integrity but not availability. No official patch or remediation information is provided, and no known exploits are reported in the wild.