Threats Tagged 'packagist-https-packages-drupa'

The Media folders module for Drupal provides an improved UI for managing media entities in a folder structure. It suffers from a stored cross-site scripting (XSS) vulnerability due to insufficient sanitization of media item and folder names and descriptions when displayed in the media browser. Exploitation requires the attacker to have permissions to create or edit media items or folders. Versions prior to 1.0.8 are affected.

The Drupal i18n_sso module for multilingual websites with different domain names per language has a vulnerability that allows an attacker to bypass access control and authenticate as a victim user by exploiting insufficient validation of a short-lived token. This automatic cross-domain login feature can be abused if the attacker originates from the same client IP as the victim. Versions of the module prior to 1.8.0 are affected. No CVSS score is available for this vulnerability.

The Search API Autocomplete module for Drupal enables autocomplete suggestions for search forms created with the Search API module. A test script included with the module is accessible to anonymous users and does not sufficiently validate user input, resulting in a Cross Site Scripting (XSS) vulnerability. This vulnerability is mitigated by the requirement that the web server must be configured to display warning messages to users. Versions of the module prior to 1.12.0 are affected.

The Drupal contrib project 'commerce_elavon' is marked as unsupported by its security team due to an unresolved security vulnerability identified as CVE-2026-16641. The maintainer has not fixed the known security issue, and no patch or remediation is currently available. Users of this project are advised to consider taking over maintenance or seek alternatives.

The Drupal contributed project 'email_login_otp' is marked as unsupported by its security team due to an unresolved security issue. The maintainer has not fixed the known vulnerability, and no patch or remediation is currently available. Users of this project should be aware that it is no longer maintained for security and consider alternative solutions or take over maintenance.

The Drupal contributed project 'lunr_filters' is marked as unsupported by the security team due to an unresolved security vulnerability. The maintainer has not fixed the known issue, and no patch or remediation is currently available. Users of this project should be aware that it is no longer maintained for security and consider alternative solutions or take over maintenance.

The Drupal webform_rest module versions prior to 4.0.3 contain a vulnerability where the module does not sufficiently verify the parent webform's permissions for creating, viewing, and updating submissions via REST endpoints. This issue affects unsupported versions 4.0.3 and earlier. Exploitation requires the attacker to already have permissions to use the REST resource, which mitigates the risk to some extent.

The Photoswipe Drupal module integrates the PhotoSwipe lightbox library to display and zoom images in galleries. Versions prior to 3.2.0 do not sufficiently check access permissions when viewing images via the photoswipe image gallery display formatter. This vulnerability primarily affects sites that restrict access to images shown in photoswipe galleries. Public image galleries are not impacted by this issue.

The Drupal development environment project has been marked as unsupported by the security team due to an unresolved security issue. The maintainer has not fixed the known vulnerability, and no patch or remediation is currently available. Users are advised that the project is no longer maintained for security purposes and may pose a risk if used without mitigation or replacement.