Boris Doesborg

Improper neutralization of input during web page generation allows for Cross-Site Scripting (XSS), a condition where malicious scripts are injected into trusted websites. The issue occurs because the autocomplete widget does not sufficiently escape user input. This cannot occur in a default installation and requires the presence of additional modules or custom code.

The Login Disable module, which restricts site access by requiring a secret key on the login form, does not sufficiently protect the form from brute force attacks. An attacker could potentially bypass this protection by guessing the secret key, depending on its length. This issue is partially mitigated because the attacker still requires a valid username and password to gain access.

A flaw exists in the Login Disable module where the access key check is bypassed when using the HTTP request login route. This allows users to log in without providing the required access key, potentially compromising site security.