Drew Webber

**Name of the Vulnerable Software and Affected Versions** Drupal Blazy versions 0.0.0 through 3.0.18 **Description** An incorrect authorization issue allows forceful browsing. The module enables users to display a field of a target entity using a Blazy Filter plugin shortcode. Because the module does not consistently check entity view access, a user with access to a Blazy-enabled text format can render a field from an entity they are not permitted to view. This is limited to fields that the shortcode is capable of rendering. **Recommendations** Update Drupal Blazy to a version later than 3.0.18.

**Name of the Vulnerable Software and Affected Versions** Drupal Slick Carousel versions 0.0.0 through 2.1.0 **Description** Improper neutralization of input during web page generation in the Slick UI sub-module allows for Stored Cross-site Scripting (XSS). The issue occurs because the module does not sufficiently validate user input within Slick option sets that contain HTML for carousel buttons. **Recommendations** Update Drupal Slick Carousel to version 8.x-2.1 or later.

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined (affected versions not specified) **Description** Two distinct issues were identified. First, a module designed to restrict access to the `/user/login` endpoint via a secret key fails to invalidate relevant caches upon activation. This allows attackers to access the login page through cached responses. Second, a module that exposes structured data via JSON endpoints does not sufficiently verify access permissions. This allows anonymous users to retrieve field values from entities they are not authorized to view, such as unpublished content. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Drupal Link content parser (affected versions not specified) **Description** A security issue exists within the Drupal Link content parser. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The Element Pack Addons for Elementor plugin for WordPress is vulnerable to Email Header Injection in all versions up to, and including, 8.3.15 via the `element pack contact form` AJAX action. This is due to insufficient sanitization of newline characters in user-supplied input that gets concatenated into email headers. This makes it possible for unauthenticated attackers to inject arbitrary email headers into emails sent by the contact form.

**Name of the Vulnerable Software and Affected Versions** Drupal Entity Browser versions 0.0.0 through 2.16.0 **Description** Stored cross-site scripting (XSS) occurs because the module does not sufficiently sanitize tab titles. This allows an attacker to insert HTML with specific attributes on a page displaying an entity browser. Cross-site scripting is a flaw where malicious scripts are injected into trusted websites. **Recommendations** Update Drupal Entity Browser to a version later than 2.16.0.

**Name of the Vulnerable Software and Affected Versions** Edit in-place field versions 0.0.0 through 2.1.1 **Description** An incorrect authorization issue allows forceful browsing when editing entities. The module fails to sufficiently verify access rights, enabling a malicious user to craft requests to modify any field on any entity. This issue is mitigated if the attacker lacks the "edit in place field editing permission" role. **Recommendations** Update Edit in-place field to a version later than 2.1.1.

**Name of the Vulnerable Software and Affected Versions** WooCommerce PayPal Payments versions prior to 3.3.3 **Description** An Insecure Direct Object Reference (IDOR) exists in the `enqueue paypal insights script on order received()` function due to missing validation on a user-controlled key. This allows unauthenticated attackers to obtain sensitive order information, such as order keys. These keys can be used to access full customer billing details, including name, email, phone, and address, via the WooCommerce Store API within a 10-minute grace period following the creation of an order. **Recommendations** Update to a version newer than 3.3.2.

**Name of the Vulnerable Software and Affected Versions** Drupal Media Folders versions 0.0.0 through 1.0.8 **Description** Stored cross-site scripting (XSS) occurs because the module does not sufficiently sanitize the names and descriptions of media items and folders when they are displayed in the media browser. This allows an attacker with permissions to create or edit media items or folders to inject malicious scripts. Cross-site scripting is a technique where malicious scripts are injected into trusted websites. **Recommendations** Update Drupal Media Folders to a version later than 1.0.8.

**Name of the Vulnerable Software and Affected Versions** Search API Autocomplete versions 0.0.0 through 1.12.0 **Description** Improper neutralization of input during web page generation allows Reflected Cross-site Scripting (XSS), a flaw where malicious scripts are injected into a web page and reflected back to the user. The issue exists in a test script accessible to anonymous users that fails to sufficiently validate user input. This is partially mitigated if the web server is configured to hide warning messages from users. **Recommendations** Update Search API Autocomplete to a version later than 1.12.0. As a temporary mitigation, configure the web server to disable the display of warning messages to users.

**Name of the Vulnerable Software and Affected Versions** Drupal Internationalization Single Sign-On versions 0.0.0 through 1.8.0 **Description** An authentication bypass exists in the Drupal Internationalization Single Sign-On module. The module fails to sufficiently validate a short-lived token, which allows an attacker to bypass access control and authenticate as a victim user. This issue occurs in multilingual website scenarios where different domain names are used per language to enable automatic connection across domains. Exploitation requires the attacker to appear to originate from the same client IP address as the victim. **Recommendations** Update Drupal Internationalization Single Sign-On to a version later than 1.8.0.

**Name of the Vulnerable Software and Affected Versions** Drupal AI SEO/GEO Analyzer versions 0.0.0 through 1.1.3 **Description** Stored Cross-site Scripting (XSS) occurs when the module generates SEO/GEO analysis reports by sending entity content, including comments, to a Large Language Model (LLM). The module converts the Markdown response from the LLM into HTML and stores it for privileged users without passing it through the filtering pipeline. A crafted prompt injection—where an attacker inserts malicious text into the content analyzed by the LLM—can cause the model to generate markup that executes scripts when the report is viewed. Prompt injection is a technique used to manipulate the output of an LLM by providing specifically crafted input. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Location Selector versions 0.0.0 through 1.3.0 **Description** An SQL injection issue exists in the Location Selector module, which provides a Views filter for selecting location values. A specific Views filter fails to sufficiently sanitize values derived from user input, allowing for the improper neutralization of special elements used in an SQL command. This issue is mitigated if no View using the affected filter is configured to accept user input. **Recommendations** Update Location Selector to a version later than 1.3.0.

**Name of the Vulnerable Software and Affected Versions** Drupal Commerce Realex / Global Payments versions 0.0.0 through 3.0.2 **Description** An incorrect authorization issue allows forceful browsing when the gateway is configured with the redirect payment method. The module fails to sufficiently verify the authenticity of the payment response returned by Global Payments. This specifically affects the redirect payment method, while the lightbox method, which validates the signature, remains unaffected. **Recommendations** Update Drupal Commerce Realex / Global Payments to a version later than 3.0.2. As a temporary mitigation, avoid using the redirect payment method and use the lightbox payment method instead.

**Name of the Vulnerable Software and Affected Versions** WissKI versions 0.0.0 through 4.2.0 **Description** A missing authorization issue in the `wisski mirador` submodule allows forceful browsing and access bypass. The module fails to sufficiently validate parameters submitted via a route before writing them to the session object. **Recommendations** Update WissKI to a version later than 4.2.0. Restrict the use of the `wisski mirador` submodule to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Drupal Advanced Content Feedback versions 0.0.0 through 2.8.0 **Description** An incorrect authorization issue in the Advanced Content Feedback module allows forceful browsing. The module fails to sufficiently verify authorization over the targeted feedback record during the processing of a comment submission. This issue can be exploited by users with the "give feedback" permission, which is granted to both anonymous and authenticated users by default upon installation. **Recommendations** Update Drupal Advanced Content Feedback to a version later than 2.8.0.

**Name of the Vulnerable Software and Affected Versions** Drupal AI versions 0.0.0 through 1.2.17 Drupal AI versions 1.3.0 through 1.3.8 Drupal AI versions 1.4.0 through 1.4.3 **Description** A missing authorization issue allows forceful browsing. Certain Drupal core actions exposed as agent tools lack correct access validation, and some core actions are missing associated access-level definitions. This allows an agent to utilize Drupal core actions tools by bypassing access controls, provided the attacker can communicate with the affected agent and the site is configured to expose these tools to non-privileged users. **Recommendations** Update Drupal AI versions 0.0.0 through 1.2.17 to a version newer than 1.2.17. Update Drupal AI versions 1.3.0 through 1.3.8 to a version newer than 1.3.8. Update Drupal AI versions 1.4.0 through 1.4.3 to a version newer than 1.4.3.

**Name of the Vulnerable Software and Affected Versions** Tealium iQ Tag Management versions 0.0.0 through 2.4.0 **Description** Improperly controlled modification of dynamically-determined object attributes in the Tealium iQ Tag Management module allows for Object Injection. This occurs because the `tealiumiq` field stores data as PHP-serialized strings; if malicious data is written to this field, it can be executed when the data is unserialized. Exploitation requires the attacker to have permissions to edit a content entity with an attached `tealiumiq` field. Additionally, the core `jsonapi` module must be enabled with the option "Accept all JSON:API create, read, update, and delete operations", or the attacker must have an alternative method to edit field values directly. **Recommendations** Update Tealium iQ Tag Management to a version later than 2.4.0. Restrict permissions to edit content entities containing the `tealiumiq` field. Disable the "Accept all JSON:API create, read, update, and delete operations" option in the `jsonapi` module.

**Name of the Vulnerable Software and Affected Versions** Drupal AI versions 0.0.0 through 1.2.17 Drupal AI versions 1.3.0 through 1.3.8 Drupal AI versions 1.4.0 through 1.4.3 **Description** Improper neutralization of input during web page generation allows Cross-Site Scripting (XSS). The module and specific submodules, including AI Automators, AI Translate, AI API Explorer, and AI Content Suggestions, enable the use of a Large Language Model (LLM) to generate HTML or Markdown for browser preview. Under certain conditions, rendering this HTML can lead to XSS or the exposure of secret communications within the context of the LLM request. This issue requires an attacker to be able to inject text into prompts to execute the attack. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Drupal AI Agents versions 0.0.0 through 1.1.4 Drupal AI Agents versions 1.2.0 through 1.2.5 Drupal AI Agents versions 1.3.0 through 1.3.1 **Description** An incorrect authorization issue allows forceful browsing. Under certain conditions, the agent inherits deterministic parameters when invoking the same tool within a single request, which may result in information disclosure. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.