Drew Webber

A security issue exists within the Drupal GroupEx PRO ( Daxko ) integration. The project is currently marked as unsupported, and the maintainer has not provided a fix for this issue.

A security issue exists in the PayUmoney for Drupal Commerce module. The project has been marked as unsupported by the Drupal Security Team because the maintainer has not provided a fix for this issue.

Single Content Sync allows exporting and importing content, referenced entities, and files between Drupal sites. A maliciously crafted import file can cause untrusted data to be deserialized, potentially leading to remote code execution via Object Injection. This issue requires the attacker to possess a role with the "import single content" permission.

Stored Cross-site Scripting (XSS) occurs because the theme does not sufficiently sanitize menu link titles before inserting them into HTML class attributes. This issue requires an attacker to have permissions to create or modify menu link titles via menu administration or content menu settings.

Stored Cross-site Scripting (XSS) occurs when the `file uri` formatter fails to properly escape filenames when rendering links to uploaded files. This allows an attacker with permissions to upload files into a Data Field file subfield to inject malicious scripts into the web page. Cross-site Scripting is a flaw where untrusted data is inserted into a web page without proper validation or encoding, allowing the execution of scripts in the victim's browser.

Stored Cross-site Scripting (XSS) occurs because the theme does not sufficiently sanitize menu link titles before inserting them into HTML class attributes. This issue allows an attacker who can create or modify menu link titles, via menu administration or permitted content menu settings, to execute malicious scripts in the context of the user's session.

Improper neutralization of input during web page generation allows Cross-Site Scripting (XSS). The module fails to sufficiently validate icon settings provided by users before they are rendered.

Improperly controlled modification of dynamically-determined object attributes in the Drupal Monster Menus module allows for object injection. Specifically, the RSS Page submodule uses the PHP `unserialize()` function when processing input from the node creation form. This allows an attacker with the "RSS Feed: Create new content" permission to inject PHP objects. Object injection is a condition where untrusted input is passed to a deserialization function, potentially allowing the execution of arbitrary code or manipulation of application logic.

Stored Cross-site Scripting (XSS) occurs because the theme does not sufficiently sanitize menu link titles before inserting them into HTML class attributes. This issue requires an attacker to have permissions to create or modify menu link titles via menu administration or content menu settings.

Stored Cross-site Scripting (XSS) occurs because user-entered text is used as part of a slide without appropriate filtering. This issue requires the attacker to possess a role with permissions to edit the caption.

An issue exists where a module specific to the distribution does not sufficiently sanitize media names, allowing for Stored Cross-site Scripting (XSS), which occurs when an application includes untrusted data in a web page without proper validation or encoding. Exploitation requires the attacker to possess a role with permissions to create or edit a media entity.

An issue exists in the Drupal core Link module, which provides a field type for internal and external URLs. The module fails to sufficiently sanitize certain markup in specific circumstances, leading to Cross-Site Scripting (XSS), a condition where malicious scripts are injected into trusted websites.

An Unsafe Reflection issue exists where externally-controlled input can be used to select classes or code, leading to Reflection Injection. This flaw allows for remote code execution. While the issue is not directly exploitable using the module in isolation, multiple serious exploit paths exist when combined with other contributed modules, including at least one path that does not require authentication. Custom code may also expose this functionality.

A remote code execution issue exists within the Field UI module (`field ui`) in Drupal core. While the issue is not directly exploitable using core functionality alone, multiple serious exploit paths are available through the use of contributed modules or custom code. At least one known exploit path allows for unauthenticated remote code execution. Approximately 151,000 sites are potentially affected due to the use of outdated CMS branches. This flaw can be used to achieve lateral movement from compromised web servers into internal infrastructure.

An incorrect authorization issue allows forceful browsing. The module fails to sufficiently check entity access across several editor endpoints. Exploitation requires the attacker to possess a role with the "use gutenberg" permission.

An authorization flaw allows forceful browsing by failing to sufficiently check entity access when rendering an entity through the display-mode example route. This enables an attacker to view unpublished or access-restricted content. Field-level access remains enforced, preventing the disclosure of restricted fields such as email addresses or password hashes.

A security issue exists in the Drupal Orphans Media project. The project has been marked as unsupported by the Drupal Security Team because the maintainer has not provided a fix for this issue.

Improperly controlled modification of dynamically-determined object attributes in the Block AJAX module allows for Object Injection. The module fails to sufficiently validate user-supplied data used to construct a block, which can lead to PHP Object Injection and Remote Code Execution. This issue specifically affects sites that have Layout Builder enabled or other block plugins that handle the data passed by this module in an unsafe manner.

A security issue exists in the Drupal ECA Helper project. The Drupal Security Team has marked this project as unsupported because the maintainer has not provided a fix for the known issue.

Insufficient validation of a managed file upload element during the processing of new submissions allows a user with submission access to potentially access other managed files they are not authorized to view. This issue occurs when a site is configured with a Webform containing a managed file upload element and a configuration that exposes submitted files, such as allowing users to view their own submissions or sending uploads as email attachments. Approximately 436,400 instances are identified globally.