Greg Knaddison

**Name of the Vulnerable Software and Affected Versions** Drupal Commerce CyberSource versions 0.0.0 through 1.10.0 **Description** An observable timing discrepancy in the Secure Acceptance Hosted Checkout gateway integration allows for brute force attacks. The module fails to correctly verify the integrity of data returned by the payment provider, which could enable an attacker to use a timing attack to trick the site into registering a payment as received when it has not been. **Recommendations** Update Drupal Commerce CyberSource to a version later than 1.10.0.

**Name of the Vulnerable Software and Affected Versions** DXPR Builder: The Best Editing (AI) Experience for Drupal versions 0.0.0 through 2.8.1 **Description** DXPR Builder allows Forceful Browsing due to the insertion of sensitive information into sent data. In the 2.x version, the module does not sufficiently restrict access to API credentials within JavaScript settings. When AI agent features are enabled, the JSON Web Token used for licensing, user license management, AI services, and subscription metadata is exposed to all page visitors, including anonymous users, via the `drupalSettings` variable. **Recommendations** Update DXPR Builder: The Best Editing (AI Experience) for Drupal to a version later than 2.8.1. As a temporary mitigation, disable the AI agent features to prevent the exposure of the API token via `drupalSettings`.

**Name of the Vulnerable Software and Affected Versions** Drupal Monster Menus versions 0.0.0 through 9.5.3 **Description** Stored Cross-site Scripting (XSS) occurs because the module does not sufficiently sanitize HTML code within the page name when it is displayed in the built-in tree browser. This allows an attacker with the ability to create pages to execute arbitrary JavaScript in the context of a user session. Cross-site Scripting is a flaw where malicious scripts are injected into trusted websites. **Recommendations** Update Drupal Monster Menus to a version later than 9.5.3.

**Name of the Vulnerable Software and Affected Versions** Entity API versions 0.0.0 through 1.8.0 **Description** An incorrect authorization issue in the Entity API allows forceful browsing. The module fails to correctly apply access controls for JSON:API entity collection endpoints, leading to an information disclosure. This issue occurs when the JSON:API module is enabled alongside the Entity API module. **Recommendations** Update Entity API to a version later than 1.8.0. As a temporary mitigation, disable the JSON:API module to prevent the exploitation of the entity collection endpoints.

**Name of the Vulnerable Software and Affected Versions** Drupal Slick Carousel versions 0.0.0 through 2.1.0 **Description** Improper neutralization of input during web page generation in the Slick UI sub-module allows for Stored Cross-site Scripting (XSS). The issue occurs because the module does not sufficiently validate user input within Slick option sets that contain HTML for carousel buttons. **Recommendations** Update Drupal Slick Carousel to version 8.x-2.1 or later.

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined (affected versions not specified) **Description** Two distinct issues were identified. First, a module designed to restrict access to the `/user/login` endpoint via a secret key fails to invalidate relevant caches upon activation. This allows attackers to access the login page through cached responses. Second, a module that exposes structured data via JSON endpoints does not sufficiently verify access permissions. This allows anonymous users to retrieve field values from entities they are not authorized to view, such as unpublished content. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** CAPTCHA Protected Page versions 0.0.0 through 1.0.2 **Description** An authentication bypass exists in the CAPTCHA Protected Page module, which allows site administrators to require CAPTCHA confirmation on specific pages. The module fails to sufficiently validate its CAPTCHA verification cookies, enabling an unauthenticated user or automated bot to forge the cookie and bypass the verification process entirely. **Recommendations** Update CAPTCHA Protected Page to a version newer than 1.0.2.

**Name of the Vulnerable Software and Affected Versions** Drupal Blazy versions 0.0.0 through 3.0.18 **Description** An incorrect authorization issue allows forceful browsing. The module enables users to display a field of a target entity using a Blazy Filter plugin shortcode. Because the module does not consistently check entity view access, a user with access to a Blazy-enabled text format can render a field from an entity they are not permitted to view. This is limited to fields that the shortcode is capable of rendering. **Recommendations** Update Drupal Blazy to a version later than 3.0.18.

**Name of the Vulnerable Software and Affected Versions** Entity PDF versions 0.0.0 through 2.1.5 **Description** Missing authorization in the Entity PDF module allows forceful browsing. The module fails to check entity view access when fetching a PDF route, which may allow a user to access a PDF of an entity they are not authorized to view. **Recommendations** Update Entity PDF to a version later than 2.1.5.

**Name of the Vulnerable Software and Affected Versions** Content Moderation Notifications versions 0.0.0 through 3.9.0 **Description** An issue exists where a permission allowing users to configure email templates containing Twig (a template engine for web pages) was not marked as restricted. If a site administrator grants this permission to less-trusted users, those users can execute Twig code within email templates to escalate privileges and access functionality or information intended only for highly trusted administrators. **Recommendations** Update Content Moderation Notifications to a version later than 3.9.0.

**Name of the Vulnerable Software and Affected Versions** Drupal Address Suggestion versions 0.0.0 through 1.0.25 **Description** Improper neutralization of input during web page generation allows for Cross-Site Scripting (XSS). The Address Suggestion module, which provides address autocomplete functionality via configured providers, fails to sufficiently sanitize the data returned by these providers. Exploitation requires an attacker to inject malicious content into the data returned by a configured address provider and a user to perform a search that triggers the malicious suggestion. **Recommendations** Update Drupal Address Suggestion to a version later than 1.0.25.

**Name of the Vulnerable Software and Affected Versions** Disable Login Page versions 0.0.0 through 1.1.4 **Description** An authentication bypass exists because the module fails to invalidate relevant caches when login page access restrictions are enabled. This allows previously cached responses for the `/user/login` endpoint to remain accessible, enabling an attacker to bypass the functionality intended to restrict access to the login page. **Recommendations** Clear the system caches after enabling login page access restrictions to ensure that cached responses for the `/user/login` endpoint are invalidated.

**Name of the Vulnerable Software and Affected Versions** Drupal Digital Signage Framework versions 0.0.0 through 2.6.1 **Description** A missing authorization issue allows forceful browsing. The module provides a route for signage devices to refresh dynamic blocks on a display, but it fails to verify if the requester is an authorized signage device or if the requested block is intended for display. Consequently, an anonymous visitor can read the rendered content of blocks they are not authorized to see. This is partially mitigated if block plugins perform their own access checks on the content. **Recommendations** Update Drupal Digital Signage Framework to a version later than 2.6.1.

**Name of the Vulnerable Software and Affected Versions** Drupal LDAP / Active Directory Integration versions 0.0.0 through 2.2.1 **Description** An LDAP Injection issue exists because the module does not sufficiently sanitize user-supplied input before incorporating it into an LDAP search filter. This allows an attacker to discover information that should not normally be accessible. **Recommendations** Update Drupal LDAP / Active Directory Integration to a version newer than 2.2.1.

**Name of the Vulnerable Software and Affected Versions** Drupal Screenshot versions *.* **Description** A security issue exists in the Drupal Screenshot project. The project is currently marked as unsupported, and the security flaw remains unaddressed by the maintainer. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Drupal Screenshot versions *.* **Description** A security issue exists in the Drupal Screenshot project. The project is currently marked as unsupported, and the security flaw remains unaddressed by the maintainer. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Drupal Gammu SMS Daemon versions *.* **Description** A security issue exists in the Drupal Gammu SMS Daemon project. The project is currently marked as unsupported, and the security flaw remains unaddressed by the maintainer. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Drupal Gammu SMS Daemon versions *.* **Description** A security issue exists in the Drupal Gammu SMS Daemon project. The project is currently marked as unsupported, and the security flaw remains unaddressed by the maintainer. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Drupal Gammu SMS Daemon versions *.* **Description** A security issue exists in the Drupal Gammu SMS Daemon project. The project is currently marked as unsupported, and the security flaw remains unaddressed by the maintainer. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Drupal Entity Share Websub versions 0.0.0 through 1.1.2 **Description** Insufficient validation of certain inputs allows an attacker to perform Server-Side Request Forgery (SSRF), a technique where the server is coerced into making unauthorized requests to internal or external resources. **Recommendations** Update Drupal Entity Share Websub to a version later than 1.1.2.