Juraj Nemec

**Name of the Vulnerable Software and Affected Versions** Entity PDF versions 0.0.0 through 2.1.5 **Description** Missing authorization in the Entity PDF module allows forceful browsing. The module fails to check entity view access when fetching a PDF route, which may allow a user to access a PDF of an entity they are not authorized to view. **Recommendations** Update Entity PDF to a version later than 2.1.5.

**Name of the Vulnerable Software and Affected Versions** DXPR Builder: The Best Editing (AI) Experience for Drupal versions 0.0.0 through 2.8.1 **Description** DXPR Builder allows Forceful Browsing due to the insertion of sensitive information into sent data. In the 2.x version, the module does not sufficiently restrict access to API credentials within JavaScript settings. When AI agent features are enabled, the JSON Web Token used for licensing, user license management, AI services, and subscription metadata is exposed to all page visitors, including anonymous users, via the `drupalSettings` variable. **Recommendations** Update DXPR Builder: The Best Editing (AI Experience) for Drupal to a version later than 2.8.1. As a temporary mitigation, disable the AI agent features to prevent the exposure of the API token via `drupalSettings`.

**Name of the Vulnerable Software and Affected Versions** Drupal LDAP / Active Directory Integration versions 0.0.0 through 2.2.1 **Description** An LDAP Injection issue exists because the module does not sufficiently sanitize user-supplied input before incorporating it into an LDAP search filter. This allows an attacker to discover information that should not normally be accessible. **Recommendations** Update Drupal LDAP / Active Directory Integration to a version newer than 2.2.1.

**Name of the Vulnerable Software and Affected Versions** Content Moderation Notifications versions 0.0.0 through 3.9.0 **Description** An issue exists where a permission allowing users to configure email templates containing Twig (a template engine for web pages) was not marked as restricted. If a site administrator grants this permission to less-trusted users, those users can execute Twig code within email templates to escalate privileges and access functionality or information intended only for highly trusted administrators. **Recommendations** Update Content Moderation Notifications to a version later than 3.9.0.

**Name of the Vulnerable Software and Affected Versions** Drupal Commerce CyberSource versions 0.0.0 through 1.10.0 **Description** An observable timing discrepancy in the Secure Acceptance Hosted Checkout gateway integration allows for brute force attacks. The module fails to correctly verify the integrity of data returned by the payment provider, which could enable an attacker to use a timing attack to trick the site into registering a payment as received when it has not been. **Recommendations** Update Drupal Commerce CyberSource to a version later than 1.10.0.

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined (affected versions not specified) **Description** Two distinct issues were identified. First, a module designed to restrict access to the `/user/login` endpoint via a secret key fails to invalidate relevant caches upon activation. This allows attackers to access the login page through cached responses. Second, a module that exposes structured data via JSON endpoints does not sufficiently verify access permissions. This allows anonymous users to retrieve field values from entities they are not authorized to view, such as unpublished content. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Entity API versions 0.0.0 through 1.8.0 **Description** An incorrect authorization issue in the Entity API allows forceful browsing. The module fails to correctly apply access controls for JSON:API entity collection endpoints, leading to an information disclosure. This issue occurs when the JSON:API module is enabled alongside the Entity API module. **Recommendations** Update Entity API to a version later than 1.8.0. As a temporary mitigation, disable the JSON:API module to prevent the exploitation of the entity collection endpoints.

**Name of the Vulnerable Software and Affected Versions** CAPTCHA Protected Page versions 0.0.0 through 1.0.2 **Description** An authentication bypass exists in the CAPTCHA Protected Page module, which allows site administrators to require CAPTCHA confirmation on specific pages. The module fails to sufficiently validate its CAPTCHA verification cookies, enabling an unauthenticated user or automated bot to forge the cookie and bypass the verification process entirely. **Recommendations** Update CAPTCHA Protected Page to a version newer than 1.0.2.

**Name of the Vulnerable Software and Affected Versions** Disable Login Page versions 0.0.0 through 1.1.4 **Description** An authentication bypass exists because the module fails to invalidate relevant caches when login page access restrictions are enabled. This allows previously cached responses for the `/user/login` endpoint to remain accessible, enabling an attacker to bypass the functionality intended to restrict access to the login page. **Recommendations** Clear the system caches after enabling login page access restrictions to ensure that cached responses for the `/user/login` endpoint are invalidated.

**Name of the Vulnerable Software and Affected Versions** Drupal Monster Menus versions 0.0.0 through 9.5.3 **Description** Stored Cross-site Scripting (XSS) occurs because the module does not sufficiently sanitize HTML code within the page name when it is displayed in the built-in tree browser. This allows an attacker with the ability to create pages to execute arbitrary JavaScript in the context of a user session. Cross-site Scripting is a flaw where malicious scripts are injected into trusted websites. **Recommendations** Update Drupal Monster Menus to a version later than 9.5.3.

**Name of the Vulnerable Software and Affected Versions** Drupal Gammu SMS Daemon versions *.* **Description** A security issue exists in the Drupal Gammu SMS Daemon project. The project is currently marked as unsupported, and the security flaw remains unaddressed by the maintainer. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Drupal Gammu SMS Daemon versions *.* **Description** A security issue exists in the Drupal Gammu SMS Daemon project. The project is currently marked as unsupported, and the security flaw remains unaddressed by the maintainer. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Drupal Link content parser (affected versions not specified) **Description** A security issue exists within the Drupal Link content parser. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Drupal Screenshot versions *.* **Description** A security issue exists in the Drupal Screenshot project. The project is currently marked as unsupported, and the security flaw remains unaddressed by the maintainer. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Drupal Gammu SMS Daemon versions *.* **Description** A security issue exists in the Drupal Gammu SMS Daemon project. The project is currently marked as unsupported, and the security flaw remains unaddressed by the maintainer. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Drupal Screenshot versions *.* **Description** A security issue exists in the Drupal Screenshot project. The project is currently marked as unsupported, and the security flaw remains unaddressed by the maintainer. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Drupal External Authentication versions 0.0.0 through 2.0.13 **Description** Improper handling of case sensitivity allows privilege escalation. The module fails to ensure exact matching of externally supplied identity values when storing and looking up authentication mappings under specific database collation configurations. This issue primarily affects sites using certain MySQL or MariaDB collation settings for the authentication mapping storage. **Recommendations** Update Drupal External Authentication to a version newer than 2.0.13.

**Name of the Vulnerable Software and Affected Versions** Commerce PayPal versions 0.0.0 through 1.12.0 Commerce PayPal versions 2.0.0 through 2.1.3 **Description** An incorrect authorization issue allows forceful browsing. The module fails to sufficiently validate transaction results when using the Payflow Link payment gateway, which enables a malicious user to mark transactions as completed without providing payment. **Recommendations** Update Commerce PayPal versions 0.0.0 through 1.12.0 to a version newer than 1.12.0. Update Commerce PayPal versions 2.0.0 through 2.1.3 to a version newer than 2.1.3.

**Name of the Vulnerable Software and Affected Versions** Token Content Access versions 0.0.0 through 3.1.2 **Description** An observable timing discrepancy exists in the Token Content Access module, which allows site administrators to grant content access via access tokens. The module fails to sufficiently protect the comparison of access tokens, enabling a persistent attacker to perform a timing attack—a method of guessing secret data by measuring how long a system takes to respond—to discover a valid token and bypass access restrictions. Exploitation requires the attacker to know the URL of the protected content and accurately measure timing differences in the responses. **Recommendations** Update Token Content Access to a version later than 3.1.2.

**Name of the Vulnerable Software and Affected Versions** Disable Login Page versions *.* **Description** A security issue exists in the Disable Login Page project. The project is currently marked as unsupported, and the maintainer has not provided a fix for this issue. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.