CVE Vulnerability Catalog

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal SafeDelete allows Stored XSS. This issue affects SafeDelete versions from 0.0.0 to 1.0.88.

A vulnerability was found in the Drupal Patreon module. This issue affects Patreon versions 7.x; the description does not specify the nature of the vulnerability.

The Drupal Key auth module uses browser cache containing sensitive information, allowing exploitation of incorrectly configured access control security levels. This issue affects Key auth versions from 0.0.0 to 2.2.4.

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Feed Block allows Stored XSS. This issue affects Feed Block versions from 0.0.0 to 2.0.2 and from 3.0.0 to 3.0.2.

The CSP log module for Drupal contains an SQL Injection vulnerability due to improper neutralization of special elements used in SQL commands. This issue affects CSP log versions from 0.0.0 to 1.0.2.

The Drupal Central Authentication System (CAS) Server module contains an Open Redirect vulnerability (redirection to an untrusted site) that allows faking the source of data. The issue affects versions from 0.0.0 to 2.0.4 and from 2.1.0 to 2.1.3.

The amazee.ai Private AI Provider module for Drupal contains an SQL Injection vulnerability due to improper neutralization of special elements used in SQL commands. The issue affects versions from 0.0.0 to 1.3.7 and from 1.4.0 to 1.4.3.

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Email Verification / SMS Verification / OTP Verification allows Reflected XSS. This issue affects Email Verification / SMS Verification / OTP Verification versions from 0.0.0 to 2.4.0.

The Email Verification / SMS Verification / OTP Verification module for Drupal contains an Authentication Bypass Using an Alternate Path or Channel vulnerability that allows authentication bypass. This issue affects versions from 0.0.0 to 2.4.0.

The Webform Submissions Delete module for Drupal contains a Missing Authorization vulnerability that allows Forceful Browsing. This issue affects versions from 0.0.0 to 1.2.0.

The Drupal Unpublished Node Permissions module contains an incorrect authorization vulnerability, allowing forceful browsing. This issue affects Unpublished Node Permissions versions from 0.0.0 to 1.8.0.

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal PhotoSwipe - Responsive JavaScript Modal Image Gallery allows Stored XSS. This issue affects PhotoSwipe - Responsive JavaScript Modal Image Gallery versions from 0.0.0 to 5.0.9.

Incorrect Authorization vulnerability in the Drupal Jsonapi Role Access module allows Forceful Browsing. This issue affects Jsonapi Role Access versions from 0.0.0 to 2.0.2.

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Component blocks allows Stored XSS. This issue affects Component blocks versions from 0.0.0 to 1.2.7.

Missing Authorization vulnerability in the Drupal Calculate Working Days module allows Forceful Browsing. This issue affects Calculate Working Days versions from 0.0.0 to 2.0.3.

Missing Authorization vulnerability in the Drupal AI Translate module allows Forceful Browsing. This issue affects AI Translate versions from 0.0.0 to 1.3.2 and from 1.4.0 to 1.4.1.

Missing Authorization vulnerability in the Drupal AI (Artificial Intelligence) module allows Forceful Browsing. This issue affects AI (Artificial Intelligence) versions from 0.0.0 to 1.3.13 and from 1.4.0 to 1.4.8.

Missing Authorization vulnerability in the Drupal Advanced Search module allows Forceful Browsing. This issue affects Advanced Search versions from 0.0.0 to 2.4.5.

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Drupal Media Library Importer allows Path Traversal. This issue affects Media Library Importer versions from 0.0.0 to 2.1.6.

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass in the handling of FuncIRI attributes. rcube_washtml detected the CSS url() token with a pattern that enumerated only some of its escaped spellings, so values using other CSS escape sequences, for example \000075rl( or u\72 l(, were not recognized and remote content was loaded from an HTML message without the user's consent. Upstream fixed this in the commit “Fix remote content blocking bypass via CSS escapes in FuncIRI attributes (again)”, which resolves CSS escapes before matching and also inspects the `to`, `from` and `by` attributes.