This module provides Drupal with various security-hardening options, for example by emitting various configurable HTTP response headers.

The module doesn't sufficiently validate input in Content Security Policy (CSP) violation reports. This can cause errors when a logging module (e.g. dblog or syslog) attempts to parse the resulting log message which contains invalid data.

This vulnerability is mitigated by the fact that to be affected a site must have seckit's CSP reporting functionality enabled. Recent versions of Drupal 10 and 11 core are not vulnerable due to [improved parsing of log messages](https://www.drupal.org/project/drupal/issues/2481349).

Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 3.4.x before 3.4.5 allow remote authenticated users to inject arbitrary web script or HTML via a crafted row that triggers an improperly constructed confirmation message after inline-editing and save operations, related to (1) `js/functions.js` and (2) `js/tbl_structure.js`.

This security advisory fixes a severe vulnerability in the eZ Platform Admin UI, and we recommend that you install it as soon as possible. Parts of the Admin UI are vulnerable to XSS injection. All 2.x sites are at risk, and particularly those that allow user generated content. The update adds the necessary escaping of injected code. This resolves the issue both for code that has already been injected, and any future such code.

To install, use Composer to update "ezsystems/ezplatform-admin-ui" and "ezsystems/ezplatform-page-builder" to one of the "Resolving versions" mentioned above. (ezplatform-page-builder exists only in eZ Platform Enterprise Edition.)

This module makes it possible for you to integrate Cookiebot and Google Tag Manager in a fast and simple way.

The module doesn't sufficiently filter for malicious script leading to a persistent cross site scripting (XSS) vulnerability.

The module doesn't sufficiently sanitize the Siteimprove Analytics identification code when inserting the JavaScript tracking code; this could be exploited to achieve Cross-Site Scripting (XSS).

This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer siteimprove\_analytics".

The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: [https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai...](https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-maintainer-of-a-project-that-is-unsupported-for-security-reasons)

The Session package 1.x before 1.3.1 for Joomla! Framework allows remote attackers to execute arbitrary code via unspecified session values.

### Impact
Layout XML enabled admin users to execute arbitrary commands via block methods.

This module enables you to retrieve image metadata and use them in fields or title.

The module doesn't sufficiently restrict access to module setting pages thereby causing an access bypass vulnerability.

This vulnerability is mitigated by the fact that an attacker must have permission to create entities of certain content entity types.

Failing to properly encode editor input, several frontend components are susceptible to Cross-Site Scripting, allowing authenticated editors to inject arbitrary HTML.

Failing to respect user groups of logged in users when caching queries, Extbase is susceptible to information disclosure. The query caching (introduced in Extbase 6.2) used to cache queries that query results for a specific user group were presented to a different group.

This module configures default editorial workflows for LocalGov Drupal content types. It provides a Drupal content moderation workflow, a content approvals dashboard, content scheduling and content preview.

The module doesn't sufficiently restrict access to a view of Service Contacts at which exposes the names and content items assigned to each Service Contact.

Multiple directory traversal vulnerabilities in the relational schema implementation in phpMyAdmin 3.4.x before 3.4.3.2 allow remote authenticated users to include and execute arbitrary local files via directory traversal sequences in an export type field, related to (1) `libraries/schema/User_Schema.class.php` and (2) `schema_export.php`.

An Information Disclosure vulnerability in jumpUrl mechanism, used to track access on web pages and provided files, allows a remote attacker to read arbitrary files on a host.

The expected value of a mandatory hash secret, intended to invalidate such requests, is exposed to remote users allowing them to bypass access control by providing the correct value.

There's no authentication required to exploit this vulnerability. The vulnerability allows to read any file, the web server user account has access to.

This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider.

The module stores sensitive authentication information in a manner that could allow disclosure to users with access to configuration or related system data.

This vulnerability is mitigated by the fact that an attacker must first obtain access to configuration or underlying storage mechanisms.

Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr ERP/CRM 3.5 and 3.6 allow remote attackers to inject arbitrary web script or HTML via the Business Search (`search_nom`) field to (1) `htdocs/societe/societe.php` or (2) `htdocs/societe/admin/societe.php`.

This module enables users to log in by email address with minimal configurations.

Drupal core contains protection against brute force attacks via a flood control mechanism. This module's functionality did not replicate the flood control, enabling brute force attacks.

Stage File Proxy is a general solution for getting production files on a development server on demand.

The module doesn't sufficiently validate the existence of remote files prior to attempting to download and create them. An attacker could send many requests and exhaust disk resources.

This vulnerability is mitigated by the fact it only affects sites where the Origin is configured with a trailing slash. Sites that cannot upgrade immediately can confirm they do not have a trailing slash or remove the trailing slash to mitigate the issue.

The Indexed Search Engine (indexed_search) system extension in TYPO3 4.0.0 through 4.0.9, 4.1.0 through 4.1.7, and 4.2.0 through 4.2.3 allows remote attackers to execute arbitrary commands via a crafted filename containing shell metacharacters, which is not properly handled by the command-line indexer.

This module enables notifications to be sent to all users of a particular role, or to the content's author when a piece of content is transitioned from one state to another via core's content\_moderation module.

The module doesn't sufficiently check access to content when sending notifications.  
This vulnerability is mitigated by the fact that an attacker must have been assigned to receive notifications for the given content. Additionally, only data sent in the email is visible, so the attacker cannot access the content on the site.

This Security Advisory is about two issues of low to medium severity. We recommend that you install the update as soon as possible.


There is an XSS vulnerability in CKEditor, which is used by AlloyEditor, which is used in eZ Platform Admin UI. Scripts can be injected through specially crafted "protected" comments. We are not sure it is exploitable in eZ Platform, but recommend installing it to be on the safe side. It is fixed in CKEditor v4.14, AlloyEditor v2.11.9. It is distributed via Composer, for:

eZ Platform v1.13.x: ezsystems/PlatformUIAssetsBundle v4.2.3 (included from ezsystems/PlatformUIBundle v1.13.x)
eZ Platform v2.5.13: ezsystems/ezplatform-admin-ui-assets v4.2.1
eZ Platform v3.0.*: ezsystems/ezplatform-admin-ui-assets v5.0.1
eZ Platform v3.1.2: ezsystems/ezplatform-admin-ui-assets v5.1.1


Drafts that are sent to trash become visible in the Review Queue, even for users that were not able to see them before this action. It's not possible to preview them, but their title and review history is displayed. This affects Enterprise Edition only, of which ezplatform-workflow is a part. This security update is distributed via Composer, for

eZ Platform EE v2.5.13: ezsystems/ezplatform-workflow v1.1.9
eZ Platform EE v3.1.2: ezsystems/ezplatform-workflow v2.1.1

mod/data/edit.php in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 sets a certain group ID to zero upon a database-entry change, which allows remote authenticated users to obtain sensitive information by accessing the database after an edit by a teacher.

Cross-site scripting (XSS) vulnerability in the URL downloader repository in repository/url/lib.php in Moodle through 2.3.11, 2.4.x before 2.4.10, 2.5.x before 2.5.6, and 2.6.x before 2.6.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

This module enables you to take payments through the Global Payments / Realex Hosted Payment Page (HPP), either via a lightbox iframe or via a full-page redirect.

When the gateway is configured with the **redirect** payment method, the module doesn't sufficiently verify the authenticity of the payment response returned by Global Payments.

The **lightbox** payment method validates the signature and is not affected, so sites that use the lightbox payment method are not affected.

This module integrates with Islandora, an open-source digital asset management (DAM) framework. Islandora integrates with various open-source services, which can be run in a distributed environment.

The module doesn't sufficiently sanitize URI paths for its custom route used for attaching media to nodes, which can also lead to cross-site scripting and other vulnerabilities.

This vulnerability is mitigated by the fact that an attacker must have a role with the permission "create media" and the ability to edit the node the media is being attached to.

This module enables you to allow users to include a second authentication method in addition to password authentication.

The module doesn't sufficiently prevent one time login links from bypassing TFA.

This vulnerability is mitigated by the fact that an attacker must have access to an email account attached to a user or a valid one time password link for a user.

This module integrates Plausible Analytics on a site.

The module did not properly filter output in certain cases.

This vulnerability is mitigated by the fact that an attacker must have permission to add raw HTML to the website, such as an unfiltered WYSIWYG field on a public-facing comment.

The Media Responsive Thumbnail module allows media reference fields to be rendered as a responsive image.

This module does not properly check entity access prior to rendering media. This may result in users seeing thumbnails of media items they do not have access to.

This release was coordinated with [SA-CORE-2023-002](https://www.drupal.org/sa-core-2023-002).

Multiple cross-site scripting (XSS) vulnerabilities in the advanced-grading implementation in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allow remote authenticated users to inject arbitrary web script or HTML via a crafted (1) qualification or (2) rating field in a rubric.

The Ultimate Table Field module enables you to store table data in a field and edit each table cell through a dialog, using cell field plugins such as text, link, and file.

The module doesn't sufficiently protect the route that opens the cell editor dialog. The route is accessible to anonymous users, who can open the dialog for any cell type. The dialog allows uploading files to the server location.

This vulnerability is partially mitigated by the fact that only files with the `pdf`, `doc` and `docx` extensions are accepted.

This module enables you to store structured data in configurable fields and expose Data Field values through JSON endpoints.

The module doesn't sufficiently check access when returning Data Field values through its JSON endpoint. This may allow anonymous users to access field values belonging to entities they cannot otherwise view, including unpublished content.

This module enables you to add or overwrite PHP configuration on a drupal website.

The module doesn't sufficiently allow access to set these configurations, leading to arbitrary PHP configuration execution by an attacker.

This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer phpconfig".

After updating the module, it's important to review the permissions of your website and if 'administer phpconfig' permission is given to a not fully trusted user role, we advise to revoke it.

The Lottiefiles Field module enables you to integrate the lottiefiles features into your page.

The module does not sufficiently filter user-provided text on output, resulting in a Cross-Site Scripting (XSS) vulnerability.

This vulnerability is mitigated by the fact that an attacker must have a role with the permission to create or edit content that has lottiefiles fields.

Due to an oversized maximum result limit, TYPO3 component Indexed Search is susceptible to a Denial of Service attack.

This webform module enables you to build 'Term select' and 'Term checkboxes' elements.

The module doesn't sufficiently check term 'view' access when rendering the 'Term select' and 'Term checkboxes' elements. Unpublished terms will always appear in the 'Term select' and 'Term checkboxes' elements.

This module enables a UI to display all libraries provided by modules and themes on the Drupal site.

The module doesn't sufficiently protect the libraries reporting page. It curently is using the 'access content' permission and not a proper administrative/access permission.

The vulnerability/library information can be exploited by simply visiting/knowing the url of the reporting page. The solution is to protect the page via a module specific permission that must be granted by an administrative user.

his Security Update fixes a severe vulnerability in the eZ Platform Admin UI, and we recommend that you install it as soon as possible. It affects eZ Platform 2.x.
 
The functionality for resetting a forgotten password is vulnerable to brute force attack. Depending on configuration and other circumstances an attacker may exploit this to gain control over user accounts. The update ensures such an attack is exceedingly unlikely to succeed.
 
You may want to consider a configuration change to further strengthen your security. By default a password reset request is valid for 1 hour. Reducing this time will make attacks even more difficult, but ensure there is enough time left to account for email delivery delays, and user delays. See documentation at https://doc.ezplatform.com/en/latest/guide/user_management/#changing-and-recovering-passwords

To install, use Composer to update to one of the "Resolving versions" mentioned above. If you use eZ Platform 2.5, update ezsystems/ezplatform-user to v1.0.1. If you use eZ Platform 2.4, update ezsystems/ezplatform-admin-ui to v1.4.6, and ezsystems/ezplatform-admin-ui-modules to v1.4.4, and ezsystems/repository-forms to v2.4.5)

Failing to sanitize content from editors, the link validator component is susceptible to Cross-Site Scripting. A valid editor account with access to content which is scanned by the link validator component is required to exploit this vulnerability.

This module enables you to handle fields for Custom Menu Links.  
The module doesn't sufficiently check requests to one of the module controllers if the user has permission 'administer menu'.  
This vulnerability is mitigated by the fact that an attacker must have a role with the permission to create content.

### Impact
An XSS vulnerability exists in versions of Pterodactyl Panel before 0.7.19. Affected versions do not properly sanitize account names before rendering them to the dropdown selector in the admin area when creating or modifying a server.

### Patches
This XSS has been addressed in 0.7.19 and will be rolled forwards into the 1.0-rc.7 release.

### Workarounds
No workaround exists without manual patching. See https://github.com/pterodactyl/panel/pull/2441/files for the files changed.

### For more information
If you have any questions or comments about this advisory please reach out on Discord, or by emailing `dane` at `pterodactyl` dot `io`.

_Thank you to Sergej for the responsible disclosure of this issue._

Cross-site scripting (XSS) vulnerability in the click enlarge functionality in TYPO3 4.3.x before 4.3.9 and 4.4.x before 4.4.5 when the caching framework is enabled, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

If a website has been set to the "dev" environment mode, a URL can be provided which includes an XSS payload which will be executed in the resulting error message.

notes/edit.php in Moodle 1.9.x through 1.9.19, 2.x through 2.1.10, 2.2.x before 2.2.8, 2.3.x before 2.3.5, and 2.4.x before 2.4.2 allows remote authenticated users to reassign notes via a modified (1) userid or (2) courseid field.

The Basket module enables e-commerce and checkout functionality for Drupal sites.

The module does not sufficiently sanitize user-supplied data before passing it to PHP's unserialize().

An attacker can supply a crafted payload and trigger PHP Object Injection. If a viable gadget chain exists in the site codebase or installed dependencies, this can result in arbitrary PHP code execution.

Concrete CMS before 8.5.13 and 9.x before 9.2.2 allows unauthorized access because directories can be created with insecure permissions. File creation functions (such as the Mkdir() function) gives universal access (0777) to created folders by default. Excessive permissions can be granted when creating a directory with permissions greater than 0755 or when the permissions argument is not specified.

### Impact
Canceling of orders not related to the logged-in user

### Patches
We recommend updating to the current version 6.4.1.1. You can get the update to 6.4.1.1 regularly via the Auto-Updater or directly via the download overview.

https://www.shopware.com/en/download/#shopware-6

### Workarounds
For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.

https://store.shopware.com/en/detail/index/sArticle/518463/number/Swag136939272659


### Impact
File validation can be configured to reject certain files by file type. When this happens, validation fails, and the content can't be published. However, the file can be saved when saving the content draft. This means unwanted files can be present in storage, even if they are not easily accessible due to the content not being published. The fix ensures these unwanted file types are never stored. An attacker would need to have existing access to create content with a file field type to exploit this.

### Patches
See "Patched versions".
Commit: https://github.com/ezsystems/ezplatform-kernel/commit/7e472317f7c75f45f72f74c38406952d8bea0de1

### References
https://developers.ibexa.co/security-advisories/ibexa-sa-2024-002-file-validation-and-workflow-stages

The module doesn’t sufficiently protect against malicious links, which means an attacker can trick an administrator into performing unwanted actions.

This vulnerability is mitigated by the fact that the set of unwanted actions is limited to specific configurations.

CVE ID↕	Published↕	CVSS↓
DRUPAL-CONTRIB-2024-039	Sep 11, 2024	N/A
GHSA-3p87-w3c5-27gf	May 17, 2022	N/A
GHSA-q73v-79x3-jv2w	May 15, 2024	N/A
DRUPAL-CONTRIB-2024-055	Oct 30, 2024	N/A
DRUPAL-CONTRIB-2026-073	Jul 8, 2026	N/A
DRUPAL-CONTRIB-2026-089	Jul 22, 2026	N/A
GHSA-wwfh-28hx-w2r2	May 17, 2022	N/A
GHSA-26rr-v2j2-25fh	Aug 30, 2021	N/A
DRUPAL-CONTRIB-2018-017	Mar 21, 2018	N/A
GHSA-6fc6-cj2j-h22x	Jun 3, 2024	N/A
GHSA-vccp-5v5h-p8m6	May 17, 2022	N/A
DRUPAL-CONTRIB-2026-039	Jun 3, 2026	N/A
GHSA-xhqq-554j-p4x8	May 17, 2022	N/A
GHSA-jg55-3q6h-2ccf	May 2, 2022	N/A
DRUPAL-CONTRIB-2026-149	Sep 9, 2026	N/A
GHSA-6fw8-vf2x-4wpm	May 17, 2022	N/A
DRUPAL-CONTRIB-2023-045	Sep 13, 2023	N/A
DRUPAL-CONTRIB-2025-035	Apr 16, 2025	N/A
GHSA-74w6-ww7w-45j9	May 2, 2022	N/A
DRUPAL-CONTRIB-2023-047	Sep 27, 2023	N/A
GHSA-4c2w-v5rq-5mx7	May 15, 2024	N/A
GHSA-jq7x-gm9r-v8m7	May 13, 2022	N/A
GHSA-ch68-5r37-p7c3	May 13, 2022	N/A
DRUPAL-CONTRIB-2026-058	Jun 24, 2026	N/A
DRUPAL-CONTRIB-2026-016	Feb 25, 2026	N/A
DRUPAL-CONTRIB-2025-006	Jan 22, 2025	N/A
DRUPAL-CONTRIB-2025-061	May 14, 2025	N/A
DRUPAL-CONTRIB-2026-079	Jul 8, 2026	N/A
DRUPAL-CONTRIB-2025-107	Sep 24, 2025	N/A
DRUPAL-CONTRIB-2023-010	Mar 15, 2023	N/A
GHSA-m8f5-9wg8-2c3h	May 13, 2022	N/A
DRUPAL-CONTRIB-2026-153	Sep 9, 2026	N/A
DRUPAL-CONTRIB-2026-108	Aug 26, 2026	N/A
DRUPAL-CONTRIB-2018-055	Aug 8, 2018	N/A
DRUPAL-CONTRIB-2022-046	Jun 29, 2022	N/A
GHSA-pmxp-7224-h794	Jun 4, 2024	N/A
DRUPAL-CONTRIB-2020-016	May 6, 2020	N/A
DRUPAL-CONTRIB-2023-027	Jun 28, 2023	N/A
GHSA-hfpp-2vhw-qq43	May 15, 2024	N/A
DRUPAL-CONTRIB-2024-074	Dec 11, 2024	N/A
GHSA-cg4m-qjjp-7497	Jun 3, 2024	N/A
DRUPAL-CONTRIB-2019-050	May 22, 2019	N/A
GHSA-5822-pw57-vv37	Oct 8, 2020	N/A
GHSA-9hw3-4gvp-8mv5	May 17, 2022	N/A
GHSA-74j9-xhqr-6qv3	Jan 23, 2025	N/A
GHSA-prrh-679x-79qh	May 13, 2022	N/A
DRUPAL-CONTRIB-2026-038	May 27, 2026	N/A
GHSA-m87h-jxr6-f82w	Nov 17, 2023	N/A
GHSA-wq3r-jwrq-xg6w	Jun 28, 2021	N/A
GHSA-mwvh-p3hx-x4gg	Mar 20, 2024	N/A
DRUPAL-CONTRIB-2023-031	Jul 26, 2023	N/A

Know every vulnerability
before it knows you.

packagist CVE Vulnerabilities — DevGuard Vulnerability Database

Know every vulnerabilitybefore it knows you.

packagist CVE Vulnerabilities — DevGuard Vulnerability Database

Know every vulnerability
before it knows you.