This page displays all public Tag1 D7ES announcements, including security advisories and compatibility updates. You may filter below by announcement type, project, and subscribe to that customized RSS feed at the bottom of the page.

 

Commerce Paybox - Moderately Critical - Payment bypass vulnerability

Date
Severity
Moderately Critical
Affected versions
<7.x-1.6
The Commerce Paybox module integrates with Verifone e-commerce for accepting online payments. A payment bypass vulnerability could be exploited to mark a payment as done and flag an order as completed, without the user actually entering a credit card number.

Stage File Proxy - Moderately critical - Denial of Service - SA-CONTRIB-2025-035

Date
Severity
Moderately Critical
Affected versions
<7.x-1.11
Stage File Proxy is a solution for transferring production files to a development server on demand. The module doesn't sufficiently validate the existence of remote files prior to attempting to download and create them.

Filebrowser - Moderately Critical - Risk of data exposure

Date
Severity
Moderately Critical
Affected versions
All Drupal 7 versions are affected
The Filebrowser module allows users to browse a list of files in specific directories. This module and its directory listing node type should only be used by users with elevated user access.

Colorbox - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-041

Date
Severity
Moderately Critical
Affected versions
<7.x-2.20
The Colorbox module allows images, iframed, or inline content to be displayed in a modal above the current page. It doesn't sufficiently sanitize data attributes before opening modals.

Flag - Moderately Critical - Cross Site Scripting - BACKDROP-SA-CONTRIB-2025-011

Date
Severity
Moderately Critical
Affected versions
<7.x-3.10
The module doesn't verify flag links before performing the flag action, or verify that the response returned was provided by the flag module. This can allow specially crafted HTML to result in Cross Site Scripting.