D7ES PSA related to Internationalization Node (i18n_node)
Date
Tag1 D7ES recommends you restrict access to trusted roles with the Administer content translations permission similar to if that permission were tagged with restricted access.
This page displays all public Tag1 D7ES announcements, including security advisories and compatibility updates. You may filter below by announcement type, project, and subscribe to that customized RSS feed at the bottom of the page.
Facebook Pixel - Less critical - Cross Site Scripting
Project
Date
Severity
Less Critical
Affected versions
<7.x-1.2
The Facebook Pixel module integrates with Facebook analytics. The Drupal 7 version of the module does not sufficiently protect its configuration against cross-site scripting attacks.
Commerce Paybox - Moderately Critical - Payment bypass vulnerability
Project
Date
Severity
Moderately Critical
Affected versions
<7.x-1.6
The Commerce Paybox module integrates with Verifone e-commerce for accepting online payments. A payment bypass vulnerability could be exploited to mark a payment as done and flag an order as completed, without the user actually entering a credit card number.
Stage File Proxy - Moderately critical - Denial of Service - SA-CONTRIB-2025-035
Project
Date
Severity
Moderately Critical
Affected versions
<7.x-1.11
Stage File Proxy is a solution for transferring production files to a development server on demand. The module doesn't sufficiently validate the existence of remote files prior to attempting to download and create them.
Filebrowser - Moderately Critical - Risk of data exposure
Project
Date
Severity
Moderately Critical
Affected versions
All Drupal 7 versions are affected
The Filebrowser module allows users to browse a list of files in specific directories. This module and its directory listing node type should only be used by users with elevated user access.
D7ES PSA relating to 7.x PHPExcel
Date
Tag1 D7ES is marking the 7.x branch of the PHPExcel Drupal project as unsupported. Multiple vulnerabilities in this library are known. If you use this project, it is recommended that you uninstall it.
Colorbox - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-041
Project
Date
Severity
Moderately Critical
Affected versions
<7.x-2.20
The Colorbox module allows images, iframed, or inline content to be displayed in a modal above the current page. It doesn't sufficiently sanitize data attributes before opening modals.
Mailjet - Less critical - Multiple upstream vulnerabilities
Project
Date
Severity
Less Critical
Affected versions
<7.x02.24
Mailjet is susceptible to multiple upstream vulnerabilities from its use of the embedded PHPMailer & Guzzle library.
Flag - Moderately Critical - Cross Site Scripting - BACKDROP-SA-CONTRIB-2025-011
Project
Date
Severity
Moderately Critical
Affected versions
<7.x-3.10
The module doesn't verify flag links before performing the flag action, or verify that the response returned was provided by the flag module. This can allow specially crafted HTML to result in Cross Site Scripting.
D7ES PSA relating to 7.x elFinder file manager
Date
Tag1 D7ES is marking the 7.x branch of the elfinder Drupal project as unsupported. There is at least one known security issue with its upstream dependencies that have not been addressed. If you use this project, it is recommended that you uninstall it.