This page displays all public Tag1 D7ES announcements, including security advisories and compatibility updates. You may filter below by announcement type, project, and subscribe to that customized RSS feed at the bottom of the page.

 

Filebrowser - Moderately Critical - Risk of data exposure

Project
Filebrowser
Date
Severity
Moderately Critical
Risk Score
10 ∕ 25 AC:Basic/A:Admin/CI:Some/II:None/E:Theoretical/TD:All
Affected versions
All Drupal 7 versions are affected
The Filebrowser module allows users to browse a list of files in specific directories. This module and its directory listing node type should only be used by users with elevated user access.

Commerce Paybox - Moderately Critical - Payment bypass vulnerability

Project
Commerce Paybox
Date
Severity
Moderately Critical
Risk Score
13 ∕ 25 AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:All
Affected versions
<7.x-1.6
The Commerce Paybox module integrates with Verifone e-commerce for accepting online payments. A payment bypass vulnerability could be exploited to mark a payment as done and flag an order as completed, without the user actually entering a credit card number.

Stage File Proxy - Moderately critical - Denial of Service - SA-CONTRIB-2025-035

Project
Stage File Proxy
Date
Severity
Moderately Critical
Risk Score
11 ∕ 25 AC:Complex/A:None/CI:None/II:Some/E:Theoretical/TD:Default
Affected versions
<7.x-1.11
Stage File Proxy is a solution for transferring production files to a development server on demand. The module doesn't sufficiently validate the existence of remote files prior to attempting to download and create them.

Colorbox - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-041

Project
Colorbox
Date
Severity
Moderately Critical
Risk Score
14 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All
Affected versions
<7.x-2.20
The Colorbox module allows images, iframed, or inline content to be displayed in a modal above the current page. It doesn't sufficiently sanitize data attributes before opening modals.

Flag - Moderately Critical - Cross Site Scripting - BACKDROP-SA-CONTRIB-2025-011

Project
Flag
Date
Severity
Moderately Critical
Risk Score
14 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All
Affected versions
<7.x-3.10
The module doesn't verify flag links before performing the flag action, or verify that the response returned was provided by the flag module. This can allow specially crafted HTML to result in Cross Site Scripting.
Subscribe to Tag1 D7ES Announcements