This page displays all public Tag1 D7ES announcements, including security advisories and compatibility updates. You may filter below by announcement type, project, and subscribe to that customized RSS feed at the bottom of the page.

 

Colorbox - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-041

Project
Colorbox
Date
Severity
Moderately Critical
Risk Score
14 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All
Affected versions
<7.x-2.20
The Colorbox module allows images, iframed, or inline content to be displayed in a modal above the current page. It doesn't sufficiently sanitize data attributes before opening modals.

Flag - Moderately Critical - Cross Site Scripting - BACKDROP-SA-CONTRIB-2025-011

Project
Flag
Date
Severity
Moderately Critical
Risk Score
14 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All
Affected versions
<7.x-3.10
The module doesn't verify flag links before performing the flag action, or verify that the response returned was provided by the flag module. This can allow specially crafted HTML to result in Cross Site Scripting.

Access code - Moderately critical - Access bypass - SA-CONTRIB-2025-028

Project
Access code
Date
Severity
Moderately Critical
Risk Score
14 ∕ 25 AC:Complex/A:None/CI:Some/II:Some/E:Theoretical/TD:Default
Affected versions
< 7.x-1.2
The Access code module allows site visitors to log in using an access code instead of entering username and password. The module doesn't sufficiently protect against brute force attacks to guess a user's access code.

Global Redirect - Moderately critical - Server Side Request Forgery

Project
Global Redirect
Date
Severity
Moderately Critical
Risk Score
10 ∕ 25 AC:None/A:None/CI:None/II:None/E:Theoretical/TD:Uncommon
Affected versions
<=7.x-1.6
Global Redirect is a module that provides support for clean URLs, paths, and aliases. It is susceptible to a Server Side Request Forgery (SSRF) when used in combination with remote_stream_wrapper project.

Link - Moderately critical - Cross Site Scripting - SA-CORE-2025-004

Project
Link
Date
Severity
Moderately Critical
Risk Score
13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default
Affected versions
< 7.x-1.13
The link module provides a standard custom content field for links. This release is a backport of SA-CORE-2025-004, with the addition of a hook_update to register the new sanitization PHP class in Drupal 7's class registry.
Subscribe to Tag1 D7ES Announcements