Tag1 D7ES Security Advisories

The Boolean module fails to sanitize admin-configured prefix and suffix strings before rendering them in the field formatter, allowing a user with field administration privileges to inject arbitrary HTML or JavaScript that executes in the browser of any visitor viewing content with that field.

A logic error in `antispam_access_callback()` causes the spam-moderator permission check to never execute, allowing any authenticated user to perform spam moderation operations (marking content as spam, publishing/unpublishing) regardless of their role.

The Friendly Register module exposed unauthenticated AJAX endpoints for checking username and email availability without CSRF token validation, allowing any external site or script to enumerate valid usernames and email addresses on the Drupal site.

The Fit Text module embeds admin-supplied jQuery selectors directly into inline JavaScript without encoding, allowing a user with the "administer fittext" permission to inject arbitrary JavaScript that executes in every site visitor's browser on every page load.

The Add To Calendar module outputs calendar event data (title, description, location, organizer, dates, timezone, and privacy) into HTML "" tags without sanitization, allowing users with content editing permissions to inject arbitrary JavaScript via those fields.

The Get Directions module fails to sanitize location address fields before rendering them in HTML, allowing a user who can edit location data to inject arbitrary JavaScript that executes in the browsers of other users.

The Mailchimp module exposed an administrative autocomplete endpoint to all users, including anonymous visitors. This allowed unauthenticated users to enumerate entity titles and IDs from the site.

When a CAPTCHA protects a form that has additional validation (such as the user login form), an incorrect CAPTCHA answer does not suppress the form's other validation errors. This lets an attacker read those errors without ever solving a CAPTCHA, defeating the brute-force protection and enabling enumeration of credentials or other field values.

The Bootstrap Carousel module fails to sanitize carousel caption text and video ID values before rendering them as HTML, allowing authenticated users with content creation permissions to inject arbitrary scripts that execute in the browsers of site visitors.

The Node View Permissions module fails to exclude anonymous users from its "view own content" permission check. Because Drupal represents anonymous users with uid=0, any node reassigned to uid=0 (e.g., after an account cancellation) becomes accessible to anonymous users who hold a "view own [type] content" permission.