Greg Knaddison

**Name of the Vulnerable Software and Affected Versions** Ray Enterprise Translation versions 0.0.0 through 4.0.4 Ray Enterprise Translation versions 4.1.0 through 4.1.4 Ray Enterprise Translation versions 11.0.0 through 11.0.4 **Description** Cross-Site Request Forgery (CSRF) occurs when a module fails to protect state-changing administrative routes. This allows an attacker to trick a privileged user into visiting a crafted page to trigger unauthorized actions, such as updating callback settings, uploading or downloading translations, or changing translation state. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Drupal Login Disable versions 0.0.0 through 2.1.4 **Description** The Login Disable module, which restricts site access by requiring a secret key on the login form, does not sufficiently protect the form from brute force attacks. An attacker could potentially bypass this protection by guessing the secret key, depending on its length. This issue is partially mitigated because the attacker still requires a valid username and password to gain access. **Recommendations** Update Drupal Login Disable to a version newer than 2.1.4 to enable flood control that blocks excessive authentication attempts.

**Name of the Vulnerable Software and Affected Versions** ECA: Event - Condition - Action versions 0.0.0 through 2.1.20 ECA: Event - Condition - Action versions 3.0.0 through 3.0.12 ECA: Event - Condition - Action versions 3.1.0 through 3.1.4 **Description** Improperly controlled modification of dynamically-determined object attributes allows Object Injection. Additionally, the Render submodule fails to sufficiently sanitize template code when rendering inline Twig templates as part of no-code models, which can lead to information disclosure. This issue is mitigated if the site is not running an ECA model that utilizes the "Render: Twig" action on a data flow. **Recommendations** Update ECA: Event - Condition - Action to a version later than 2.1.20. Update ECA: Event - Condition - Action to a version later than 3.0.12. Update ECA: Event - Condition - Action to a version later than 3.1.4.

**Name of the Vulnerable Software and Affected Versions** Location Selector versions 0.0.0 through 1.3.0 **Description** An SQL injection issue exists in the Location Selector module, which provides a Views filter for selecting location values. A specific Views filter fails to sufficiently sanitize values derived from user input, allowing for the improper neutralization of special elements used in an SQL command. This issue is mitigated if no View using the affected filter is configured to accept user input. **Recommendations** Update Location Selector to a version later than 1.3.0.

**Name of the Vulnerable Software and Affected Versions** Drupal AI SEO/GEO Analyzer versions 0.0.0 through 1.1.3 **Description** Stored Cross-site Scripting (XSS) occurs when the module generates SEO/GEO analysis reports by sending entity content, including comments, to a Large Language Model (LLM). The module converts the Markdown response from the LLM into HTML and stores it for privileged users without passing it through the filtering pipeline. A crafted prompt injection—where an attacker inserts malicious text into the content analyzed by the LLM—can cause the model to generate markup that executes scripts when the report is viewed. Prompt injection is a technique used to manipulate the output of an LLM by providing specifically crafted input. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Drupal UI Patterns (SDC in Drupal UI) versions 2.0.0 through 2.0.17 **Description** An issue exists where the module does not sufficiently sanitize markup passed to components in certain scenarios, leading to Stored Cross-site Scripting (XSS). Cross-site Scripting is a flaw that allows an attacker to inject malicious scripts into web pages viewed by other users. Exploitation requires the attacker to have permissions to create or update content rendered by UI Patterns. **Recommendations** Update Drupal UI Patterns (SDC in Drupal UI) to a version later than 2.0.17.

**Name of the Vulnerable Software and Affected Versions** Drupal Siteimprove Analytics versions 0.0.0 through 2.0.1 **Description** Improper neutralization of input during web page generation allows Cross-Site Scripting (XSS). The module fails to sufficiently sanitize the Siteimprove Analytics identification code when inserting the JavaScript tracking code. Exploitation requires the attacker to possess a role with the `administer siteimprove analytics` permission. **Recommendations** Update Drupal Siteimprove Analytics to a version later than 2.0.1.

**Name of the Vulnerable Software and Affected Versions** FlowDrop versions 0.0.0 through 1.6.0 **Description** A missing authorization issue allows forceful browsing. The module, which enables testing and running AI-driven workflows via a chat interface, fails to sufficiently enforce permissions on certain endpoints. This may allow attackers to trigger workflow execution, resulting in LLM (Large Language Model) costs and tool side effects, or enable them to send messages into sessions belonging to other users. This issue is mitigated if the attacker does not possess the "View any session" permission, which is not granted to anonymous or authenticated users by default. **Recommendations** Update FlowDrop to a version later than 1.6.0. Restrict the "View any session" permission to prevent unauthorized users from accessing the affected endpoints.

**Name of the Vulnerable Software and Affected Versions** FlowDrop versions 0.0.0 through 1.6.0 **Description** A missing authorization issue allows forceful browsing. The module, which enables testing and running AI-driven workflows via a chat interface, fails to sufficiently re-evaluate human-in-the-loop approval gates during workflow iterations that occur more than once. This can lead to the execution of workflows not intended by the user. Exploitation requires the attacker to possess the "Administer FlowDrop workflows" role or equivalent permissions such as "Create FlowDrop workflows" or "Edit FlowDrop workflows". **Recommendations** Update FlowDrop to a version later than 1.6.0.

**Name of the Vulnerable Software and Affected Versions** Drupal Commerce Realex / Global Payments versions 0.0.0 through 3.0.2 **Description** An incorrect authorization issue allows forceful browsing when the gateway is configured with the redirect payment method. The module fails to sufficiently verify the authenticity of the payment response returned by Global Payments. This specifically affects the redirect payment method, while the lightbox method, which validates the signature, remains unaffected. **Recommendations** Update Drupal Commerce Realex / Global Payments to a version later than 3.0.2. As a temporary mitigation, avoid using the redirect payment method and use the lightbox payment method instead.

**Name of the Vulnerable Software and Affected Versions** Drupal AI Agents versions 0.0.0 through 1.1.4 Drupal AI Agents versions 1.2.0 through 1.2.5 Drupal AI Agents versions 1.3.0 through 1.3.1 **Description** An incorrect authorization issue allows forceful browsing. Under certain conditions, the agent inherits deterministic parameters when invoking the same tool within a single request, which may result in information disclosure. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Drupal AI versions 0.0.0 through 1.2.17 Drupal AI versions 1.3.0 through 1.3.8 Drupal AI versions 1.4.0 through 1.4.3 **Description** A missing authorization issue allows forceful browsing. Certain Drupal core actions exposed as agent tools lack correct access validation, and some core actions are missing associated access-level definitions. This allows an agent to utilize Drupal core actions tools by bypassing access controls, provided the attacker can communicate with the affected agent and the site is configured to expose these tools to non-privileged users. **Recommendations** Update Drupal AI versions 0.0.0 through 1.2.17 to a version newer than 1.2.17. Update Drupal AI versions 1.3.0 through 1.3.8 to a version newer than 1.3.8. Update Drupal AI versions 1.4.0 through 1.4.3 to a version newer than 1.4.3.

**Name of the Vulnerable Software and Affected Versions** WissKI versions 0.0.0 through 4.2.0 **Description** A missing authorization issue in the `wisski mirador` submodule allows forceful browsing and access bypass. The module fails to sufficiently validate parameters submitted via a route before writing them to the session object. **Recommendations** Update WissKI to a version later than 4.2.0. Restrict the use of the `wisski mirador` submodule to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Drupal Paragraphs versions 0.0.0 through 1.21.0 **Description** A missing authorization issue in the Paragraphs Library module allows forceful browsing. The module fails to sufficiently restrict access to direct child paragraphs of library items through API endpoints. This issue is mitigated if the `paragraphs library` module is not in use or if general write access to paragraphs via other modules is restricted. **Recommendations** Update Drupal Paragraphs to a version later than 1.21.0. As a temporary mitigation, disable the `paragraphs library` module.

**Name of the Vulnerable Software and Affected Versions** Drupal Paragraphs versions 0.0.0 through 1.21.0 **Description** A missing authorization issue in the Paragraphs Library module allows forceful browsing. The module does not sufficiently restrict access to unpublished library items within lists. This occurs when the `paragraphs library` module is active and an attacker can access a list of library items, such as a view or a field providing autocomplete suggestions. **Recommendations** Update Drupal Paragraphs to a version later than 1.21.0. As a temporary mitigation, restrict access to the `paragraphs library` module or disable views and autocomplete fields that list library items.

**Name of the Vulnerable Software and Affected Versions** Drupal Advanced Content Feedback versions 0.0.0 through 2.8.0 **Description** An incorrect authorization issue in the Advanced Content Feedback module allows forceful browsing. The module fails to sufficiently verify authorization over the targeted feedback record during the processing of a comment submission. This issue can be exploited by users with the "give feedback" permission, which is granted to both anonymous and authenticated users by default upon installation. **Recommendations** Update Drupal Advanced Content Feedback to a version later than 2.8.0.

**Name of the Vulnerable Software and Affected Versions** Drupal Advanced Content Feedback versions 0.0.0 through 2.8.0 **Description** Stored Cross-site Scripting (XSS) occurs when the module fails to sufficiently sanitize administrator-configured response messages. Specifically, the "Yes response", "No response", and custom text for "No" answers can contain HTML or script markup that is emitted as raw HTML to site visitors. Exploitation requires the attacker to possess a role with the "administer admin feedback" permission. **Recommendations** Update Drupal Advanced Content Feedback to a version later than 2.8.0. Restrict the "administer admin feedback" permission to only trusted users to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Drupal Geolocation Field versions 0.0.0 through 3.15.0 **Description** An SQL injection issue exists in the Drupal Geolocation Field module, which provides functionality to store coordinates and supports views and other modules. The problem occurs because one of the views filters does not sufficiently sanitize values when they are exposed to user input. This allows for the improper neutralization of special elements used in an SQL command. The risk is limited to scenarios where a view is configured to use the affected filter and is set to accept user input. **Recommendations** Update Drupal Geolocation Field to a version later than 3.15.0.

**Name of the Vulnerable Software and Affected Versions** Drupal OpenAI Provider versions 0.0.0 through 1.1.1 Drupal OpenAI Provider versions 1.2.0 through 1.2.2 **Description** Insufficient sanitization of user-supplied URLs leads to a Server-Side Request Forgery (SSRF), a flaw where an attacker can induce the server to make requests to an unintended location. Exploitation requires the attacker to have permissions to modify the host URL and the ability to generate AI-generated images. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Drupal core (affected versions not specified) **Description** The `rebuild.php` front controller, used to clear caches and rebuild the container when a site is in an unexpected condition, fails to correctly validate the Host header against trusted host patterns. This flaw can lead to cache poisoning, where a cache is filled with a malicious response, or an open redirect, which sends users to an attacker-controlled domain. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.