CVE-2014-3453: Improper Control of Generation of Code

Eval injection vulnerability in the flagimportformvalidate function in includes/flag.export.inc in the Flag module 7.x-3.0, 7.x-3.5, and earlier for Drupal allows remote authenticated administrators to execute arbitrary PHP code via the "Flag import code" text area to admin/structure/flags/import...

PT-2014-5332

Name of the Vulnerable Software and Affected Versions Flag module versions 7.x-3.0 through 7.x-3.5 Description The issue allows remote authenticated administrators to execute arbitrary PHP code via the "Flag import code" text area in the /admin/structure/flags/import API endpoint. This could...