CVE-2024-13237

The Drupal File Entity (fieldable files) module (versions 7.X- through 7.X-2.38 *) contains an Improper Neutralization of Input During Web Page Generation vulnerability. This flaw allows attackers to bypass security restrictions and execute Cross-Site Scripting (XSS) attacks, including persistent...

CVE-2024-13276

The File Entity (fieldable files) module in the Drupal CMS (versions 7.X-* before 7.X-2.39) is vulnerable to Forceful Browsing due to an Insertion of Sensitive Information Into Sent Data issue. The root cause is that the module fails to verify the existence of folders within the private destinati...