Easy Breadcrumb
Monthly
Missing authorization checks in the Drupal contributed module Easy Breadcrumb (versions 0.0.0 through 2.0.11) allow a remote unauthenticated visitor to reach resources by directly requesting them rather than following the intended navigation path, a forceful-browsing condition whose confirmed impact is limited to low-severity information disclosure (CVSS 3.7). There is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis, and the EPSS score of 0.14% (4th percentile) plus an SSVC posture of exploitation:none / automatable:no place this in a monitor-and-schedule band rather than an emergency. The vendor has released a patch, so sites running the affected range should update the module.
Cross-site scripting (XSS) vulnerability in the Easy Breadcrumb module 7.x-2.x before 7.x-2.10 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable.
Missing authorization checks in the Drupal contributed module Easy Breadcrumb (versions 0.0.0 through 2.0.11) allow a remote unauthenticated visitor to reach resources by directly requesting them rather than following the intended navigation path, a forceful-browsing condition whose confirmed impact is limited to low-severity information disclosure (CVSS 3.7). There is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis, and the EPSS score of 0.14% (4th percentile) plus an SSVC posture of exploitation:none / automatable:no place this in a monitor-and-schedule band rather than an emergency. The vendor has released a patch, so sites running the affected range should update the module.
Cross-site scripting (XSS) vulnerability in the Easy Breadcrumb module 7.x-2.x before 7.x-2.10 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable.