PatchTheCVE: rest\/json projecthttps://patchthecve.com/CVEs with upgrade or downgrade fix stepsCVE-2016-20005: The REST/JSON project 7.x-1.x for Drupal allows user registration bypass, aka SA-CONTRIB-2016-033https://patchthecve.com/cve/CVE-2016-20005.htmlhttps://patchthecve.com/cve/CVE-2016-20005.htmlWed, 17 Jun 2026 00:43:04 +0000CRITICAL 9.8: The REST/JSON project 7.x-1.x for Drupal allows user registration bypass, aka SA-CONTRIB-2016-033. NOTE: This project is not covered by Drupal's security advisory policy.CVE-2016-20004: The REST/JSON project 7.x-1.x for Drupal allows field access bypass, aka SA-CONTRIB-2016-033https://patchthecve.com/cve/CVE-2016-20004.htmlhttps://patchthecve.com/cve/CVE-2016-20004.htmlWed, 17 Jun 2026 00:43:04 +0000CRITICAL 9.8: The REST/JSON project 7.x-1.x for Drupal allows field access bypass, aka SA-CONTRIB-2016-033. NOTE: This project is not covered by Drupal's security advisory policy.CVE-2016-20003: The REST/JSON project 7.x-1.x for Drupal allows user enumeration, aka SA-CONTRIB-2016-033https://patchthecve.com/cve/CVE-2016-20003.htmlhttps://patchthecve.com/cve/CVE-2016-20003.htmlWed, 17 Jun 2026 00:43:03 +0000HIGH 7.5: The REST/JSON project 7.x-1.x for Drupal allows user enumeration, aka SA-CONTRIB-2016-033. NOTE: This project is not covered by Drupal's security advisory policy.CVE-2016-20002: The REST/JSON project 7.x-1.x for Drupal allows comment access bypass, aka SA-CONTRIB-2016-033https://patchthecve.com/cve/CVE-2016-20002.htmlhttps://patchthecve.com/cve/CVE-2016-20002.htmlWed, 17 Jun 2026 00:43:03 +0000CRITICAL 9.8: The REST/JSON project 7.x-1.x for Drupal allows comment access bypass, aka SA-CONTRIB-2016-033. NOTE: This project is not covered by Drupal's security advisory policy.CVE-2016-20001: The REST/JSON project 7.x-1.x for Drupal allows node access bypass, aka SA-CONTRIB-2016-033https://patchthecve.com/cve/CVE-2016-20001.htmlhttps://patchthecve.com/cve/CVE-2016-20001.htmlWed, 17 Jun 2026 00:43:03 +0000CRITICAL 9.8: The REST/JSON project 7.x-1.x for Drupal allows node access bypass, aka SA-CONTRIB-2016-033. NOTE: This project is not covered by Drupal's security advisory policy.CVE-2016-20008: The REST/JSON project 7.x-1.x for Drupal allows session enumeration, aka SA-CONTRIB-2016-033https://patchthecve.com/cve/CVE-2016-20008.htmlhttps://patchthecve.com/cve/CVE-2016-20008.htmlWed, 17 Jun 2026 00:43:04 +0000HIGH 7.5: The REST/JSON project 7.x-1.x for Drupal allows session enumeration, aka SA-CONTRIB-2016-033. NOTE: This project is not covered by Drupal's security advisory policy.CVE-2016-20007: The REST/JSON project 7.x-1.x for Drupal allows session name guessing, aka SA-CONTRIB-2016-033https://patchthecve.com/cve/CVE-2016-20007.htmlhttps://patchthecve.com/cve/CVE-2016-20007.htmlWed, 17 Jun 2026 00:43:04 +0000HIGH 7.5: The REST/JSON project 7.x-1.x for Drupal allows session name guessing, aka SA-CONTRIB-2016-033. NOTE: This project is not covered by Drupal's security advisory policy.CVE-2016-20006: The REST/JSON project 7.x-1.x for Drupal allows blockage of user logins, aka SA-CONTRIB-2016-033https://patchthecve.com/cve/CVE-2016-20006.htmlhttps://patchthecve.com/cve/CVE-2016-20006.htmlWed, 17 Jun 2026 00:43:04 +0000HIGH 7.5: The REST/JSON project 7.x-1.x for Drupal allows blockage of user logins, aka SA-CONTRIB-2016-033. NOTE: This project is not covered by Drupal's security advisory policy.