https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2015-4394.htmlhttps://patchthecve.com/cve/CVE-2015-4394.htmlWed, 17 Jun 2026 00:27:13 +0000MEDIUM 5.0: The Services module 7.x-3.x before 7.x-3.12 for Drupal allows remote attackers to bypass the field_access restriction and obtain sensitive private field information via unspecified vectors.https://patchthecve.com/cve/CVE-2015-4393.htmlhttps://patchthecve.com/cve/CVE-2015-4393.htmlWed, 17 Jun 2026 00:27:13 +0000MEDIUM 6.0: The resource/endpoint for uploading files in the Services module 7.x-3.x before 7.x-3.12 for Drupal allows remote authenticated users with the "Save file information" permission to execute arbitrary code via a crafted filename.https://patchthecve.com/cve/CVE-2014-9153.htmlhttps://patchthecve.com/cve/CVE-2014-9153.htmlWed, 17 Jun 2026 00:17:50 +0000MEDIUM 4.3: Cross-site scripting (XSS) vulnerability in the Services module 7.x-3.x before 7.x-3.10 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via the callback parameter in a JSONP response.https://patchthecve.com/cve/CVE-2014-9152.htmlhttps://patchthecve.com/cve/CVE-2014-9152.htmlWed, 17 Jun 2026 00:17:50 +0000HIGH 7.5: The _user_resource_create function in the Services module 7.x-3.x before 7.x-3.10 for Drupal uses a password of 1 when creating new user accounts, which makes it easier for remote attackers to guess the password via a brute force attack.https://patchthecve.com/cve/CVE-2014-9151.htmlhttps://patchthecve.com/cve/CVE-2014-9151.htmlWed, 17 Jun 2026 00:17:50 +0000HIGH 7.5: The Services module 7.x-3.x before 7.x-3.10 for Drupal does not properly limit the rate of authentication attempts, which makes it easier for remote attackers to obtain access via a brute-force attack on the administrative password.https://patchthecve.com/cve/CVE-2013-2158.htmlhttps://patchthecve.com/cve/CVE-2013-2158.htmlTue, 16 Jun 2026 23:52:51 +0000MEDIUM 6.8: Cross-site request forgery (CSRF) vulnerability in the Services module 6.x-3.x and 7.x-3.x before 7.x-3.4 for Drupal allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.