CVE-2020-13673 | ByteOS Network

Vulnerability Details :

CVE-2020-13673

Assigner-drupal

Assigner Org ID-2c85b837-eb8b-40ed-9d74-228c62987387

Published At-11 Feb, 2022 | 15:35

Updated At-04 Aug, 2024 | 12:25

The Entity Embed module provides a filter to allow embedding entities in content fields. In certain circumstances, the filter could allow an unprivileged user to inject HTML into a page when it is accessed by a trusted user with permission to embed entities. In some cases, this could lead to cross-site scripting.

EPSS History

Score

Latest Score

-

N/A

Percentile

Latest Percentile

-

N/A

▼Common Vulnerabilities and Exposures (CVE)

Assigner:drupal

Assigner Org ID:2c85b837-eb8b-40ed-9d74-228c62987387

Published At:11 Feb, 2022 | 15:35

Updated At:04 Aug, 2024 | 12:25

▼CVE Numbering Authority (CNA)

The Entity Embed module provides a filter to allow embedding entities in content fields. In certain circumstances, the filter could allow an unprivileged user to inject HTML into a page when it is accessed by a trusted user with permission to embed entities. In some cases, this could lead to cross-site scripting.

Affected Products

Vendor

The Drupal Association

Product

Versions

Affected

From 8.x before 8.x-1.2 (custom)

Problem Types

Type	CWE ID	Description
CWE	CWE-352	CWE-352 Cross-Site Request Forgery (CSRF)

Type: CWE

CWE ID: CWE-352

Description: CWE-352 Cross-Site Request Forgery (CSRF)

References

Hyperlink	Resource
https://www.drupal.org/sa-contrib-2021-028	x_refsource_CONFIRM

Hyperlink: https://www.drupal.org/sa-contrib-2021-028

Resource:

x_refsource_CONFIRM

▼Authorized Data Publishers (ADP)

CVE Program Container

References

Hyperlink	Resource
https://www.drupal.org/sa-contrib-2021-028	x_refsource_CONFIRM x_transferred

Hyperlink: https://www.drupal.org/sa-contrib-2021-028

Resource:

x_refsource_CONFIRM

x_transferred

▼National Vulnerability Database (NVD)

Source:mlhess@drupal.org

Published At:11 Feb, 2022 | 16:15

Updated At:25 Jul, 2022 | 10:26

The Entity Embed module provides a filter to allow embedding entities in content fields. In certain circumstances, the filter could allow an unprivileged user to inject HTML into a page when it is accessed by a trusted user with permission to embed entities. In some cases, this could lead to cross-site scripting.

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	6.1	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Primary	2.0	2.6	LOW	AV:N/AC:H/Au:N/C:N/I:P/A:N

Type: Primary

Version: 3.1

Base score: 6.1

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Type: Primary

Version: 2.0

Base score: 2.6

Base severity: LOW

Vector:

AV:N/AC:H/Au:N/C:N/I:P/A:N

CPE Matches

The Drupal Association

>>entity_embed>>8.x-1.0

cpe:2.3:a:drupal:entity_embed:8.x-1.0:-:*:*:*:*:*:*

The Drupal Association

>>entity_embed>>8.x-1.0

cpe:2.3:a:drupal:entity_embed:8.x-1.0:alpha1:*:*:*:*:*:*

The Drupal Association

>>entity_embed>>8.x-1.0

cpe:2.3:a:drupal:entity_embed:8.x-1.0:alpha2:*:*:*:*:*:*

The Drupal Association

>>entity_embed>>8.x-1.0

cpe:2.3:a:drupal:entity_embed:8.x-1.0:alpha3:*:*:*:*:*:*

The Drupal Association

>>entity_embed>>8.x-1.0

cpe:2.3:a:drupal:entity_embed:8.x-1.0:beta1:*:*:*:*:*:*

The Drupal Association

>>entity_embed>>8.x-1.0

cpe:2.3:a:drupal:entity_embed:8.x-1.0:beta2:*:*:*:*:*:*

The Drupal Association

>>entity_embed>>8.x-1.0

cpe:2.3:a:drupal:entity_embed:8.x-1.0:beta3:*:*:*:*:*:*

The Drupal Association

>>entity_embed>>8.x-1.0

cpe:2.3:a:drupal:entity_embed:8.x-1.0:rc1:*:*:*:*:*:*

The Drupal Association

>>entity_embed>>8.x-1.0

cpe:2.3:a:drupal:entity_embed:8.x-1.0:rc2:*:*:*:*:*:*

The Drupal Association

>>entity_embed>>8.x-1.1

cpe:2.3:a:drupal:entity_embed:8.x-1.1:*:*:*:*:*:*:*

The Drupal Association

>>entity_embed>>8.x-1.2

cpe:2.3:a:drupal:entity_embed:8.x-1.2:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-79	Primary	nvd@nist.gov
CWE-352	Secondary	mlhess@drupal.org

CWE ID: CWE-79

Type: Primary

Source: nvd@nist.gov

CWE ID: CWE-352

Type: Secondary

Source: mlhess@drupal.org

References

Hyperlink	Source	Resource
https://www.drupal.org/sa-contrib-2021-028	mlhess@drupal.org	Patch Vendor Advisory

Hyperlink: https://www.drupal.org/sa-contrib-2021-028

Source: mlhess@drupal.org

Resource:

Patch

Vendor Advisory

Similar CVEs

9803Records found

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-2.1||LOW

EPSS-0.20% / 42.36%

||

7 Day CHG~0.00%

Published-30 Sep, 2009 | 15:00

Updated-07 Aug, 2024 | 06:31

Cross-site scripting (XSS) vulnerability in the Bibliography (aka Biblio) module 6.x-1.6 for Drupal allows remote authenticated users, with certain content-creation privileges, to inject arbitrary web script or HTML via the Title field, probably a different vulnerability than CVE-2009-3479.

Vendor-ron_jerome n/a The Drupal Association

Product-bibliography drupal n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.67% / 70.35%

||

7 Day CHG~0.00%

Published-26 Oct, 2009 | 17:00

Updated-07 Aug, 2024 | 06:38

Cross-site scripting (XSS) vulnerability in Organic Groups (OG) Vocabulary 5.x before 5.x-1.1 and 6.x before 6.x-1.1, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via the group title.

Vendor-moshe_weitzman n/a The Drupal Association

Product-og_vocab drupal n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-3.5||LOW

EPSS-0.16% / 37.19%

||

7 Day CHG~0.00%

Published-16 Sep, 2009 | 17:00

Updated-07 Aug, 2024 | 06:14

Multiple cross-site scripting (XSS) vulnerabilities in the ImageCache module 5.x before 5.x-2.5 and 6.x before 6.x-2.0-beta10, a module for Drupal, allow remote authenticated users, with "administer imagecache" permissions, to inject arbitrary web script or HTML via unspecified vectors.

Vendor-drewish n/a The Drupal Association

Product-imagecache drupal n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-6.8||MEDIUM

EPSS-0.15% / 36.51%

||

7 Day CHG~0.00%

Published-09 Nov, 2009 | 17:00

Updated-07 Aug, 2024 | 06:45

Multiple cross-site request forgery (CSRF) vulnerabilities in the User Protect module 5.x before 5.x-1.4 and 6.x before 6.x-1.3, a module for Drupal, allow remote attackers to hijack the authentication of administrators for requests that (1) delete the editing protection of a user or (2) delete a certain type of administrative-bypass rule.

Vendor-chad_phillips n/a The Drupal Association

Product-userprotect drupal n/a

CWE ID-CWE-352

Cross-Site Request Forgery (CSRF)

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-3.5||LOW

EPSS-0.34% / 55.67%

||

7 Day CHG~0.00%

Published-10 Sep, 2009 | 18:00

Updated-17 Sep, 2024 | 01:36

Cross-site scripting (XSS) vulnerability in the Calendar module 6.x before 6.x-2.2 for Drupal allows remote authenticated users, with "create new content types" privileges, to inject arbitrary web script or HTML via the title of a content type.

Vendor-karen_stevenson n/a The Drupal Association

Product-drupal calendar n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.61% / 68.94%

||

7 Day CHG~0.00%

Published-16 May, 2019 | 21:36

Updated-04 Aug, 2024 | 22:40

In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, validation messages are not escaped, which can lead to XSS when user input is included. This is related to symfony/framework-bundle.

Vendor-sensiolabs n/a The Drupal Association

Product-drupal symfony n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.52% / 65.68%

||

7 Day CHG~0.00%

Published-09 Oct, 2009 | 14:18

Updated-07 Aug, 2024 | 06:38

Cross-site scripting (XSS) vulnerability in the "Monitor browsers' feature in Browscap before 5.x-1.1 and 6.x-1.1, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via the User-Agent HTTP header.

Vendor-mikeryan n/a The Drupal Association

Product-browscap drupal n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.52% / 65.68%

||

7 Day CHG~0.00%

Published-09 Nov, 2009 | 17:00

Updated-07 Aug, 2024 | 06:45

Cross-site scripting (XSS) vulnerability in the Node Hierarchy module 5.x before 5.x-1.3 and 6.x before 6.x-1.3, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via a child node title.

Vendor-ronan_dowling n/a The Drupal Association

Product-nodehierarchy drupal n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-6.8||MEDIUM

EPSS-0.21% / 43.94%

||

7 Day CHG~0.00%

Published-26 Oct, 2009 | 17:00

Updated-16 Sep, 2024 | 21:09

Open redirect vulnerability in Simplenews Statistics 6.x before 6.x-2.0, a module for Drupal, allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.

Vendor-sjoerd_arendsen n/a The Drupal Association

Product-drupal simplenews_statistics n/a

CWE ID-CWE-352

Cross-Site Request Forgery (CSRF)

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.52% / 65.68%

||

7 Day CHG~0.00%

Published-09 Nov, 2009 | 17:00

Updated-07 Aug, 2024 | 06:45

Cross-site scripting (XSS) vulnerability in the NGP COO/CWP Integration (crmngp) module 6.x before 6.x-1.12 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified "user-supplied information."

Vendor-sean_robertson n/a The Drupal Association

Product-crmngp drupal n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.25% / 48.62%

||

7 Day CHG~0.00%

Published-08 Jul, 2009 | 15:00

Updated-07 Aug, 2024 | 05:52

Cross-site scripting (XSS) vulnerability in the Forum module in Drupal 6.x before 6.13 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Vendor-n/a The Drupal Association

Product-drupal n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-3.5||LOW

EPSS-0.34% / 55.67%

||

7 Day CHG~0.00%

Published-27 Jul, 2009 | 18:00

Updated-17 Sep, 2024 | 04:09

Cross-site scripting (XSS) vulnerability in the Links Related module in the Links Package 5.x before 5.x-1.13 and 6.x before 6.x-1.2, a module for Drupal, allows remote authenticated users to inject arbitrary web script or HTML via the title field.

Vendor-scott_courtney n/a The Drupal Association

Product-links_package drupal n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-3.5||LOW

EPSS-0.23% / 45.90%

||

7 Day CHG~0.00%

Published-16 Jun, 2009 | 20:26

Updated-16 Sep, 2024 | 19:56

Cross-site scripting (XSS) vulnerability in the term data detail page in Taxonomy manager 5.x before 5.x-1.2, a module for Drupal, allows remote authenticated users, with administer taxonomy privileges or the ability to use free tagging to add taxonomy terms, to inject arbitrary web script or HTML via "Parent and related terms."

Vendor-mattias_hutterer n/a The Drupal Association

Product-taxonomy_manager drupal n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.36% / 57.19%

||

7 Day CHG~0.00%

Published-16 Jun, 2009 | 19:00

Updated-16 Sep, 2024 | 18:55

Multiple cross-site scripting (XSS) vulnerabilities in Booktree 5.x before 5.x-7.3 and 6.x before 6.x-1.1, a module for Drupal, allow remote attackers to inject arbitrary web script or HTML via the (1) node title and (2) node body in a tree root page.

Vendor-heine.familiedeelstra n/a The Drupal Association

Product-drupal booktree n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-3.5||LOW

EPSS-0.34% / 55.67%

||

7 Day CHG~0.00%

Published-16 Jun, 2009 | 19:00

Updated-17 Sep, 2024 | 03:43

Cross-site scripting (XSS) vulnerability in the administrative page interface in Taxonomy manager 5.x before 5.x-1.2 and 6.x before 6.x-1.1, a module for Drupal, allows remote authenticated users, with administer taxonomy privileges or the ability to use free tagging to add taxonomy terms, to inject arbitrary web script or HTML via (1) vocabulary names, (2) synonyms, and (3) term names.

Vendor-n/a The Drupal Association

Product-taxonomy_manager drupal n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-6.8||MEDIUM

EPSS-0.25% / 48.53%

||

7 Day CHG~0.00%

Published-22 Jul, 2009 | 17:09

Updated-07 Aug, 2024 | 05:52

Cross-site request forgery (CSRF) vulnerability in the Fivestar module 5.x-1.x before 5.x-1.14 and 6.x-1.x before 6.x-1.14, a module for Drupal, allows remote attackers to hijack the authentication of arbitrary users for requests that cast votes.

Vendor-lullabot n/a The Drupal Association

Product-fivestar_module_for_drupal drupal n/a

CWE ID-CWE-352

Cross-Site Request Forgery (CSRF)

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-3.5||LOW

EPSS-0.25% / 48.46%

||

7 Day CHG~0.00%

Published-16 Jun, 2009 | 19:00

Updated-16 Sep, 2024 | 19:56

Cross-site scripting (XSS) vulnerability in Nodequeue 5.x before 5.x-2.7 and 6.x before 6.x-2.2, a module for Drupal, allows remote authenticated users with administer taxonomy permissions to inject arbitrary web script or HTML via vocabulary names.

Vendor-n/a The Drupal Association

Product-nodequeue drupal n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.36% / 57.19%

||

7 Day CHG~0.00%

Published-20 Mar, 2009 | 18:00

Updated-07 Aug, 2024 | 04:57

Cross-site scripting (XSS) vulnerability in the Tasklist module 5.x-1.x before 5.x-1.3 and 5.x-2.x before 5.x-2.0-alpha1, a module for Drupal, allows remote authenticated users to inject arbitrary web script or HTML via Cascading Style Sheets (CSS).

Vendor-jake_gordon n/a The Drupal Association

Product-tasks drupal n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.52% / 65.68%

||

7 Day CHG~0.00%

Published-24 Mar, 2009 | 19:00

Updated-07 Aug, 2024 | 04:57

Multiple cross-site scripting (XSS) vulnerabilities in the node edit form feature in Drupal Content Construction Kit (CCK) 6.x before 6.x-2.2, a module for Drupal, allow remote attackers to inject arbitrary web script or HTML via the (1) titles of candidate referenced nodes in the Node reference sub-module and the (2) names of candidate referenced users in the User reference sub-module.

Vendor-n/a The Drupal Association

Product-content_construction_kit drupal n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-3.5||LOW

EPSS-0.26% / 48.73%

||

7 Day CHG~0.00%

Published-20 May, 2009 | 19:00

Updated-07 Aug, 2024 | 05:20

Cross-site scripting (XSS) vulnerability in Feed Block 6.x-1.x before 6.x-1.1, a module for Drupal, allows remote authenticated users with administrator feed permissions to inject arbitrary web script or HTML via unspecified vectors in "aggregator items."

Vendor-ivanjaros n/a The Drupal Association

Product-feed_block drupal n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.31% / 53.55%

||

7 Day CHG~0.00%

Published-06 Apr, 2009 | 16:00

Updated-17 Sep, 2024 | 03:23

Cross-site scripting (XSS) vulnerability in Feed element mapper 5.x before 5.x-1.1, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via the content title in admin/content/node-type/nodetype/map.

Vendor-n/a The Drupal Association

Product-feedapi_mapper drupal n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.72% / 71.60%

||

7 Day CHG~0.00%

Published-06 May, 2009 | 17:00

Updated-07 Aug, 2024 | 05:20

Cross-site scripting (XSS) vulnerability in Drupal 5.x before 5.17 and 6.x before 6.11, as used in vbDrupal before 5.17.0, allows remote attackers to inject arbitrary web script or HTML via crafted UTF-8 byte sequences before the Content-Type meta tag, which are treated as UTF-7 by Internet Explorer 6 and 7.

Vendor-n/a The Drupal Association

Product-drupal n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-3.5||LOW

EPSS-0.34% / 55.67%

||

7 Day CHG~0.00%

Published-05 Jun, 2009 | 18:13

Updated-16 Sep, 2024 | 23:01

Cross-site scripting (XSS) vulnerability in the Quiz module 5.x, 6.x-2.x before 6.x-2.2, and 6.x-3.x before 6.x-3.0, a module for Drupal, allows remote authenticated users, with create quizzes or quiz questions access, to inject arbitrary web script or HTML via unspecified vectors.

Vendor-n/a The Drupal Association

Product-quiz n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.36% / 57.19%

||

7 Day CHG~0.00%

Published-20 Apr, 2009 | 14:06

Updated-16 Sep, 2024 | 23:56

Cross-site scripting (XSS) vulnerability in the CCK comment reference module 6.x before 6.x-1.2, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via certain comment titles associated with a node edit form.

Vendor-n/a The Drupal Association

Product-cck_comment_reference drupal n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.26% / 49.44%

||

7 Day CHG~0.00%

Published-23 Mar, 2009 | 19:26

Updated-07 Aug, 2024 | 04:57

Cross-site scripting (XSS) vulnerability in the Send by e-mail module in the "Printer, e-mail and PDF versions" module 5.x before 5.x-4.4 and 6.x before 6.x-1.4, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via vectors involving outbound HTML e-mail.

Vendor-n/a The Drupal Association

Product-drupal print n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.52% / 65.68%

||

7 Day CHG~0.00%

Published-08 Jul, 2009 | 15:00

Updated-16 Sep, 2024 | 18:08

Cross-site scripting (XSS) vulnerability in Advanced Forum 5.x before 5.x-1.1 and 6.x before 6.x-1.1, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Vendor-michelle_cox n/a The Drupal Association

Product-advanced_forum drupal n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-3.5||LOW

EPSS-0.32% / 54.79%

||

7 Day CHG~0.00%

Published-05 Mar, 2009 | 02:00

Updated-07 Aug, 2024 | 04:48

Cross-site scripting (XSS) vulnerability in the taxonomy_theme_admin_table_builder function (taxonomy_theme_admin.inc) in Taxonomy Theme module before 5.x-1.2, a module for Drupal, allows remote authenticated users with the "administer taxonomy" permission, or the ability to create pages when tagging is enabled, to inject arbitrary web script or HTML via the Vocabulary name (name parameter) to index.php. NOTE: some of these details are obtained from third party information.

Vendor-n/a The Drupal Association

Product-drupal taxonomy_theme_module n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-6

Assigner-Drupal.org

Matching Score-6

Assigner-Drupal.org

CVSS Score-7.6||HIGH

EPSS-0.04% / 12.41%

||

7 Day CHG~0.00%

Published-15 Aug, 2025 | 16:26

Updated-21 Aug, 2025 | 18:49

COOKiES Consent Management - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-092

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal COOKiES Consent Management allows Cross-Site Scripting (XSS).This issue affects COOKiES Consent Management: from 0.0.0 before 1.2.16.

Vendor-cookies_consent_management_project The Drupal Association

Product-cookies_consent_management COOKiES Consent Management

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-6.8||MEDIUM

EPSS-0.16% / 37.91%

||

7 Day CHG~0.00%

Published-27 Jun, 2009 | 18:00

Updated-16 Sep, 2024 | 23:51

Cross-site request forgery (CSRF) vulnerability in OpenID 5.x before 5x.-1.2, a module for Drupal, allows remote attackers to hijack the authentication of unspecified victims to delete OpenID identities via unknown vectors.

Vendor-peter_wolanin n/a The Drupal Association

Product-drupal openid n/a

CWE ID-CWE-352

Cross-Site Request Forgery (CSRF)

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-6.8||MEDIUM

EPSS-0.21% / 42.84%

||

7 Day CHG~0.00%

Published-19 Feb, 2009 | 15:02

Updated-07 Aug, 2024 | 11:20

Cross-site request forgery (CSRF) vulnerability in the Localization client 5.x before 5.x-1.1 and 6.x before 6.x-1.6 and the Localization server 5.x before 5.x-1.0-alpha5 and 6.x before 6.x-alpha2, modules for Drupal, allows remote attackers to perform unauthorized actions as administrators via unspecified vectors related to the "local translation submission interface."

Vendor-n/a The Drupal Association

Product-localization_client localization_server n/a

CWE ID-CWE-352

Cross-Site Request Forgery (CSRF)

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.36% / 57.19%

||

7 Day CHG~0.00%

Published-06 Mar, 2009 | 11:00

Updated-07 Aug, 2024 | 11:27

Cross-site scripting (XSS) vulnerability in the Answers module 5.x-1.x-dev and possibly other 5.x versions, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via a Simple Answer to a question.

Vendor-ticklespace n/a The Drupal Association

Product-answers_module drupal n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.36% / 57.19%

||

7 Day CHG~0.00%

Published-27 Jun, 2009 | 18:00

Updated-16 Sep, 2024 | 17:15

Cross-site scripting (XSS) vulnerability in OpenID 5.x before 5.x-1.2, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Vendor-peter_wolanin n/a The Drupal Association

Product-drupal openid n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.36% / 57.19%

||

7 Day CHG~0.00%

Published-25 Feb, 2009 | 23:00

Updated-07 Aug, 2024 | 11:27

Cross-site scripting (XSS) vulnerability in the User Karma module 5.x before 5.x-1.13 and 6.x before 6.x-1.0-beta1, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via unspecified messages.

Vendor-n/a Joomla!The Drupal Association

Product-joomla\!user_karma_module n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.30% / 52.55%

||

7 Day CHG~0.00%

Published-01 Sep, 2009 | 16:00

Updated-07 Aug, 2024 | 11:56

Cross-site scripting (XSS) vulnerability in Refine by Taxonomy 5.x before 5.x-0.1, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via a taxonomy term, which is not properly handled by refine_by_taxo when displaying tags.

Vendor-ber_kessels n/a The Drupal Association

Product-refine_by_taxo drupal n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-6.8||MEDIUM

EPSS-0.13% / 32.66%

||

7 Day CHG~0.00%

Published-01 Sep, 2009 | 16:00

Updated-07 Aug, 2024 | 11:56

Cross-site request forgery (CSRF) vulnerability in Live 5.x before 5.x-0.1, a module for Drupal, allows remote attackers to hijack the authentication of unspecified privileged users for requests that can be leveraged to execute arbitrary PHP code.

Vendor-gurpartap_singh n/a The Drupal Association

Product-drupal live n/a

CWE ID-CWE-352

Cross-Site Request Forgery (CSRF)

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-6.8||MEDIUM

EPSS-0.14% / 35.03%

||

7 Day CHG~0.00%

Published-02 Mar, 2009 | 19:00

Updated-07 Aug, 2024 | 11:27

Multiple cross-site request forgery (CSRF) vulnerabilities in Comment Mail 5.x before 5.x-1.1, a module for Drupal, allow remote attackers to hijack the authentication of administrators.

Vendor-n/a The Drupal Association

Product-comment_mail n/a

CWE ID-CWE-352

Cross-Site Request Forgery (CSRF)

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-6.8||MEDIUM

EPSS-0.44% / 62.17%

||

7 Day CHG~0.00%

Published-26 Mar, 2009 | 20:28

Updated-07 Aug, 2024 | 11:34

Multiple cross-site request forgery (CSRF) vulnerabilities in the update feature in Drupal 5.x before 5.13 and 6.x before 6.7 allow remote attackers to perform unauthorized actions as the superuser via unspecified vectors, as demonstrated by causing the superuser to "execute old updates" that modify the database.

Vendor-n/a The Drupal Association

Product-drupal n/a

CWE ID-CWE-352

Cross-Site Request Forgery (CSRF)

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.51% / 65.29%

||

7 Day CHG~0.00%

Published-26 Mar, 2009 | 20:28

Updated-07 Aug, 2024 | 11:34

Drupal 5.x before 5.13 and 6.x before 6.7 does not delete all related content when an input format is deleted, which prevents the content from being properly filtered and allows remote attackers to conduct cross-site scripting (XSS) attacks via unspecified vectors.

Vendor-n/a The Drupal Association

Product-drupal n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-3.5||LOW

EPSS-0.25% / 48.46%

||

7 Day CHG~0.00%

Published-20 Feb, 2009 | 23:00

Updated-07 Aug, 2024 | 11:20

Cross-site scripting (XSS) vulnerability in the administrative interface in Drupal Content Construction Kit (CCK) 5.x before 5.x-1.10 and 6.x before 6.x-2.0, a module for Drupal, allows remote authenticated users with "administer content" permissions to inject arbitrary web script or HTML via (1) field labels and (2) content-type names.

Vendor-n/a The Drupal Association

Product-content_construction_kit n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-3.5||LOW

EPSS-0.28% / 50.86%

||

7 Day CHG~0.00%

Published-19 Feb, 2009 | 15:02

Updated-07 Aug, 2024 | 11:20

Cross-site scripting (XSS) vulnerability in Drupal 5.x before 5.12 and 6.x before 6.6 allows remote authenticated users with create book content or edit node book hierarchy permissions to inject arbitrary web script or HTML via the book page title.

Vendor-n/a The Drupal Association

Product-drupal n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-3.5||LOW

EPSS-0.14% / 34.07%

||

7 Day CHG~0.00%

Published-01 Jun, 2009 | 14:00

Updated-07 Aug, 2024 | 05:27

Multiple cross-site scripting (XSS) vulnerabilities in Drupal 5.x before 5.18 and 6.x before 6.12 allow (1) remote authenticated users to inject arbitrary web script or HTML via crafted UTF-8 byte sequences that are treated as UTF-7 by Internet Explorer 6 and 7, which are not properly handled in the "HTML exports of books" feature; and (2) allow remote authenticated users with administer taxonomy permissions to inject arbitrary web script or HTML via the help text of an arbitrary vocabulary. NOTE: vector 1 exists because of an incomplete fix for CVE-2009-1575.

Vendor-n/a The Drupal Association

Product-drupal n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-3.5||LOW

EPSS-0.16% / 37.19%

||

7 Day CHG~0.00%

Published-28 Jan, 2009 | 15:00

Updated-07 Aug, 2024 | 11:13

Cross-site scripting (XSS) vulnerability in the Ajax Checklist module 5.x before 5.x-1.1 for Drupal allows remote authenticated users, with create and edit permissions for posts, to inject arbitrary web script or HTML via unspecified vectors involving the ajax_checklist filter.

Vendor-n/a The Drupal Association

Product-ajax_checklist drupal n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-3.5||LOW

EPSS-0.15% / 36.41%

||

7 Day CHG~0.00%

Published-28 Jan, 2009 | 15:00

Updated-07 Aug, 2024 | 11:13

Cross-site scripting (XSS) vulnerability in the Simplenews module 5.x before 5.x-1.5 and 6.x before 6.x-1.0-beta4, a module for Drupal, allows remote authenticated users, with "administer taxonomy" permissions, to inject arbitrary web script or HTML via a Newsletter category field.

Vendor-link3 n/a The Drupal Association

Product-simplenews drupal n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.31% / 53.55%

||

7 Day CHG~0.00%

Published-14 Feb, 2009 | 02:00

Updated-07 Aug, 2024 | 11:20

Cross-site scripting (XSS) vulnerability in EveryBlog 5.x and 6.x, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Vendor-n/a The Drupal Association

Product-everyblog drupal n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.36% / 57.19%

||

7 Day CHG~0.00%

Published-20 Apr, 2009 | 14:06

Updated-17 Sep, 2024 | 03:08

Cross-site scripting (XSS) vulnerability in the Localization client module 5.x before 5.x-1.2 and 6.x before 6.x-1.7, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via input to the translation functionality.

Vendor-n/a The Drupal Association

Product-localization_client drupal n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-6

Assigner-Drupal.org

Matching Score-6

Assigner-Drupal.org

CVSS Score-5.4||MEDIUM

EPSS-0.03% / 8.68%

||

7 Day CHG~0.00%

Published-26 Jun, 2025 | 13:34

Updated-11 Jul, 2025 | 14:24

Paragraphs table - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-084

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Paragraphs table allows Cross-Site Scripting (XSS).This issue affects Paragraphs table: from 2.0.0 before 2.0.5.

Vendor-paragraphs_table_project The Drupal Association

Product-paragraphs_table Paragraphs table

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.47% / 63.90%

||

7 Day CHG~0.00%

Published-19 Sep, 2008 | 18:00

Updated-07 Aug, 2024 | 10:08

Cross-site scripting (XSS) vulnerability in the Greg Holsclaw Link to Us module 5.x before 5.x-1.1 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via the "Link page header" field.

Vendor-n/a The Drupal Association

Product-link_to_us n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-3.5||LOW

EPSS-0.23% / 45.90%

||

7 Day CHG~0.00%

Published-19 Sep, 2008 | 18:00

Updated-07 Aug, 2024 | 10:08

Cross-site scripting (XSS) vulnerability in the Talk module 5.x before 5.x-1.3 and 6.x before 6.x-1.5, a module for Drupal, allows remote authenticated users to inject arbitrary web script or HTML via a node title.

Vendor-n/a The Drupal Association

Product-talk n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-6

Assigner-Drupal.org

Matching Score-6

Assigner-Drupal.org

CVSS Score-5.4||MEDIUM

EPSS-0.03% / 8.68%

||

7 Day CHG~0.00%

Published-26 Jun, 2025 | 13:33

Updated-11 Jul, 2025 | 14:25

Simple XML sitemap - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-083

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Simple XML sitemap allows Cross-Site Scripting (XSS).This issue affects Simple XML sitemap: from 0.0.0 before 4.2.2.

Vendor-gbyte The Drupal Association

Product-simple_xml_sitemap Simple XML sitemap

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.32% / 54.60%

||

7 Day CHG~0.00%

Published-17 Oct, 2008 | 21:00

Updated-07 Aug, 2024 | 10:24

Cross-site scripting (XSS) vulnerability in Shindig-Integrator 5.x, a module for Drupal, allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors in generated pages.

Vendor-n/a The Drupal Association

Product-shindig-integrator n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')