Description
Multiple cross-site scripting (XSS) vulnerabilities in Drupal before 4.6.11, and 4.7 before 4.7.5, allow remote attackers to inject arbitrary web script or HTML via unspecified parameters in the (1) filter and (2) system modules. NOTE: some of these details are obtained from third party information.
Remediation
References
Related Vulnerabilities
Lodash Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2026-4800)
Piwigo Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2017-10681)
WordPress 2.5 Cookie Integrity Protection Unauthorized Access Vulnerability (0.6.2 - 2.5)
WordPress Plugin Photo Gallery by 10Web-Mobile-Friendly Image Gallery SQL Injection (1.3.29)
Jboss EAP Permissions, Privileges, and Access Controls Vulnerability (CVE-2016-2141)