Description
Multiple cross-site scripting (XSS) vulnerabilities in Drupal 5.x before 5.2, and 4.7.x before 4.7.7, (1) allow remote attackers to inject arbitrary web script or HTML via "some server variables," including PHP_SELF; and (2) allow remote authenticated administrators to inject arbitrary web script or HTML via custom content type names.
Remediation
References
Related Vulnerabilities
WordPress Plugin Page Showcaser Boxes Cross-Site Scripting (1.1)
Moodle Cryptographic Issues Vulnerability (CVE-2011-4303)
Serendipity Other Vulnerability (CVE-2004-1620)
Moodle Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2015-3180)
Ruby Use of Externally-Controlled Format String Vulnerability (CVE-2017-0898)