Description
Cross-site scripting (XSS) vulnerability in the Form API in Drupal 6.x before 6.32 and possibly 7.x before 7.29 allows remote authenticated users with the "administer taxonomy" permission to inject arbitrary web script or HTML via an option group label.
Remediation
References
Related Vulnerabilities
PostgreSQL Improper Validation of Array Index Vulnerability (CVE-2026-2006)
Moodle Permissions, Privileges, and Access Controls Vulnerability (CVE-2015-5272)
WordPress Plugin WP Mobile Detector Cross-Site Scripting (3.2)
Oracle Application Server Other Vulnerability (CVE-2002-0559)
Apache HTTP Server Out-of-bounds Read Vulnerability (CVE-2017-7668)