Description

Cross-site scripting (XSS) vulnerability in the Ajax system in Drupal 7.x before 7.29 allows remote attackers to inject arbitrary web script or HTML via vectors involving forms with an Ajax-enabled textfield and a file field.

Remediation

References

CVE-2014-5022

Related Vulnerabilities

WordPress Plugin Magic Fields 2 Unspecified Vulnerability (2.3.2.2)

WordPress Plugin Ocean Extra Multiple Vulnerabilities (2.1.2)

Oracle JRE CVE-2023-22006 Vulnerability (CVE-2023-22006)

WordPress 3.7.x Multiple Vulnerabilities (3.7 - 3.7.39)

WordPress Plugin WooCommerce Cross-Site Request Forgery (3.6.4)

Severity

Medium

Tags

Missing Update Known Vulnerabilities CWE-707 CVE-2014-5022