XSS in Drupal

CVE-2012-1624

Multiple cross-site scripting (XSS) vulnerabilities in the Lingotek module 6.x-1.x before 6.x-1.40 for Drupal allow remote authenticated users to inject arbitrary web script or HTML when (1) creating or (2) editing page content.

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.011 (61.4th percentile) — read the EPSS interpretation.

Affected products

  • Drupal
  • Lingotek — versions 6.x-1.0, 6.x-1.1, 6.x-1.3
  • N/a — versions n/a

Weakness classification (CWE)

References