Show filters
7 Total Results
Displaying 1-7 of 7
Sort by:
Attacker Value
Unknown
CVE-2013-4502
Disclosure Date: May 13, 2014 (last updated October 05, 2023)
The FileField Sources module 6.x-1.x before 6.x-1.9 and 7.x-1.x before 7.x-1.9 for Drupal does not properly check file permissions, which allows remote authenticated users to read arbitrary files by attaching a file.
0
Attacker Value
Unknown
CVE-2013-2129
Disclosure Date: June 24, 2013 (last updated October 05, 2023)
Cross-site scripting (XSS) vulnerability in the Webform module 6.x-3.x before 6.x-3.19 for Drupal allows remote authenticated users with the "edit own webform content" or "edit all webform content" permissions to inject arbitrary web script or HTML via a component label.
0
Attacker Value
Unknown
CVE-2012-5538
Disclosure Date: December 03, 2012 (last updated October 05, 2023)
Cross-site scripting (XSS) vulnerability in the FileField Sources module 6.x-1.x before 6.x-1.6 and 7.x-1.x before 7.x-1.6 for Drupal, when the field has "Reference existing" source enabled, allows remote authenticated users to inject arbitrary web script or HTML via the filename of an uploaded file.
0
Attacker Value
Unknown
CVE-2012-1660
Disclosure Date: September 18, 2012 (last updated October 05, 2023)
Multiple cross-site scripting (XSS) vulnerabilities in components/select.inc in the Webform module 6.x-3.x before 6.x-3.17 and 7.x-3.x before 7.x-3.17 for Drupal, when the "Select (or other)" module is enabled, allow remote authenticated users with the create webform content permission to inject arbitrary web script or HTML via vectors related to (1) checkboxes or (2) radios.
0
Attacker Value
Unknown
CVE-2009-4532
Disclosure Date: December 31, 2009 (last updated October 04, 2023)
Cross-site scripting (XSS) vulnerability in the Webform module 5.x before 5.x-2.8 and 6.x before 6.x-2.8, a module for Drupal, allows remote authenticated users, with webform creation privileges, to inject arbitrary web script or HTML via a field label.
0
Attacker Value
Unknown
CVE-2009-4533
Disclosure Date: December 31, 2009 (last updated October 04, 2023)
The Webform module 5.x before 5.x-2.8 and 6.x before 6.x-2.8, a module for Drupal, does not prevent caching of a page that contains token placeholders for a default value, which allows remote attackers to read session variables via unspecified vectors.
0
Attacker Value
Unknown
CVE-2009-4207
Disclosure Date: December 04, 2009 (last updated October 04, 2023)
Cross-site scripting (XSS) vulnerability in the Webform module 5.x before 5.x-2.7 and 6.x before 6.x-2.7, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via a submission.
0
