Description

Cross-site scripting (XSS) vulnerability in the Date Tools sub-module in the Date module 6.x before 6.x-2.3 for Drupal allows remote authenticated users, with "use date tools" or "administer content types" privileges, to inject arbitrary web script or HTML via a "Content type label" field.

Remediation

References

CVE-2009-3156

Related Vulnerabilities

Tornado Improper Input Validation Vulnerability (CVE-2012-2374)

Dot CMS Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2021-35361)

WordPress Plugin vSlider Multi Image Slider for WordPress Multiple Vulnerabilities (4.1.2)

WordPress Plugin Companion Auto Update Multiple Vulnerabilities (3.2.0)

Coppermine Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2012-1614)

Severity

Low

Classification

CVE-2009-3156 CWE-707

Tags

Missing Update Known Vulnerabilities