Description

Cross-site scripting (XSS) vulnerability in the Autocomplete system in Drupal 6.x before 6.37 and 7.x before 7.39 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, related to uploading files.

Remediation

References

CVE-2015-6658

Related Vulnerabilities

Perl Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability (CVE-2018-18312)

TYPO3 Unrestricted Upload of File with Dangerous Type Vulnerability (CVE-2017-14251)

MediaWiki CVE-2023-45374 Vulnerability (CVE-2023-45374)

ownCloud Improper Access Control Vulnerability (CVE-2016-9462)

WordPress Plugin Pondol Form to Mail Cross-Site Scripting (1.1)

Severity

Medium

Classification

CVE-2015-6658 CWE-707

Tags

Missing Update Known Vulnerabilities