Description
Cross-site scripting vulnerability in Drupal Core. Drupal AJAX API does not disable JSONP by default, allowing for an XSS attack. This issue affects: Drupal Drupal Core 7.x versions prior to 7.73; 8.8.x versions prior to 8.8.10; 8.9.x versions prior to 8.9.6; 9.0.x versions prior to 9.0.6.
Remediation
References
Related Vulnerabilities
WordPress Plugin Nextend Google Connect Cross-Site Scripting (1.5.0)
Microsoft SQL Server CVE-2023-36417 Vulnerability (CVE-2023-36417)
phpBB Server-Side Request Forgery (SSRF) Vulnerability (CVE-2019-11767)
Dotclear Unrestricted Upload of File with Dangerous Type Vulnerability (CVE-2016-7902)
qdPM Multiple Cross-site Scripting (XSS) Vulnerabilities (CVE-2015-3883)