CVE-2014-5169

Cross-site scripting XSS vulnerability in the Date module before 7.x-2.8 for Drupal allows remote authenticated users with the permission to create a date field to inject arbitrary web script or HTML via the date field title...

CVE-2014-5169

CVE-2014-5169 is a Cross‑Site Scripting (XSS) vulnerability in the Drupal Date module before 7.x-2.8. It allows remote authenticated users with the permission to create a date field to inject arbitrary web script or HTML via the date field title. Impact is partial integrity (I:P) with no confiden...

Drupal HTTP Parameter Key/Value SQL Injection

This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'Drupal HTTP Parameter Key/Value SQL Injection', 'Description' = %q This module exploits the Drupal HTTP Parameter Key/Value SQL...

Drupal HTTP Parameter Key/Value SQL Injection Vulnerability

This Metasploit module exploits the Drupal HTTP Parameter Key/Value SQL Injection aka Drupageddon in order to achieve a remote shell on the vulnerable instance. This Metasploit module was tested against Drupal 7.0 and 7.31 was fixed in 7.32. This module requires Metasploit:...

CVE-2014-8320

Cross-site scripting XSS vulnerability in the Custom Search module 6.x-1.x before 6.x-1.12 and 7.x-1.x before 7.x-1.14 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via the "Label text" field to the results configuration page...

CVE-2014-8319

Cross-site scripting XSS vulnerability in the easysocialadminsummary function in the Easy Social module 7.x-2.x before 7.x-2.11 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via a block title...

CVE-2014-8317

Cross-site scripting XSS vulnerability in the Webform Validation module 6.x-1.x before 6.x-1.6 and 7.x-1.x before 7.x-1.4 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via a component name text...

Cross site scripting

Cross-site scripting XSS vulnerability in the Custom Search module 6.x-1.x before 6.x-1.12 and 7.x-1.x before 7.x-1.14 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via the "Label text" field to the results configuration page...

Cross site scripting

Cross-site scripting XSS vulnerability in the Webform Validation module 6.x-1.x before 6.x-1.6 and 7.x-1.x before 7.x-1.4 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via a component name text...

Cross site scripting

Cross-site scripting XSS vulnerability in the easysocialadminsummary function in the Easy Social module 7.x-2.x before 7.x-2.11 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via a block title...

Cross site scripting

Cross-site scripting XSS vulnerability in the Webform module 6.x-3.x before 6.x-3.20, 7.x-3.x before 7.x-3.20, and 7.x-4.x before 7.x-4.0-beta2 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via a field label title, when two fields hav...

CVE-2014-8320

Cross-site scripting XSS vulnerability in the Custom Search module 6.x-1.x before 6.x-1.12 and 7.x-1.x before 7.x-1.14 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via the "Label text" field to the results configuration page...

CVE-2014-8317

The CVE-2014-8317 entry concerns Drupal’s Webform Validation module. A cross-site scripting (XSS) flaw exists in the component name text field in versions 6.x-1.x prior to 6.x-1.6 and 7.x-1.x prior to 7.x-1.4, allowing remote authenticated users with certain permissions to inject arbitrary web sc...

CVE-2014-8317

Cross-site scripting XSS vulnerability in the Webform Validation module 6.x-1.x before 6.x-1.6 and 7.x-1.x before 7.x-1.4 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via a component name text...

CVE-2014-8319

CVE-2014-8319 describes a cross-site scripting (XSS) vulnerability in the Drupal Easy Social module (version 7.x-2.x prior to 7.x-2.11). The issue arises from insufficient validation of block titles when users create a custom block via the module’s admin interface, allowing remote authenticated u...

CVE-2014-8319

Cross-site scripting XSS vulnerability in the easysocialadminsummary function in the Easy Social module 7.x-2.x before 7.x-2.11 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via a block title...

CVE-2014-8318

The issue CVE-2014-8318 affects the Webform contributed module for Drupal. Affected versions: Webform 6.x-3.x before 6.x-3.20; 7.x-3.x before 7.x-3.20; and 7.x-4.x before 7.x-4.0-beta2. Description: remote authenticated users with certain permissions can inject arbitrary web script or HTML via a ...

CVE-2014-8320

The CVE-2014-8320 entry concerns Drupal's Custom Search module (6.x-1.x prior to 6.x-1.12 and 7.x-1.x prior to 7.x-1.14). The vulnerability is an XSS flaw where remote authenticated users with certain permissions can inject arbitrary web script or HTML via the "Label text" field on the results co...

CVE-2014-8318

Cross-site scripting XSS vulnerability in the Webform module 6.x-3.x before 6.x-3.20, 7.x-3.x before 7.x-3.20, and 7.x-4.x before 7.x-4.0-beta2 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via a field label title, when two fields hav...

Internet Bug Bounty: Drupal 7 pre auth sql injection and remote code execution

Motivation I found a SQL Injection bug in Drupal $value ... $newkeys$key . '' . $i = $value; The function assumes that it is called with an array which has no keys. Example: dbquery"SELECT FROM users where name IN :name", array':name'=array'user1','user2'; Which results in this SQL Statement SELE...