DRUPAL-CONTRIB-2026-140

This module enables you to manage content deletion and provides reports for identifying orphaned content. The module doesn't sufficiently sanitize node titles when displaying the orphaned nodes report. This leads to a persistent cross-site scripting vulnerability XSS. This vulnerability is...

PT-2026-89241

Name of the Vulnerable Software and Affected Versions Drupal SafeDelete versions 0.0.0 through 1.0.88 Description Stored cross-site scripting XSS occurs because the module does not sufficiently sanitize node titles when displaying the orphaned nodes report. This allows an attacker with permission...

EUVD-2009-4014

Malware in sbrugna...

CVE-2015-6808

Cross-site scripting XSS vulnerability in the Spotlight module 7.x-1.x before 7.x-1.5 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via a node title...

CVE-2021-42750

A cross-site scripting XSS vulnerability in Rule Engine in ThingsBoard 3.3.1 allows remote attackers with administrative access to inject arbitrary JavaScript within the title of a rule node...

PT-2022-22589 · Joplin · Joplin

Name of the Vulnerable Software and Affected Versions: Joplin version 2.8.8 Description: The issue allows attackers to execute arbitrary commands via a crafted payload injected into the Node titles. Recommendations: For Joplin version 2.8.8, consider restricting the injection of crafted payloads...

MAL-2022-4890 Malicious code in node-title (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e48deb4e94109fe1c6aa6462bcd840fba34d7a47198045030885d6e0f85931a1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in node-title (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e48deb4e94109fe1c6aa6462bcd840fba34d7a47198045030885d6e0f85931a1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Cross site scripting

Cross-site scripting XSS vulnerability in the Spotlight module 7.x-1.x before 7.x-1.5 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via a node title...

PT-2015-7364

Name of the Vulnerable Software and Affected Versions Drupal Spotlight module versions 7.x-1.x before 7.x-1.5 Description A cross-site scripting XSS issue exists, allowing remote authenticated users with specific permissions to inject arbitrary web script or HTML via a node title. Recommendations...

CVE-2015-6808: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Spotlight module 7.x-1.x before 7.x-1.5 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via a node title...

CVE-2015-6753

Multiple cross-site scripting XSS vulnerabilities in the Quick Edit module 7.x-1.x before 7.x-1.2 for Drupal allow remote authenticated users with certain permissions to inject arbitrary web script or HTML via an 1 entity title, related to in-place editing, or a 2 node title...

CVE-2015-6753: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the Quick Edit module 7.x-1.x before 7.x-1.2 for Drupal allow remote authenticated users with certain permissions to inject arbitrary web script or HTML via an 1 entity title, related to in-place editing, or a 2 node title...

PT-2015-7337

Name of the Vulnerable Software and Affected Versions Drupal Quick Edit module versions 7.x-1.x before 7.x-1.2 Description The issue allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via an entity title, related to in-place editing, or a node title,...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the Tournament module 7.x-1.x before 7.x-1.2 for Drupal allow remote authenticated users with certain permissions to inject arbitrary web script or HTML via an 1 account username, a 2 node title, or a 3 team entity title...

CVE-2014-9738

Multiple cross-site scripting XSS vulnerabilities in the Tournament module 7.x-1.x before 7.x-1.2 for Drupal allow remote authenticated users with certain permissions to inject arbitrary web script or HTML via an 1 account username, a 2 node title, or a 3 team entity title...

PT-2015-4372

Name of the Vulnerable Software and Affected Versions Tournament module versions 7.x-1.x before 7.x-1.2 Description The issue allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via the account username, node title, or team entity title. This can lead...

CVE-2015-4357

Cross-site scripting XSS vulnerability in the Webform module before 6.x-3.22, 7.x-3.x before 7.x-3.22, and 7.x-4.x before 7.x-4.4 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via a node title, which is used as the default title of a...

PT-2015-6539

Name of the Vulnerable Software and Affected Versions Drupal Webform module versions prior to 6.x-3.22 Drupal Webform module versions 7.x-3.x prior to 7.x-3.22 Drupal Webform module versions 7.x-4.x prior to 7.x-4.4 Description The issue allows remote authenticated users with certain permissions ...

CVE-2015-4357: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Webform module before 6.x-3.22, 7.x-3.x before 7.x-3.22, and 7.x-4.x before 7.x-4.4 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via a node title, which is used as the default title of a...