432 matches found
CVE-2015-1621
Cross-site scripting XSS vulnerability in the Webform prepopulate block module before 7.x-3.1 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...
CVE-2015-1621
The CVE-2015-1621 is a Drupal Webform prepopulate block vulnerability. Affected component: Webform prepopulate block module for Drupal 7.x (before 7.x-3.1). Issue: cross-site scripting (XSS) where user-supplied text is not sufficiently sanitized when displaying the block, allowing remote authenti...
PT-2015-5395
Name of the Vulnerable Software and Affected Versions Drupal Webform prepopulate block module version prior to 7.x-3.1 Description The issue is related to a cross-site scripting XSS vulnerability. This allows remote authenticated users to inject arbitrary web script or HTML. Recommendations For...
CVE-2015-1621: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in the Webform prepopulate block module before 7.x-3.1 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...
SA-CONTRIB-2015-040 - Webform prepopulate block - Cross Site Scripting (XSS)
Webform prepopulate block module enables you to set a webform component to display in a separated block. The module doesn't sufficiently sanitize user supplied text when displaying the block, thereby exposing a Cross Site Scripting vulnerability. This vulnerability is mitigated by the fact that a...
CVE-2014-9498
Cross-site scripting XSS vulnerability in the Webform Invitation module 7.x-1.x before 7.x-1.3 and 7.x-2.x before 7.x-2.4 for Drupal allows remote authenticated users with the Webform: Create new content, Webform: Edit own content, or Webform: Edit any content permission to inject arbitrary web...
Cross site scripting
Cross-site scripting XSS vulnerability in the Webform Invitation module 7.x-1.x before 7.x-1.3 and 7.x-2.x before 7.x-2.4 for Drupal allows remote authenticated users with the Webform: Create new content, Webform: Edit own content, or Webform: Edit any content permission to inject arbitrary web...
CVE-2014-9498
Cross-site scripting XSS vulnerability in the Webform Invitation module 7.x-1.x before 7.x-1.3 and 7.x-2.x before 7.x-2.4 for Drupal allows remote authenticated users with the Webform: Create new content, Webform: Edit own content, or Webform: Edit any content permission to inject arbitrary web...
CVE-2014-9498
The Drupal Webform Invitation module (7.x-1.x before 7.x-1.3 and 7.x-2.x before 7.x-2.4) is affected by an XSS vulnerability due to insufficient sanitization of node titles. Exploitation requires an attacker to have one of the Webform-related permissions: Webform: Create new content, Webform: Edi...
PT-2015-4246
Name of the Vulnerable Software and Affected Versions Webform Invitation module versions 7.x-1.x before 7.x-1.3 Webform Invitation module versions 7.x-2.x before 7.x-2.4 Description The issue allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via a...
CVE-2014-9498: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in the Webform Invitation module 7.x-1.x before 7.x-1.3 and 7.x-2.x before 7.x-2.4 for Drupal allows remote authenticated users with the Webform: Create new content, Webform: Edit own content, or Webform: Edit any content permission to inject arbitrary web...
SA-CONTRIB-2014-116 - Webform Invitation - Cross Site Scripting (XSS)
This module enables you to create custom invitation codes for Webforms. The module failed to sanitize node titles. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "Webform: Create new content", "Webform: Edit own content" and/or "Webform: Edit any...
CVE-2014-9022
The Webform Component Roles module 6.x-1.x before 6.x-1.8 and 7.x-1.x before 7.x-1.8 for Drupal allows remote attackers to bypass the "disabled" restriction and modify read-only components via a crafted form...
Design/Logic Flaw
The Webform Component Roles module 6.x-1.x before 6.x-1.8 and 7.x-1.x before 7.x-1.8 for Drupal allows remote attackers to bypass the "disabled" restriction and modify read-only components via a crafted form...
CVE-2014-9022
The CVE-2014-9022 issue affects Drupal’s Webform Component Roles module: versions 6.x-1.x before 6.x-1.8 and 7.x-1.x before 7.x-1.8. The root cause is that the module allows remote attackers to bypass the disabled restriction and modify read-only webform components via a crafted form. Impact is r...
PT-2014-8792
Name of the Vulnerable Software and Affected Versions Webform Component Roles module versions 6.x-1.x through 6.x-1.7 Webform Component Roles module versions 7.x-1.x through 7.x-1.7 Description The issue allows remote attackers to bypass the "disabled" restriction and modify read-only components...
CVE-2014-9022: Undefined Security Weakness
The Webform Component Roles module 6.x-1.x before 6.x-1.8 and 7.x-1.x before 7.x-1.8 for Drupal allows remote attackers to bypass the "disabled" restriction and modify read-only components via a crafted form...
SA-CONTRIB-2014-115 - Form Builder - Cross-Site Scripting (XSS)
The Form Builder module enables users to build entire Form API structures through a graphical, AJAX-like interface. The module doesn't sufficiently sanitize form titles in some cases. This vulnerability is mitigated by the fact that an attacker must have a role with the permission to create forms...
SA-CONTRIB-2014-108 - Webform Component Roles - Access Bypass
The Webform component module enables site admins to limit visibility or editability of webform components based on user roles. The module doesn't sufficiently check that disabled component values are not modified upon submission of the form. CVE identifiers issued CVE-2014-9022 Versions affected...
Sql injection
SQL injection vulnerability in XRMS CRM, possibly 1.99.2, allows remote attackers to execute arbitrary SQL commands via the userid parameter to plugins/webform/new-form.php, which is not properly handled by plugins/useradmin/fingeruser.php...