CVE-2016-1565

Cross-site scripting XSS vulnerability in the Field Group module 7.x-1.x before 7.x-1.5 for Drupal allows remote authenticated users with permission to configure field display settings to inject arbitrary web script or HTML via an element attribute...

CVE-2016-1565

An XSS vulnerability (CVE-2016-1565) affects the Drupal Field Group module for Drupal 7.x: versions prior to 7.x-1.5; remote authenticated users with permission to configure field display settings can inject script/HTML via an element attribute. Drupal core is not affected. Remediation: upgrade F...

Field Group - Moderately Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2016-001

Field Group module enables you to group fields on entity forms and entity displays. When adding a HTML element as group, the user has the option to add custom HTML attributes on the group. Via this option, a malicious user can embed scripts within the page, resulting in a Cross-site Scripting XSS...