CVE-2026-107258

Incorrect Authorization vulnerability in Drupal Inline Entity Form Dialog allows Forceful Browsing. This issue affects Inline Entity Form Dialog versions: from 0.0.0 to 1.0.6...

CVE-2026-107258 Inline Entity Form Dialog - Moderately critical - Access bypass - SA-CONTRIB-2026-199

Incorrect Authorization vulnerability in Drupal Inline Entity Form Dialog allows Forceful Browsing. This issue affects Inline Entity Form Dialog versions: from 0.0.0 to 1.0.6...

CVE-2026-107258

The Drupal Inline Entity Form Dialog module (versions 0.0.0 to 1.0.6) contains an Incorrect Authorization vulnerability (CWE-863) that allows Forceful Browsing . The root cause is that the module relies solely on the "access administration pages" permission and fails to verify if the current user...

CVE-2026-107258 Inline Entity Form Dialog - Moderately critical - Access bypass - SA-CONTRIB-2026-199

Incorrect Authorization vulnerability in Drupal Inline Entity Form Dialog allows Forceful Browsing. This issue affects Inline Entity Form Dialog versions: from 0.0.0 to 1.0.6...

EUVD-2026-113576

Incorrect Authorization vulnerability in Drupal Inline Entity Form Dialog allows Forceful Browsing. This issue affects Inline Entity Form Dialog versions: from 0.0.0 to 1.0.6...

CVE-2026-107258 Inline Entity Form Dialog - Moderately critical - Access bypass - SA-CONTRIB-2026-199

Incorrect Authorization vulnerability in Drupal Inline Entity Form Dialog allows Forceful Browsing. This issue affects Inline Entity Form Dialog versions: from 0.0.0 to 1.0.6...

CVE-2026-107258: Drupal Inline Entity Form Dialog: Incorrect Authorization vulnerability in Drupal Inline Entity Form Dialog allows Forceful Browsing

Incorrect Authorization vulnerability in Drupal Inline Entity Form Dialog allows Forceful Browsing. This issue affects Inline Entity Form Dialog versions: from 0.0.0 to 1.0.6...

Inline Entity Form Dialog - Moderately critical - Access bypass - SA-CONTRIB-2026-199

This module renders entity add/edit forms inside an AJAX dialog for use with entity reference fields. This module relies only on the "access administration pages" permission, without checking whether the current user had create or update access to the entity itself. This vulnerability is mitigate...

EUVD-2015-5462

Malware in sbrugna...

CVE-2015-5507

Cross-site scripting XSS vulnerability in the Inline Entity Form module 7.x-1.x before 7.x-1.6 for Drupal allows remote authenticated users with permission to create or edit fields to inject arbitrary web script or HTML via unspecified vectors...

CVE-2015-5507

The issue is a Cross-Site Scripting (XSS) vulnerability in the Drupal contributed module Inline Entity Form (7.x-1.x) prior to 7.x-1.6. The module does not sufficiently sanitize user-supplied text, allowing remote authenticated users with permission to create or edit fields to inject arbitrary sc...

CVE-2015-5507

Cross-site scripting XSS vulnerability in the Inline Entity Form module 7.x-1.x before 7.x-1.6 for Drupal allows remote authenticated users with permission to create or edit fields to inject arbitrary web script or HTML via unspecified vectors...

PT-2015-6959

Name of the Vulnerable Software and Affected Versions Inline Entity Form module versions 7.x-1.x before 7.x-1.6 Description A cross-site scripting XSS issue exists, allowing remote authenticated users with permission to create or edit fields to inject arbitrary web script or HTML. Recommendations...

CVE-2015-5507: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Inline Entity Form module 7.x-1.x before 7.x-1.6 for Drupal allows remote authenticated users with permission to create or edit fields to inject arbitrary web script or HTML via unspecified vectors...

Drupal Inline Entity Form Module Cross-Site Scripting Vulnerability

Drupal is a free and open source content management system developed in PHP. A cross-site scripting vulnerability exists in the Drupal Inline Entity Form module, which allows remote attackers to exploit the vulnerability to inject malicious script or HTML code, which can be used to obtain sensiti...

Inline Entity Form - Less critical - Cross Site Scripting (XSS) - SA-CONTRIB-2015-120

The Inline Entity Form module provides a field widget for inline management creation, modification, removal of referenced entities. The module doesn't sufficiently sanitize user supplied text, thereby exposing a Cross Site Scripting vulnerability. This vulnerability is mitigated by the fact that ...