Inline Entity Form Dialog - Moderately critical - Access bypass - SA-CONTRIB-2026-199

This module renders entity add/edit forms inside an AJAX dialog for use with entity reference fields. This module relies only on the "access administration pages" permission, without checking whether the current user had create or update access to the entity itself. This vulnerability is mitigate...

EUVD-2015-5462

Malware in sbrugna...

CVE-2015-5507

Cross-site scripting XSS vulnerability in the Inline Entity Form module 7.x-1.x before 7.x-1.6 for Drupal allows remote authenticated users with permission to create or edit fields to inject arbitrary web script or HTML via unspecified vectors...

CVE-2015-5507

Cross-site scripting XSS vulnerability in the Inline Entity Form module 7.x-1.x before 7.x-1.6 for Drupal allows remote authenticated users with permission to create or edit fields to inject arbitrary web script or HTML via unspecified vectors...

CVE-2015-5507

The issue is a Cross-Site Scripting (XSS) vulnerability in the Drupal contributed module Inline Entity Form (7.x-1.x) prior to 7.x-1.6. The module does not sufficiently sanitize user-supplied text, allowing remote authenticated users with permission to create or edit fields to inject arbitrary sc...

CVE-2015-5507: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Inline Entity Form module 7.x-1.x before 7.x-1.6 for Drupal allows remote authenticated users with permission to create or edit fields to inject arbitrary web script or HTML via unspecified vectors...

PT-2015-6959

Name of the Vulnerable Software and Affected Versions Inline Entity Form module versions 7.x-1.x before 7.x-1.6 Description A cross-site scripting XSS issue exists, allowing remote authenticated users with permission to create or edit fields to inject arbitrary web script or HTML. Recommendations...

Drupal Inline Entity Form Module Cross-Site Scripting Vulnerability

Drupal is a free and open source content management system developed in PHP. A cross-site scripting vulnerability exists in the Drupal Inline Entity Form module, which allows remote attackers to exploit the vulnerability to inject malicious script or HTML code, which can be used to obtain sensiti...

Inline Entity Form - Less critical - Cross Site Scripting (XSS) - SA-CONTRIB-2015-120

The Inline Entity Form module provides a field widget for inline management creation, modification, removal of referenced entities. The module doesn't sufficiently sanitize user supplied text, thereby exposing a Cross Site Scripting vulnerability. This vulnerability is mitigated by the fact that ...