Multiple vulnerabilities in Drupal Node Notify module

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community.Node Notify is one of the node modules that allows registered users and anonymous users to subscribe. A cross-site scripting vulnerability and a cross-site request forgery vulnerability...

Node Notify - Critical - Multiple Vulnerabilities - SA-CONTRIB-2016-013

Node Notify is a lightweight module to allow subscription to comments on nodes for registered and anonymous users. The module doesn't sufficiently sanitize some user provided content, leading to a Cross Site Scripting vulnerability. Additionally, some paths were not protected against CSRF. An...