CVE-2012-5538

The CVE-2012-5538 issue is a cross-site scripting (XSS) vulnerability in the Drupal FileField Sources module (versions 6.x-1.x prior to 6.x-1.6 and 7.x-1.x prior to 7.x-1.6). When the field uses the “Reference existing” source, remote authenticated users can inject arbitrary web script or HTML vi...

CVE-2013-4502

The CVE-2013-4502 entry concerns the Drupal contributed module FileField Sources. Affected versions are FileField Sources 6.x-1.x before 6.x-1.9 and 7.x-1.x before 7.x-1.9. The root cause is improper file permission checks when attaching files, enabling remote authenticated users to read arbitrar...