Cross-site scripting (XSS) vulnerability in the Locale module (modules/locale/locale.module) in Drupal Core 6.14, and possibly other versions including 6.15, allows remote authenticated users with "administer languages" permissions to inject arbitrary web script or HTML via the (1) Language name in English or (2) Native language name fields in the Custom language form.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Drupal | — | Upgrade to drupal version 6.16 | Sep 18, 2017 | Dec 21, 2009 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub