CoreCVE
Back

LOW

Multiple cross-site scripting (XSS) vulnerabilities in the Token module before 4.7.x-1.5, and 5.x before 5.x-1.9, for Drupal; as used by the ASIN Field, e-Commerce, Fullname field for CCK, Invite, Node Relativity, Pathauto, PayPal Node, and Ubercart modules; allow remote authenticated users with a post comments privilege to inject arbitrary web script or HTML via unspecified vectors related to (1) comments, (2) vocabulary names, (3) term names, and (4) usernames

Published Oct 22, 2007

Description

Multiple cross-site scripting (XSS) vulnerabilities in the Token module before 4.7.x-1.5, and 5.x before 5.x-1.9, for Drupal; as used by the ASIN Field, e-Commerce, Fullname field for CCK, Invite, Node Relativity, Pathauto, PayPal Node, and Ubercart modules; allow remote authenticated users with a post comments privilege to inject arbitrary web script or HTML via unspecified vectors related to (1) comments, (2) vocabulary names, (3) term names, and (4) usernames.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (5)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner mitre
Published Oct 22, 2007
Updated Aug 7, 2024
Reserved Oct 22, 2007
Link CVE-2007-5621
CISA Vulnrichment
Updated n/a
NVD
Status Modified
Modified Jun 16, 2026
Link CVE-2007-5621
Red Hat
Severity n/a
Public date n/a
Links CVE-2007-5621
ENISA EUVD
Assigner mitre
Published Oct 22, 2007
Updated Aug 7, 2024
Exploited since n/a
Link EUVD-2007-5593
EUVD-2007-5593