CVSS: 5.4EPSS: 0%CPEs: 14EXPL: 0CVE-2007-5621
https://notcve.org/view.php?id=CVE-2007-5621
22 Oct 2007 — Multiple cross-site scripting (XSS) vulnerabilities in the Token module before 4.7.x-1.5, and 5.x before 5.x-1.9, for Drupal; as used by the ASIN Field, e-Commerce, Fullname field for CCK, Invite, Node Relativity, Pathauto, PayPal Node, and Ubercart modules; allow remote authenticated users with a post comments privilege to inject arbitrary web script or HTML via unspecified vectors related to (1) comments, (2) vocabulary names, (3) term names, and (4) usernames. Múltiples vulnerabilidades de secuencias de ... • http://drupal.org/node/184336 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2006-4360
https://notcve.org/view.php?id=CVE-2006-4360
25 Aug 2006 — Cross-site scripting (XSS) vulnerability in E-commerce 4.7 for Drupal before file.module 1.37.2.4 (20060812) allows remote authenticated users with the "create products" permission to inject arbitrary web script or HTML via unspecified vectors. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en E-commerce 4.7 para Drupal con file.module anerior a 1.37.2.4 (12/08/2006) permite a atacantes remotos autenticados con permiso para "crear productos" inyectar secuencias de comandos web o HTML de s... • http://drupal.org/node/80084 •