Unscored severity · published Aug 15, 2007
CVE-2007-4363
Multiple cross-site scripting (XSS) vulnerabilities in the nodereference module in Drupal Content Construction Kit (CCK) before 4.7.x-1.6, and 5.x before 5.x-1.6 ,allow remote…
–
CVSS
2.3%
EPSS
No
On KEV
Description
Multiple cross-site scripting (XSS) vulnerabilities in the nodereference module in Drupal Content Construction Kit (CCK) before 4.7.x-1.6, and 5.x before 5.x-1.6 ,allow remote attackers to inject arbitrary web script or HTML via nodereference fields, when using (1) the plain formatter or (2) the autocomplete text field widget without Views.module.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.3% · higher than 83% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CC
Content Construction Kit · Drupal
4.7; 5.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2007-4363
CVE.org
https://www.cve.org/CVERecord?id=CVE-2007-4363
drupal.org
http://drupal.org/node/166992
drupal.org
http://drupal.org/node/166994
drupal.org
http://drupal.org/node/166998
osvdb.org
http://osvdb.org/37208
osvdb.org
http://osvdb.org/37209
Patch
http://secunia.com/advisories/26416
More from Content Construction Kit
–
CVE-2009-1069
Multiple cross-site scripting (XSS) vulnerabilities in the node edit form feature in Drupal Content Construction Kit (CCK) 6.x before 6.x-2.2, a module for Drupal, allow remote…
–
CVE-2008-6229
Cross-site scripting (XSS) vulnerability in the administrative interface in Drupal Content Construction Kit (CCK) 5.x before 5.x-1.10 and 6.x before 6.x-2.0, a module for Drupal,…