https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T04:05:40.486146+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/drupal-contrib-2026-051 DRUPAL-CONTRIB-2026-051 2026-10-04T04:05:40.494185+00:00

Affected: Packagist:https://packages.drupal.org/8: drupal/admin_feedback

This module enables you to collect feedback from your site visitors on content pages, presenting Yes/No buttons and providing dashboards for administrators to review the responses.

The module doesn't sufficiently sanitize several administrator-configured response messages (the "Yes response", "No response", and the custom text shown on a "No" answer) under the scenario where those settings contain HTML or script markup, which is then emitted as raw HTML in the feedback response shown to visitors.

This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer admin feedback".

 https://cve.radiocsirt.org/vuln/euvd-2026-336073 EUVD-2026-336073 2026-10-04T04:05:40.494286+00:00 EUVD-2026-336073 https://cve.radiocsirt.org/vuln/fkie_cve-2026-13231 fkie_cve-2026-13231 2026-10-04T04:05:40.494314+00:00

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Advanced Content Feedback (aka admin_feedback) allows Stored XSS. This issue affects Advanced Content Feedback (aka admin_feedback) versions: from 0.0.0 to 2.8.0.

 https://cve.radiocsirt.org/vuln/ghsa-m44m-73vr-r5qh GHSA-m44m-73vr-r5qh 2026-10-04T04:05:40.494355+00:00

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Advanced Content Feedback (aka admin_feedback) allows Stored XSS. This issue affects Advanced Content Feedback (aka admin_feedback) versions: from 0.0.0 to 2.8.0.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2080 WID-SEC-W-2026-2080 — Drupal: Mehrere Schwachstellen 2026-10-04T04:05:40.494385+00:00

Ein Angreifer kann mehrere Schwachstellen in Drupal ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um einen Cross-Site Scripting Angriff durchzuführen, um Informationen offenzulegen, um einen SQL-Injection Angriff durchzuführen, und um Daten zu manipulieren.