Most recent entries from all

DRUPAL-CONTRIB-2026-032

Affected: Packagist:https://packages.drupal.org/8: drupal/orejime

The IframeConsent element writes HTML attributes without escaping their value.

This module has a XSS vulnerability. If an attacker is able to write an `<iframe-consent>` tag, they may be able to insert arbitrary JavaScript.

This vulnerability is mitigated by the fact that a text format that allows `iframe-consent` HTML tags with alt attributes in the necessary option (*Enable JS Iframe consent*) must be enabled, and an attacker must have a role allowing the creation or modification of content in a field with text the format.

EUVD-2026-319622

fkie_cve-2026-6095

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Orejime allows Cross-Site Scripting (XSS).

This issue affects Orejime: from 0.0.0 before 2.0.16.

GHSA-6g8q-jh52-g228

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Orejime allows Cross-Site Scripting (XSS).

This issue affects Orejime: from 0.0.0 before 2.0.16.

WID-SEC-W-2026-1018 — Drupal (Orejime): Schwachstelle ermöglicht Cross-Site Scripting

Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Drupal Orejime ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen.