Most recent entries from all

DRUPAL-CONTRIB-2026-036

Affected: Packagist:https://packages.drupal.org/8: drupal/colorbox_inline

This module enables you to open content already on the page within a colorbox.

The module doesn't sufficiently sanitize the data-colorbox-inline attribute value before passing it to jQuery, leading to a Cross-Site Scripting (XSS) vulnerability.

This vulnerability is mitigated by the fact that an attacker must have a role with permission to enter HTML tags containing specific data attributes.

EUVD-2026-319734

fkie_cve-2026-8493

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Colorbox Inline allows Cross-Site Scripting (XSS).

This issue affects Colorbox Inline: from 0.0.0 before 2.1.1.

GHSA-3mw4-ccpc-mvj9

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Colorbox Inline allows Cross-Site Scripting (XSS).

This issue affects Colorbox Inline: from 0.0.0 before 2.1.1.

WID-SEC-W-2026-1533 — Drupal Extensions: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in Drupal ausnutzen, um Informationen offenzulegen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren oder Cross-Site-Scripting-Angriffe durchzuführen.