Cross-Site Scripting

Critical ratings are only part of the triage. Project reach varies sharply, and one advisory requires administrators to clean stored data after updating. ...more

Sites that missed the 26 August security batch still have a clear task: identify affected contrib versions and apply the available fixes. ...more

The 8.9 login-screen flaw is remotely reachable without an authenticated account, yet its path to code execution still depends on social engineering and active victim interaction. ...more

A July security update fixed insufficient sanitisation of markup passed to UI Patterns components. Follow-up work moved escaping closer to render time, while UI Patterns 2.0.19 is now the current stable release. ...more

The same severity label does not mean the same exposure. Site maintainers need to distinguish administrator-dependent XSS from a permission-based field-editing bypass when assessing the two updates. ...more

A single advisory window can demand upgrades, removals, and tighter environment controls. The correct response depends on support status and exposure conditions, not the severity label alone. ...more

The vulnerabilities depend on different permissions and configurations, but supported sites should still install the appropriate security release. Maintainers of contributed modules that handle HTMX attributes or implement custom stream wrappers should review the accompanying hardening. ...more

The batch presents three response paths to Drupal site teams: uninstall unsupported projects, patch active modules, and review where untrusted or generated content reaches the rendering layers. ...more

Security alert: CKEditor 4 LTS module for Drupal flagged with a moderately critical Cross Site Scripting vulnerability. ...more

Discover the recently revealed Drupalwned script designed to escalate Cross-Site Scripting vulnerabilities to critical levels within the Drupal CMS. Learn about its features and potential impact on cybersecurity. ...more