CVE-2009-2076
Drupal Views <6.x-2.6 - XSS
Title source: llmDescription
Cross-site scripting (XSS) vulnerability in Views 6.x before 6.x-2.6, a module for Drupal, allows remote authenticated users to inject arbitrary web script or HTML via (1) exposed filters in the Views UI administrative interface and in the (2) view name parameter in the define custom views feature. NOTE: vector 2 is only exploitable by users with administer views permissions.
References (5)
Scores
EPSS
0.0016
EPSS Percentile
36.2%
Classification
CWE
CWE-79
Status
published
Affected Products (7)
drupal/views
drupal/views
drupal/views
drupal/views
drupal/views
drupal/views
n/a/n/a
Timeline
Published
Jun 16, 2009
Tracked Since
Feb 18, 2026