CVE-2010-1539

Drupal Workflow <6.1.4 - XSS

Title source: llm

Description

Cross-site scripting (XSS) vulnerability in the Workflow module 5.x-2.x before 5.x-2.6 and 6.x-1.x before 6.x-1.4 for Drupal, when used with the Token module, might allow remote authenticated users to inject arbitrary web script or HTML via a certain Comment field.

References (6)

Scores

EPSS 0.0036
EPSS Percentile 57.5%

Classification

CWE
CWE-79
Status published

Affected Products (19)

john_vandyk/workflow
john_vandyk/workflow
john_vandyk/workflow
john_vandyk/workflow
john_vandyk/workflow
john_vandyk/workflow
john_vandyk/workflow
john_vandyk/workflow
john_vandyk/workflow
john_vandyk/workflow
john_vandyk/workflow
john_vandyk/workflow
john_vandyk/workflow
john_vandyk/workflow
john_vandyk/workflow
... and 4 more

Timeline

Published Apr 26, 2010
Tracked Since Feb 18, 2026