CVE-2014-8076

Professional Theme < 7.x-2.04 - Authenticated Cross-Site Scripting via Custom Copyright Information

Title source: llm

Description

Cross-site scripting (XSS) vulnerability in the Professional theme 7.x before 7.x-2.04 for Drupal allows remote authenticated users with the "administer themes" permission to inject arbitrary web script or HTML via vectors related to custom copyright information.

References (4)

Core 4

Core References

Third Party Advisory, VDB Entry vdb-entry x_refsource_xf

https://exchange.xforce.ibmcloud.com/vulnerabilities/92755

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/58233

Vendor Advisory x_refsource_misc

http://drupal.org/node/2248145

Patch x_refsource_confirm

https://www.drupal.org/node/2248095

Scores

EPSS 0.0020

EPSS Percentile 41.9%

Details

CWE

CWE-79

Status published

Products (16)

drupal/professional_theme 7.x-1.0

drupal/professional_theme 7.x-1.1

drupal/professional_theme 7.x-1.2

drupal/professional_theme 7.x-1.3

drupal/professional_theme 7.x-1.4

drupal/professional_theme 7.x-1.5

drupal/professional_theme 7.x-1.6

drupal/professional_theme 7.x-1.7

drupal/professional_theme 7.x-1.8

drupal/professional_theme 7.x-1.9

... and 6 more

Published Oct 09, 2014

Tracked Since Feb 18, 2026