Cross-site scripting (XSS) vulnerability in the Webform module 6.x-3.x before 6.x-3.19 for Drupal allows remote authenticated users with the "edit own webform content" or "edit all webform content" permissions to inject arbitrary web script or HTML via a component label.
2013-06-24T16:55:01.107
2025-04-11T00:51:21.963
Deferred
CVSSv2: 4.3 (MEDIUM)
AV:N/AC:M/Au:N/C:N/I:P/A:N
8.6
2.9
| Type | Vendor | Product | Version/Range | Vulnerable? |
|---|---|---|---|---|
| Application | nathan_haug | webform | ≤ 6.x-3.18 | Yes |
| Application | nathan_haug | webform | 6.x-3.0 | Yes |
| Application | nathan_haug | webform | 6.x-3.0 | Yes |
| Application | nathan_haug | webform | 6.x-3.0 | Yes |
| Application | nathan_haug | webform | 6.x-3.0 | Yes |
| Application | nathan_haug | webform | 6.x-3.0 | Yes |
| Application | nathan_haug | webform | 6.x-3.0 | Yes |
| Application | nathan_haug | webform | 6.x-3.0 | Yes |
| Application | nathan_haug | webform | 6.x-3.1 | Yes |
| Application | nathan_haug | webform | 6.x-3.2 | Yes |
| Application | nathan_haug | webform | 6.x-3.3 | Yes |
| Application | nathan_haug | webform | 6.x-3.4 | Yes |
| Application | nathan_haug | webform | 6.x-3.5 | Yes |
| Application | nathan_haug | webform | 6.x-3.6 | Yes |
| Application | nathan_haug | webform | 6.x-3.7 | Yes |
| Application | nathan_haug | webform | 6.x-3.8 | Yes |
| Application | nathan_haug | webform | 6.x-3.9 | Yes |
| Application | nathan_haug | webform | 6.x-3.10 | Yes |
| Application | nathan_haug | webform | 6.x-3.11 | Yes |
| Application | nathan_haug | webform | 6.x-3.12 | Yes |
| Application | nathan_haug | webform | 6.x-3.13 | Yes |
| Application | nathan_haug | webform | 6.x-3.14 | Yes |
| Application | nathan_haug | webform | 6.x-3.15 | Yes |
| Application | nathan_haug | webform | 6.x-3.16 | Yes |
| Application | nathan_haug | webform | 6.x-3.17 | Yes |
| Application | nathan_haug | webform | 6.x-3.x | Yes |
| Application | drupal | drupal | - | No |