4.8Media

CVE-2026-0749Cross-Site Scripting Vulnerability in Drupal Form Builder Module

Drupal Drupal Publicada: 2026-01-28 21:56 (hace 9 meses)

Descripción

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Form Builder allows Cross-Site Scripting (XSS).This issue affects Drupal: from 7.X-1.0 through 7.X-1.22.

Debilidad (CWE): CWE-79

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

Fabricante	Producto	Versiones
Drupal	Drupal	7.x-1.0 – ≤ 7.x-1.22
silence	form builder	7.x-1.0 – ≤ 7.x-1.22

Referencias y parches

https://www.herodevs.com/vulnerability-directory/cve-2026-0749 third-party-advisoryExploitThird Party Advisory
https://d7es.tag1.com/security-advisories/form-builder-less-critical-cross-site-scripting third-party-advisoryThird Party Advisory

Coincidencias CPE (NVD) (1)

cpe:2.3:a:silence:form_builder:*:*:*:*:*:drupal:*:* ≥ 7.x-1.0 ≤ 7.x-1.22

Puntuación CVSS

4.8Media

Fuente: drupal · CVSS 4.0

Vector de ataque: Red
Complejidad: Baja
Requisitos: Ninguno
Privilegios: Bajos
Interacción del usuario: Activa
Confidencialidad: Ninguno
Integridad: Bajo
Disponibilidad: Ninguno

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N

Todas las puntuaciones (3)

cna	CVSS 4.0	4.8Media
mlhess@drupal.org	CVSS 4.0	4.8Media
nvd	CVSS 3.1	6.1Media

EPSS (probabilidad de explotación en 30 días)

0.23%

superior al 14 % de todas las CVE

Evaluación de CISA (SSVC)

Explotación: none
Automatizable: no
Impacto técnico: partial

Cronología

ID reservado2026-01-08
Publicada2026-01-28 21:56
Llegó a IP-DB2026-10-24 23:46
Última actualización2026-06-17 13:11

Asignada por (CNA): drupal
Estado en NVD: Analyzed

Ver en la fuente: CVE.org · NVD

Reciba un aviso cuando estos productos tengan una vulnerabilidad nueva

Activar alertas por correo

Gratis · con cuenta · se desactiva cuando quiera

CVE recientes del mismo producto — Drupal

8.1Alta

CVE-2026-108097 hace 12 días

Drupal core - Critical - Remote code execution - SA-CORE-2026-014

Drupal Drupal core

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Drupal Drupal core allows Reflection Injection. This issue affects Drupal core versions: from 8.9.0 to 10.6.19, from 11.0.0 to 11.3.19, from 11.4.0 to 11.4.10,…

6.5Media

CVE-2026-108515 hace 12 días

Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-015

Drupal Drupal core

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects Drupal core versions: from 8.9.0 to 10.6.19, from 11.0.0 to 11.3.19, from 11.4.0 to …

6.5Media

CVE-2026-108514 hace 12 días

Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-016

Drupal Drupal core

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects Drupal core versions: from 10.3.0 to 10.6.19, from 11.0.0 to 11.3.19, from 11.4.0 to…

4.2Media

CVE-2026-15916 hace 2 meses

Drupal core - Moderately critical - Information disclosure - SA-CORE-2026-010

Drupal Drupal core

Missing Authorization vulnerability in Drupal Drupal core allows Forceful Browsing. This issue affects Drupal core versions: from 0.0.0 to 10.6.13, from 11.3.0 to 11.3.14, from 11.4.0 to 11.4.4, from 0.0.0 to 11.0.*, from 0.0.0 to 11.1.*, from 0.0.0 to 11.2.*.

4.7Media

CVE-2026-15917 hace 2 meses

Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-011

Drupal Drupal core

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects Drupal core versions: from 11.3.0 to 11.3.14, from 11.4.0 to 11.4.4, from 0.0.0 to 11.2.*.

5.4Media

CVE-2026-55805 hace 2 meses

Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-012

Drupal Drupal core

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Stored XSS. This issue affects Drupal core versions: from 0.0.0 to 10.6.13, from 11.3.0 to 11.3.14, from 11.4.0 to 11.4.4, from 0.0…