CVE-2007-5621

Published: Oct 22, 2007Modified: Apr 23, 2026

3.5

Vector

AV:N/AC:M/Au:S/C:N/I:P/A:N

Exploitability: 6.8 / Impact: 2.9

Source: NVD

Description

Multiple cross-site scripting (XSS) vulnerabilities in the Token module before 4.7.x-1.5, and 5.x before 5.x-1.9, for Drupal; as used by the ASIN Field, e-Commerce, Fullname field for CCK, Invite, Node Relativity, Pathauto, PayPal Node, and Ubercart modules; allow remote authenticated users with a post comments privilege to inject arbitrary web script or HTML via unspecified vectors related to (1) comments, (2) vocabulary names, (3) term names, and (4) usernames.

Affected (14)

Products: Drupal: Asin Field Module, Drupal, E Commerce Module, Fullname Field For Cck, Invite Module, Node Relativity Module, Pathauto Module, Paypal Node Module, Token Module, Ubercart Module

10 products

Fullname Field For Cck

Invite Module

Node Relativity Module

Configuration A

14 vulnerable

Vulnerable Software	Affected Versions
Drupal Asin Field Module	All versions
Drupal Drupal	Version 4.7
Drupal Drupal	Version 5.0
Drupal Drupal	Version 5.1
Drupal Drupal	Version 5.2
Drupal E Commerce Module	All versions
Drupal Fullname Field For Cck	All versions
Drupal Invite Module	All versions
Drupal Node Relativity Module	All versions
Drupal Pathauto Module	All versions
Drupal Paypal Node Module	All versions
Drupal Token Module	Up to 1.4
Drupal Token Module	Up to 1.8
Drupal Ubercart Module	All versions