CVE-2008-0274

Severity: low (CVSS 2.6 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2008-01-15 · updated 2026-06-16
Weakness: CWE-79

Description

Cross-site scripting (XSS) vulnerability in Drupal 4.7.x and 5.x, when certain .htaccess protections are disabled, allows remote attackers to inject arbitrary web script or HTML via crafted links involving theme .tpl.php files.

Affected products

Drupal: 4.7, 5.0

References

http://drupal.org/node/208565
http://secunia.com/advisories/28422
http://secunia.com/advisories/28486
http://www.securityfocus.com/bid/27238
http://www.vbdrupal.org/forum/showthread.php?p=6878
http://www.vbdrupal.org/forum/showthread.php?t=1349
http://www.vupen.com/english/advisories/2008/0127
http://www.vupen.com/english/advisories/2008/0134
https://exchange.xforce.ibmcloud.com/vulnerabilities/39605
http://drupal.org/node/208565
http://secunia.com/advisories/28422
http://secunia.com/advisories/28486

Get alerted when CVE-2008-0274 or the next vulnerability affects your stack