CVE-2010-1958

Severity: low (CVSS 2.1 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2010-06-21 · updated 2026-06-16
Weakness: CWE-79

Description

Cross-site scripting (XSS) vulnerability in the FileField module 5.x before 5.x-2.5 and 6.x before 6.x-3.4 for Drupal allows remote authenticated users, with create or edit permissions and 'Path to File' or 'URL to File' display enabled, to inject arbitrary web script or HTML via the file name (filepath parameter).

Affected products

Quicksketch Filefield: 5.x-1.x-dev, 5.x-2.0, 5.x-2.1, 5.x-2.2, 5.x-2.3, 5.x-2.3-rc2 (+27)

References

http://drupal.org/node/829808
http://osvdb.org/65611
http://secunia.com/advisories/40186
http://www.madirish.net/?article=461
http://www.securityfocus.com/bid/40923
https://exchange.xforce.ibmcloud.com/vulnerabilities/59500
http://drupal.org/node/829808
http://osvdb.org/65611
http://secunia.com/advisories/40186
http://www.madirish.net/?article=461
http://www.securityfocus.com/bid/40923
https://exchange.xforce.ibmcloud.com/vulnerabilities/59500

Get alerted when CVE-2010-1958 or the next vulnerability affects your stack