CVE-2010-2125

Severity: low (CVSS 2.1 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2010-06-01 · updated 2026-06-16
Weakness: CWE-79

Description

Multiple cross-site scripting (XSS) vulnerabilities in the Rotor Banner module 5.x before 5.x-1.8 and 6.x before 6.x-2.5 for Drupal allow remote authenticated users, with "create rotor item" or "edit any rotor item" privileges, to inject arbitrary web script or HTML via the (1) srs, (2) title, or (3) alt image attribute.

Affected products

Systemseed Rotor: 5.x-1.0, 5.x-1.1, 5.x-1.2, 5.x-1.3, 5.x-1.4, 5.x-1.5 (+19)

References

http://drupal.org/node/803930
http://secunia.com/advisories/39883
http://www.osvdb.org/64770
https://exchange.xforce.ibmcloud.com/vulnerabilities/58719
http://drupal.org/node/803930
http://secunia.com/advisories/39883
http://www.osvdb.org/64770
https://exchange.xforce.ibmcloud.com/vulnerabilities/58719

Get alerted when CVE-2010-2125 or the next vulnerability affects your stack