CVE-2013-1906

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2013-06-24 · updated 2026-06-16
Weakness: CWE-79

Description

Cross-site scripting (XSS) vulnerability in the Rules module 7.x-2.x before 7.x-2.3 for Drupal allows remote authenticated users with the "administer rules" permission to inject arbitrary web script or HTML via a rule tag.

Affected products

Wolfgang Ziegler Rules: 7.x-2.0, 7.x-2.0-beta1, 7.x-2.0-beta2, 7.x-2.0-beta3, 7.x-2.0-rc1, 7.x-2.0-rc2 (+2)

References

http://secunia.com/advisories/52768
https://drupal.org/node/1954508
https://drupal.org/node/1954592
http://secunia.com/advisories/52768
https://drupal.org/node/1954508
https://drupal.org/node/1954592

Get alerted when CVE-2013-1906 or the next vulnerability affects your stack