CVE-2015-6752

Severity: low (CVSS 2.1 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2015-08-31 · updated 2026-06-17
Weakness: CWE-79

Description

Cross-site scripting (XSS) vulnerability in the Search API Autocomplete module 7.x-1.x before 7.x-1.3 for Drupal, when the search index is configured to use the HTML filter processor, allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via unspecified vectors, which are not properly handled in the returned suggestions.

Affected products

Search Api Autocomplete Project Search Api Autocomplete: 7.x-1.0, 7.x-1.1, 7.x-1.2

References

https://www.drupal.org/node/2553485
https://www.drupal.org/node/2553977
https://www.drupal.org/node/2553485
https://www.drupal.org/node/2553977

Get alerted when CVE-2015-6752 or the next vulnerability affects your stack