CVE-2016-1565

Severity: medium (CVSS 6.1 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2016-01-08 · updated 2026-06-17
Weakness: CWE-79

Description

Cross-site scripting (XSS) vulnerability in the Field Group module 7.x-1.x before 7.x-1.5 for Drupal allows remote authenticated users with permission to configure field display settings to inject arbitrary web script or HTML via an element attribute.

Affected products

Field Group Project Field Group: 7.x-1.0, 7.x-1.0-rc1, 7.x-1.0-rc2, 7.x-1.1, 7.x-1.2, 7.x-1.3 (+1)

References

https://www.drupal.org/node/2644832
https://www.drupal.org/node/2645350
https://www.drupal.org/node/2644832
https://www.drupal.org/node/2645350

Get alerted when CVE-2016-1565 or the next vulnerability affects your stack