Live › vulnerability › CVE-2026-114525
The Drupal ABC module has a stored cross-site scripting flaw, so input saved by one user can run as script in other users' browsers. Affected versions are 0.0.0 through 1.25.0 and 2.0.0 through 2.0.1.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 04:28 UTC. All times on this page are UTC.
Sites running the Drupal ABC module in the listed version ranges are exposed. The sources do not describe the specific input field or configuration involved, so unknown whether anonymous users can reach it.
No product ranges from the sources yet.
drush pm:list or the Extend page) and compare it against the affected ranges.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal ABC allows Stored XSS. This issue affects ABC versions: from 0.0.0 to 1.25.0, from 2.0.0 to 2.0.1.
This page as .md · .json · in your agent: get_signal("CVE-2026-114525")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.