Live › vulnerability › CVE-2026-118575
The Drupal Signature pad widget module does not neutralize input when generating web pages, allowing stored cross-site scripting. An attacker who can submit data through the widget can run script in the browsers of users who view the stored content.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 04:28 UTC. All times on this page are UTC.
Drupal sites that use the Signature pad widget module on forms or content types, where users can enter data that is later displayed to others. Sites without this module installed are not affected. The sources do not say whether a special permission is needed to submit the data.
No product ranges from the sources yet.
drush pm:list --filter=signature (unknown if the sources do not say this exact command works).0.0.0 to 1.15.0 are affected; the sources do not name a fixed version.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Signature pad widget allows Stored XSS. This issue affects Signature pad widget versions: from 0.0.0 to 1.15.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-118575")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.