Live › vulnerability › CVE-2026-96382
Go to dashboardThe Diba carousel slider module for Drupal does not neutralize some user-supplied input before writing it into web pages, so the stored content can run script in visitors' browsers. An attacker who can get content stored through the module can run script in the browser of anyone who views the affected page.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Drupal sites that have the Diba carousel slider module installed at version 3.0.2 or earlier. The sources do not say which configuration or user roles store the input, so sites without the module can skip it.
No product ranges from the sources yet.
composer show drupal/diba or the Extend page) and see whether it is 3.0.2 or earlier.3.0.2; the fixed version number is unknown from the sources.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Diba carousel slider allows Stored XSS. This issue affects Diba carousel slider versions: from 0.0.0 to 3.0.2.
This page as .md · .json · in your agent: get_signal("CVE-2026-96382")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.