CVE-2009-1575

no score yetEPSS 1.6%

drupal drupal: no CVSS score yet. EPSS 1.6% chance of exploitation in the next 30 days.

Cross-site scripting (XSS) vulnerability in Drupal 5.x before 5.17 and 6.x before 6.11, as used in vbDrupal before 5.17.0, allows remote attackers to inject arbitrary web script or HTML via crafted UTF-8 byte sequences before the Content-Type meta tag, which are treated as UTF-7 by Internet Explorer 6 and 7.

EPSS: 1.6% chance of exploitation in the next 30 days; higher than 75% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2009-05-06
Modified: 2026-06-16
Record from: the NVD, synced 2026-10-19

Affected

drupal:drupal

References

http://drupal.org/node/449078
http://secunia.com/advisories/34948
http://secunia.com/advisories/34950
http://secunia.com/advisories/34980
http://www.debian.org/security/2009/dsa-1792

Check your stack JSON