CVE-2009-2076

no score yetEPSS 0.9%

drupal views: no CVSS score yet. EPSS 0.9% chance of exploitation in the next 30 days.

Cross-site scripting (XSS) vulnerability in Views 6.x before 6.x-2.6, a module for Drupal, allows remote authenticated users to inject arbitrary web script or HTML via (1) exposed filters in the Views UI administrative interface and in the (2) view name parameter in the define custom views feature. NOTE: vector 2 is only exploitable by users with administer views permissions.

EPSS: 0.9% chance of exploitation in the next 30 days; higher than 59% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2009-06-16
Modified: 2026-06-16
Record from: the NVD, synced 2026-10-19

Affected

drupal:views

References

http://drupal.org/node/488068
http://drupal.org/node/488082
http://lampsecurity.org/drupal-views-xss-vulnerability
http://secunia.com/advisories/35425
http://www.securityfocus.com/bid/35304

Check your stack JSON