CVE-2009-2371

no score yetEPSS 1.1%

michelle cox advanced forum: no CVSS score yet. EPSS 1.1% chance of exploitation in the next 30 days.

Advanced Forum 6.x before 6.x-1.1, a module for Drupal, does not prevent users from modifying user signatures after the associated comment format has been changed to an administrator-controlled input format, which allows remote authenticated users to inject arbitrary web script, HTML, and possibly PHP code via a crafted user signature.

EPSS: 1.1% chance of exploitation in the next 30 days; higher than 66% of CVEs (scores of 2026-10-31)
CWE: CWE-264
Published: 2009-07-08
Modified: 2026-06-16
Record from: the NVD, synced 2026-10-19

Affected

michelle_cox:advanced_forum

References

http://drupal.org/node/507526
http://drupal.org/node/507580
http://osvdb.org/55522
http://secunia.com/advisories/35678
http://www.vupen.com/english/advisories/2009/1769

Check your stack JSON