CVE-2010-2472

4.8 mediumEPSS 0.8%

Locale module and dependent contributed modules in Drupal 6.x before 6.16 and 5.x before version 5.22 do not sanitize the display of language codes, native and English language names properly which could allow an attacker to perform a cross-site scripting (XSS) attack. This vulnerability is mitigated by the fact that an attacker must have a role with the 'administer languages' permission.

Severity

CVSS 3.1

4.8 medium

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

EPSS: 0.8% chance of exploitation in the next 30 days; higher than 55% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2019-11-07
Modified: 2026-06-16
Record from: the NVD, synced 2026-10-19

Affected

drupal:drupal

References

https://security-tracker.debian.org/tracker/CVE-2010-2472
https://www.drupal.org/node/731710
https://www.openwall.com/lists/oss-security/2010/06/28/8
https://security-tracker.debian.org/tracker/CVE-2010-2472
https://www.drupal.org/node/731710

Check your stack JSON