Search

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

    Related vulnerabilities

    DRUPAL-CONTRIB-2026-155 (CVE-2026-96361)

    Vulnerability from drupal – Published: 2026-09-23 16:11 – Updated: 2026-09-23 16:46 – Source website
    VLAI
    Details

    The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data.

    The module does not sufficiently sanitize text counter configuration before passing options to the bundled jQuery Text Counter library. Under certain configurations, this can allow markup from counter-related settings to be inserted into the page leading to a cross-site scripting vulnerability.

    This vulnerability is mitigated by the fact that an attacker must be able to create or edit affected Webform elements, or place specially crafted counter markup on a page where the Webform counter JavaScript is active.

    Credits
    Pierre Rudloff (prudloff) www.drupal.org/u/prudloff
    References
    To clipboard 

    {
  "affected": [
    {
      "database_specific": {
        "affected_versions": "\u003c6.2.12 || \u003e=6.3.0 \u003c6.3.1"
      },
      "package": {
        "ecosystem": "Packagist:https://packages.drupal.org/8",
        "name": "drupal/webform"
      },
      "ranges": [
        {
          "database_specific": {
            "constraint": "\u003c6.2.12"
          },
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.2.12"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "database_specific": {
            "constraint": "\u003e=6.3.0 \u003c6.3.1"
          },
          "events": [
            {
              "introduced": "6.3.0"
            },
            {
              "fixed": "6.3.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "severity": []
    }
  ],
  "aliases": [
    "CVE-2026-96361"
  ],
  "credits": [
    {
      "contact": [
        "https://www.drupal.org/u/prudloff"
      ],
      "name": "Pierre Rudloff (prudloff)"
    }
  ],
  "details": "The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data.\n\nThe module does not sufficiently sanitize text counter configuration before passing options to the bundled jQuery Text Counter library. Under certain configurations, this can allow markup from counter-related settings to be inserted into the page leading to a cross-site scripting vulnerability.\n\nThis vulnerability is mitigated by the fact that an attacker must be able to create or edit affected Webform elements, or place specially crafted counter markup on a page where the Webform counter JavaScript is active.",
  "id": "DRUPAL-CONTRIB-2026-155",
  "modified": "2026-09-23T16:46:57.000Z",
  "published": "2026-09-23T16:11:35.000Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://www.drupal.org/sa-contrib-2026-155"
    }
  ],
  "schema_version": "1.7.0"
}