Search

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

    Related vulnerabilities

    DRUPAL-CONTRIB-2026-161 (CVE-2026-96363)

    Vulnerability from drupal – Published: 2026-09-23 16:14 – Updated: 2026-09-23 16:46 – Source website
    VLAI
    Details

    The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data.

    Webform includes a submodule called Webform Entity Print. This submodule doesn't sufficiently limit access to its print templates. When the submodule is enabled, a user with permissions to create a webform can exploit cross-site scripting (XSS) in submodule settings.

    This vulnerability is mitigated by the fact that an attacker must have a role with create webform and edit own webform permissions, and the Webform Entity Print module must be enabled.

    Credits
    Pierre Rudloff (prudloff) www.drupal.org/u/prudloff
    References
    To clipboard 

    {
  "affected": [
    {
      "database_specific": {
        "affected_versions": "\u003c6.2.12 || \u003e=6.3.0 \u003c6.3.1"
      },
      "package": {
        "ecosystem": "Packagist:https://packages.drupal.org/8",
        "name": "drupal/webform"
      },
      "ranges": [
        {
          "database_specific": {
            "constraint": "\u003c6.2.12"
          },
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.2.12"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "database_specific": {
            "constraint": "\u003e=6.3.0 \u003c6.3.1"
          },
          "events": [
            {
              "introduced": "6.3.0"
            },
            {
              "fixed": "6.3.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "severity": []
    }
  ],
  "aliases": [
    "CVE-2026-96363"
  ],
  "credits": [
    {
      "contact": [
        "https://www.drupal.org/u/prudloff"
      ],
      "name": "Pierre Rudloff (prudloff)"
    }
  ],
  "details": "The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data.\n\nWebform includes a submodule called Webform Entity Print. This submodule doesn\u0027t sufficiently limit access to its print templates. When the submodule is enabled, a user with permissions to create a webform can exploit cross-site scripting (XSS) in submodule settings.\n\nThis vulnerability is mitigated by the fact that an attacker must have a role with *create webform* and *edit own webform* permissions, and the Webform Entity Print module must be enabled.",
  "id": "DRUPAL-CONTRIB-2026-161",
  "modified": "2026-09-23T16:46:45.000Z",
  "published": "2026-09-23T16:14:32.000Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://www.drupal.org/sa-contrib-2026-161"
    }
  ],
  "schema_version": "1.7.0"
}