CVE-2007-0626 json
The comment_form_add_preview function in comment.module in Drupal before 4.7.6, and 5.x before 5.1, and vbDrupal, allows remote attackers w…
published 2007-01-31 19 y ago modified 2026-06-16 4 mo ago also EUVD-2007-0624
- cvss
- 6.5
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 3.4%
- EPSS 3.4% chance of exploitation in 30 days, percentile 88%
- public exploits
- 0
- none known
Summary
The comment_form_add_preview function in comment.module in Drupal before 4.7.6, and 5.x before 5.1, and vbDrupal, allows remote attackers with "post comments" privileges and access to multiple input filters to execute arbitrary code by previewing comments, which are not processed by "normal form validation routines."
Patch / fix
Exploit prediction
3.40% chance of exploitation in the next 30 days, higher than 88% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 6.5 | AV:N/AC:L/Au:S/C:P/I:P/A:P |
References
-
drupal.org
/node/113935
patch, vendor-advisory
-
vbdrupal.org
/forum/showthread.php?t=786
broken-link
-
securityfocus.com
/bid/22306
vdb-entry, third-party-advisory
-
secunia.com
/advisories/23960
third-party-advisory
-
vupen.com
/english/advisories/2007/0406
vdb-entry, third-party-advisory
-
osvdb.org
/32136
vdb-entry, broken-link
-
vupen.com
/english/advisories/2007/0415
vdb-entry, third-party-advisory
-
exchange.xforce.ibmcloud.com
/vulnerabilities/31940
vdb-entry, third-party-advisory
-
archives.neohapsis.com
/archives/bugtraq/2007-01/0670.html
mailing-list, broken-link
-
secunia.com
/advisories/23990
third-party-advisory
Sources
- CVE List CVE-2007-0626
- NVD CVE-2007-0626
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.