Unrated severityNVD Advisory· Published Jan 31, 2007· Updated Jun 16, 2026

CVE-2007-0626

Description

The comment_form_add_preview function in comment.module in Drupal before 4.7.6, and 5.x before 5.1, and vbDrupal, allows remote attackers with "post comments" privileges and access to multiple input filters to execute arbitrary code by previewing comments, which are not processed by "normal form validation routines."

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Drupal/Drupal2 versions
cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*range: >4.7.0,<4.7.6
- (no CPE)range: <4.7.6, <5.1
Vbdrupal/Vbdrupalllm-fuzzy

Patches

Vulnerability mechanics

References

drupal.org/node/113935nvdPatchVendor Advisory
secunia.com/advisories/23960nvdThird Party Advisory
secunia.com/advisories/23990nvdThird Party Advisory
www.securityfocus.com/bid/22306nvdThird Party AdvisoryVDB Entry
www.vupen.com/english/advisories/2007/0406nvdThird Party Advisory
www.vupen.com/english/advisories/2007/0415nvdThird Party Advisory
exchange.xforce.ibmcloud.com/vulnerabilities/31940nvdThird Party AdvisoryVDB Entry
archives.neohapsis.com/archives/bugtraq/2007-01/0670.htmlnvdBroken Link
osvdb.org/32136nvdBroken Link
www.vbdrupal.org/forum/showthread.phpnvdBroken Link

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.003
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000