Unrated severityNVD Advisory· Published Aug 15, 2007· Updated Apr 23, 2026
CVE-2007-4363
CVE-2007-4363
Description
Multiple cross-site scripting (XSS) vulnerabilities in the nodereference module in Drupal Content Construction Kit (CCK) before 4.7.x-1.6, and 5.x before 5.x-1.6 ,allow remote attackers to inject arbitrary web script or HTML via nodereference fields, when using (1) the plain formatter or (2) the autocomplete text field widget without Views.module.
Affected products
2cpe:2.3:a:drupal:content_construction_kit:4.7:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:drupal:content_construction_kit:4.7:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:content_construction_kit:5.2:*:*:*:*:*:*:*
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
10- secunia.com/advisories/26416nvdPatchVendor Advisory
- drupal.org/node/166992nvd
- drupal.org/node/166994nvd
- drupal.org/node/166998nvd
- osvdb.org/37208nvd
- osvdb.org/37209nvd
- www.securityfocus.com/bid/25321nvd
- www.vupen.com/english/advisories/2007/2876nvd
- exchange.xforce.ibmcloud.com/vulnerabilities/36000nvd
- exchange.xforce.ibmcloud.com/vulnerabilities/36002nvd
News mentions
0No linked articles in our index yet.