Unrated severityNVD Advisory· Published Oct 22, 2007· Updated Apr 23, 2026
CVE-2007-5621
CVE-2007-5621
Description
Multiple cross-site scripting (XSS) vulnerabilities in the Token module before 4.7.x-1.5, and 5.x before 5.x-1.9, for Drupal; as used by the ASIN Field, e-Commerce, Fullname field for CCK, Invite, Node Relativity, Pathauto, PayPal Node, and Ubercart modules; allow remote authenticated users with a post comments privilege to inject arbitrary web script or HTML via unspecified vectors related to (1) comments, (2) vocabulary names, (3) term names, and (4) usernames.
Affected products
13- cpe:2.3:a:drupal:asin_field_module:*:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:e-commerce_module:*:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:fullname_field_for_cck:*:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:invite_module:*:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:node_relativity_module:*:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:pathauto_module:*:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:paypal_node_module:*:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:ubercart_module:*:*:*:*:*:*:*:*
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
4News mentions
0No linked articles in our index yet.