Unrated severityNVD Advisory· Published Jan 15, 2008· Updated Apr 23, 2026

CVE-2008-0274

Description

Cross-site scripting (XSS) vulnerability in Drupal 4.7.x and 5.x, when certain .htaccess protections are disabled, allows remote attackers to inject arbitrary web script or HTML via crafted links involving theme .tpl.php files.

Affected products

Drupal/Drupal2 versions
cpe:2.3:a:drupal:drupal:4.7:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:drupal:drupal:4.7:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:5.0:*:*:*:*:*:*:*

Patches

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

secunia.com/advisories/28422nvdPatch
www.securityfocus.com/bid/27238nvdPatch
drupal.org/node/208565nvd
secunia.com/advisories/28486nvd
www.vbdrupal.org/forum/showthread.phpnvd
www.vbdrupal.org/forum/showthread.phpnvd
www.vupen.com/english/advisories/2008/0127nvd
www.vupen.com/english/advisories/2008/0134nvd
exchange.xforce.ibmcloud.com/vulnerabilities/39605nvd

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000