Unrated severityNVD Advisory· Published Jan 15, 2008· Updated Jun 16, 2026

CVE-2008-0274

Description

Cross-site scripting (XSS) vulnerability in Drupal 4.7.x and 5.x, when certain .htaccess protections are disabled, allows remote attackers to inject arbitrary web script or HTML via crafted links involving theme .tpl.php files.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Drupal/Drupal3 versions
cpe:2.3:a:drupal:drupal:4.7:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:drupal:drupal:4.7:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:5.0:*:*:*:*:*:*:*
- (no CPE)range: 4.7.x, 5.x

Patches

Vulnerability mechanics

References

secunia.com/advisories/28422nvdPatch
www.securityfocus.com/bid/27238nvdPatch
drupal.org/node/208565nvd
secunia.com/advisories/28486nvd
www.vbdrupal.org/forum/showthread.phpnvd
www.vbdrupal.org/forum/showthread.phpnvd
www.vupen.com/english/advisories/2008/0127nvd
www.vupen.com/english/advisories/2008/0134nvd
exchange.xforce.ibmcloud.com/vulnerabilities/39605nvd

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000