VYPR
← All advisories
Medium severity6.1NVD Advisory· Published Jan 28, 2026· Updated Jun 17, 2026

CVE-2025-13984

CVE-2025-13984

Description

Permissive Cross-domain Security Policy with Untrusted Domains vulnerability in Drupal Next.Js allows Cross-Site Scripting (XSS).This issue affects Next.Js: from 0.0.0 before 1.6.4, from 2.0.0 before 2.0.1.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

2
  • Kanopi/Next.js
    cpe:2.3:a:kanopi:next.js:*:*:*:*:*:drupal:*:*
    Range: <1.6.4
  • Drupal/Next.Jsllm-create
    Range: from 0.0.0 before 1.6.4, from 2.0.0 before 2.0.1

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.