CVE-2025-12761
LOWCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N
Lifecycle Timeline
3Description
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Simple multi step form allows Cross-Site Scripting (XSS).This issue affects Simple multi step form: from 0.0.0 before 2.0.0.
Analysis
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Simple multi step form allows Cross-Site Scripting (XSS).0.0 before 2.0.0. Rated low severity (CVSS 3.5), this vulnerability is remotely exploitable, low attack complexity.
Technical Context
This vulnerability is classified as Cross-Site Scripting (XSS) (CWE-79), which allows attackers to inject malicious scripts into web pages viewed by other users. Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Simple multi step form allows Cross-Site Scripting (XSS).0.0 before 2.0.0. Affected products include: Simple Multi Step Form Project Simple Multi Step Form. Version information: before 2.0.0..
Affected Products
Simple Multi Step Form Project Simple Multi Step Form.
Remediation
A vendor patch is available. Apply the latest security update as soon as possible. Sanitize all user input, use Content-Security-Policy headers, encode output contextually (HTML, JS, URL). Use frameworks with built-in XSS protection.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today