EUVD-2025-18288Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal COOKiES Consent Management allows Cross-Site Scripting (XSS).This issue affects COOKiES Consent Management: from 0.0.0 before 1.2.15.
AnalysisAI
Cross-Site Scripting (XSS) vulnerability in Drupal's COOKiES Consent Management module that allows unauthenticated remote attackers to inject and execute malicious scripts during web page generation. All versions from 0.0.0 before 1.2.15 are affected. The vulnerability has a high CVSS score of 8.6 with no authentication or user interaction required, enabling attackers to compromise confidentiality, modify page content, and degrade availability. The network-based attack vector and low complexity indicate this is likely actively exploitable in real-world deployments.
Technical ContextAI
The vulnerability exists in the Drupal COOKiES Consent Management module (CPE: cpe:2.3:a:drupal:cookies_consent_management:*), which is a web-based cookie consent banner and management solution for Drupal-based websites. The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), a classic XSS vulnerability where user-controlled input or configuration data is rendered into HTML/JavaScript without proper sanitization or output encoding. In the context of a cookie consent management tool, this likely involves inadequate escaping of cookie policy text, consent messages, or configuration parameters that are reflected in the dynamically generated consent banner. The module operates within Drupal's rendering pipeline, where content should be properly sanitized using Drupal's XHTML filter or equivalent functions before output. The failure to do so allows attackers to bypass the cookie consent interface entirely and inject arbitrary client-side code.
RemediationAI
Immediate Patch: Upgrade Drupal COOKiES Consent Management module to version 1.2.15 or later; priority: CRITICAL; method: Use Drupal's module update system (Manage > Extend > Update or via Composer: composer update drupal/cookies_consent_management) Verification: After patching, verify the module version: drush pm-info cookies_consent_management or check /admin/modules; priority: HIGH Interim Mitigation (if patching delayed): Disable the COOKiES Consent Management module temporarily via /admin/modules if the delay in patching is necessary; this removes the attack surface entirely; priority: MEDIUM Input Validation Review: If operating a custom fork or extension, audit all cookie policy text, consent message fields, and configuration parameters to ensure they are properly sanitized using Drupal's sanitizer functions (e.g., Xss::filter(), htmlspecialchars() with ENT_QUOTES, or Drupal's render array #plain_text property); priority: HIGH WAF/Content Security Policy: Implement or strengthen Content Security Policy (CSP) headers to restrict inline script execution and limit XSS blast radius, even if exploitation occurs; priority: MEDIUM
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today