EUVD-2025-18290Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Lifecycle Timeline
4DescriptionCVE.org
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal etracker allows Cross-Site Scripting (XSS).This issue affects etracker: from 0.0.0 before 3.1.0.
AnalysisAI
Stored/Reflected Cross-Site Scripting (XSS) vulnerability in the Drupal etracker module that allows unauthenticated remote attackers to inject malicious scripts into web pages without requiring user interaction. The vulnerability affects etracker versions prior to 3.1.0, enabling attackers to steal session tokens, perform unauthorized actions, or redirect users to malicious sites. The CVSS 7.3 score and network-accessible attack vector indicate this is a significant vulnerability affecting any Drupal installation with the vulnerable etracker module enabled.
Technical ContextAI
The vulnerability stems from CWE-79 (Improper Neutralization of Input During Web Page Generation), which occurs when user-supplied input is not properly sanitized or escaped before being rendered in HTML context. The Drupal etracker module fails to properly neutralize user inputs that may be reflected or stored in web pages, allowing attackers to inject JavaScript payloads. Drupal's security model relies on proper use of sanitization functions (like Xss::filter() or check_plain()) and output escaping through templating engines. The etracker module likely accepts user input (through form submissions, URL parameters, or configuration) without applying adequate input validation or output encoding, violating OWASP Top 10 2021 A03:2021 - Injection principles.
RemediationAI
Immediate actions: (1) Update the etracker module to version 3.1.0 or later immediately—this is the official patched version that neutralizes the XSS input. (2) If immediate patching is not possible, disable the etracker module temporarily via Drupal admin or drush: drush pm-disable etracker. (3) Implement Content Security Policy (CSP) headers with script-src restrictions to mitigate XSS impact. (4) Review web server logs and database audit logs for evidence of exploitation (unusual script tags in module-related parameters). (5) Force user session invalidation post-patch to clear any stolen tokens. (6) Apply Drupal security updates for core and all contrib modules. Refer to https://www.drupal.org/project/etracker for official advisory and patch downloads.
More from same product – last 7 days
Authentication bypass in Discuz! X5.0 releases 20260320 through 20260501 allows unauthenticated remote attackers to acce
Authenticated remote code execution in Discuz! X5.0 releases 20260320 through 20260501 allows administrators to chain a
Unauthenticated PHP Object Injection in the Happyforms WordPress plugin (versions <= 1.26.13) allows remote attackers to
Unauthenticated PHP Object Injection in the Broadcast Live Video WordPress plugin (versions prior to 7.1.3) allows remot
Unauthenticated PHP object injection in the WordPress plugin 'Integration for Keap/Infusionsoft and Contact Form 7, WPFo
Share
External POC / Exploit Code
Leaving vuln.today