EUVD-2026-43093
GHSA-44mv-pf85-f9px
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Typical stored XSS: network vector, low complexity, UI:R because a victim must view the payload, S:C into the browser, low C/I and no A; PR:L assumes some access to submit input.
Primary rating from Vendor (drupal).
CVSS VectorVendor: drupal
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
vulnerability in Drupal Mother May I allows . This issue affects Mother May I versions: *.*.
AnalysisAI
Stored/reflected cross-site scripting (CWE-79) affects the Drupal contributed module 'Mother May I' across all released versions (*.*), letting attackers inject script that executes in the browser context of other Drupal users. Because the module is a Drupal add-on rather than core, exposure is limited to sites that have installed it, and no public exploit has been identified. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the Drupal site has the 'Mother May I' contrib module installed and enabled and that an attacker can reach an input field the module renders back into a page; the effective trigger is a victim (often an admin) viewing the page containing the injected payload, so despite the published UI:N metric, XSS of this class realistically depends on user interaction with the poisoned content. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals conflict sharply and should be reconciled before prioritization. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker submits a crafted value containing HTML/JavaScript into a field processed by the Mother May I module; when a Drupal user or administrator later views the page that renders that value, the script executes in their authenticated session. Given the network attack vector and low complexity, the attacker could use this to steal session cookies, perform actions as the victim, or attempt to escalate toward administrative control. … |
| Remediation | Patch available per vendor advisory - consult the Drupal Security Team advisory at https://www.drupal.org/sa-contrib-2026-045 for the fixed release and upgrade to the patched version of the Mother May I module (an exact fixed version number is not present in the provided data, so confirm it directly from the advisory before deploying). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Audit all Drupal installations to identify systems where the 'Mother May I' module is active and document affected environments. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today