EUVD-2026-70010
GHSA-499q-gx9f-wxhq
Severity by source
AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:N
PR:H and AC:H reflect admin-only access under specific conditions; S:C with C:H/I:H captures XSS session-hijacking impact on victim users; A:N as availability is unaffected.
Primary rating from Vendor (drupal).
CVSS VectorVendor: drupal
Lifecycle Timeline
4DescriptionCVE.org
Vulnerability in Drupal Screenshot. This issue affects Screenshot versions: *.*.
AnalysisAI
Cross-site scripting (XSS) in the Drupal Screenshot contributed module allows a high-privileged authenticated attacker to inject malicious script content that executes in the browser context of other users who view the affected output, crossing security boundaries as reflected by the scope-changed CVSS vector. All tracked versions of the module are affected per the wildcard CPE and EUVD-2026-70010 listing. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated session with high administrative privileges on the target Drupal installation (PR:H), ruling out unauthenticated remote attackers. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:N yields a base score of 7.3, which accurately reflects the tension between high theoretical post-exploitation impact and substantially constrained exploitability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the update specified in Drupal security advisory SA-CONTRIB-2026-102, available at https://www.drupal.org/sa-contrib-2026-102. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Drupal instances running the Screenshot module and document versions in use; verify that only authorized personnel have high-privilege account access and that multi-factor authentication is enforced. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Screenshot
View allSame weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today