Json Field
Monthly
Cross-site scripting in the Drupal contributed module JSON Field (versions from 0.0.0 before 1.5) allows injected script to execute in the browser of a user who views a page rendering unsanitized JSON Field output. Per the CVSS vector AV:N/AC:L/PR:N/UI:R, exploitation is remote but requires victim user interaction, and per the independent assessment the realistic prerequisite is that the target site has the module installed below 1.5 and exposes a page or form that accepts and later renders JSON Field input without sanitization; impact is confined to the browser/session context with Low confidentiality and integrity impact and no availability impact. Exploitation status: no public exploit identified at time of analysis, and the EPSS score is low at 0.20% (9th percentile), so mass scanning and opportunistic exploitation are unlikely. No CISA KEV entry is present for this CVE.
Cross-site scripting in the Drupal contributed module JSON Field (versions from 0.0.0 before 1.5) allows injected script to execute in the browser of a user who views a page rendering unsanitized JSON Field output. Per the CVSS vector AV:N/AC:L/PR:N/UI:R, exploitation is remote but requires victim user interaction, and per the independent assessment the realistic prerequisite is that the target site has the module installed below 1.5 and exposes a page or form that accepts and later renders JSON Field input without sanitization; impact is confined to the browser/session context with Low confidentiality and integrity impact and no availability impact. Exploitation status: no public exploit identified at time of analysis, and the EPSS score is low at 0.20% (9th percentile), so mass scanning and opportunistic exploitation are unlikely. No CISA KEV entry is present for this CVE.