Screenshot
Monthly
Cross-site scripting (XSS) in the Drupal Screenshot contributed module allows a high-privileged authenticated attacker to inject malicious script content that executes in the browser context of other users who view the affected output, crossing security boundaries as reflected by the scope-changed CVSS vector. All tracked versions of the module are affected per the wildcard CPE and EUVD-2026-70010 listing. No public exploit code and no CISA KEV listing have been identified at time of analysis; Drupal's security team published advisory SA-CONTRIB-2026-102.
Cross-site scripting in the Drupal Screenshot contributed module allows a high-privileged authenticated attacker to inject malicious script content that executes in the browser context of other users who view the affected page. The scope-changing CVSS vector (S:C) confirms that the injected payload can compromise sessions or data belonging to users other than the attacker, enabling session hijacking, credential theft, or unauthorized actions on behalf of victims. No public exploit code has been identified at time of analysis, and no KEV listing is present.
Cross-site scripting (XSS) in the Drupal Screenshot contributed module allows a high-privileged authenticated attacker to inject malicious script content that executes in the browser context of other users who view the affected output, crossing security boundaries as reflected by the scope-changed CVSS vector. All tracked versions of the module are affected per the wildcard CPE and EUVD-2026-70010 listing. No public exploit code and no CISA KEV listing have been identified at time of analysis; Drupal's security team published advisory SA-CONTRIB-2026-102.
Cross-site scripting in the Drupal Screenshot contributed module allows a high-privileged authenticated attacker to inject malicious script content that executes in the browser context of other users who view the affected page. The scope-changing CVSS vector (S:C) confirms that the injected payload can compromise sessions or data belonging to users other than the attacker, enabling session hijacking, credential theft, or unauthorized actions on behalf of victims. No public exploit code has been identified at time of analysis, and no KEV listing is present.