CVE-2012-1639
01.10.2012, 20:55
Multiple cross-site scripting (XSS) vulnerabilities in product/commerce_product.module in the Drupal Commerce module for Drupal before 7.x-1.2 allow remote authenticated users to inject arbitrary web script or HTML via the (1) sku or (2) title parameters.
| Vendor | Product | Version |
|---|---|---|
| commerceguys | commerce | 𝑥 ≤ 7.x-1.1 |
| commerceguys | commerce | 7.x-1.0:x |
| commerceguys | commerce | 7.x-1.0:x |
| commerceguys | commerce | 7.x-1.0:x |
| commerceguys | commerce | 7.x-1.0:x |
| commerceguys | commerce | 7.x-1.0:x |
| commerceguys | commerce | 7.x-1.0:x |
| commerceguys | commerce | 7.x-1.0:x |
| commerceguys | commerce | 7.x-1.0:x |
| commerceguys | commerce | 7.x-1.0:x |
| commerceguys | commerce | 7.x-1.0:x |
| commerceguys | commerce | 7.x-1.0:x |
| commerceguys | commerce | 7.x-1.0:x |
| commerceguys | commerce | 7.x-1.x:x |
𝑥
= Vulnerable software versions
References