UpHeron
All vulnerabilities

Servers and applications

CVE-2007-0626

The comment_form_add_preview function in comment.module in Drupal before 4.7.6, and 5.x before 5.1, and vbDrupal, allows remote attackers with "post comments" privileges and access to multiple input filters to execute arbitrary code by previewing comments, which are not processed by "normal form validation routines."

Severity
Medium 6.5
Published
31 Jan 2007
Last changed
16 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
4.7.6, 5.1
Exploit chance
3.4% in the next 30 daysHigher than 89% of CVEs. EPSS by FIRST, 12 Nov 2026
Attack
Over the network · Needs a login
Attacker can
Read some data · Change some data · Slow it down
CVSS vector
AV:N/AC:L/Au:S/C:P/I:P/A:P
Sources
NVD

Affected software

SoftwareAffected versions
DrupalServers and applications · cpe:a:drupal:drupal
  • After 4.7.0 before 4.7.6
  • From 5.0 before 5.1

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2007-0626
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2007-0626