CVE-2007-0626
The comment_form_add_preview function in comment.module in Drupal before 4.7.6, and 5.x before 5...
The comment_form_add_preview function in comment.module in Drupal before 4.7.6, and 5.x before 5.1, and vbDrupal, allows remote attackers with "post comments" privileges and access to multiple input filters to execute arbitrary code by previewing comments, which are not processed by "normal form validation routines."
Exploit likelihood
What each source reports
NVD Score used
The comment_form_add_preview function in comment.module in Drupal before 4.7.6, and 5.x before 5.1, and vbDrupal, allows remote attackers with "post comments" privileges and access to multiple input filters to execute arbitrary code by previewing comments, which are not processed by "normal form validation routines."
- Record
CVE-2007-0626- CVSS 2.0
- 6.5 Medium
AV:N/AC:L/Au:S/C:P/I:P/A:P - Updated
- 2026-11-02
CVE List No score
The comment_form_add_preview function in comment.module in Drupal before 4.7.6, and 5.x before 5.1, and vbDrupal, allows remote attackers with "post comments" privileges and access to multiple input filters to execute arbitrary code by previewing comments, which are not processed by "normal form validation routines."
- Record
CVE-2007-0626- Updated
- 2026-11-02
EUVDEUVD-2007-0624 No score
The comment_form_add_preview function in comment.module in Drupal before 4.7.6, and 5.x before 5.1, and vbDrupal, allows remote attackers with "post comments" privileges and access to multiple input filters to execute arbitrary code by previewing comments, which are not processed by "normal form validation routines."
- Record
EUVD-2007-0624- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-phv5-85pf-xrp3 No score
The comment_form_add_preview function in comment.module in Drupal before 4.7.6, and 5.x before 5...
The comment_form_add_preview function in comment.module in Drupal before 4.7.6, and 5.x before 5.1, and vbDrupal, allows remote attackers with "post comments" privileges and access to multiple input filters to execute arbitrary code by previewing comments, which are not processed by "normal form validation routines."
- Record
GHSA-phv5-85pf-xrp3- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2007-0626 is a medium vulnerability (CVSS 6.5) in Drupal, published January 31, 2007. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.40%, the 88th percentile. No source names a fixed version.