CVE-2015-6658

Cross-site scripting (XSS) vulnerability in the Autocomplete system in Drupal 6.x before 6.37 and...

4.3 Medium

Cross-site scripting (XSS) vulnerability in the Autocomplete system in Drupal 6.x before 6.37 and 7.x before 7.39 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, related to uploading files.

Exploit likelihood

2.48%Up 0.5 points since Feb 4, 2022

What each source reports

NVD Score used 4.3

Record: CVE-2015-6658
CVSS 2.0: 4.3 MediumAV:N/AC:M/Au:N/C:N/I:P/A:N
Weakness: CWE-79
Updated: 2026-11-02

CVE List No score

Record: CVE-2015-6658
Updated: 2026-11-02

EUVDEUVD-2015-6596 No score

Record: EUVD-2015-6596
Updated: 2026-11-03

GitHub AdvisoriesGHSA-j9pq-x44j-6p86 No score

Cross-site scripting (XSS) vulnerability in the Autocomplete system in Drupal 6.x before 6.37 and...

Record: GHSA-j9pq-x44j-6p86
Weakness: CWE-79
Updated: 2026-11-02

OSVMGASA-2015-0328 No score

Updated drupal packages fix security vulnerabilities

Cross-site scripting (XSS) vulnerability in the Autocomplete system in Drupal before 7.39 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, related to uploading files (CVE-2015-6658).

SQL injection vulnerability in the SQL comment filtering system in the Database API in Drupal before 7.39 allows remote attackers to execute arbitrary SQL commands via an SQL comment (CVE-2015-6659).

The Form API in Drupal 6.x before 6.37 and 7.x before 7.39 does not properly validate the form token, which allows remote attackers to conduct CSRF attacks that upload files in a different user's account via vectors related to "file upload value callbacks" (CVE-2015-6660).

Drupal before 7.39 allows remote attackers to obtain sensitive node titles by reading the menu (CVE-2015-6661).

Cross-site scripting (XSS) vulnerability in the Ajax handler in Drupal before 7.39 allows remote attackers to inject arbitrary web script or HTML via vectors involving a whitelisted HTML element, possibly related to the "a" tag (CVE-2015-6665).

Record: MGASA-2015-0328
Updated: 2026-11-02

OSVUBUNTU-CVE-2015-6658 No score

Record: UBUNTU-CVE-2015-6658
Updated: 2026-11-02

Affected products

drupal

Affected packages

Affected packages
Package	Affected	Fixed
`drupal7` Debian:7 From an advisory covering 5 CVEs	before 7.14-2+deb7u11, plus listed versions 7.14-27.14-2+deb7u17.14-2+deb7u107.14-2+deb7u10~bpo60+17.14-2+deb7u11~bpo60+1 Show 14 moreShow less 7.14-2+deb7u1~bpo60+17.14-2+deb7u27.14-2+deb7u2~bpo60+17.14-2+deb7u37.14-2+deb7u47.14-2+deb7u4~bpo60+17.14-2+deb7u57.14-2+deb7u67.14-2+deb7u6~bpo60+17.14-2+deb7u77.14-2+deb7u7~bpo60+17.14-2+deb7u87.14-2+deb7u97.14-2+deb7u9~bpo60+1	7.14-2+deb7u11
`drupal7` Debian:8 From an advisory covering 5 CVEs	before 7.32-1+deb8u5, plus listed versions 7.32-1+deb8u37.32-1+deb8u47.32-1+deb8u4~bpo70+17.32-1+deb8u5~bpo70+1	7.32-1+deb8u5
`drupal` Mageia:4 From an advisory covering 5 CVEs	before 7.39-1.mga4	7.39-1.mga4
`drupal` Mageia:5 From an advisory covering 5 CVEs	before 7.39-1.mga5	7.39-1.mga5
`drupal7` Ubuntu:Pro:14.04:LTS	All versions, plus listed versions 7.23-17.24-17.24-27.26-17.26-1ubuntu0.17.26-1ubuntu0.1+esm17.26-1ubuntu0.1+esm27.26-1ubuntu0.1+esm3	None known

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2015-6658 is a medium vulnerability (CVSS 4.3) in Drupal, published August 24, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.48%, the 84th percentile. No source names a fixed version.

References

Show 12 moreShow less