{"id":"CVE-2007-0626","aliases":["EUVD-2007-0624","GHSA-phv5-85pf-xrp3"],"status":"published","title":"The comment_form_add_preview function in comment.module in Drupal before 4.7.6, and 5.x before 5...","description":"The comment_form_add_preview function in comment.module in Drupal before 4.7.6, and 5.x before 5.1, and vbDrupal, allows remote attackers with \"post comments\" privileges and access to multiple input filters to execute arbitrary code by previewing comments, which are not processed by \"normal form validation routines.\"","severity":{"version":"2.0","score":6.5,"vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.034,"percentile":0.88919,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"published":"2007-01-31T18:00:00Z","modified":"2026-06-16T22:35:57Z","products":[{"vendor":"drupal","product":"drupal"}],"references":[{"url":"http://www.vbdrupal.org/forum/showthread.php?t=786","tags":["x_refsource_CONFIRM","x_transferred","Broken Link"]},{"url":"http://www.securityfocus.com/bid/22306","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"http://secunia.com/advisories/23960","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Third Party Advisory"]},{"url":"http://www.vupen.com/english/advisories/2007/0406","tags":["vdb-entry","x_refsource_VUPEN","x_transferred","Third Party Advisory"]},{"url":"http://osvdb.org/32136","tags":["vdb-entry","x_refsource_OSVDB","x_transferred","Broken Link"]},{"url":"http://www.vupen.com/english/advisories/2007/0415","tags":["vdb-entry","x_refsource_VUPEN","x_transferred","Third Party Advisory"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/31940","tags":["vdb-entry","x_refsource_XF","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"http://drupal.org/node/113935","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory"]},{"url":"http://archives.neohapsis.com/archives/bugtraq/2007-01/0670.html","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred","Broken Link"]},{"url":"http://secunia.com/advisories/23990","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2007-0626"},{"url":"https://github.com/advisories/GHSA-phv5-85pf-xrp3"}],"sources":{"cve":[{"id":"CVE-2007-0626","description":"The comment_form_add_preview function in comment.module in Drupal before 4.7.6, and 5.x before 5.1, and vbDrupal, allows remote attackers with \"post comments\" privileges and access to multiple input filters to execute arbitrary code by previewing comments, which are not processed by \"normal form validation routines.\"","status":"published","published":"2007-01-31T18:00:00Z","modified":"2024-08-07T12:26:54.479Z","updated_at":"2026-11-02T13:34:15.046008Z"}],"euvd":[{"id":"EUVD-2007-0624","description":"The comment_form_add_preview function in comment.module in Drupal before 4.7.6, and 5.x before 5.1, and vbDrupal, allows remote attackers with \"post comments\" privileges and access to multiple input filters to execute arbitrary code by previewing comments, which are not processed by \"normal form validation routines.\"","status":"published","published":"2007-01-31T18:00:00Z","modified":"2024-08-07T12:26:54Z","updated_at":"2026-11-03T01:38:29.627526Z"}],"ghsa":[{"id":"GHSA-phv5-85pf-xrp3","title":"The comment_form_add_preview function in comment.module in Drupal before 4.7.6, and 5.x before 5...","description":"The comment_form_add_preview function in comment.module in Drupal before 4.7.6, and 5.x before 5.1, and vbDrupal, allows remote attackers with \"post comments\" privileges and access to multiple input filters to execute arbitrary code by previewing comments, which are not processed by \"normal form validation routines.\"","status":"published","published":"2022-05-01T17:45:48Z","modified":"2023-01-31T05:03:33Z","updated_at":"2026-11-02T14:48:29.288424Z"}],"nvd":[{"id":"CVE-2007-0626","description":"The comment_form_add_preview function in comment.module in Drupal before 4.7.6, and 5.x before 5.1, and vbDrupal, allows remote attackers with \"post comments\" privileges and access to multiple input filters to execute arbitrary code by previewing comments, which are not processed by \"normal form validation routines.\"","status":"published","published":"2007-01-31T18:28:00Z","modified":"2026-06-16T22:35:57.267Z","cvss":[{"version":"2.0","score":6.5,"vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:01:13.10493Z"}]}}