{"id":"CVE-2025-14556","aliases":["CLSA-2026-1789632791","EUVD-2026-2442","GHSA-53jh-8vxh-rrrh"],"status":"published","title":"XSS in Drupal 7 Flag Module","description":"Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Drupal Flag allows Cross-Site Scripting (XSS).This issue affects Flag: from 7.X-3.0 through 7.X-3.9.","severity":{"version":"4.0","score":4.8,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00209,"percentile":0.11193,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2026-01-14T18:38:21Z","modified":"2026-10-28T02:30:29Z","fixes":[{"ecosystem":"TuxCare:Packagist","package":"drupal/flag","fixed_in":["7.3.9-p1+tuxcare"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"TuxCare:Packagist","package":"drupal/flag","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.3.9"},{"fixed":"7.3.9-p1+tuxcare"}]}],"versions":["7.3.9"]}],"products":[{"vendor":"drupal","product":"flag"},{"vendor":"flag_module_project","product":"flag"}],"references":[{"url":"https://www.herodevs.com/vulnerability-directory/cve-2025-14556","tags":["vendor-advisory","Exploit","Third Party Advisory","advisory"]},{"url":"https://d7es.tag1.com/security-advisories/flag-moderately-critical-cross-site-scripting-backdrop-sa-contrib-2025-011","tags":["vendor-advisory","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-14556","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-53jh-8vxh-rrrh"},{"url":"https://git.drupalcode.org/project/flag","tags":["web"]},{"url":"https://www.drupal.org/project/flag","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/14xxx/CVE-2025-14556.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-14556","title":"XSS in Drupal 7 Flag Module","description":"Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Drupal Flag allows Cross-Site Scripting (XSS).This issue affects Flag: from 7.X-3.0 through 7.X-3.9.","status":"published","published":"2026-01-14T18:38:21.047Z","modified":"2026-01-14T19:16:19.268Z","cvss":[{"version":"4.0","score":4.8,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"medium","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:32:28.943062Z"}],"euvd":[{"id":"EUVD-2026-2442","description":"Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Drupal Flag allows Cross-Site Scripting (XSS).This issue affects Flag: from 7.X-3.0 through 7.X-3.9.","status":"published","published":"2026-01-14T18:38:21Z","modified":"2026-01-14T19:16:19Z","cvss":[{"version":"4.0","score":4.8,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"medium"}],"updated_at":"2026-11-02T19:48:51.744142Z"}],"ghsa":[{"id":"GHSA-53jh-8vxh-rrrh","title":"Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')...","description":"Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Drupal Flag allows Cross-Site Scripting (XSS).This issue affects Flag: from 7.X-3.0 through 7.X-3.9.","status":"published","published":"2026-01-14T21:34:10Z","modified":"2026-01-23T15:31:34Z","cvss":[{"version":"4.0","score":4.8,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"},{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:05:53.055975Z"}],"nvd":[{"id":"CVE-2025-14556","description":"Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Drupal Flag allows Cross-Site Scripting (XSS).This issue affects Flag: from 7.X-3.0 through 7.X-3.9.","status":"published","published":"2026-01-14T19:16:41.4Z","modified":"2026-06-17T08:36:09.93Z","cvss":[{"version":"4.0","score":4.8,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:11:57.915063Z"}],"osv":[{"id":"CVE-2025-14556","title":"XSS in Drupal 7 Flag Module","description":"Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Drupal Flag allows Cross-Site Scripting (XSS).This issue affects Flag: from 7.X-3.0 through 7.X-3.9.","status":"published","published":"2026-01-14T18:38:21.047Z","modified":"2026-10-28T02:30:29.318827023Z","cvss":[{"version":"4.0","score":4.8,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:44:46.340268Z"},{"id":"CLSA-2026-1789632791","title":"TuxCare security update for drupal/flag (1 CVE)","description":"TuxCare rebuilt drupal/flag to address 1 CVE. Fixed in 7.3.9-p1+tuxcare.","status":"published","published":"2026-09-17T08:13:11Z","modified":"2026-10-15T09:48:00.461201638Z","updated_at":"2026-11-02T15:43:48.28229Z"}]}}