{"id":"CVE-2025-31687","aliases":["CLSA-2026-1788971215","CLSA-2026-1788973403","DRUPAL-CONTRIB-2025-016","EUVD-2025-9040","GHSA-8r2q-865v-wm8j"],"status":"published","title":"SpamSpan filter - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-016","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal SpamSpan filter allows Cross-Site Scripting (XSS).This issue affects SpamSpan filter: from 0.0.0 before 3.2.1.","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00262,"percentile":0.18185,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2025-02-12T17:38:09Z","modified":"2026-10-28T02:30:55Z","fixes":[{"ecosystem":"Packagist","package":"drupal/spamspan","fixed_in":["3.2.1"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:Packagist","package":"drupal/spamspan","fixed_in":["7.1.4-p1+tuxcare","3.2.0-p1+tuxcare"],"sources":["osv"]},{"ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/spamspan","fixed_in":["3.2.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"drupal/spamspan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.1"}]}]},{"source":"osv","ecosystem":"TuxCare:Packagist","package":"drupal/spamspan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.1.4"},{"fixed":"7.1.4-p1+tuxcare"}]}],"versions":["7.1.4"]},{"source":"osv","ecosystem":"TuxCare:Packagist","package":"drupal/spamspan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.0"},{"fixed":"3.2.0-p1+tuxcare"}]}],"versions":["3.2.0"]},{"source":"osv","ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/spamspan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.1"}]}]},{"source":"osv","ecosystem":"Packagist","package":"drupal/spamspan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.1"}]}]}],"products":[{"vendor":"drowl","product":"spamspan_filter"},{"vendor":"drupal","product":"spamspan filter"}],"references":[{"url":"https://www.drupal.org/sa-contrib-2025-016","tags":["Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-31687","tags":["advisory"]},{"url":"https://git.drupalcode.org/project/spamspan/-/commit/90d622211c8bb316080a3af1dcf253b0d7e90791","tags":["web"]},{"url":"https://github.com/advisories/GHSA-8r2q-865v-wm8j"},{"url":"https://git.drupalcode.org/project/spamspan","tags":["web","package"]},{"url":"https://www.drupal.org/project/spamspan","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/31xxx/CVE-2025-31687.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-31687","title":"SpamSpan filter - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-016","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal SpamSpan filter allows Cross-Site Scripting (XSS).This issue affects SpamSpan filter: from 0.0.0 before 3.2.1.","status":"published","published":"2025-03-31T21:44:50.483Z","modified":"2025-04-29T15:26:59.461Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:32:44.763463Z"}],"euvd":[{"id":"EUVD-2025-9040","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal SpamSpan filter allows Cross-Site Scripting (XSS).This issue affects SpamSpan filter: from 0.0.0 before 3.2.1.","status":"published","published":"2025-03-31T21:44:50Z","modified":"2025-04-29T15:26:59Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T20:52:00.449871Z"}],"ghsa":[{"id":"GHSA-8r2q-865v-wm8j","title":"Drupal SpamSpan Cross-Site Scripting (XSS) vulnerability","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal SpamSpan filter allows Cross-Site Scripting (XSS). This issue affects SpamSpan filter: from 0.0.0 before 3.2.1.","status":"published","published":"2025-04-01T00:30:34Z","modified":"2025-04-29T20:23:13Z","cvss":[{"version":"4.0","score":1.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U","level":"low"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:38:41.402125Z"}],"nvd":[{"id":"CVE-2025-31687","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal SpamSpan filter allows Cross-Site Scripting (XSS).This issue affects SpamSpan filter: from 0.0.0 before 3.2.1.","status":"published","published":"2025-03-31T22:15:21.317Z","modified":"2026-06-17T09:10:46.59Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:10:57.134561Z"}],"osv":[{"id":"CVE-2025-31687","title":"SpamSpan filter - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-016","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal SpamSpan filter allows Cross-Site Scripting (XSS).This issue affects SpamSpan filter: from 0.0.0 before 3.2.1.","status":"published","published":"2025-03-31T21:44:50.483Z","modified":"2026-10-28T02:30:55.174570294Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:44:48.02508Z"},{"id":"GHSA-8r2q-865v-wm8j","title":"Drupal SpamSpan Cross-Site Scripting (XSS) vulnerability","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal SpamSpan filter allows Cross-Site Scripting (XSS). This issue affects SpamSpan filter: from 0.0.0 before 3.2.1.","status":"published","published":"2025-04-01T00:30:34Z","modified":"2025-12-10T23:41:11.245251Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"},{"version":"4.0","score":1.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U","level":"low"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:42.78452Z"},{"id":"CLSA-2026-1788971215","title":"TuxCare security update for drupal/spamspan (1 CVE)","description":"TuxCare rebuilt drupal/spamspan to address 1 CVE. Fixed in 7.1.4-p1+tuxcare.","status":"published","published":"2026-09-09T16:26:55Z","modified":"2026-10-15T09:48:00.606202019Z","updated_at":"2026-11-02T15:43:47.938828Z"},{"id":"CLSA-2026-1788973403","title":"TuxCare security update for drupal/spamspan (1 CVE)","description":"TuxCare rebuilt drupal/spamspan to address 1 CVE. Fixed in 3.2.0-p1+tuxcare.","status":"published","published":"2026-09-09T17:03:23Z","modified":"2026-10-15T09:48:00.575479495Z","updated_at":"2026-11-02T15:43:47.938828Z"},{"id":"DRUPAL-CONTRIB-2025-016","description":"This module enables your site to obfuscate Email addresses and prevent spambots to collect them.\n\nThe module doesn't sanitize HTML data attributes when an email address link is transformed to separate span HTML elements and then transformed back by JavaScript leading to a Cross Site Scripting (XSS) vulnerability.\n\nThis is mitigated by the fact an attacker must be able to insert span HTML elements with data attributes in the page.","status":"published","published":"2025-02-12T17:38:09Z","modified":"2026-09-10T03:46:13.598531812Z","updated_at":"2026-11-02T15:46:13.584509Z"}]}}