PT-2026-23111 · Drupal+2 · Calculation Fields+1

Drew Webber + 2 · Publicado 2026-03-04 · Atualizado 2026-03-26 · CVE-2026-3528

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Drupal Calculation Fields versions prior to 1.0.4

Description The Calculation Fields module for Drupal does not properly validate user-supplied input, potentially allowing for Information Disclosure or Cross-Site Scripting (XSS) attacks. This module extends the Drupal form API, adding calculation element form element types that can evaluate mathematical expressions and offers webform integration. The issue arises from insufficient input validation, which could be exploited by an attacker.

Recommendations Update the Calculation Fields module to version 1.0.4 or later.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2026-3528

DRUPAL-CONTRIB-2026-023

Produtos afetados

Calculation Fields

Drupal/Calculation Fields

Referências · 4

• https://drupal.org/sa-contrib-2026-023 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-3528 · Nota de Segurança
• https://osv.dev/vulnerability/DRUPAL-CONTRIB-2026-023 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2037280556220854621 · Publicação no Twitter