PT-2026-5189 · Drupal · Drupal Form Builder

Yonatan Offek · Publicado 2026-01-28 · Atualizado 2026-03-09 · CVE-2026-0749

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Drupal Form Builder versions 7.X-1.0 through 7.X-1.22

Description A flaw exists in Drupal Form Builder that allows for Cross-Site Scripting (XSS). This issue is due to improper neutralization of input during web page generation. Successful exploitation could allow an attacker to inject malicious scripts into web pages viewed by other users.

Recommendations Update Drupal Form Builder to a version later than 7.X-1.22.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2026-0749

Produtos afetados

Drupal Form Builder

Referências · 6

• 🔥 https://herodevs.com/vulnerability-directory/cve-2026-0749 · Exploit
• https://d7es.tag1.com/security-advisories/form-builder-less-critical-cross-site-scripting · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-0749 · Nota de Segurança
• https://twitter.com/CVEnew/status/2016587736631648412 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-0749 · Aviso do Fabricante
• https://t.me/cveNotify/154803 · Publicação no Telegram