CVE-2007-3818: Drupal Logintoboggan Module

Low severity, CVSS 3.5. EPSS: 0.7% chance of exploitation in the next 30 days.

Cross-site scripting (XSS) vulnerability in the LoginToboggan module 5.x-1.x-dev before 20070712 for Drupal allows remote authenticated users with "administer blocks" permission to inject arbitrary JavaScript and gain privileges via "the message displayed above the default user login block."

Affected products

• Drupal Logintoboggan Module: up to and including 4.7.x-1.0; up to and including 5.x-1.x-dev

Published 2007-07-17. Last modified 2026-06-16.