CVE-2010-2250: Drupal

Medium severity, CVSS 6.1. EPSS: 1% chance of exploitation in the next 30 days.

Drupal 5.x and 6.x before 6.16 uses a user-supplied value in output during site installation which could allow an attacker to craft a URL and perform a cross-site scripting attack.

Affected products

• Drupal Drupal: from 5.0, before 5.22 (fixed in 5.22); from 6.0, before 6.16 (fixed in 6.16)

Published 2019-11-07. Last modified 2026-06-16.