CVE-2014-1607: Drupal

Medium severity, CVSS 4.3. EPSS: 1.3% chance of exploitation in the next 30 days.

Cross-site scripting (XSS) vulnerability in the EventCalendar module for Drupal 7.14 allows remote attackers to inject arbitrary web script or HTML via the year parameter to eventcalander/. NOTE: this issue has been disputed by the Drupal Security Team; it may be site-specific. If so, then this CVE will be REJECTed in the future

Affected products

• Drupal Drupal: version 7.14 only

Published 2014-01-26. Last modified 2026-06-17.