CVE-2010-2472

score

<0.1

cvss

4.8

epss

0.8%

published

2019-11-07

kev added

—

first seen

2026-10-21

Drupal 6.x before 6.16 and 5.x before 5.22 contain a cross-site scripting caused by improper sanitization of language codes and names in the Locale module, letting attackers with 'administer languages' permission execute malicious scripts, exploit requires attacker to have 'administer languages' permission.