CVE-2020-13666

score

<0.1

cvss

6.1

epss

2.9%

published

2021-05-05

kev added

—

first seen

2026-10-21

Drupal Core contains a reflected cross-site scripting caused by AJAX API not disabling JSONP by default, letting attackers execute malicious scripts in victim browsers, exploit requires attacker to craft malicious JSONP request.