CVE-2024-12393

score

<0.1

cvss

5.4

epss

0.3%

published

2024-12-10

kev added

—

first seen

2026-10-21

Drupal Core versions from 8.8.0 before 10.2.11, from 10.3.0 before 10.3.9, and from 11.0.0 before 11.0.8 contain a cross-site scripting caused by improper input neutralization during web page generation, letting attackers execute malicious scripts in users' browsers, exploit requires attacker to inject malicious input.