Description
Cross-site scripting (XSS) vulnerability in the Imagemenu module 6.x-1.x before 6.x-1.4 for Drupal allows remote authenticated users with the "administer imagemenu" permission to inject arbitrary web script or HTML via an image file name.
References
- 50683 third-party-advisory
- 85679 vdb-entry
- https://drupal.org/node/1789260
- 55610 vdb-entry
- https://drupal.org/node/1788726
- imagemenu-imagefilenames-xss(78697) vdb-entry