CVE-2025-3130

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Obfuscate allows Stored XSS.This issue affects Obfuscate: from 0.0.0 before 2.0.1.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Drupal	Obfuscate	>= 0.0.0, < 2.0.1

References

https://www.drupal.org/sa-contrib-2025-029Vendor Advisory

Timeline

Published: Apr 2, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-31315.4Cross-Site Request Forgery (CSRF) vulnerability in Drupal ECA: Event - Condition - Action allows Cross Site Request Forgery.This issue affec CVE-2025-313249.8SAP NetWeaver Visual Composer Metadata Uploader is not protected with a proper authorization, allowing unauthenticated agent to upload poten CVE-2025-313255.8Due to a Cross-Site Scripting vulnerability in SAP NetWeaver (ABAP Keyword Documentation), an unauthenticated attacker could inject maliciou CVE-2025-313264.1SAP�BusinessObjects Business�Intelligence Platform (Web Intelligence) is vulnerable to HTML Injection, allowing an attacker with basic user CVE-2025-313274.3SAP Field Logistics Manage Logistics application OData meta-data property is vulnerable to data tampering, due to which certain fields could CVE-2025-313284.6SAP Learning Solution is vulnerable to Cross-Site Request Forgery (CSRF), allowing an attacker to trick authenticated user into sending unin CVE-2025-313296.2SAP NetWeaver is vulnerable to an Information Disclosure vulnerability caused by the injection of malicious instructions into user configura CVE-2025-313309.9SAP Landscape Transformation (SLT) allows an attacker with user privileges to exploit a vulnerability in the function module exposed via RFC CVE-2025-313314.3SAP NetWeaver allows an attacker to bypass authorization checks, enabling them to view portions of ABAP code that would normally require add CVE-2025-313327.1Due to insecure file permissions in SAP BusinessObjects Business Intelligence Platform, an attacker who has local access to the system could CVE-2025-313334.3SAP S4CORE OData meta-data property is vulnerable to data tampering, due to which entity set could be externally modified by an attacker cau CVE-2025-313346.8Issue that bypasses the "Mark of the Web" security warning function for files when opening a symbolic link that points to an executable file