CVE-2008-1916: Multiple cross-site scripting (XSS) vulnerabilities in the Ubercart 5.x before 5.x-1.0-rc1 module for Drupa...

Security readout for executives and security teams

This is a cross-site scripting issue in the Ubercart module for Drupal 5. Malicious content entered into address or order fields could later run when an order or administrative page is viewed. The main business concern is compromise of staff sessions or administrative actions on legacy Drupal commerce sites. Exposure appears limited to legacy Drupal 5 deployments running Ubercart 5.x versions earlier than 5.x-1.0-rc1, especially sites where untrusted users can submit order or address data that staff later review. Treat this as a legacy platform risk. It is not supported by current exploitation evidence in the bundle, but exposed Drupal commerce administration paths can create meaningful account and transaction integrity risk if still operating. Mitigation focus: Identify any Drupal 5 sites using the Ubercart 5.x module.; Upgrade Ubercart to 5.x-1.0-rc1 or later where applicable.; Review the Drupal advisory for vendor-specific upgrade guidance..

Prepared

Jun 28, 2026, 19:09 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.