CVE-2008-3097: Cross-site scripting (XSS) vulnerability in the Tinytax module (aka Tinytax taxonomy block) 5.x before 5.x-...

Security readout for executives and security teams

CVE-2008-3097 is an authenticated cross-site scripting issue in the Drupal Tinytax taxonomy block module. A user with the right site permissions could create content such as a taxonomy term that makes script or HTML run for other users viewing affected output. Exposure is most likely on legacy Drupal 5 sites running Tinytax taxonomy block versions before 5.x-1.10-1, especially where authenticated users can create or edit taxonomy terms. Treat this as a legacy-platform cleanup item unless a vulnerable public-facing Drupal site still accepts authenticated user content. Prioritize faster if administrators or customers view affected taxonomy pages. Mitigation focus: Upgrade Tinytax 5.x to 5.x-1.10-1 or later where applicable.; Review Drupal advisory guidance before changing production systems.; Restrict taxonomy term creation and editing to trusted roles..

Prepared

Jun 28, 2026, 18:52 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.