CVE-2008-5999: Cross-site scripting (XSS) vulnerability in the Ajax Checklist module 5.x before 5.x-1.1 for Drupal allows...

Security readout for executives and security teams

This is an older authenticated XSS issue in Drupal’s Ajax Checklist module. A user who can create and edit posts could place script or HTML through the module’s filter path, potentially affecting other users who view the content. It mainly matters for legacy Drupal 5 deployments or archived sites still running the vulnerable module. Exposure is likely limited to Drupal 5-era sites with the Ajax Checklist module installed below 5.x-1.1 and roles allowed to create or edit posts using the affected filter. Modern Drupal sites are unlikely to be exposed unless legacy code or content systems remain in service. Treat this as a legacy exposure cleanup item unless a Drupal 5 site with this module is still internet-facing or used by many contributors. Prioritize verification in asset inventories and retire or update affected systems, but do not treat it as confirmed actively exploited based on the supplied evidence. Mitigation focus: Upgrade Ajax Checklist module 5.x to 5.x-1.1 or later.; Remove the module if it is unused or unsupported.; Restrict post create/edit permissions to trusted roles only..

Prepared

Jun 28, 2026, 11:23 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.