CVE-2009-0603: Cross-site scripting (XSS) vulnerability in index.php in the Link module 5.x-2.5 for Drupal 5.10 allows rem...

Security readout for executives and security teams

This issue lets a logged-in Drupal user with content-type administration rights place script or HTML into the Link module Help/description field. The attacker already needs elevated site privileges, but the result could still compromise other administrators’ browser sessions or alter trusted admin pages. Exposure is likely limited to legacy Drupal 5.10 deployments using Link module 5.x-2.5, especially where multiple users have content-type administration rights. The supplied affected-product metadata is incomplete, so asset validation is required. Treat as a legacy-platform hygiene issue with moderate urgency. Prioritize confirmation first; if exposed, reduce privileged access and plan migration because Drupal 5-era components are unlikely to fit modern support expectations. Mitigation focus: Inventory Drupal 5.10 sites using Link module 5.x-2.5.; Restrict "administer content types" to trusted administrators only.; Check Drupal or Link module guidance for fixed release or migration advice..

Prepared

Jun 28, 2026, 11:23 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.