CVE-2009-3488: Cross-site scripting (XSS) vulnerability in the Bibliography (aka Biblio) module 6.x-1.6 for Drupal allows...

Security readout for executives and security teams

This is an XSS issue in the Drupal Bibliography/Biblio module 6.x-1.6. A logged-in user with content-creation privileges could place script or HTML in a Title field. Business urgency depends on whether an old Drupal 6 site still runs this module and allows semi-trusted authors. Exposure is likely limited to legacy Drupal 6 installations running Biblio 6.x-1.6 where authenticated users can create affected content. Sites without that module, version, or authoring workflow are unlikely to be exposed based on the supplied evidence. Prioritize if the organization still operates legacy Drupal 6 publishing sites with multiple content authors. This is not marked as actively exploited in the supplied sources, but XSS in old CMS modules can affect users and administrators who view malicious content. Mitigation focus: Inventory Drupal sites for the Bibliography/Biblio module and exact version 6.x-1.6.; Check Drupal or module maintainer guidance for a fixed release or official workaround.; Restrict affected content-creation privileges to trusted users until remediation is complete..

Prepared

Jun 28, 2026, 18:15 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.