CVE-2009-3650: Cross-site scripting (XSS) vulnerability in Dex 5.x-1.0 and earlier and 6.x-1.0-rc1 and earlier, a module f...

Security readout for executives and security teams

CVE-2009-3650 is a reported cross-site scripting issue in the Dex module for Drupal. A remote attacker may be able to inject script or HTML through unspecified input, potentially affecting users who view vulnerable content. The public record does not provide CVSS scoring, affected vendor metadata, or confirmed fixed versions. Exposure appears limited to Drupal sites running the Dex module at the listed 5.x or 6.x release levels. The provided CVE metadata lists generic affected fields, so asset owners should verify module inventory directly rather than relying on CPE matching. Prioritize discovery over emergency response unless Dex is internet-facing on important Drupal properties. The issue is old and not KEV-listed in the supplied evidence, but XSS on public sites can still create reputational and user-account risk. Mitigation focus: Inventory Drupal sites for the Dex module and recorded version.; Check Drupal advisory guidance for fixed releases or supported mitigations.; Upgrade Dex only to a vendor-confirmed fixed version if available..

Prepared

Jun 28, 2026, 18:15 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.