CVE-2009-3651: Cross-site scripting (XSS) vulnerability in the "Monitor browsers' feature in Browscap before 5.x-1.1 and 6...

Security readout for executives and security teams

This issue affects the Drupal Browscap module's Monitor browsers feature. A remote request can place script or HTML into the stored browser-monitoring view through the User-Agent header. Business impact is mainly site-administration compromise risk if a privileged user later views the affected data. Exposure appears limited to Drupal deployments using the Browscap module versions before 5.x-1.1 or 6.x-1.1, especially where Monitor browsers is enabled. The bundle does not identify other affected products or branches. Treat as a targeted remediation item for legacy Drupal estates. It is not KEV-listed and lacks severity scoring, but XSS in an administrative monitoring feature can still support account compromise or unauthorized site changes. Mitigation focus: Inventory Drupal sites for the Browscap module and exact branch version.; Upgrade Browscap to 5.x-1.1, 6.x-1.1, or later vendor-supported releases.; Disable the Monitor browsers feature until the module is updated..

Prepared

Jun 28, 2026, 18:15 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.