CVE-2009-3914: Cross-site scripting (XSS) vulnerability in the Temporary Invitation module 5.x before 5.x-2.3 for Drupal a...

Security readout for executives and security teams

This is an older cross-site scripting issue in the Temporary Invitation module for Drupal 5. A remote attacker could place script or HTML in an invitation Name field, potentially affecting users who view that invitation. Exposure is limited to sites still running the affected module versions. Likely exposed assets are Drupal 5 sites using the Temporary Invitation module earlier than 5.x-2.3. Sites without this module, or using a fixed version, are not indicated as affected by the provided sources. Treat as a targeted remediation item for legacy Drupal assets. It is not KEV-listed, but any affected public site can create user-session, phishing, or content-integrity risk if administrators or users view malicious invitations. Mitigation focus: Inventory Drupal sites for the Temporary Invitation module and recorded version.; Upgrade affected Temporary Invitation 5.x installations to 5.x-2.3 or later.; Review the linked Drupal advisory pages for official remediation guidance..

Prepared

Jun 28, 2026, 18:15 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.