CVE-2009-3917: Cross-site scripting (XSS) vulnerability in the S5 Presentation Player module 6.x-1.x before 6.x-1.1 for Dr...

Security readout for executives and security teams

This issue affects the Drupal S5 Presentation Player module before 6.x-1.1. A remote attacker could inject script or HTML into a field that is copied into the page HTML HEAD, creating a cross-site scripting risk for visitors or administrators viewing affected content. Exposure is likely limited to Drupal sites that installed the S5 Presentation Player module in the 6.x-1.x branch before 6.x-1.1. The provided affected-product metadata is incomplete, so confirm against actual Drupal module inventories rather than CPE data. Treat as a targeted legacy-application hygiene issue, not an emergency based on the provided evidence. Prioritize remediation if any public or administrator-facing Drupal site still runs the affected module version. Mitigation focus: Upgrade S5 Presentation Player to 6.x-1.1 or later where applicable.; Disable or remove the module if it is unused or unsupported.; Check the Drupal advisory for current project-specific guidance..

Prepared

Jun 28, 2026, 18:15 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.