CVE-2009-3919: Cross-site scripting (XSS) vulnerability in the NGP COO/CWP Integration (crmngp) module 6.x before 6.x-1.12...

Security readout for executives and security teams

This is a cross-site scripting issue in the Drupal NGP COO/CWP Integration module. A remote attacker could inject script or HTML through unspecified user-supplied information. The sources identify affected versions as 6.x before 6.x-1.12, but do not provide CVSS, exploitation evidence, or detailed attack conditions. Exposure is likely limited to Drupal 6-era sites that installed the NGP COO/CWP Integration, also called crmngp, module before version 6.x-1.12. Organizations without this module are not indicated as affected by the supplied sources. Handle as a targeted legacy Drupal remediation item. It is not shown as actively exploited in the supplied evidence, but XSS can affect user trust, sessions, and administrative workflows on exposed sites. Mitigation focus: Inventory Drupal sites for the crmngp or NGP COO/CWP Integration module.; Upgrade affected 6.x installations to 6.x-1.12 or later, per the vulnerable version boundary.; Review Drupal advisory guidance before applying compensating controls..

Prepared

Jun 28, 2026, 18:15 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.