CVE-2010-1108: Cross-site scripting (XSS) vulnerability in the Control Panel module 5.x through 5.x-1.5 and 6.x through 6....

Security readout for executives and security teams

This is a stored or reflected XSS risk in the Drupal Control Panel module. A logged-in user who already has the powerful "administer blocks" permission could inject script or HTML through unspecified input. The main business risk is compromise of administrator browser sessions or content integrity in legacy Drupal sites using this module. Exposure is likely limited to legacy Drupal 5 or 6 installations with the Control Panel module installed and users granted "administer blocks". Sites not using that module, or without such privileged authenticated users, are not indicated as affected by the provided sources. Treat this as a legacy-platform hygiene issue unless the affected module is present on a production Drupal site. Prioritize remediation where untrusted or broadly assigned administrative users exist, because the vulnerability requires privileged authenticated access but may affect administrator browser trust. Mitigation focus: Check the Drupal advisory for fixed Control Panel module versions or retirement guidance.; Upgrade the module if Drupal identifies a non-affected maintained release.; Restrict "administer blocks" to trusted administrators only..

Prepared

Jun 28, 2026, 09:59 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.