CVE-2012-1654: Multiple cross-site scripting (XSS) vulnerabilities in the Data module 6.x-1.x before 6.x-1.0 and 7.x-1.x b...

Security readout for executives and security teams

CVE-2012-1654 is an authenticated cross-site scripting issue in the Drupal Data contributed module. A user with the “administer data tables” permission could store or inject script through table title handling. Business urgency is highest for legacy Drupal sites still using affected Data module releases and granting that permission to non-fully-trusted users. Exposure is limited to Drupal installations using the contributed Data module in the affected version ranges. Sites are more exposed if data table administration is delegated beyond trusted administrators. Treat as a legacy-platform cleanup item unless affected Drupal Data deployments still exist. Prioritize remediation where the module is installed on business-critical sites or where data table administration is delegated to less-trusted users. Mitigation focus: Upgrade Data module to 6.x-1.0, 7.x-1.0-alpha3, or later vendor-supported guidance.; Review and restrict the “administer data tables” permission to trusted administrators only.; If upgrades are not feasible, check Drupal project advisories for supported compensating controls..

Prepared

Jun 27, 2026, 20:09 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.