CVE-2012-6645: Cross-site scripting (XSS) vulnerability in the autocomplete functionality in the Finder module 6.x-1.x bef...

Security readout for executives and security teams

This is a stored cross-site scripting issue in the Drupal Finder contributed module. If an affected site exposes Finder autocomplete and an attacker can influence a node title, malicious script or HTML could be rendered to users of that autocomplete path. The source bundle does not show active exploitation or a CVSS score. Likely limited to Drupal sites that installed the Finder module and use its autocomplete functionality. Risk rises where untrusted or lower-privileged users can create or edit node titles that later appear in autocomplete responses. Treat as a targeted web application cleanup item, not an emergency based on the supplied evidence. Prioritize internet-facing Drupal sites where Finder is installed and content titles can be influenced by less-trusted users. Mitigation focus: Upgrade Finder 6.x-1.x to 6.x-1.26 or later.; Upgrade Finder 7.x-2.x to 7.x-2.0-alpha8 or later.; For 7.x-1.x, check Drupal project guidance for the supported remediation path..

Prepared

Jun 14, 2026, 14:32 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.