CVE-2013-4174: Multiple cross-site scripting (XSS) vulnerabilities in the Scald module 7.x-1.x before 7.x-1.1 for Drupal a...

Security readout for executives and security teams

This CVE affects Drupal sites using the Scald module 7.x-1.x before 7.x-1.1. It allows attacker-controlled script or HTML to appear through specific Flash and image fields, creating a cross-site scripting risk for site visitors and administrators who view affected content. Exposure is likely limited to legacy Drupal 7 installations that installed the contributed Scald module in the 7.x-1.x branch and have not upgraded past 7.x-1.0. Evidence in the bundle does not identify other products or branches. Prioritize remediation for internet-facing Drupal sites, especially where non-admin users can submit media content. This is not supported as actively exploited in the provided evidence, but XSS can enable account compromise when privileged users view attacker-controlled content. Mitigation focus: Upgrade the Drupal Scald module to 7.x-1.1 or later.; Review the Drupal advisory before applying changes in production.; Restrict content creation permissions until affected instances are remediated..

Prepared

Jun 14, 2026, 21:50 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.