CVE-2014-9499: Cross-site scripting (XSS) vulnerability in the Godwin's Law module before 7.x-1.1 for Drupal, when using t...

Security readout for executives and security teams

This issue affects Drupal sites using the Godwin's Law contributed module before 7.x-1.1 with dblog enabled. An authenticated user could inject script or HTML into logged Watchdog messages, potentially affecting administrators or staff who view those logs. Exposure is likely limited to Drupal 7 environments that installed this contributed module, run a vulnerable version, enable dblog, and allow authenticated users capable of generating affected Watchdog messages. Treat this as a targeted web application hygiene issue, not an emergency based on the supplied evidence. Remediate where the module is present, especially on shared or public Drupal sites with administrative log viewers. Mitigation focus: Upgrade the Godwin's Law module to 7.x-1.1 or later.; Review Drupal advisory guidance before making production changes.; Identify sites where dblog and Godwin's Law are both enabled..

Prepared

Jun 14, 2026, 05:41 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.