CVE-2014-9500: Cross-site scripting (XSS) vulnerability in the Moip module 7.x-1.x before 7.x-1.4 for Drupal allows remote...

Security readout for executives and security teams

CVE-2014-9500 is a cross-site scripting issue in the Drupal Moip module. A remote attacker could inject script or HTML into the notification page callback. The public sources identify fixed versions but do not provide severity scoring, authentication requirements, or detailed impact. Exposure is likely limited to Drupal 7 sites running the contributed Moip module 7.x-1.x before 7.x-1.4, especially where the notification callback is reachable. The source bundle does not identify broader affected products. Prioritize remediation only where the Moip Drupal module is present. This is a legacy, module-specific XSS issue with incomplete severity data and no cited active exploitation, but exposed payment-related Drupal workflows should be checked promptly. Mitigation focus: Inventory Drupal sites for the Moip contributed module.; Upgrade Moip module 7.x-1.x to 7.x-1.4 or later.; If upgrade status is unclear, check the Drupal advisory and vendor guidance..

Prepared

Jun 14, 2026, 05:41 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.