CVE-2014-9505: Cross-site scripting (XSS) vulnerability in the School Administration module 7.x-1.x before 7.x-1.8 for Dru...

Security readout for executives and security teams

This is a Drupal contributed-module XSS flaw in School Administration. A logged-in user allowed to create or edit class nodes could place script or HTML in a node title. Impact depends on who can view those titles and what privileges their sessions carry. Exposure is likely limited to Drupal 7 sites running the School Administration module 7.x-1.x before 7.x-1.8, where untrusted or lower-privileged authenticated users can create or edit class nodes. Treat as a targeted remediation item, not an internet-wide emergency. Fix promptly on affected Drupal school administration sites, especially where students, staff, or other broad user groups can create or edit class records. Mitigation focus: Upgrade the School Administration module to 7.x-1.8 or later.; Review which roles can create or edit class nodes.; Remove class node editing rights from untrusted users..

Prepared

Jun 14, 2026, 05:41 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.