CVE-2014-9738: Multiple cross-site scripting (XSS) vulnerabilities in the Tournament module 7.x-1.x before 7.x-1.2 for Dru...

Security readout for executives and security teams

CVE-2014-9738 is a set of cross-site scripting issues in the Drupal Tournament module 7.x-1.x before 7.x-1.2. An authenticated user with certain permissions could place script or HTML in names or titles that other users may later view. Exposure is likely limited to Drupal 7 sites that installed and enabled the Tournament module in the affected 7.x-1.x range, especially where non-admin users can create or edit relevant accounts, nodes, or team entities. Treat this as a targeted maintenance issue, not an emergency based on the supplied evidence. Prioritize remediation where Drupal Tournament is internet-facing or writable by broad authenticated user groups. Mitigation focus: Upgrade the Drupal Tournament module to 7.x-1.2 or later if still in use.; Review Drupal.org advisory guidance for any module-specific cleanup or configuration notes.; Restrict permissions for editing accounts, nodes, and team entities to trusted roles..

Prepared

Jun 13, 2026, 22:22 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.