CVE-2015-4381: Cross-site scripting (XSS) vulnerability in the Invoice module 6.x-1.x before 6.x-1.2 and 7.x-1.x before 7....

Security readout for executives and security teams

CVE-2015-4381 is an authenticated cross-site scripting issue in the Drupal Invoice module. A user with the "Administer own invoices" permission could inject script or HTML through Invoice content. Business risk depends on whether the module is installed and who has that permission. Exposure is limited to Drupal 6 or Drupal 7 sites running the contributed Invoice module in the affected version ranges, especially where non-administrative users have "Administer own invoices" permission. Prioritize remediation for internet-facing Drupal sites using the Invoice module. This is not shown as actively exploited, but stored XSS can support account compromise or administrative abuse when privileged users view affected content. Mitigation focus: Upgrade Invoice module to 6.x-1.2, 7.x-1.3, or a later fixed release.; Review users and roles with "Administer own invoices" permission.; Remove that permission from users who do not strictly need it..

Prepared

Jun 13, 2026, 22:39 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.