CVE-2025-12761 - Vulnerability Details - OpenCVE

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Simple multi step form allows Cross-Site Scripting (XSS).This issue affects Simple multi step form: from 0.0.0 before 2.0.0.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Drupal	Drupal Simple Multi Step Form

No data.

No data.

References

Link	Providers
https://www.drupal.org/sa-contrib-2025-116

History

Thu, 20 Nov 2025 10:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Drupal Drupal drupal Drupal simple Multi Step Form
Vendors & Products		Drupal Drupal drupal Drupal simple Multi Step Form

Tue, 18 Nov 2025 22:15:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 3.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Tue, 18 Nov 2025 17:15:00 +0000

Type	Values Removed	Values Added
Description		Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Simple multi step form allows Cross-Site Scripting (XSS).This issue affects Simple multi step form: from 0.0.0 before 2.0.0.
Title		Simple multi step form - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-116
Weaknesses		CWE-79
References		https://www.drupal.org/sa-contrib-2025-116

MITRE

Status: PUBLISHED

Assigner: drupal

Published: 2025-11-18T16:56:14.234Z

Updated: 2025-11-18T20:33:44.934Z

Reserved: 2025-11-05T17:03:17.026Z

Link: CVE-2025-12761

Vulnrichment

Updated: 2025-11-18T20:33:39.703Z

NVD

Status : Awaiting Analysis

Published: 2025-11-18T17:15:58.570

Modified: 2025-11-19T19:14:59.327

Link: CVE-2025-12761

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-12761", "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "state": "PUBLISHED", "assignerShortName": "drupal", "dateReserved": "2025-11-05T17:03:17.026Z", "datePublished": "2025-11-18T16:56:14.234Z", "dateUpdated": "2025-11-18T20:33:44.934Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://www.drupal.org/project/simple_multistep", "defaultStatus": "unaffected", "product": "Simple multi step form", "repo": "https://git.drupalcode.org/project/simple_multistep", "vendor": "Drupal", "versions": [{"lessThan": "2.0.0", "status": "affected", "version": "0.0.0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Ide Braakman (idebr)"}, {"lang": "en", "type": "remediation developer", "value": "Diosbel Mezqu\u00c3\u00ada (dmezquia)"}, {"lang": "en", "type": "remediation developer", "value": "Ide Braakman (idebr)"}, {"lang": "en", "type": "remediation developer", "value": "Vitaliy Bogomazyuk (vitaliyb98)"}, {"lang": "en", "type": "coordinator", "value": "Greg Knaddison (greggles)"}, {"lang": "en", "type": "coordinator", "value": "Ivo Van Geertruyen (mr.baileys)"}, {"lang": "en", "type": "coordinator", "value": "Juraj Nemec (poker10)"}], "datePublic": "2025-11-05T18:09:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal Simple multi step form allows Cross-Site Scripting (XSS).<p>This issue affects Simple multi step form: from 0.0.0 before 2.0.0.</p>"}], "value": "Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal Simple multi step form allows Cross-Site Scripting (XSS).This issue affects Simple multi step form: from 0.0.0 before 2.0.0."}], "impacts": [{"capecId": "CAPEC-63", "descriptions": [{"lang": "en", "value": "CAPEC-63 Cross-Site Scripting (XSS)"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\")", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "shortName": "drupal", "dateUpdated": "2025-11-18T16:56:14.234Z"}, "references": [{"url": "https://www.drupal.org/sa-contrib-2025-116"}], "source": {"discovery": "UNKNOWN"}, "title": "Simple multi step form - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-116", "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.5, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-11-18T20:33:42.542969Z", "id": "CVE-2025-12761", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-18T20:33:44.934Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.5, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-12761", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-18T20:33:42.542969Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-18T20:33:39.703Z"}}], "cna": {"title": "Simple multi step form - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-116", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Ide Braakman (idebr)"}, {"lang": "en", "type": "remediation developer", "value": "Diosbel Mezqu\u00c3\u00ada (dmezquia)"}, {"lang": "en", "type": "remediation developer", "value": "Ide Braakman (idebr)"}, {"lang": "en", "type": "remediation developer", "value": "Vitaliy Bogomazyuk (vitaliyb98)"}, {"lang": "en", "type": "coordinator", "value": "Greg Knaddison (greggles)"}, {"lang": "en", "type": "coordinator", "value": "Ivo Van Geertruyen (mr.baileys)"}, {"lang": "en", "type": "coordinator", "value": "Juraj Nemec (poker10)"}], "impacts": [{"capecId": "CAPEC-63", "descriptions": [{"lang": "en", "value": "CAPEC-63 Cross-Site Scripting (XSS)"}]}], "affected": [{"repo": "https://git.drupalcode.org/project/simple_multistep", "vendor": "Drupal", "product": "Simple multi step form", "versions": [{"status": "affected", "version": "0.0.0", "lessThan": "2.0.0", "versionType": "semver"}], "collectionURL": "https://www.drupal.org/project/simple_multistep", "defaultStatus": "unaffected"}], "datePublic": "2025-11-05T18:09:00.000Z", "references": [{"url": "https://www.drupal.org/sa-contrib-2025-116"}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal Simple multi step form allows Cross-Site Scripting (XSS).This issue affects Simple multi step form: from 0.0.0 before 2.0.0.", "supportingMedia": [{"type": "text/html", "value": "Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal Simple multi step form allows Cross-Site Scripting (XSS).<p>This issue affects Simple multi step form: from 0.0.0 before 2.0.0.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\")"}]}], "providerMetadata": {"orgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "shortName": "drupal", "dateUpdated": "2025-11-18T16:56:14.234Z"}}}, "cveMetadata": {"cveId": "CVE-2025-12761", "state": "PUBLISHED", "dateUpdated": "2025-11-18T20:33:44.934Z", "dateReserved": "2025-11-05T17:03:17.026Z", "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "datePublished": "2025-11-18T16:56:14.234Z", "assignerShortName": "drupal"}, "dataVersion": "5.2"}