CVE-2026-6095

MediumCVSS 6.1

Published: 19/05/2026(UTC)Updated: 24/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.20%

10th percentile - higher than 10% of all known CVEs

Summary

Cross-site scripting vulnerability in Drupal Orejime before version 2.0.16. Improper input neutralization during page generation allows injection of malicious scripts.

Risk Assessment

An attacker can steal user sessions, deface the page, or redirect victims to malicious sites.

Recommendation

Update the Orejime module to version 2.0.16 or later.

Original NVD description (English source)

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Orejime allows Cross-Site Scripting (XSS). This issue affects Orejime: from 0.0.0 before 2.0.16.