CVE-2007-0626

The comment_form_add_preview function in comment.module in Drupal before 4.7.6, and 5.x before 5.1, and vbDrupal, allows remote attackers with "post comments" privileges and access to multiple input filters to execute arbitrary code by previewing comments, which are not processed by "normal form validation routines."

• http://archives.neohapsis.com/archives/bugtraq/2007-01/0670.htmlBroken Link
• http://drupal.org/node/113935Patch, Vendor Advisory
• http://osvdb.org/32136Broken Link
• http://secunia.com/advisories/23960Third Party Advisory
• http://secunia.com/advisories/23990Third Party Advisory
• http://www.securityfocus.com/bid/22306Third Party Advisory, VDB Entry
• http://www.vbdrupal.org/forum/showthread.php?t=786Broken Link
• http://www.vupen.com/english/advisories/2007/0406Third Party Advisory
• http://www.vupen.com/english/advisories/2007/0415Third Party Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/31940Third Party Advisory, VDB Entry
• http://archives.neohapsis.com/archives/bugtraq/2007-01/0670.htmlBroken Link
• http://drupal.org/node/113935Patch, Vendor Advisory
• http://osvdb.org/32136Broken Link
• http://secunia.com/advisories/23960Third Party Advisory
• http://secunia.com/advisories/23990Third Party Advisory
• http://www.securityfocus.com/bid/22306Third Party Advisory, VDB Entry
• http://www.vbdrupal.org/forum/showthread.php?t=786Broken Link
• http://www.vupen.com/english/advisories/2007/0406Third Party Advisory
• http://www.vupen.com/english/advisories/2007/0415Third Party Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/31940Third Party Advisory, VDB Entry

Published

Jan 31, 2007

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2007-0620download.php in FD Script 1.3.2 and earlier allows remote at…
• CVE-2007-0621Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2007-0622Cross-site request forgery (CSRF) vulnerability in MyBB (aka…
• CVE-2007-0623SQL injection vulnerability in index.php in MAXdev MDPro 1.0…
• CVE-2007-0624user.php in MAXdev MDPro 1.0.76 allows remote attackers to o…
• CVE-2007-0625nxconfigure.sh in NoMachine NX Server before 2.1.0-18 does n…
• CVE-2007-0627Michael Still gtalkbot before 1.2 places username and passwo…
• CVE-2007-0628Multiple cross-site scripting (XSS) vulnerabilities in Sun J…
• CVE-2007-0629The www_purgeList method in Plain Black WebGUI before 7.3.8 …
• CVE-2007-0630Multiple SQL injection vulnerabilities in the generate_csv f…
• CVE-2007-0631SQL injection vulnerability in index.php in Eclectic Designs…
• CVE-2007-0632SQL injection vulnerability in artreplydelete.asp in ASP EDG…