CVE-2009-2074

Cross-site scripting (XSS) vulnerability in Nodequeue 5.x before 5.x-2.7 and 6.x before 6.x-2.2, a module for Drupal, allows remote authenticated users with administer taxonomy permissions to inject arbitrary web script or HTML via vocabulary names.

• CWE-79

• http://drupal.org/node/488092Patch, Vendor Advisory
• http://drupal.org/node/488102Patch
• http://drupal.org/node/488104Patch
• http://lampsecurity.org/drupal-nodeque-xss-vulnerabilityExploit, URL Repurposed
• http://secunia.com/advisories/35424Vendor Advisory
• http://www.securityfocus.com/bid/35305
• http://drupal.org/node/488092Patch, Vendor Advisory
• http://drupal.org/node/488102Patch
• http://drupal.org/node/488104Patch
• http://lampsecurity.org/drupal-nodeque-xss-vulnerabilityExploit, URL Repurposed
• http://secunia.com/advisories/35424Vendor Advisory
• http://www.securityfocus.com/bid/35305

Published

Jun 16, 2009

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2009-2068Google Chrome detects http content in https web pages only w…
• CVE-2009-2069Microsoft Internet Explorer before 8 displays a cached certi…
• CVE-2009-2070Opera displays a cached certificate for a (1) 4xx or (2) 5xx…
• CVE-2009-2071Google Chrome before 1.0.154.53 displays a cached certificat…
• CVE-2009-2072Apple Safari does not require a cached certificate before di…
• CVE-2009-2073Cross-site request forgery (CSRF) vulnerability in Linksys W…
• CVE-2009-2075Nodequeue 5.x before 5.x-2.7 and 6.x before 6.x-2.2, a modul…
• CVE-2009-2076Cross-site scripting (XSS) vulnerability in Views 6.x before…
• CVE-2009-2077Drupal 6.x before 6.x-2.6, a module for Drupal, allows remot…
• CVE-2009-2078Multiple cross-site scripting (XSS) vulnerabilities in Bookt…
• CVE-2009-2079Cross-site scripting (XSS) vulnerability in the administrati…
• CVE-2009-2080admin.php in MRCGIGUY The Ticket System 2.0 does not properl…