Cross-site Scripting Vulnerability in Drupal Zero Point
CVE-2026-114528

Currently unrated

Key Information:

Vendor

Drupal
Status
Zero Point
Vendor
CVE Published:
30 October 2026

What is CVE-2026-114528?

The Cross-site Scripting vulnerability in Drupal Zero Point arises from the improper neutralization of input during web page generation. This flaw enables attackers to inject malicious scripts into web pages viewed by other users, leading to potential data theft and unauthorized actions within the web application. The vulnerability affects specific versions of the Zero Point product, underscoring the need for users to promptly apply security patches and updates to safeguard their applications.

Affected Version(s)

Zero Point 0.0.0 < 1.30.0

Zero Point 2.0.0 < 2.0.1

References

https://www.drupal.org/sa-contrib-2026-222

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Drew Webber (mcdruid)
Florian Radut (florian)
Swan Kalata (akalata)
Greg Knaddison (greggles)
Drew Webber (mcdruid)
Juraj Nemec (poker10)
.