CVE-2025-3902
CVSS 3.1 Score 6.1 of 10 (medium)
Details
Published Apr 23, 2025
Updated: Apr 29, 2025
CWE ID 79
Summary
CVE-2025-3902 is a Cross-Site Scripting (XSS) vulnerability affecting Drupal's Block Class from versions 4.0.0 to 4.0.0 before 4.0.1. Maliciously crafted input during web page generation was not properly neutralized, enabling attackers to inject malicious scripts into a victim's browser. This issue poses a significant security risk as it allows for unauthorized access to sensitive information or even takeover of user accounts. Users are urged to update their Block Class module as soon as possible to mitigate this threat.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.