Paul Mckibben

**Name of the Vulnerable Software and Affected Versions** Drupal Colorbox versions 0.0.0 through 2.2.0 **Description** Improper neutralization of input during web page generation allows Cross-Site Scripting (XSS), where malicious JavaScript can be injected into the page. This occurs because the module, which integrates with the Colorbox JavaScript library to display content in an overlay, does not sufficiently protect against injection in certain scenarios. Exploitation requires the attacker to possess a role that permits the entry of HTML content. **Recommendations** Update Drupal Colorbox to a version later than 2.2.0.

**Name of the Vulnerable Software and Affected Versions** Drupal Colorbox versions 0.0.0 through 2.1.2 **Description** The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting (XSS). This allows an attacker to perform Cross-Site Scripting (XSS) attacks. **Recommendations** For versions 0.0.0 through 2.1.2, update to version 2.1.3 or later to resolve the issue.