{"api_version":"1","generated_at":"2026-07-23T08:12:59+00:00","cve":"CVE-2015-6807","urls":{"html":"https://cve.report/CVE-2015-6807","api":"https://cve.report/api/cve/CVE-2015-6807.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2015-6807","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2015-6807"},"summary":{"title":"CVE-2015-6807","description":"Cross-site scripting (XSS) vulnerability in the Mass Contact module 6.x-1.x before 6.x-1.6 and 7.x-1.x before 7.x-1.1 for Drupal allows remote authenticated users with the \"administer mass contact\" permission to inject arbitrary web script or HTML via a category label.","state":"PUBLISHED","assigner":"mitre","published_at":"2015-09-04 15:59:04","updated_at":"2026-05-06 22:30:45"},"problem_types":["CWE-79","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"2.1","severity":"","vector":"AV:N/AC:H/Au:S/C:N/I:P/A:N","data":{"version":"2.0","vectorString":"AV:N/AC:H/Au:S/C:N/I:P/A:N","baseScore":2.1,"accessVector":"NETWORK","accessComplexity":"HIGH","authentication":"SINGLE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"}}],"references":[{"url":"https://www.drupal.org/node/2561951","name":"https://www.drupal.org/node/2561951","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Vendor Advisory"],"title":"Mass Contact - Moderately Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2015-144 | Drupal.org","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.drupal.org/node/2561695","name":"https://www.drupal.org/node/2561695","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"],"title":"mass_contact 6.x-1.6 | Drupal.org","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.drupal.org/node/2561699","name":"https://www.drupal.org/node/2561699","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"],"title":"mass_contact 7.x-1.1 | Drupal.org","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-6807","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-6807","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2015","cve_id":"6807","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"mass_contact_project","cpe5":"mass_contact","cpe6":"6.x-1.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"drupal","cpe12":"*","cpe13":"*"},{"cve_year":"2015","cve_id":"6807","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"mass_contact_project","cpe5":"mass_contact","cpe6":"6.x-1.0","cpe7":"beta1","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"drupal","cpe12":"*","cpe13":"*"},{"cve_year":"2015","cve_id":"6807","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"mass_contact_project","cpe5":"mass_contact","cpe6":"6.x-1.0","cpe7":"beta2","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"drupal","cpe12":"*","cpe13":"*"},{"cve_year":"2015","cve_id":"6807","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"mass_contact_project","cpe5":"mass_contact","cpe6":"6.x-1.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"drupal","cpe12":"*","cpe13":"*"},{"cve_year":"2015","cve_id":"6807","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"mass_contact_project","cpe5":"mass_contact","cpe6":"6.x-1.2","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"drupal","cpe12":"*","cpe13":"*"},{"cve_year":"2015","cve_id":"6807","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"mass_contact_project","cpe5":"mass_contact","cpe6":"6.x-1.3","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"drupal","cpe12":"*","cpe13":"*"},{"cve_year":"2015","cve_id":"6807","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"mass_contact_project","cpe5":"mass_contact","cpe6":"6.x-1.4","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"drupal","cpe12":"*","cpe13":"*"},{"cve_year":"2015","cve_id":"6807","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"mass_contact_project","cpe5":"mass_contact","cpe6":"6.x-1.5","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"drupal","cpe12":"*","cpe13":"*"},{"cve_year":"2015","cve_id":"6807","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"mass_contact_project","cpe5":"mass_contact","cpe6":"6.x-1.x","cpe7":"dev","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"drupal","cpe12":"*","cpe13":"*"},{"cve_year":"2015","cve_id":"6807","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"mass_contact_project","cpe5":"mass_contact","cpe6":"7.x-1.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"drupal","cpe12":"*","cpe13":"*"},{"cve_year":"2015","cve_id":"6807","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"mass_contact_project","cpe5":"mass_contact","cpe6":"7.x-1.0","cpe7":"alpha1","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"drupal","cpe12":"*","cpe13":"*"},{"cve_year":"2015","cve_id":"6807","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"mass_contact_project","cpe5":"mass_contact","cpe6":"7.x-1.0","cpe7":"alpha2","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"drupal","cpe12":"*","cpe13":"*"},{"cve_year":"2015","cve_id":"6807","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"mass_contact_project","cpe5":"mass_contact","cpe6":"7.x-1.0","cpe7":"alpha3","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"drupal","cpe12":"*","cpe13":"*"},{"cve_year":"2015","cve_id":"6807","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"mass_contact_project","cpe5":"mass_contact","cpe6":"7.x-1.0","cpe7":"alpha4","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"drupal","cpe12":"*","cpe13":"*"},{"cve_year":"2015","cve_id":"6807","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"mass_contact_project","cpe5":"mass_contact","cpe6":"7.x-1.0","cpe7":"alpha5","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"drupal","cpe12":"*","cpe13":"*"},{"cve_year":"2015","cve_id":"6807","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"mass_contact_project","cpe5":"mass_contact","cpe6":"7.x-1.0","cpe7":"alpha6","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"drupal","cpe12":"*","cpe13":"*"},{"cve_year":"2015","cve_id":"6807","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"mass_contact_project","cpe5":"mass_contact","cpe6":"7.x-1.0","cpe7":"beta1","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"drupal","cpe12":"*","cpe13":"*"},{"cve_year":"2015","cve_id":"6807","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"mass_contact_project","cpe5":"mass_contact","cpe6":"7.x-1.0","cpe7":"beta2","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"drupal","cpe12":"*","cpe13":"*"},{"cve_year":"2015","cve_id":"6807","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"mass_contact_project","cpe5":"mass_contact","cpe6":"7.x-1.0","cpe7":"beta3","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"drupal","cpe12":"*","cpe13":"*"},{"cve_year":"2015","cve_id":"6807","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"mass_contact_project","cpe5":"mass_contact","cpe6":"7.x-1.x","cpe7":"dev","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"drupal","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-06T07:29:24.563Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"https://www.drupal.org/node/2561695"},{"tags":["x_refsource_MISC","x_transferred"],"url":"https://www.drupal.org/node/2561951"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"https://www.drupal.org/node/2561699"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"descriptions":[{"lang":"en","value":"Cross-site scripting (XSS) vulnerability in the Mass Contact module 6.x-1.x before 6.x-1.6 and 7.x-1.x before 7.x-1.1 for Drupal allows remote authenticated users with the \"administer mass contact\" permission to inject arbitrary web script or HTML via a category label."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2015-09-04T15:00:00.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"tags":["x_refsource_CONFIRM"],"url":"https://www.drupal.org/node/2561695"},{"tags":["x_refsource_MISC"],"url":"https://www.drupal.org/node/2561951"},{"tags":["x_refsource_CONFIRM"],"url":"https://www.drupal.org/node/2561699"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2015-6807","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Cross-site scripting (XSS) vulnerability in the Mass Contact module 6.x-1.x before 6.x-1.6 and 7.x-1.x before 7.x-1.1 for Drupal allows remote authenticated users with the \"administer mass contact\" permission to inject arbitrary web script or HTML via a category label."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"https://www.drupal.org/node/2561695","refsource":"CONFIRM","url":"https://www.drupal.org/node/2561695"},{"name":"https://www.drupal.org/node/2561951","refsource":"MISC","url":"https://www.drupal.org/node/2561951"},{"name":"https://www.drupal.org/node/2561699","refsource":"CONFIRM","url":"https://www.drupal.org/node/2561699"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2015-6807","datePublished":"2015-09-04T15:00:00.000Z","dateReserved":"2015-09-04T00:00:00.000Z","dateUpdated":"2024-09-16T23:20:46.571Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2015-09-04 15:59:04","lastModifiedDate":"2026-05-06 22:30:45","problem_types":["CWE-79","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:H/Au:S/C:N/I:P/A:N","baseScore":2.1,"accessVector":"NETWORK","accessComplexity":"HIGH","authentication":"SINGLE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"LOW","exploitabilityScore":3.9,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:mass_contact_project:mass_contact:7.x-1.0:*:*:*:*:drupal:*:*","matchCriteriaId":"3EA1FC95-1F03-4DD9-8778-C753E8D4B202"},{"vulnerable":true,"criteria":"cpe:2.3:a:mass_contact_project:mass_contact:7.x-1.0:alpha1:*:*:*:drupal:*:*","matchCriteriaId":"B480497B-9ADB-401D-8ACD-F3D6E8F76CC4"},{"vulnerable":true,"criteria":"cpe:2.3:a:mass_contact_project:mass_contact:7.x-1.0:alpha2:*:*:*:drupal:*:*","matchCriteriaId":"AFEF6C58-AD7E-476F-918B-95A29D0838C9"},{"vulnerable":true,"criteria":"cpe:2.3:a:mass_contact_project:mass_contact:7.x-1.0:alpha3:*:*:*:drupal:*:*","matchCriteriaId":"5A933FEA-0CAA-456E-B1FF-4E6335DCC3C5"},{"vulnerable":true,"criteria":"cpe:2.3:a:mass_contact_project:mass_contact:7.x-1.0:alpha4:*:*:*:drupal:*:*","matchCriteriaId":"EA0DF198-2551-48B8-B6B5-94BF85F06EA2"},{"vulnerable":true,"criteria":"cpe:2.3:a:mass_contact_project:mass_contact:7.x-1.0:alpha5:*:*:*:drupal:*:*","matchCriteriaId":"351AA8DD-79A7-4F6D-98F8-25A42A137212"},{"vulnerable":true,"criteria":"cpe:2.3:a:mass_contact_project:mass_contact:7.x-1.0:alpha6:*:*:*:drupal:*:*","matchCriteriaId":"BBD89401-E4E9-4913-86CE-609AAE2A6F55"},{"vulnerable":true,"criteria":"cpe:2.3:a:mass_contact_project:mass_contact:7.x-1.0:beta1:*:*:*:drupal:*:*","matchCriteriaId":"9A2A4BF6-5AEB-463C-A79F-59E853FF49FF"},{"vulnerable":true,"criteria":"cpe:2.3:a:mass_contact_project:mass_contact:7.x-1.0:beta2:*:*:*:drupal:*:*","matchCriteriaId":"F322D3CF-7535-4867-8545-C706414596E0"},{"vulnerable":true,"criteria":"cpe:2.3:a:mass_contact_project:mass_contact:7.x-1.0:beta3:*:*:*:drupal:*:*","matchCriteriaId":"8EF34E8D-AB0A-483B-8BBC-1C7959FF27E7"},{"vulnerable":true,"criteria":"cpe:2.3:a:mass_contact_project:mass_contact:7.x-1.x:dev:*:*:*:drupal:*:*","matchCriteriaId":"01202E8E-EF37-4AF2-8739-64E5AD91FC73"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:mass_contact_project:mass_contact:6.x-1.0:*:*:*:*:drupal:*:*","matchCriteriaId":"98104EAC-2102-4400-9DBC-82CE6416F9FA"},{"vulnerable":true,"criteria":"cpe:2.3:a:mass_contact_project:mass_contact:6.x-1.0:beta1:*:*:*:drupal:*:*","matchCriteriaId":"7D1D3566-AEC4-4DC1-9E22-A9E02EFC9860"},{"vulnerable":true,"criteria":"cpe:2.3:a:mass_contact_project:mass_contact:6.x-1.0:beta2:*:*:*:drupal:*:*","matchCriteriaId":"B6DE32ED-D729-49F5-B2E9-E2A75A2B626D"},{"vulnerable":true,"criteria":"cpe:2.3:a:mass_contact_project:mass_contact:6.x-1.1:*:*:*:*:drupal:*:*","matchCriteriaId":"6BA61673-B389-4E4F-ACAB-EFBC05867BA4"},{"vulnerable":true,"criteria":"cpe:2.3:a:mass_contact_project:mass_contact:6.x-1.2:*:*:*:*:drupal:*:*","matchCriteriaId":"D87502B7-9F4F-4BC5-9962-9B2F16BEF81D"},{"vulnerable":true,"criteria":"cpe:2.3:a:mass_contact_project:mass_contact:6.x-1.3:*:*:*:*:drupal:*:*","matchCriteriaId":"392CD27A-716B-4D28-99DA-FBEB066CF240"},{"vulnerable":true,"criteria":"cpe:2.3:a:mass_contact_project:mass_contact:6.x-1.4:*:*:*:*:drupal:*:*","matchCriteriaId":"33889DE3-DA8E-4D92-9BDC-9EEFCD7DEDC9"},{"vulnerable":true,"criteria":"cpe:2.3:a:mass_contact_project:mass_contact:6.x-1.5:*:*:*:*:drupal:*:*","matchCriteriaId":"3D13E645-CFEE-4A2B-A5D2-F7D72AF3B55F"},{"vulnerable":true,"criteria":"cpe:2.3:a:mass_contact_project:mass_contact:6.x-1.x:dev:*:*:*:drupal:*:*","matchCriteriaId":"1FB7DEC1-CAE8-4219-8E5F-08D4EA11099E"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2015","CveId":"6807","Ordinal":"1","Title":"CVE-2015-6807","CVE":"CVE-2015-6807","Year":"2015"},"notes":[{"CveYear":"2015","CveId":"6807","Ordinal":"1","NoteData":"Cross-site scripting (XSS) vulnerability in the Mass Contact module 6.x-1.x before 6.x-1.6 and 7.x-1.x before 7.x-1.1 for Drupal allows remote authenticated users with the \"administer mass contact\" permission to inject arbitrary web script or HTML via a category label.","Type":"Description","Title":"CVE-2015-6807"},{"CveYear":"2015","CveId":"6807","Ordinal":"2","NoteData":"2015-09-04","Type":"Other","Title":"Published"}]}}}