CVE-2025-48920: Drupal etracker · Cross-site Scripting
Affects Drupal etrackerSource CVE Database V5
Not known to be exploited.
Data as of 26 Oct 2026, 14:05 UTC
Rated High by the CNA (drupal) · No CVSS score from NVD or the CNA
- EPSS
- 0.2% chance of exploitation in 30 days – higher than 19% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Exploitation evidence
Disclosed: evidence found.
CVE published 13 Jun 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| Drupal etracker | Affected
| Fixed in– |
AI-suggested
Organizations should prioritize upgrading the Drupal etracker module to version 3.1.0 or later once available, as this will likely contain the necessary fixes for input neutralization. Until a patch is released, implement strict Content Security Policy (CSP) headers to restrict the execution of inline scripts and limit the domains from which scripts can be loaded. Employ web application firewalls (WAFs) with rules targeting common XSS attack patterns to detect and block malicious payloads. Review and sanitize all user inputs and outputs related to the etracker module manually if feasible, applying context-aware encoding (e.g., HTML entity encoding) to prevent script injection. Conduct thorough security testing, including automated and manual XSS scanning, focusing on pages integrating etracker functionality. Educate web developers and administrators about secure coding practices specific to Drupal modules and input validation. Monitor logs for unusual activity or attempted exploitation attempts. Finally, consider isolating or disabling the etracker module temporarily if the risk is deemed unacceptable and no immediate patch is available.
Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal etracker allows Cross-Site Scripting (XSS).This issue affects etracker: from 0.0.0 before 3.1.0.