CVE-2025-14556

MEDIO 5.4CVE-2025-14556 · Published 14/01/2026 · updated 17/06/2026

En resumen

CVE-2025-14556 es una vulnerabilidad MEDIO (CVSS 5.4) que afecta a flag (flag module project).
Probabilidad de explotación en los próximos 30 días (EPSS): 0.21%, mayor que el 11.1% de las vulnerabilidades.
Aún no hay una versión corregida: sigue el aviso del fabricante en Referencias.

Package	Affected versions	Patched versions
flag flag_module_project	`≥ 7.x-3.0, ≤ 7.x-3.9`	No fix yet

Description

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Drupal Flag allows Cross-Site Scripting (XSS).This issue affects Flag: from 7.X-3.0 through 7.X-3.9.

References

d7es.tag1.com/security-advisories/flag-moderately-critical-cross-site-scripting-backdrop-sa-contrib-2025-011 · Third Party Advisory
herodevs.com/vulnerability-directory/cve-2025-14556 · Exploit

Más vulnerabilidades de flag

Ver todo →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free