> CVE-2026-3217

« BACK_TO_HOME
PUBLISHED
2026-03-25 16:16
MODIFIED
2026-03-25 16:16
EPSS (Prob. Exploit)
0.26%
Top 82.8%
DATA SOURCES:
NVD 🔗 2026-03-25 CWE MITRE 🔗 2026-11-01 FIRST EPSS 🔗 2026-10-25 GITHUB 🔗 2026-10-28

> DESCRIPTION

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal SAML SSO - Service Provider allows Cross-Site Scripting (XSS).This issue affects SAML SSO - Service Provider: from 0.0.0 before 3.1.3.

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> WEAKNESSES

CWE-79

> CWE DETAILED DESCRIPTIONS

CWE-79: Improper Neutralization of Input During Web Page Generation - The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

> GITHUB SECURITY ADVISORY

GHSA-rg75-q538-x34v HIGH

Microsoft Security Advisory CVE-2026-32175 – .NET Core Tampering Vulnerability

AFFECTED PACKAGES:
NUGET / Microsoft.NetCore.App.Runtime.win-x86
>= 10.0.0, <= 10.0.7
Fixed in: 10.0.8
NUGET / Microsoft.NetCore.App.Runtime.win-x86
>= 9.0.0, <= 9.0.15
Fixed in: 9.0.16
NUGET / Microsoft.NetCore.App.Runtime.win-x86
>= 8.0.0, <= 8.0.26
Fixed in: 8.0.27
NUGET / Microsoft.NetCore.App.Runtime.win-x64
>= 10.0.0, <= 10.0.7
Fixed in: 10.0.8
NUGET / Microsoft.NetCore.App.Runtime.win-x64
>= 9.0.0, <= 9.0.15
Fixed in: 9.0.16
NUGET / Microsoft.NetCore.App.Runtime.win-x64
>= 8.0.0, <= 8.0.26
Fixed in: 8.0.27
NUGET / Microsoft.NetCore.App.Runtime.win-arm64
>= 10.0.0, <= 10.0.7
Fixed in: 10.0.8
NUGET / Microsoft.NetCore.App.Runtime.win-arm64
>= 9.0.0, <= 9.0.15
Fixed in: 9.0.16
NUGET / Microsoft.NetCore.App.Runtime.win-arm64
>= 8.0.0, <= 8.0.26
Fixed in: 8.0.27
NUGET / Microsoft.NetCore.App.Runtime.win-arm
>= 10.0.0, <= 10.0.7
Fixed in: 10.0.8

> HISTORIQUE DES MODIFICATIONS

Première apparition
25/03/2026 16:16
Source: NVD
📊 ENRICHISSEMENT 01/11/2026 06:59
CWE
Champ modifié: Description CWE
Ancienne valeur:
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') - The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in...
Nouvelle valeur:
CWE-79: Improper Neutralization of Input During Web Page Generation - The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a...
📊 ENRICHISSEMENT 01/04/2026 06:02
CWE
Champ modifié: Description CWE
Ancienne valeur:
N/A
Nouvelle valeur:
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') - The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in...
Total des modifications: 2 Dernière mise à jour: 1 week ago

> REFERENCES

https://www.drupal.org/sa-contrib-2026-018
« BACK_TO_HOME