CVE:CVE-2009-2074
CNNVD:CNNVD-200906-268
Drupal Nodequeue 5.x-2.7版本之前的5.x版本和6.x-2.2版本之前的6.x版本中存在跨站脚本攻击漏洞。具有管理员分类系统许可的远程认证用户可以借助词汇表名字，注入任意web脚本或HTML。
solution:Upgrade drupal nodequeue to a higher version than 5.x-2.0-rc,5.x-2.0_beta,5.x-2.0_rc1,5.x-2.1,5.x-2.2,5.x-2.3,5.x-2.4,5.x-2.5,5.x-2.6,6.x-2.0,6.x-2.0-rc1,6.x-2.0-rc2,6.x-2.1,and avoid the version 5.x-2.0-rc,5.x-2.0_beta,5.x-2.0_rc1,5.x-2.1,5.x-2.2,5.x-2.3,5.x-2.4,5.x-2.5,5.x-2.6,6.x-2.0,6.x-2.0-rc1,6.x-2.0-rc2,6.x-2.1