Cross-site scripting (XSS) vulnerability in the Date Tools sub-module in the Date module 6.x before 6.x-2.3 for Drupal allows remote authenticated users with \use date tools\ or \administer content types\ privileges to inject arbitrary web script or HTML via a \Content type label\ field.