Cross-site scripting (XSS) vulnerability in Brilliant Gallery 5.x before 5.x-4.2 a module for Drupal allows remote authenticated users with permissions to inject arbitrary web script or HTML via unspecified vectors related to posting of answers.