{"id":"CVE-2005-3973","url":"https://www.cyber-defence.io/tools/cve/CVE-2005-3973","generatedAt":"2026-10-27T19:37:45.143Z","title":"Multiple cross-site scripting (XSS) vulnerabilities in Drupal 4.5.0 through 4.5.5 and 4.6.0 through 4.6.3 allow remote attackers to inject arbitrary web script or HTML via various HTML tags and values, such as the (1) legend tag and the value parameter…","description":"Multiple cross-site scripting (XSS) vulnerabilities in Drupal 4.5.0 through 4.5.5 and 4.6.0 through 4.6.3 allow remote attackers to inject arbitrary web script or HTML via various HTML tags and values, such as the (1) legend tag and the value parameter used in (2) label and (3) input tags, possibly due to an incomplete blacklist.","published":"2005-12-03T19:03:00.000Z","lastModified":"2026-06-16T22:17:59.000Z","status":"Modified","sourceIdentifier":"cve@mitre.org","cvss":{"version":"2.0","score":4.3,"severity":"MEDIUM","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N"},"cwe":[],"affected":["drupal/drupal"],"epss":{"score":0.01437,"percentile":0.72958,"date":"2026-10-26","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (1.44%). Track it; it rarely justifies an emergency change on its own."},"changes":[],"references":[{"url":"http://drupal.org/files/sa-2005-007/4.6.3.patch","source":"cve@mitre.org"},{"url":"http://drupal.org/files/sa-2005-007/advisory.txt","tags":["Patch","Vendor Advisory"],"source":"cve@mitre.org"},{"url":"http://secunia.com/advisories/17824","tags":["Patch","Vendor Advisory"],"source":"cve@mitre.org"},{"url":"http://secunia.com/advisories/18630","source":"cve@mitre.org"},{"url":"http://www.debian.org/security/2006/dsa-958","source":"cve@mitre.org"},{"url":"http://www.securityfocus.com/archive/1/418292/100/0/threaded","source":"cve@mitre.org"},{"url":"http://www.securityfocus.com/bid/15677","tags":["Patch"],"source":"cve@mitre.org"},{"url":"http://www.vupen.com/english/advisories/2005/2684","source":"cve@mitre.org"},{"url":"http://drupal.org/files/sa-2005-007/4.6.3.patch","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://drupal.org/files/sa-2005-007/advisory.txt","tags":["Patch","Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://secunia.com/advisories/17824","tags":["Patch","Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://secunia.com/advisories/18630","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.debian.org/security/2006/dsa-958","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.securityfocus.com/archive/1/418292/100/0/threaded","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.securityfocus.com/bid/15677","tags":["Patch"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.vupen.com/english/advisories/2005/2684","source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2005-3973","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}