VulnerabilityModified
CVE-2006-2833
Cross-site scripting (XSS) vulnerability in the taxonomy module in Drupal 4.6.8 and 4.7.2 allows remote attackers to inject arbitrary web script or HTML via inputs that are not properly validated when the page title is output, possibly involving the…
LOW 2.6EPSS 2.54%
Does this matter?
Lower severity and a low EPSS score (2.54%). Track it; it rarely justifies an emergency change on its own.
Description
Cross-site scripting (XSS) vulnerability in the taxonomy module in Drupal 4.6.8 and 4.7.2 allows remote attackers to inject arbitrary web script or HTML via inputs that are not properly validated when the page title is output, possibly involving the $names variable.
- CVSS 2.0
- 2.6 LOWAV:N/AC:H/Au:N/C:N/I:P/A:N
- EPSS
- 2.54% probability · 84th percentile
- CISA KEV
- Not listed
- Affected
- drupal/drupal
- Source
- cve@mitre.org
References
- http://drupal.org/files/sa-2006-008/4.6.7.patchPatch
- http://drupal.org/node/66767Patch
- http://secunia.com/advisories/20412Patch, Vendor Advisory
- http://secunia.com/advisories/21244
- http://securityreason.com/securityalert/1041
- http://www.debian.org/security/2006/dsa-1125
- http://www.securityfocus.com/archive/1/435793/100/0/threaded
- http://www.securityfocus.com/bid/18245Patch
- http://www.vupen.com/english/advisories/2006/2112
- https://exchange.xforce.ibmcloud.com/vulnerabilities/26893
- http://drupal.org/files/sa-2006-008/4.6.7.patchPatch
- http://drupal.org/node/66767Patch
- http://secunia.com/advisories/20412Patch, Vendor Advisory
- http://secunia.com/advisories/21244
- http://securityreason.com/securityalert/1041
- http://www.debian.org/security/2006/dsa-1125
- http://www.securityfocus.com/archive/1/435793/100/0/threaded
- http://www.securityfocus.com/bid/18245Patch
- http://www.vupen.com/english/advisories/2006/2112
- https://exchange.xforce.ibmcloud.com/vulnerabilities/26893
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.