CVE-2006-0070

Exploit

EPSS 0.66%
Veröffentlicht 04.01.2006 00:03:00
Zuletzt bearbeitet 03.04.2025 01:03:51
Quelle cve@mitre.org
CVE-Watchlists
Login
Unerledigt
Login

Drupal allows remote attackers to conduct cross-site scripting (XSS) attacks via an IMG tag with an unusual encoded Javascript function name, as demonstrated using variations of the alert() function.  NOTE: a followup by the vendor suggests that the issue does not exist in 4.5.6 or 4.6.4 when "Filtered HTML" is enabled, and since "Full HTML" would not filter HTML by design, perhaps this should not be included in CVE

Betroffene Produkte Warnungen 0 Metriken 2 CWE 0 Referenzen 5

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Drupal ≫ Drupal Version4.5.6

Drupal ≫ Drupal Version4.6.4

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.66%	0.701

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
nvd@nist.gov	4.3	8.6	2.9	AV:N/AC:M/Au:N/C:N/I:P/A:N

http://www.securityfocus.com/archive/1/420671/100/0/threaded

Vendor Advisory

Exploit

http://www.securityfocus.com/archive/1/420683/100/0/threaded

https://nvd.nist.gov/vuln/detail/CVE-2006-0070

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2006-0070

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2006-0070

EUVD