6.8

CVE-2006-6386

EPSS 1.19%
Published 08.12.2006 01:28:00
Last modified 09.04.2025 00:30:58
Source cve@mitre.org
Teams watchlist Login
Open Login

Cross-site scripting (XSS) vulnerability in the CVS management/tracker 4.7.x-1.0, 4.7.x-2.0, and 4.7.0 (before the 20060807 contribution release system) for Drupal allows remote attackers to inject arbitrary web script or HTML via the motivation field in the CVS application page, which is not passed through check_markup on display.

Affected products Warnungen 0 Metrics 2 CWE 0 References 8

Data is provided by the National Vulnerability Database (NVD)

Drupal ≫ Cvs Management And Tracker Version4.7_1.0

Drupal ≫ Cvs Management And Tracker Version4.7_2.0

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	1.19%	0.781

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	6.8	8.6	6.4	AV:N/AC:M/Au:N/C:P/I:P/A:P

http://drupal.org/node/101540

Patch

Vendor Advisory

http://secunia.com/advisories/23261

Patch

Vendor Advisory

http://www.securityfocus.com/bid/21455

http://www.vupen.com/english/advisories/2006/4870

https://exchange.xforce.ibmcloud.com/vulnerabilities/30748

https://nvd.nist.gov/vuln/detail/CVE-2006-6386

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2006-6386

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2006-6386

EUVD