Unscored severity · published Dec 8, 2006
CVE-2006-6386
Cross-site scripting (XSS) vulnerability in the CVS management/tracker 4.7.x-1.0, 4.7.x-2.0, and 4.7.0 (before the 20060807 contribution release system) for Drupal allows remote…
–
CVSS
1.3%
EPSS
No
On KEV
Description
Cross-site scripting (XSS) vulnerability in the CVS management/tracker 4.7.x-1.0, 4.7.x-2.0, and 4.7.0 (before the 20060807 contribution release system) for Drupal allows remote attackers to inject arbitrary web script or HTML via the motivation field in the CVS application page, which is not passed through check_markup on display.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.3% · higher than 69% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CM
Cvs Management And Tracker · Drupal
4.7_1.0; 4.7_2.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2006-6386
CVE.org
https://www.cve.org/CVERecord?id=CVE-2006-6386
Patch
http://drupal.org/node/101540
Patch
http://secunia.com/advisories/23261
www.securityfocus.com
http://www.securityfocus.com/bid/21455
www.vupen.com
http://www.vupen.com/english/advisories/2006/4870
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/30748