CVSS: 7.5EPSS: 1%CPEs: 9EXPL: 0CVE-2006-2742
https://notcve.org/view.php?id=CVE-2006-2742
SQL injection vulnerability in Drupal 4.6.x before 4.6.7 and 4.7.0 allows remote attackers to execute arbitrary SQL commands via the (1) count and (2) from variables to (a) database.mysql.inc, (b) database.pgsql.inc, and (c) database.mysqli.inc. • http://drupal.org/node/65357 http://secunia.com/advisories/20140 http://secunia.com/advisories/21244 http://www.debian.org/security/2006/dsa-1125 http://www.securityfocus.com/archive/1/435790/100/0/threaded http://www.securityfocus.com/bid/18245 http://www.vupen.com/english/advisories/2006/1975 https://exchange.xforce.ibmcloud.com/vulnerabilities/26654 •
CVSS: 5.1EPSS: 3%CPEs: 9EXPL: 1CVE-2006-2743 – Drupal 4.7 - 'Attachment mod_mime' Remote Command Execution
https://notcve.org/view.php?id=CVE-2006-2743
Drupal 4.6.x before 4.6.7 and 4.7.0, when running on Apache with mod_mime, does not properly handle files with multiple extensions, which allows remote attackers to upload, modify, or execute arbitrary files in the files directory. • https://www.exploit-db.com/exploits/1821 http://drupal.org/node/65409 http://secunia.com/advisories/20140 http://secunia.com/advisories/21244 http://www.debian.org/security/2006/dsa-1125 http://www.securityfocus.com/archive/1/435794/100/0/threaded http://www.securityfocus.com/bid/18245 http://www.vupen.com/english/advisories/2006/1975 https://exchange.xforce.ibmcloud.com/vulnerabilities/26655 •
CVSS: 4.3EPSS: 0%CPEs: 10EXPL: 0CVE-2006-2260
https://notcve.org/view.php?id=CVE-2006-2260
Cross-site scripting (XSS) vulnerability in the project module (project.module) in Drupal 4.5 and 4.6 allows remote attackers to inject arbitrary web script or HTML via unknown attack vectors. • http://drupal.org/node/62406 http://secunia.com/advisories/19997 http://www.securityfocus.com/bid/17885 http://www.vupen.com/english/advisories/2006/1697 https://exchange.xforce.ibmcloud.com/vulnerabilities/26358 •
CVSS: 5.1EPSS: 3%CPEs: 6EXPL: 0CVE-2006-1228
https://notcve.org/view.php?id=CVE-2006-1228
Session fixation vulnerability in Drupal 4.5.x before 4.5.8 and 4.6.x before 4.5.8 allows remote attackers to gain privileges by tricking a user to click on a URL that fixes the session identifier. • http://drupal.org/node/53805 http://secunia.com/advisories/19245 http://secunia.com/advisories/19257 http://securityreason.com/securityalert/580 http://www.debian.org/security/2006/dsa-1007 http://www.osvdb.org/23911 http://www.securityfocus.com/archive/1/427589/100/0/threaded http://www.securityfocus.com/bid/17104 https://exchange.xforce.ibmcloud.com/vulnerabilities/25205 • CWE-287: Improper Authentication •
CVSS: 4.6EPSS: 0%CPEs: 14EXPL: 0CVE-2006-1227
https://notcve.org/view.php?id=CVE-2006-1227
Drupal 4.5.x before 4.5.8 and 4.6.x before 4.5.8, when menu.module is used to create a menu item, does not implement access control for the page that is referenced, which might allow remote attackers to access administrator pages. • http://drupal.org/node/53796 http://secunia.com/advisories/19245 http://secunia.com/advisories/19257 http://securityreason.com/securityalert/578 http://www.debian.org/security/2006/dsa-1007 http://www.osvdb.org/23909 http://www.securityfocus.com/archive/1/427587/100/0/threaded http://www.securityfocus.com/bid/17104 https://exchange.xforce.ibmcloud.com/vulnerabilities/25197 •