CVSS: 2.6EPSS: 0%CPEs: 11EXPL: 0CVE-2006-2832
https://notcve.org/view.php?id=CVE-2006-2832
Cross-site scripting (XSS) vulnerability in the upload module (upload.module) in Drupal 4.6.x before 4.6.8 and 4.7.x before 4.7.2 allows remote attackers to inject arbitrary web script or HTML via the uploaded filename. • http://drupal.org/files/sa-2006-007/advisory.txt http://drupal.org/node/66763 http://secunia.com/advisories/21244 http://securityreason.com/securityalert/1042 http://www.debian.org/security/2006/dsa-1125 http://www.securityfocus.com/archive/1/435792/100/0/threaded http://www.securityfocus.com/bid/18245 •
CVSS: 2.6EPSS: 0%CPEs: 2EXPL: 0CVE-2006-2833
https://notcve.org/view.php?id=CVE-2006-2833
Cross-site scripting (XSS) vulnerability in the taxonomy module in Drupal 4.6.8 and 4.7.2 allows remote attackers to inject arbitrary web script or HTML via inputs that are not properly validated when the page title is output, possibly involving the $names variable. • http://drupal.org/files/sa-2006-008/4.6.7.patch http://drupal.org/node/66767 http://secunia.com/advisories/20412 http://secunia.com/advisories/21244 http://securityreason.com/securityalert/1041 http://www.debian.org/security/2006/dsa-1125 http://www.securityfocus.com/archive/1/435793/100/0/threaded http://www.securityfocus.com/bid/18245 http://www.vupen.com/english/advisories/2006/2112 https://exchange.xforce.ibmcloud.com/vulnerabilities/26893 •
CVSS: 7.5EPSS: 1%CPEs: 9EXPL: 0CVE-2006-2742
https://notcve.org/view.php?id=CVE-2006-2742
SQL injection vulnerability in Drupal 4.6.x before 4.6.7 and 4.7.0 allows remote attackers to execute arbitrary SQL commands via the (1) count and (2) from variables to (a) database.mysql.inc, (b) database.pgsql.inc, and (c) database.mysqli.inc. • http://drupal.org/node/65357 http://secunia.com/advisories/20140 http://secunia.com/advisories/21244 http://www.debian.org/security/2006/dsa-1125 http://www.securityfocus.com/archive/1/435790/100/0/threaded http://www.securityfocus.com/bid/18245 http://www.vupen.com/english/advisories/2006/1975 https://exchange.xforce.ibmcloud.com/vulnerabilities/26654 •
CVSS: 5.1EPSS: 3%CPEs: 9EXPL: 1CVE-2006-2743 – Drupal 4.7 - 'Attachment mod_mime' Remote Command Execution
https://notcve.org/view.php?id=CVE-2006-2743
Drupal 4.6.x before 4.6.7 and 4.7.0, when running on Apache with mod_mime, does not properly handle files with multiple extensions, which allows remote attackers to upload, modify, or execute arbitrary files in the files directory. • https://www.exploit-db.com/exploits/1821 http://drupal.org/node/65409 http://secunia.com/advisories/20140 http://secunia.com/advisories/21244 http://www.debian.org/security/2006/dsa-1125 http://www.securityfocus.com/archive/1/435794/100/0/threaded http://www.securityfocus.com/bid/18245 http://www.vupen.com/english/advisories/2006/1975 https://exchange.xforce.ibmcloud.com/vulnerabilities/26655 •