CVE-2006-6646: drupal drupal_project
Vulnerability summary
CVE-2006-6646 is a medium (CVSS 6.8) vulnerability in drupal drupal_project. EPSS estimates a 1.25% chance of exploitation in the next 30 days, higher than 68.9% of scored vulnerabilities.
Timeline
- 20-12-2006PublishedVulnerability first disclosed.
- 07-08-2024Last modifiedVulnerability information updated.
Description
Multiple cross-site scripting (XSS) vulnerabilities in Drupal (1) Project Issue Tracking 4.7.x-1.0 and 4.7.x-2.0, and (2) Project 4.6.x-1.0, 4.7.x-1.0, and 4.7.x-2.0 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters, which do not use the check_plain function.
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
1.25%
Chance of exploitation in the next 30 days
Percentile
69%
Versus all other CVEs
30-day change
0.00 pp
From 1.25% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Drupal2 products
- drupal_project4.6 | 4.6_1.0 | 4.7 | 4.7_1.0 | 4.7_2.0
- drupal_project_issue_tracking4.7_1.0 | 4.7_2.0
1 vendor · 2 products