CVE-2006-2742

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2006-06-01 · updated 2026-06-16

Description

SQL injection vulnerability in Drupal 4.6.x before 4.6.7 and 4.7.0 allows remote attackers to execute arbitrary SQL commands via the (1) count and (2) from variables to (a) database.mysql.inc, (b) database.pgsql.inc, and (c) database.mysqli.inc.

Affected products

Drupal: 4.6, 4.6.0, 4.6.1, 4.6.2, 4.6.3, 4.6.4 (+3)

References

http://drupal.org/node/65357
http://secunia.com/advisories/20140
http://secunia.com/advisories/21244
http://www.debian.org/security/2006/dsa-1125
http://www.securityfocus.com/archive/1/435790/100/0/threaded
http://www.securityfocus.com/bid/18245
http://www.vupen.com/english/advisories/2006/1975
https://exchange.xforce.ibmcloud.com/vulnerabilities/26654
http://drupal.org/node/65357
http://secunia.com/advisories/20140
http://secunia.com/advisories/21244
http://www.debian.org/security/2006/dsa-1125

Get alerted when CVE-2006-2742 or the next vulnerability affects your stack