CVE-2006-2833

Severity: low (CVSS 2.6 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2006-06-06 · updated 2026-06-16

Description

Cross-site scripting (XSS) vulnerability in the taxonomy module in Drupal 4.6.8 and 4.7.2 allows remote attackers to inject arbitrary web script or HTML via inputs that are not properly validated when the page title is output, possibly involving the $names variable.

Affected products

Drupal: 4.6.8, 4.7.2

References

http://drupal.org/files/sa-2006-008/4.6.7.patch
http://drupal.org/node/66767
http://secunia.com/advisories/20412
http://secunia.com/advisories/21244
http://securityreason.com/securityalert/1041
http://www.debian.org/security/2006/dsa-1125
http://www.securityfocus.com/archive/1/435793/100/0/threaded
http://www.securityfocus.com/bid/18245
http://www.vupen.com/english/advisories/2006/2112
https://exchange.xforce.ibmcloud.com/vulnerabilities/26893
http://drupal.org/files/sa-2006-008/4.6.7.patch
http://drupal.org/node/66767

Get alerted when CVE-2006-2833 or the next vulnerability affects your stack