Vulnerabilities > Drupal
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2006-03-14 | CVE-2006-1226 | Input Validation vulnerability in Drupal Cross-site scripting (XSS) vulnerability in Drupal 4.5.x before 4.5.8 and 4.6.x before 4.5.8 allows remote attackers to inject arbitrary web script or HTML via unknown attack vectors. network drupal | 4.3 |
| 2006-03-14 | CVE-2006-1225 | Input Validation vulnerability in Drupal CRLF injection vulnerability in Drupal 4.5.x before 4.5.8 and 4.6.x before 4.5.8 allows remote attackers to inject headers of outgoing e-mail messages and use Drupal as a spam proxy. | 5.0 |
| 2005-12-03 | CVE-2005-3975 | HTML Injection vulnerability in Drupal Image Upload Interpretation conflict in file.inc in Drupal 4.5.0 through 4.5.5 and 4.6.0 through 4.6.3 allows remote authenticated users to inject arbitrary web script or HTML via HTML in a file with a GIF or JPEG file extension, which causes the HTML to be executed by a victim who views the file in Internet Explorer as a result of CVE-2005-3312. | 4.0 |
| 2005-12-03 | CVE-2005-3974 | Unspecified vulnerability in Drupal Drupal 4.5.0 through 4.5.5 and 4.6.0 through 4.6.3, when running on PHP5, does not correctly enforce user privileges, which allows remote attackers to bypass the "access user profiles" permission. | 6.4 |
| 2005-12-03 | CVE-2005-3973 | HTML Injection vulnerability in Drupal Submitted Content Multiple cross-site scripting (XSS) vulnerabilities in Drupal 4.5.0 through 4.5.5 and 4.6.0 through 4.6.3 allow remote attackers to inject arbitrary web script or HTML via various HTML tags and values, such as the (1) legend tag and the value parameter used in (2) label and (3) input tags, possibly due to an incomplete blacklist. network drupal | 4.3 |
| 2005-07-05 | CVE-2005-2106 | Unspecified vulnerability in Drupal Unknown vulnerability in Drupal 4.5.0 through 4.5.3, 4.6.0, and 4.6.1 allows remote attackers to execute arbitrary PHP code via a public comment or posting. | 5.0 |
| 2005-06-09 | CVE-2005-1871 | Remote Security vulnerability in Drupal Unknown vulnerability in the privilege system in Drupal 4.4.0 through 4.6.0, when public registration is enabled, allows remote attackers to gain privileges, due to an "input check" that "is not implemented properly." | 7.5 |
| 2005-05-02 | CVE-2005-0682 | Cross-Site Scripting vulnerability in Drupal Cross-site scripting (XSS) vulnerability in common.inc in Drupal before 4.5.2 allows remote attackers to inject arbitrary web script or HTML via certain inputs. network drupal | 4.3 |
| 2002-12-31 | CVE-2002-1806 | HTML Injection vulnerability in Drupal 4.0.0 Cross-site scripting (XSS) vulnerability in Drupal 4.0.0 allows remote attackers to inject arbitrary web script or HTML via Javascript in an IMG tag. network drupal | 4.3 |