CVE-2006-4646: Drupal Pathauto Module

Medium severity, CVSS 6.8. EPSS: 1.3% chance of exploitation in the next 30 days.

Cross-site scripting (XSS) vulnerability in the Drupal 4.7 Pathauto module before pathauto_node.inc 1.17.2.1 and the Drupal 4.6 Pathauto module before pathauto_node.inc 1.14.2.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Affected products

• Drupal Drupal Pathauto Module: version 4.6 only; version 4.7 only

Published 2006-09-08. Last modified 2026-06-16.