CVE-2006-6646: Drupal Project

Medium severity, CVSS 6.8. EPSS: 1.3% chance of exploitation in the next 30 days.

Multiple cross-site scripting (XSS) vulnerabilities in Drupal (1) Project Issue Tracking 4.7.x-1.0 and 4.7.x-2.0, and (2) Project 4.6.x-1.0, 4.7.x-1.0, and 4.7.x-2.0 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters, which do not use the check_plain function.

Affected products

• Drupal Drupal Project: version 4.6 only; version 4.6_1.0 only; version 4.7 only; version 4.7_1.0 only; version 4.7_2.0 only
• Drupal Drupal Project Issue Tracking: version 4.7_1.0 only; version 4.7_2.0 only

Published 2006-12-20. Last modified 2026-06-16.