CVE-2006-4120

MediumCVSS 5.1/10Last modified Jun 16, 2026

Description

Cross-site scripting (XSS) vulnerability in the Recipe module (recipe.module) before 1.54 for Drupal 4.6 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Metrics

CVSS 2.0 5.1/10AV:N/AC:H/Au:N/C:P/I:P/A:P

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://drupal.org/node/77538Patch, Vendor Advisory
http://drupal.org/node/77753Patch, Vendor Advisory
http://secunia.com/advisories/21381Patch, Vendor Advisory
http://www.securityfocus.com/bid/19422Patch
http://www.vupen.com/english/advisories/2006/3202
https://exchange.xforce.ibmcloud.com/vulnerabilities/28490
http://drupal.org/node/77538Patch, Vendor Advisory
http://drupal.org/node/77753Patch, Vendor Advisory
http://secunia.com/advisories/21381Patch, Vendor Advisory
http://www.securityfocus.com/bid/19422Patch
http://www.vupen.com/english/advisories/2006/3202
https://exchange.xforce.ibmcloud.com/vulnerabilities/28490

Timeline

Published: Aug 14, 2006
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2006

CVE-2006-41215.1PHP remote file inclusion vulnerability in owimg.php3 in See-Commerce 1.0.625 and earlier allows remote attackers to execute arbitrary PHP c CVE-2006-41227.5Simple one-file guestbook 1.0 and earlier allows remote attackers to bypass authentication and delete guestbook entries via a modified id pa CVE-2006-41237.5PHP remote file inclusion vulnerability in boitenews4/index.php in Boite de News 4.0.1 allows remote attackers to execute arbitrary PHP code CVE-2006-41244.6The libXm library in LessTif 0.95.0 and earlier allows local users to gain privileges via the DEBUG_FILE environment variable, which is used CVE-2006-41257.5Stack-based buffer overflow in main.c in DConnect Daemon 0.7.0 and earlier allows remote attackers to execute arbitrary code via a large nic CVE-2006-41265.0The dc_chat function in cmd.dc.c in DConnect Daemon 0.7.0 and earlier allows remote attackers to cause a denial of service (application cras CVE-2006-41274.6Multiple format string vulnerabilities in DConnect Daemon 0.7.0 and earlier allow remote administrators to execute arbitrary code via format CVE-2006-41286.5Multiple heap-based buffer overflows in Symantec VERITAS Backup Exec for Netware Server Remote Agent for Windows Server 9.1 and 9.2 (all bui CVE-2006-41297.5PHP remote file inclusion vulnerability in admin.webring.docs.php in the Webring Component (com_webring) 1.0 and earlier for Joomla! allows CVE-2006-41306.8PHP remote file inclusion vulnerability in admin.remository.php in the Remository Component (com_remository) 3.25 and earlier for Mambo and CVE-2006-41317.5Multiple buffer overflows in ArcSoft MMS Composer 1.5.5.6, and possibly earlier, and 2.0.0.13, and possibly earlier, allow remote attackers CVE-2006-41325.0ArcSoft MMS Composer 1.5.5.6 and possibly earlier, and 2.0.0.13 and possibly earlier, allow remote attackers to cause a denial of service (r