Description
Multiple cross-site scripting (XSS) vulnerabilities in the XML parser in Drupal 4.6.x before 4.6.10 and 4.7.x before 4.7.4 allow remote attackers to inject arbitrary web script or HTML via a crafted RSS feed.
References
- 29922 vdb-entry
- 1766 third-party-advisory
- http://drupal.org/node/88826
- OpenPKG-SA-2006.025-drupal vendor-advisory
- 20061019 [DRUPAL-SA-2006-024] Drupal 4.6.10 / 4.7.4 fixes multiple XSS issues mailing-list
- 22486 third-party-advisory
- ADV-2006-4120 vdb-entry