CVE-2006-1228

Session fixation vulnerability in Drupal 4.5.x before 4.5.8 and 4.6.x before 4.5.8 allows remote attackers to gain privileges by tricking a user to click on a URL that fixes the session identifier.

• CWE-287

• http://drupal.org/node/53805Patch, Vendor Advisory
• http://secunia.com/advisories/19245Patch, Vendor Advisory
• http://secunia.com/advisories/19257
• http://securityreason.com/securityalert/580
• http://www.debian.org/security/2006/dsa-1007
• http://www.osvdb.org/23911
• http://www.securityfocus.com/archive/1/427589/100/0/threaded
• http://www.securityfocus.com/bid/17104
• https://exchange.xforce.ibmcloud.com/vulnerabilities/25205
• http://drupal.org/node/53805Patch, Vendor Advisory
• http://secunia.com/advisories/19245Patch, Vendor Advisory
• http://secunia.com/advisories/19257
• http://securityreason.com/securityalert/580
• http://www.debian.org/security/2006/dsa-1007
• http://www.osvdb.org/23911
• http://www.securityfocus.com/archive/1/427589/100/0/threaded
• http://www.securityfocus.com/bid/17104
• https://exchange.xforce.ibmcloud.com/vulnerabilities/25205

Published

Mar 14, 2006

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2006-1222Multiple cross-site scripting (XSS) vulnerabilities in zerob…
• CVE-2006-1223Cross-site scripting (XSS) vulnerability in Jupiter Content …
• CVE-2006-1224Directory traversal vulnerability in dwnld.php in GuppY 4.5.…
• CVE-2006-1225CRLF injection vulnerability in Drupal 4.5.x before 4.5.8 an…
• CVE-2006-1226Cross-site scripting (XSS) vulnerability in Drupal 4.5.x bef…
• CVE-2006-1227Drupal 4.5.x before 4.5.8 and 4.6.x before 4.5.8, when menu.…
• CVE-2006-1229SQL injection vulnerability in search.asp in Hosting Control…
• CVE-2006-1230Multiple cross-site scripting (XSS) vulnerabilities in creat…
• CVE-2006-1231CAPI4HylaFAX 1.3, when compiled with GENERATE_DEBUGSFFDATAFI…
• CVE-2006-1232Multiple SQL injection vulnerabilities in DSDownload 1.0, wi…
• CVE-2006-1233Multiple cross-site scripting (XSS) vulnerabilities in WMNew…
• CVE-2006-1234SQL injection vulnerability in index.php in DSCounter 1.2, w…