CVE-2008-6170

Cross-site scripting (XSS) vulnerability in Drupal 5.x before 5.12 and 6.x before 6.6 allows remote authenticated users with create book content or edit node book hierarchy permissions to inject arbitrary web script or HTML via the book page title.

• CWE-79

• http://drupal.org/node/324824Patch, Vendor Advisory
• http://secunia.com/advisories/32297Vendor Advisory
• http://secunia.com/advisories/32441
• http://www.securityfocus.com/bid/31882
• http://www.vupen.com/english/advisories/2008/2913
• https://exchange.xforce.ibmcloud.com/vulnerabilities/46052
• https://www.redhat.com/archives/fedora-package-announce/2008-October/msg00783.html
• https://www.redhat.com/archives/fedora-package-announce/2008-October/msg00826.html
• http://drupal.org/node/324824Patch, Vendor Advisory
• http://secunia.com/advisories/32297Vendor Advisory
• http://secunia.com/advisories/32441
• http://www.securityfocus.com/bid/31882
• http://www.vupen.com/english/advisories/2008/2913
• https://exchange.xforce.ibmcloud.com/vulnerabilities/46052
• https://www.redhat.com/archives/fedora-package-announce/2008-October/msg00783.html
• https://www.redhat.com/archives/fedora-package-announce/2008-October/msg00826.html

Published

Feb 19, 2009

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2008-6164Cross-site scripting (XSS) vulnerability in index.php in Dre…
• CVE-2008-6165SQL injection vulnerability in gestion.php in CSPartner 0.1,…
• CVE-2008-6166SQL injection vulnerability in the KBase (com_kbase) 1.2 com…
• CVE-2008-6167Directory traversal vulnerability in search.php in miniPorta…
• CVE-2008-6168Cross-site scripting (XSS) vulnerability in search.php in mi…
• CVE-2008-6169Cross-site request forgery (CSRF) vulnerability in the Local…
• CVE-2008-6171includes/bootstrap.inc in Drupal 5.x before 5.12 and 6.x bef…
• CVE-2008-6172Directory traversal vulnerability in captcha/captcha_image.p…
• CVE-2008-6173Cross-site scripting (XSS) vulnerability in fullscreen.php i…
• CVE-2008-6174Cross-site scripting (XSS) vulnerability in admin/postlister…
• CVE-2008-6175SilverSHielD 1.0.2.34 allows remote attackers to cause a den…
• CVE-2008-6176Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…