Drupal · Drupal · CVE-2006-2833
**Name of the Vulnerable Software and Affected Versions**
Drupal versions 4.6.8 and 4.7.2
**Description**
A cross-site scripting issue exists due to improper validation of inputs when the page title is output, potentially involving the `$names` variable. This allows remote attackers to inject arbitrary web script or HTML.
**Recommendations**
For version 4.6.8, update to a version that addresses this issue.
For version 4.7.2, update to a version that addresses this issue.
As a temporary workaround, consider restricting the use of the taxonomy module until a patch is available.