Skip to content

CVE-2006-1225

CRLF injection vulnerability in Drupal 4.5.x before 4.5.8 and 4.6.x before 4.5.8 allows remote...

5.0 MediumFix available

CVE-2006-1225 is a medium vulnerability (CVSS 5.0) in Drupal, published March 14, 2006. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.92%, the 87th percentile. Fixed in drupal 4.5.3-6.

CRLF injection vulnerability in Drupal 4.5.x before 4.5.8 and 4.6.x before 4.5.8 allows remote attackers to inject headers of outgoing e-mail messages and use Drupal as a spam proxy.

Exploit likelihood

2.92%Up 0.9 points since Feb 4, 2022

What each source reports

NVD Score used 5.0

CRLF injection vulnerability in Drupal 4.5.x before 4.5.8 and 4.6.x before 4.5.8 allows remote attackers to inject headers of outgoing e-mail messages and use Drupal as a spam proxy.

Record: CVE-2006-1225
CVSS 2.0: 5.0 MediumAV:N/AC:L/Au:N/C:N/I:P/A:N
Updated: 2026-11-02

CVE List No score

CRLF injection vulnerability in Drupal 4.5.x before 4.5.8 and 4.6.x before 4.5.8 allows remote attackers to inject headers of outgoing e-mail messages and use Drupal as a spam proxy.

Record: CVE-2006-1225
Updated: 2026-11-02

EUVDEUVD-2006-1229 No score

CRLF injection vulnerability in Drupal 4.5.x before 4.5.8 and 4.6.x before 4.5.8 allows remote attackers to inject headers of outgoing e-mail messages and use Drupal as a spam proxy.

Record: EUVD-2006-1229
Updated: 2026-11-03

GitHub AdvisoriesGHSA-ffxc-f678-c54f No score

CRLF injection vulnerability in Drupal 4.5.x before 4.5.8 and 4.6.x before 4.5.8 allows remote...

CRLF injection vulnerability in Drupal 4.5.x before 4.5.8 and 4.6.x before 4.5.8 allows remote attackers to inject headers of outgoing e-mail messages and use Drupal as a spam proxy.

Record: GHSA-ffxc-f678-c54f
Updated: 2026-11-02

Affected products

drupal

Affected packages

Affected packages
Package	Affected	Fixed
`drupal` Debian:3.1	before 4.5.3-6, plus listed versions 4.5.3-24.5.3-34.5.3-44.5.3-5	4.5.3-6

History

History
When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, GitHub Advisories, NVD, OSV

References

Show 5 moreShow less