CVE-2006-4985
Multiple cross-site scripting (XSS) vulnerabilities in Grayscale BandSite CMS allow remote attackers to inject arbitrary web script or…
- 4.3MediumCVSS base score
- 1.7%Exploitation in 30 daysEPSS · top 23% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- 22Public exploitsMetasploit, Nuclei and Exploit-DB
Description
Multiple cross-site scripting (XSS) vulnerabilities in Grayscale BandSite CMS allow remote attackers to inject arbitrary web script or HTML via (1) the max_file_size_purdy parameter in adminpanel/includes/helpfiles/help_mp3.php, (2) the message_text parameter in adminpanel/includes/mailinglist/sendemail.php, (3) the this_year parameter in includes/footer.php, and the band parameter in (4) adminpanel/includes/helpfiles/help_news.php (5) adminpanel/includes/helpfiles/help_merch.php, (6) adminpanel/includes/header.php, and (7) adminpanel/login_header.php; and includes/content/ files including (8) bio_content.php, (9) gbook_content.php, (10) interview_content.php, (11) links_content.php, (12) lyrics_content.php, (13) member_content.php, (14) merch_content.php, (15) mp3_content.php, (16) news_content.php, (17) pastshows_content.php, (18) photo_content.php, (19) releases_content.php, (20) reviews_content.php, (21) shows_content.php, and (22) signgbook_content.php.
Public exploit
An exploit or proof of concept is public: anyone can try it against an unpatched system. The public collections list 22 Exploit-DB entries for it.
Show the exploits20
Exploit-DBnewest 20 of 22 entries
- BandSite CMS 1.1 - 'help_news.php' Cross-Site Scripting (Exploit-DB entry) (opens in a new tab)
EDB-ID 28617webapps, phppublished 21 Sept 2006Verified
- BandSite CMS 1.1 - 'help_merch.php' Cross-Site Scripting (Exploit-DB entry) (opens in a new tab)
EDB-ID 28618webapps, phppublished 21 Sept 2006Verified
- BandSite CMS 1.1 - 'help_mp3.php' Cross-Site Scripting (Exploit-DB entry) (opens in a new tab)
EDB-ID 28619webapps, phppublished 21 Sept 2006Verified
- BandSite CMS 1.1 - 'sendemail.php' Cross-Site Scripting (Exploit-DB entry) (opens in a new tab)
EDB-ID 28620webapps, phppublished 21 Sept 2006Verified
- BandSite CMS 1.1 - 'header.php' Cross-Site Scripting (Exploit-DB entry) (opens in a new tab)
EDB-ID 28621webapps, phppublished 21 Sept 2006Verified
- BandSite CMS 1.1 - 'login_header.php' Cross-Site Scripting (Exploit-DB entry) (opens in a new tab)
EDB-ID 28622webapps, phppublished 21 Sept 2006Verified
- BandSite CMS 1.1 - 'bio_content.php' Cross-Site Scripting (Exploit-DB entry) (opens in a new tab)
EDB-ID 28623webapps, phppublished 21 Sept 2006Verified
- BandSite CMS 1.1 - 'gbook_content.php' Cross-Site Scripting (Exploit-DB entry) (opens in a new tab)
EDB-ID 28624webapps, phppublished 21 Sept 2006Verified
- BandSite CMS 1.1 - 'interview_content.php' Cross-Site Scripting (Exploit-DB entry) (opens in a new tab)
EDB-ID 28625webapps, phppublished 21 Sept 2006Verified
- BandSite CMS 1.1 - 'links_content.php' Cross-Site Scripting (Exploit-DB entry) (opens in a new tab)
EDB-ID 28626webapps, phppublished 21 Sept 2006Verified
- BandSite CMS 1.1 - 'lyrics_content.php' Cross-Site Scripting (Exploit-DB entry) (opens in a new tab)
EDB-ID 28627webapps, phppublished 21 Sept 2006Verified
- BandSite CMS 1.1 - 'member_content.php' Cross-Site Scripting (Exploit-DB entry) (opens in a new tab)
EDB-ID 28628webapps, phppublished 21 Sept 2006Verified
- BandSite CMS 1.1 - 'merch_content.php' Cross-Site Scripting (Exploit-DB entry) (opens in a new tab)
EDB-ID 28629webapps, phppublished 21 Sept 2006Verified
- BandSite CMS 1.1 - 'mp3_content.php' Cross-Site Scripting (Exploit-DB entry) (opens in a new tab)
EDB-ID 28630webapps, phppublished 21 Sept 2006Verified
- BandSite CMS 1.1 - 'news_content.php' Cross-Site Scripting (Exploit-DB entry) (opens in a new tab)
EDB-ID 28631webapps, phppublished 21 Sept 2006Verified
- BandSite CMS 1.1 - 'pastshows_content.php' Cross-Site Scripting (Exploit-DB entry) (opens in a new tab)
EDB-ID 28632webapps, phppublished 21 Sept 2006Verified
- BandSite CMS 1.1 - 'photo_content.php' Cross-Site Scripting (Exploit-DB entry) (opens in a new tab)
EDB-ID 28633webapps, phppublished 21 Sept 2006Verified
- BandSite CMS 1.1 - 'releases_content.php' Cross-Site Scripting (Exploit-DB entry) (opens in a new tab)
EDB-ID 28634webapps, phppublished 21 Sept 2006Verified
- BandSite CMS 1.1 - 'reviews_content.php' Cross-Site Scripting (Exploit-DB entry) (opens in a new tab)
EDB-ID 28635webapps, phppublished 21 Sept 2006Verified
- BandSite CMS 1.1 - 'shows_content.php' Cross-Site Scripting (Exploit-DB entry) (opens in a new tab)
EDB-ID 28636webapps, phppublished 21 Sept 2006Verified
Modules, templates and exploits as listed by the Metasploit Framework (BSD-3-Clause), ProjectDiscovery's Nuclei templates (MIT) and the Exploit Database (GPLv2), read once a day. Where the data comes from
Timeline
ID reserved
By mitre
- 1 day later
· 1 day later
Published
- 18 years later
· 18 years later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| NVDNVD · Modified | 2.0 | Medium4.3 | AV:N/AC:M/Au:N/C:N/I:P/A:N |
- EPSS (exploitation in 30 days)
- 1.7% · top 23% of all CVEs (10 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 4.3.
Affected products
n/a
- affected n/a
References
4
- 21992 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
- 20137 (opens in a new tab)vdb-entryx_refsource_BIDx_transferred
- 20060921 Grayscale BandSite CMS Multiple Input Validation Vulnerabilities (opens in a new tab)mailing-listx_refsource_BUGTRAQx_transferred
- 1634 (opens in a new tab)third-party-advisoryx_refsource_SREASONx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2006-4971 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2006-4985)Record last updated .