CVE-2006-4985
Multiple cross-site scripting (XSS) vulnerabilities in Grayscale BandSite CMS allow remote attackers to inject arbitrary web script or HTML via (1) the max_file_size_purdy parameter in adminpanel/includes/helpfiles/help_mp3.php, (2) the message_text…
Does this matter?
22 public exploits are published in Exploit-DB (verified), so the technical barrier is gone even though the severity is medium and EPSS is 1.7%. Treat it as high on anything reachable from the internet.
Description
Multiple cross-site scripting (XSS) vulnerabilities in Grayscale BandSite CMS allow remote attackers to inject arbitrary web script or HTML via (1) the max_file_size_purdy parameter in adminpanel/includes/helpfiles/help_mp3.php, (2) the message_text parameter in adminpanel/includes/mailinglist/sendemail.php, (3) the this_year parameter in includes/footer.php, and the band parameter in (4) adminpanel/includes/helpfiles/help_news.php (5) adminpanel/includes/helpfiles/help_merch.php, (6) adminpanel/includes/header.php, and (7) adminpanel/login_header.php; and includes/content/ files including (8) bio_content.php, (9) gbook_content.php, (10) interview_content.php, (11) links_content.php, (12) lyrics_content.php, (13) member_content.php, (14) merch_content.php, (15) mp3_content.php, (16) news_content.php, (17) pastshows_content.php, (18) photo_content.php, (19) releases_content.php, (20) reviews_content.php, (21) shows_content.php, and (22) signgbook_content.php.
- CVSS 2.0
- 4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
- EPSS
- 1.70% probability · 77th percentile
- Public exploits
- 22 in Exploit-DB · verified · first 21 September 2006
- CISA KEV
- Not listed
- Weakness
- CWE-79
- Affected
- grayscale/bandsite cms
- Source
- cve@mitre.org
EPSS 1.7% since 26 October 2026; no change recorded yet. Points are recorded when the score first appears and whenever it moves by a percentage point or more.
Public exploits (22)
Entries in Exploit-DB that cite this CVE. Links go to the Exploit-DB page and to the file in the public repository; nothing is hosted here. A verified tick means the Exploit-DB team confirmed the exploit works against the stated version.
| EDB-ID | Title | Type | Published | Verified |
|---|---|---|---|---|
| EDB-28638source ↗ | BandSite CMS 1.1 - 'footer.php' Cross-Site Scriptingphp · HACKERS PAL | webapps | 21 September 2006 | yes |
| EDB-28637source ↗ | BandSite CMS 1.1 - 'signgbook_content.php' Cross-Site Scriptingphp · HACKERS PAL | webapps | 21 September 2006 | yes |
| EDB-28636source ↗ | BandSite CMS 1.1 - 'shows_content.php' Cross-Site Scriptingphp · HACKERS PAL | webapps | 21 September 2006 | yes |
| EDB-28635source ↗ | BandSite CMS 1.1 - 'reviews_content.php' Cross-Site Scriptingphp · HACKERS PAL | webapps | 21 September 2006 | yes |
| EDB-28634source ↗ | BandSite CMS 1.1 - 'releases_content.php' Cross-Site Scriptingphp · HACKERS PAL | webapps | 21 September 2006 | yes |
| EDB-28633source ↗ | BandSite CMS 1.1 - 'photo_content.php' Cross-Site Scriptingphp · HACKERS PAL | webapps | 21 September 2006 | yes |
| EDB-28632source ↗ | BandSite CMS 1.1 - 'pastshows_content.php' Cross-Site Scriptingphp · HACKERS PAL | webapps | 21 September 2006 | yes |
| EDB-28631source ↗ | BandSite CMS 1.1 - 'news_content.php' Cross-Site Scriptingphp · HACKERS PAL | webapps | 21 September 2006 | yes |
| EDB-28630source ↗ | BandSite CMS 1.1 - 'mp3_content.php' Cross-Site Scriptingphp · HACKERS PAL | webapps | 21 September 2006 | yes |
| EDB-28629source ↗ | BandSite CMS 1.1 - 'merch_content.php' Cross-Site Scriptingphp · HACKERS PAL | webapps | 21 September 2006 | yes |
| EDB-28628source ↗ | BandSite CMS 1.1 - 'member_content.php' Cross-Site Scriptingphp · HACKERS PAL | webapps | 21 September 2006 | yes |
| EDB-28627source ↗ | BandSite CMS 1.1 - 'lyrics_content.php' Cross-Site Scriptingphp · HACKERS PAL | webapps | 21 September 2006 | yes |
| EDB-28626source ↗ | BandSite CMS 1.1 - 'links_content.php' Cross-Site Scriptingphp · HACKERS PAL | webapps | 21 September 2006 | yes |
| EDB-28625source ↗ | BandSite CMS 1.1 - 'interview_content.php' Cross-Site Scriptingphp · HACKERS PAL | webapps | 21 September 2006 | yes |
| EDB-28624source ↗ | BandSite CMS 1.1 - 'gbook_content.php' Cross-Site Scriptingphp · HACKERS PAL | webapps | 21 September 2006 | yes |
| EDB-28623source ↗ | BandSite CMS 1.1 - 'bio_content.php' Cross-Site Scriptingphp · HACKERS PAL | webapps | 21 September 2006 | yes |
| EDB-28622source ↗ | BandSite CMS 1.1 - 'login_header.php' Cross-Site Scriptingphp · HACKERS PAL | webapps | 21 September 2006 | yes |
| EDB-28621source ↗ | BandSite CMS 1.1 - 'header.php' Cross-Site Scriptingphp · HACKERS PAL | webapps | 21 September 2006 | yes |
| EDB-28620source ↗ | BandSite CMS 1.1 - 'sendemail.php' Cross-Site Scriptingphp · HACKERS PAL | webapps | 21 September 2006 | yes |
| EDB-28619source ↗ | BandSite CMS 1.1 - 'help_mp3.php' Cross-Site Scriptingphp · HACKERS PAL | webapps | 21 September 2006 | yes |
| EDB-28618source ↗ | BandSite CMS 1.1 - 'help_merch.php' Cross-Site Scriptingphp · HACKERS PAL | webapps | 21 September 2006 | yes |
| EDB-28617source ↗ | BandSite CMS 1.1 - 'help_news.php' Cross-Site Scriptingphp · HACKERS PAL | webapps | 21 September 2006 | yes |
References
- http://secunia.com/advisories/21992
- http://securityreason.com/securityalert/1634
- http://www.securityfocus.com/archive/1/446576/100/0/threaded
- http://www.securityfocus.com/bid/20137Exploit
- http://secunia.com/advisories/21992
- http://securityreason.com/securityalert/1634
- http://www.securityfocus.com/archive/1/446576/100/0/threaded
- http://www.securityfocus.com/bid/20137Exploit
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.