{"id":"CVE-2006-4985","url":"https://www.cyber-defence.io/tools/cve/CVE-2006-4985","generatedAt":"2026-10-27T20:40:29.614Z","title":"Multiple cross-site scripting (XSS) vulnerabilities in Grayscale BandSite CMS allow remote attackers to inject arbitrary web script or HTML via (1) the max_file_size_purdy parameter in adminpanel/includes/helpfiles/help_mp3.php, (2) the message_text…","description":"Multiple cross-site scripting (XSS) vulnerabilities in Grayscale BandSite CMS allow remote attackers to inject arbitrary web script or HTML via (1) the max_file_size_purdy parameter in adminpanel/includes/helpfiles/help_mp3.php, (2) the message_text parameter in adminpanel/includes/mailinglist/sendemail.php, (3) the this_year parameter in includes/footer.php, and the band parameter in (4) adminpanel/includes/helpfiles/help_news.php (5) adminpanel/includes/helpfiles/help_merch.php, (6) adminpanel/includes/header.php, and (7) adminpanel/login_header.php; and includes/content/ files including (8) bio_content.php, (9) gbook_content.php, (10) interview_content.php, (11) links_content.php, (12) lyrics_content.php, (13) member_content.php, (14) merch_content.php, (15) mp3_content.php, (16) news_content.php, (17) pastshows_content.php, (18) photo_content.php, (19) releases_content.php, (20) reviews_content.php, (21) shows_content.php, and (22) signgbook_content.php.","published":"2006-09-26T02:07:00.000Z","lastModified":"2026-06-16T22:30:15.000Z","status":"Modified","sourceIdentifier":"cve@mitre.org","cvss":{"version":"2.0","score":4.3,"severity":"MEDIUM","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N"},"cwe":["CWE-79"],"affected":["grayscale/bandsite cms"],"epss":{"score":0.01704,"percentile":0.77106,"date":"2026-10-26","history":[]},"kev":{"listed":false},"exploits":{"count":22,"verified":true,"firstPublished":"2006-09-21","source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[{"edbId":28638,"kind":"exploit","title":"BandSite CMS 1.1 - 'footer.php' Cross-Site Scripting","url":"https://www.exploit-db.com/exploits/28638","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/php/webapps/28638.txt","file":"exploits/php/webapps/28638.txt","published":"2006-09-21","added":"2006-09-21","updated":"2016-12-21","author":"HACKERS PAL","type":"webapps","platform":"php","port":null,"verified":true,"codes":["CVE-2006-4985","OSVDB-29340"],"tags":null,"aliases":null,"applicationUrl":"http://www.exploit-db.comgrayscale_cms_ver1x1x0.zip","screenshotUrl":null,"referenceUrl":"https://www.securityfocus.com/bid/20137/info"},{"edbId":28637,"kind":"exploit","title":"BandSite CMS 1.1 - 'signgbook_content.php' Cross-Site Scripting","url":"https://www.exploit-db.com/exploits/28637","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/php/webapps/28637.txt","file":"exploits/php/webapps/28637.txt","published":"2006-09-21","added":"2006-09-21","updated":"2016-12-21","author":"HACKERS PAL","type":"webapps","platform":"php","port":null,"verified":true,"codes":["CVE-2006-4985","OSVDB-29339"],"tags":null,"aliases":null,"applicationUrl":"http://www.exploit-db.comgrayscale_cms_ver1x1x0.zip","screenshotUrl":null,"referenceUrl":"https://www.securityfocus.com/bid/20137/info"},{"edbId":28636,"kind":"exploit","title":"BandSite CMS 1.1 - 'shows_content.php' Cross-Site Scripting","url":"https://www.exploit-db.com/exploits/28636","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/php/webapps/28636.txt","file":"exploits/php/webapps/28636.txt","published":"2006-09-21","added":"2006-09-21","updated":"2016-12-21","author":"HACKERS PAL","type":"webapps","platform":"php","port":null,"verified":true,"codes":["CVE-2006-4985","OSVDB-29338"],"tags":null,"aliases":null,"applicationUrl":"http://www.exploit-db.comgrayscale_cms_ver1x1x0.zip","screenshotUrl":null,"referenceUrl":"https://www.securityfocus.com/bid/20137/info"},{"edbId":28635,"kind":"exploit","title":"BandSite CMS 1.1 - 'reviews_content.php' Cross-Site Scripting","url":"https://www.exploit-db.com/exploits/28635","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/php/webapps/28635.txt","file":"exploits/php/webapps/28635.txt","published":"2006-09-21","added":"2006-09-21","updated":"2016-12-21","author":"HACKERS PAL","type":"webapps","platform":"php","port":null,"verified":true,"codes":["CVE-2006-4985","OSVDB-29337"],"tags":null,"aliases":null,"applicationUrl":"http://www.exploit-db.comgrayscale_cms_ver1x1x0.zip","screenshotUrl":null,"referenceUrl":"https://www.securityfocus.com/bid/20137/info"},{"edbId":28634,"kind":"exploit","title":"BandSite CMS 1.1 - 'releases_content.php' Cross-Site Scripting","url":"https://www.exploit-db.com/exploits/28634","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/php/webapps/28634.txt","file":"exploits/php/webapps/28634.txt","published":"2006-09-21","added":"2006-09-21","updated":"2016-12-21","author":"HACKERS PAL","type":"webapps","platform":"php","port":null,"verified":true,"codes":["CVE-2006-4985","OSVDB-29336"],"tags":null,"aliases":null,"applicationUrl":"http://www.exploit-db.comgrayscale_cms_ver1x1x0.zip","screenshotUrl":null,"referenceUrl":"https://www.securityfocus.com/bid/20137/info"},{"edbId":28633,"kind":"exploit","title":"BandSite CMS 1.1 - 'photo_content.php' Cross-Site Scripting","url":"https://www.exploit-db.com/exploits/28633","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/php/webapps/28633.txt","file":"exploits/php/webapps/28633.txt","published":"2006-09-21","added":"2006-09-21","updated":"2016-12-21","author":"HACKERS PAL","type":"webapps","platform":"php","port":null,"verified":true,"codes":["CVE-2006-4985","OSVDB-29335"],"tags":null,"aliases":null,"applicationUrl":"http://www.exploit-db.comgrayscale_cms_ver1x1x0.zip","screenshotUrl":null,"referenceUrl":"https://www.securityfocus.com/bid/20137/info"},{"edbId":28632,"kind":"exploit","title":"BandSite CMS 1.1 - 'pastshows_content.php' Cross-Site Scripting","url":"https://www.exploit-db.com/exploits/28632","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/php/webapps/28632.txt","file":"exploits/php/webapps/28632.txt","published":"2006-09-21","added":"2006-09-21","updated":"2016-12-21","author":"HACKERS PAL","type":"webapps","platform":"php","port":null,"verified":true,"codes":["CVE-2006-4985","OSVDB-29334"],"tags":null,"aliases":null,"applicationUrl":"http://www.exploit-db.comgrayscale_cms_ver1x1x0.zip","screenshotUrl":null,"referenceUrl":"https://www.securityfocus.com/bid/20137/info"},{"edbId":28631,"kind":"exploit","title":"BandSite CMS 1.1 - 'news_content.php' Cross-Site Scripting","url":"https://www.exploit-db.com/exploits/28631","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/php/webapps/28631.txt","file":"exploits/php/webapps/28631.txt","published":"2006-09-21","added":"2006-09-21","updated":"2016-12-21","author":"HACKERS PAL","type":"webapps","platform":"php","port":null,"verified":true,"codes":["CVE-2006-4985","OSVDB-29333"],"tags":null,"aliases":null,"applicationUrl":"http://www.exploit-db.comgrayscale_cms_ver1x1x0.zip","screenshotUrl":null,"referenceUrl":"https://www.securityfocus.com/bid/20137/info"},{"edbId":28630,"kind":"exploit","title":"BandSite CMS 1.1 - 'mp3_content.php' Cross-Site Scripting","url":"https://www.exploit-db.com/exploits/28630","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/php/webapps/28630.txt","file":"exploits/php/webapps/28630.txt","published":"2006-09-21","added":"2006-09-21","updated":"2016-12-21","author":"HACKERS PAL","type":"webapps","platform":"php","port":null,"verified":true,"codes":["CVE-2006-4985","OSVDB-29332"],"tags":null,"aliases":null,"applicationUrl":"http://www.exploit-db.comgrayscale_cms_ver1x1x0.zip","screenshotUrl":null,"referenceUrl":"https://www.securityfocus.com/bid/20137/info"},{"edbId":28629,"kind":"exploit","title":"BandSite CMS 1.1 - 'merch_content.php' Cross-Site Scripting","url":"https://www.exploit-db.com/exploits/28629","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/php/webapps/28629.txt","file":"exploits/php/webapps/28629.txt","published":"2006-09-21","added":"2006-09-21","updated":"2016-12-21","author":"HACKERS PAL","type":"webapps","platform":"php","port":null,"verified":true,"codes":["CVE-2006-4985","OSVDB-29331"],"tags":null,"aliases":null,"applicationUrl":"http://www.exploit-db.comgrayscale_cms_ver1x1x0.zip","screenshotUrl":null,"referenceUrl":"https://www.securityfocus.com/bid/20137/info"},{"edbId":28628,"kind":"exploit","title":"BandSite CMS 1.1 - 'member_content.php' Cross-Site Scripting","url":"https://www.exploit-db.com/exploits/28628","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/php/webapps/28628.txt","file":"exploits/php/webapps/28628.txt","published":"2006-09-21","added":"2006-09-21","updated":"2016-12-21","author":"HACKERS PAL","type":"webapps","platform":"php","port":null,"verified":true,"codes":["CVE-2006-4985","OSVDB-29330"],"tags":null,"aliases":null,"applicationUrl":"http://www.exploit-db.comgrayscale_cms_ver1x1x0.zip","screenshotUrl":null,"referenceUrl":"https://www.securityfocus.com/bid/20137/info"},{"edbId":28627,"kind":"exploit","title":"BandSite CMS 1.1 - 'lyrics_content.php' Cross-Site Scripting","url":"https://www.exploit-db.com/exploits/28627","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/php/webapps/28627.txt","file":"exploits/php/webapps/28627.txt","published":"2006-09-21","added":"2006-09-21","updated":"2016-12-21","author":"HACKERS PAL","type":"webapps","platform":"php","port":null,"verified":true,"codes":["CVE-2006-4985","OSVDB-29329"],"tags":null,"aliases":null,"applicationUrl":"http://www.exploit-db.comgrayscale_cms_ver1x1x0.zip","screenshotUrl":null,"referenceUrl":"https://www.securityfocus.com/bid/20137/info"},{"edbId":28626,"kind":"exploit","title":"BandSite CMS 1.1 - 'links_content.php' Cross-Site Scripting","url":"https://www.exploit-db.com/exploits/28626","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/php/webapps/28626.txt","file":"exploits/php/webapps/28626.txt","published":"2006-09-21","added":"2006-09-21","updated":"2016-12-21","author":"HACKERS PAL","type":"webapps","platform":"php","port":null,"verified":true,"codes":["CVE-2006-4985","OSVDB-29328"],"tags":null,"aliases":null,"applicationUrl":"http://www.exploit-db.comgrayscale_cms_ver1x1x0.zip","screenshotUrl":null,"referenceUrl":"https://www.securityfocus.com/bid/20137/info"},{"edbId":28625,"kind":"exploit","title":"BandSite CMS 1.1 - 'interview_content.php' Cross-Site Scripting","url":"https://www.exploit-db.com/exploits/28625","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/php/webapps/28625.txt","file":"exploits/php/webapps/28625.txt","published":"2006-09-21","added":"2006-09-21","updated":"2016-12-21","author":"HACKERS PAL","type":"webapps","platform":"php","port":null,"verified":true,"codes":["CVE-2006-4985","OSVDB-29327"],"tags":null,"aliases":null,"applicationUrl":"http://www.exploit-db.comgrayscale_cms_ver1x1x0.zip","screenshotUrl":null,"referenceUrl":"https://www.securityfocus.com/bid/20137/info"},{"edbId":28624,"kind":"exploit","title":"BandSite CMS 1.1 - 'gbook_content.php' Cross-Site Scripting","url":"https://www.exploit-db.com/exploits/28624","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/php/webapps/28624.txt","file":"exploits/php/webapps/28624.txt","published":"2006-09-21","added":"2006-09-21","updated":"2016-12-21","author":"HACKERS PAL","type":"webapps","platform":"php","port":null,"verified":true,"codes":["CVE-2006-4985","OSVDB-29326"],"tags":null,"aliases":null,"applicationUrl":"http://www.exploit-db.comgrayscale_cms_ver1x1x0.zip","screenshotUrl":null,"referenceUrl":"https://www.securityfocus.com/bid/20137/info"},{"edbId":28623,"kind":"exploit","title":"BandSite CMS 1.1 - 'bio_content.php' Cross-Site Scripting","url":"https://www.exploit-db.com/exploits/28623","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/php/webapps/28623.txt","file":"exploits/php/webapps/28623.txt","published":"2006-09-21","added":"2006-09-21","updated":"2016-12-21","author":"HACKERS PAL","type":"webapps","platform":"php","port":null,"verified":true,"codes":["CVE-2006-4985","OSVDB-29325"],"tags":null,"aliases":null,"applicationUrl":"http://www.exploit-db.comgrayscale_cms_ver1x1x0.zip","screenshotUrl":null,"referenceUrl":"https://www.securityfocus.com/bid/20137/info"},{"edbId":28622,"kind":"exploit","title":"BandSite CMS 1.1 - 'login_header.php' Cross-Site Scripting","url":"https://www.exploit-db.com/exploits/28622","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/php/webapps/28622.txt","file":"exploits/php/webapps/28622.txt","published":"2006-09-21","added":"2006-09-21","updated":"2016-12-21","author":"HACKERS PAL","type":"webapps","platform":"php","port":null,"verified":true,"codes":["CVE-2006-4985","OSVDB-29324"],"tags":null,"aliases":null,"applicationUrl":"http://www.exploit-db.comgrayscale_cms_ver1x1x0.zip","screenshotUrl":null,"referenceUrl":"https://www.securityfocus.com/bid/20137/info"},{"edbId":28621,"kind":"exploit","title":"BandSite CMS 1.1 - 'header.php' Cross-Site Scripting","url":"https://www.exploit-db.com/exploits/28621","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/php/webapps/28621.txt","file":"exploits/php/webapps/28621.txt","published":"2006-09-21","added":"2006-09-21","updated":"2016-12-21","author":"HACKERS PAL","type":"webapps","platform":"php","port":null,"verified":true,"codes":["CVE-2006-4985","OSVDB-29323"],"tags":null,"aliases":null,"applicationUrl":"http://www.exploit-db.comgrayscale_cms_ver1x1x0.zip","screenshotUrl":null,"referenceUrl":"https://www.securityfocus.com/bid/20137/info"},{"edbId":28620,"kind":"exploit","title":"BandSite CMS 1.1 - 'sendemail.php' Cross-Site Scripting","url":"https://www.exploit-db.com/exploits/28620","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/php/webapps/28620.txt","file":"exploits/php/webapps/28620.txt","published":"2006-09-21","added":"2006-09-21","updated":"2016-12-21","author":"HACKERS PAL","type":"webapps","platform":"php","port":null,"verified":true,"codes":["CVE-2006-4985","OSVDB-29322"],"tags":null,"aliases":null,"applicationUrl":"http://www.exploit-db.comgrayscale_cms_ver1x1x0.zip","screenshotUrl":null,"referenceUrl":"https://www.securityfocus.com/bid/20137/info"},{"edbId":28619,"kind":"exploit","title":"BandSite CMS 1.1 - 'help_mp3.php' Cross-Site Scripting","url":"https://www.exploit-db.com/exploits/28619","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/php/webapps/28619.txt","file":"exploits/php/webapps/28619.txt","published":"2006-09-21","added":"2006-09-21","updated":"2016-12-21","author":"HACKERS PAL","type":"webapps","platform":"php","port":null,"verified":true,"codes":["CVE-2006-4985","OSVDB-29321"],"tags":null,"aliases":null,"applicationUrl":"http://www.exploit-db.comgrayscale_cms_ver1x1x0.zip","screenshotUrl":null,"referenceUrl":"https://www.securityfocus.com/bid/20137/info"},{"edbId":28618,"kind":"exploit","title":"BandSite CMS 1.1 - 'help_merch.php' Cross-Site Scripting","url":"https://www.exploit-db.com/exploits/28618","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/php/webapps/28618.txt","file":"exploits/php/webapps/28618.txt","published":"2006-09-21","added":"2006-09-21","updated":"2016-12-21","author":"HACKERS PAL","type":"webapps","platform":"php","port":null,"verified":true,"codes":["CVE-2006-4985","OSVDB-29320"],"tags":null,"aliases":null,"applicationUrl":"http://www.exploit-db.comgrayscale_cms_ver1x1x0.zip","screenshotUrl":null,"referenceUrl":"https://www.securityfocus.com/bid/20137/info"},{"edbId":28617,"kind":"exploit","title":"BandSite CMS 1.1 - 'help_news.php' Cross-Site Scripting","url":"https://www.exploit-db.com/exploits/28617","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/php/webapps/28617.txt","file":"exploits/php/webapps/28617.txt","published":"2006-09-21","added":"2006-09-21","updated":"2016-12-21","author":"HACKERS PAL","type":"webapps","platform":"php","port":null,"verified":true,"codes":["CVE-2006-4985","OSVDB-29319"],"tags":null,"aliases":null,"applicationUrl":"http://www.exploit-db.comgrayscale_cms_ver1x1x0.zip","screenshotUrl":null,"referenceUrl":"https://www.securityfocus.com/bid/20137/info"}]},"verdict":{"level":"high","text":"22 public exploits are published in Exploit-DB (verified), so the technical barrier is gone even though the severity is medium and EPSS is 1.7%. Treat it as high on anything reachable from the internet."},"changes":[],"references":[{"url":"http://secunia.com/advisories/21992","source":"cve@mitre.org"},{"url":"http://securityreason.com/securityalert/1634","source":"cve@mitre.org"},{"url":"http://www.securityfocus.com/archive/1/446576/100/0/threaded","source":"cve@mitre.org"},{"url":"http://www.securityfocus.com/bid/20137","tags":["Exploit"],"source":"cve@mitre.org"},{"url":"http://secunia.com/advisories/21992","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://securityreason.com/securityalert/1634","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.securityfocus.com/archive/1/446576/100/0/threaded","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.securityfocus.com/bid/20137","tags":["Exploit"],"source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2006-4985","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}