CVE-2006-4985
Multiple cross-site scripting (XSS) vulnerabilities in Grayscale BandSite CMS allow remote...
Multiple cross-site scripting (XSS) vulnerabilities in Grayscale BandSite CMS allow remote attackers to inject arbitrary web script or HTML via (1) the max_file_size_purdy parameter in adminpanel/includes/helpfiles/help_mp3.php, (2) the message_text parameter in adminpanel/includes/mailinglist/sendemail.php, (3) the this_year parameter in includes/footer.php, and the band parameter in (4) adminpanel/includes/helpfiles/help_news.php (5) adminpanel/includes/helpfiles/help_merch.php, (6) adminpanel/includes/header.php, and (7) adminpanel/login_header.php; and includes/content/ files including (8) bio_content.php, (9) gbook_content.php, (10) interview_content.php, (11) links_content.php, (12) lyrics_content.php, (13) member_content.php, (14) merch_content.php, (15) mp3_content.php, (16) news_content.php, (17) pastshows_content.php, (18) photo_content.php, (19) releases_content.php, (20) reviews_content.php, (21) shows_content.php, and (22) signgbook_content.php.
Exploit likelihood
What each source reports
NVD Score used
Multiple cross-site scripting (XSS) vulnerabilities in Grayscale BandSite CMS allow remote attackers to inject arbitrary web script or HTML via (1) the max_file_size_purdy parameter in adminpanel/includes/helpfiles/help_mp3.php, (2) the message_text parameter in adminpanel/includes/mailinglist/sendemail.php, (3) the this_year parameter in includes/footer.php, and the band parameter in (4) adminpanel/includes/helpfiles/help_news.php (5) adminpanel/includes/helpfiles/help_merch.php, (6) adminpanel/includes/header.php, and (7) adminpanel/login_header.php; and includes/content/ files including (8) bio_content.php, (9) gbook_content.php, (10) interview_content.php, (11) links_content.php, (12) lyrics_content.php, (13) member_content.php, (14) merch_content.php, (15) mp3_content.php, (16) news_content.php, (17) pastshows_content.php, (18) photo_content.php, (19) releases_content.php, (20) reviews_content.php, (21) shows_content.php, and (22) signgbook_content.php.
- Record
CVE-2006-4985- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
Multiple cross-site scripting (XSS) vulnerabilities in Grayscale BandSite CMS allow remote attackers to inject arbitrary web script or HTML via (1) the max_file_size_purdy parameter in adminpanel/includes/helpfiles/help_mp3.php, (2) the message_text parameter in adminpanel/includes/mailinglist/sendemail.php, (3) the this_year parameter in includes/footer.php, and the band parameter in (4) adminpanel/includes/helpfiles/help_news.php (5) adminpanel/includes/helpfiles/help_merch.php, (6) adminpanel/includes/header.php, and (7) adminpanel/login_header.php; and includes/content/ files including (8) bio_content.php, (9) gbook_content.php, (10) interview_content.php, (11) links_content.php, (12) lyrics_content.php, (13) member_content.php, (14) merch_content.php, (15) mp3_content.php, (16) news_content.php, (17) pastshows_content.php, (18) photo_content.php, (19) releases_content.php, (20) reviews_content.php, (21) shows_content.php, and (22) signgbook_content.php.
- Record
CVE-2006-4985- Updated
- 2026-11-02
EUVDEUVD-2006-4971 No score
Multiple cross-site scripting (XSS) vulnerabilities in Grayscale BandSite CMS allow remote attackers to inject arbitrary web script or HTML via (1) the max_file_size_purdy parameter in adminpanel/includes/helpfiles/help_mp3.php, (2) the message_text parameter in adminpanel/includes/mailinglist/sendemail.php, (3) the this_year parameter in includes/footer.php, and the band parameter in (4) adminpanel/includes/helpfiles/help_news.php (5) adminpanel/includes/helpfiles/help_merch.php, (6) adminpanel/includes/header.php, and (7) adminpanel/login_header.php; and includes/content/ files including (8) bio_content.php, (9) gbook_content.php, (10) interview_content.php, (11) links_content.php, (12) lyrics_content.php, (13) member_content.php, (14) merch_content.php, (15) mp3_content.php, (16) news_content.php, (17) pastshows_content.php, (18) photo_content.php, (19) releases_content.php, (20) reviews_content.php, (21) shows_content.php, and (22) signgbook_content.php.
- Record
EUVD-2006-4971- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-7qv9-7c8f-pg23 No score
Multiple cross-site scripting (XSS) vulnerabilities in Grayscale BandSite CMS allow remote...
Multiple cross-site scripting (XSS) vulnerabilities in Grayscale BandSite CMS allow remote attackers to inject arbitrary web script or HTML via (1) the max_file_size_purdy parameter in adminpanel/includes/helpfiles/help_mp3.php, (2) the message_text parameter in adminpanel/includes/mailinglist/sendemail.php, (3) the this_year parameter in includes/footer.php, and the band parameter in (4) adminpanel/includes/helpfiles/help_news.php (5) adminpanel/includes/helpfiles/help_merch.php, (6) adminpanel/includes/header.php, and (7) adminpanel/login_header.php; and includes/content/ files including (8) bio_content.php, (9) gbook_content.php, (10) interview_content.php, (11) links_content.php, (12) lyrics_content.php, (13) member_content.php, (14) merch_content.php, (15) mp3_content.php, (16) news_content.php, (17) pastshows_content.php, (18) photo_content.php, (19) releases_content.php, (20) reviews_content.php, (21) shows_content.php, and (22) signgbook_content.php.
- Record
GHSA-7qv9-7c8f-pg23- Weakness
- CWE-79
- Updated
- 2026-11-02
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | BandSite CMS 1.1 - 'help_news.php' Cross-Site Scripting | 2006-09-21 |
| Exploit-DB | BandSite CMS 1.1 - 'help_merch.php' Cross-Site Scripting | 2006-09-21 |
| Exploit-DB | BandSite CMS 1.1 - 'help_mp3.php' Cross-Site Scripting | 2006-09-21 |
| Exploit-DB | BandSite CMS 1.1 - 'sendemail.php' Cross-Site Scripting | 2006-09-21 |
| Exploit-DB | BandSite CMS 1.1 - 'header.php' Cross-Site Scripting | 2006-09-21 |
| Exploit-DB | BandSite CMS 1.1 - 'login_header.php' Cross-Site Scripting | 2006-09-21 |
| Exploit-DB | BandSite CMS 1.1 - 'bio_content.php' Cross-Site Scripting | 2006-09-21 |
| Exploit-DB | BandSite CMS 1.1 - 'gbook_content.php' Cross-Site Scripting | 2006-09-21 |
| Exploit-DB | BandSite CMS 1.1 - 'interview_content.php' Cross-Site Scripting | 2006-09-21 |
| Exploit-DB | BandSite CMS 1.1 - 'links_content.php' Cross-Site Scripting | 2006-09-21 |
Show 12 moreShow less
| Source | Link | Date |
|---|---|---|
| Exploit-DB | BandSite CMS 1.1 - 'lyrics_content.php' Cross-Site Scripting | 2006-09-21 |
| Exploit-DB | BandSite CMS 1.1 - 'member_content.php' Cross-Site Scripting | 2006-09-21 |
| Exploit-DB | BandSite CMS 1.1 - 'merch_content.php' Cross-Site Scripting | 2006-09-21 |
| Exploit-DB | BandSite CMS 1.1 - 'mp3_content.php' Cross-Site Scripting | 2006-09-21 |
| Exploit-DB | BandSite CMS 1.1 - 'news_content.php' Cross-Site Scripting | 2006-09-21 |
| Exploit-DB | BandSite CMS 1.1 - 'pastshows_content.php' Cross-Site Scripting | 2006-09-21 |
| Exploit-DB | BandSite CMS 1.1 - 'photo_content.php' Cross-Site Scripting | 2006-09-21 |
| Exploit-DB | BandSite CMS 1.1 - 'releases_content.php' Cross-Site Scripting | 2006-09-21 |
| Exploit-DB | BandSite CMS 1.1 - 'reviews_content.php' Cross-Site Scripting | 2006-09-21 |
| Exploit-DB | BandSite CMS 1.1 - 'shows_content.php' Cross-Site Scripting | 2006-09-21 |
| Exploit-DB | BandSite CMS 1.1 - 'signgbook_content.php' Cross-Site Scripting | 2006-09-21 |
| Exploit-DB | BandSite CMS 1.1 - 'footer.php' Cross-Site Scripting | 2006-09-21 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2006-4985 is a medium vulnerability (CVSS 4.3) in Grayscale Bandsite Cms, published September 26, 2006. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 1.70%, the 77th percentile. No source names a fixed version.