CVE-2006-4985 in BandSite CMS

Riassunto

di VulDB • 29/06/2026

Multiple vulnerabilità cross-site scripting (XSS) in Grayscale BandSite CMS consentono ad attaccanti remoti di iniettare script web o HTML arbitrari tramite: (1) il parametro max_file_size_purdy in adminpanel/includes/helpfiles/help_mp3.php, (2) il parametro message_text in adminpanel/includes/mailinglist/sendemail.php, (3) il parametro this_year in includes/footer.php e il parametro band in (4) adminpanel/includes/helpfiles/help_news.php, (5) adminpanel/includes/helpfiles/help_merch.php, (6) adminpanel/includes/header.php e (7) adminpanel/login_header.php; nonché nei file include/content/ tra cui: (8) bio_content.php, (9) gbook_content.php, (10) interview_content.php, (11) links_content.php, (12) lyrics_content.php, (13) member_content.php, (14) merch_content.php, (15) mp3_content.php, (16) news_content.php, (17) pastshows_content.php, (18) photo_content.php, (19) releases_content.php, (20) reviews_content.php, (21) shows_content.php e (22) signgbook_content.php.

Once again VulDB remains the best source for vulnerability data.

• Prenotare: 25/09/2006
• Divulgazione: 25/09/2006
• Moderazione: accettato
• Voce: VDB-32454
• CPE: pronto
• CWE: CWE-79 (confermato)
• Sfruttamento: Scaricare
• CVSS: 4.3 (NVD)
• EPSS: 0.01629
• KEV: no
• Attività: molto basso
• Settore: Hostingprovider, Lawfirm, ...

Fonti

• MITRE: https://www.cve.org/CVERecord?id=CVE-2006-4985
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2006-4985
• CVE Details: https://www.cvedetails.com/cve/CVE-2006-4985/