CVE-2005-4491 json
Multiple cross-site scripting (XSS) vulnerabilities in Sitekit CMS 6.6 and earlier allow remote attackers to inject arbitrary web script or…
published 2005-12-22 20 y ago modified 2026-06-16 4 mo ago also EUVD-2005-4486
- cvss
- 4.3
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 2.0%
- EPSS 2.0% chance of exploitation in 30 days, percentile 81%
- public exploits
- 3
- Exploit-DB
Summary
Multiple cross-site scripting (XSS) vulnerabilities in Sitekit CMS 6.6 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) query string, (2) textonly, (3) locID, and (4) lang parameters to (a) Default.aspx, and the (6) ClickFrom parameter to (b) Request-call-back.html and (c) registration-form.html. NOTE: the vendor states "This issue was resolved by a minor update to Sitekit CMS v6.6, sanitising the html code and eradicating related security issues."
Patch / fix
- osvdb.org/22073 patch
- osvdb.org/22071 patch
- osvdb.org/22072 patch
Timeline
- First public exploit (EDB-26949)
- Published
Exploit prediction
2.03% chance of exploitation in the next 30 days, higher than 81% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- EDB-26949 Sitekit CMS 6.6 - 'registration-form.html?ClickFrom' Cross-Site Scripting webapps, 2005-12-21
- EDB-26948 Sitekit CMS 6.6 - 'Request-call-back.html?ClickFrom' Cross-Site Scripting webapps, 2005-12-21
- EDB-26947 Sitekit CMS 6.6 - 'Default.aspx' Multiple Cross-Site Scripting Vulnerabilities webapps, 2005-12-21
- osvdb.org http://www.osvdb.org/22073 referenced PoC, tagged "exploit" by a source, unverified
- osvdb.org http://www.osvdb.org/22071 referenced PoC, tagged "exploit" by a source, unverified
- osvdb.org http://www.osvdb.org/22072 referenced PoC, tagged "exploit" by a source, unverified
- securityfocus.com http://www.securityfocus.com/bid/16016 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 4.3 | AV:N/AC:M/Au:N/C:N/I:P/A:N |
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
-
osvdb.org
/22073
vdb-entry, exploit, patch
-
osvdb.org
/22071
vdb-entry, exploit, patch
-
osvdb.org
/22072
vdb-entry, exploit, patch
-
securityfocus.com
/bid/16016
vdb-entry, exploit
-
vupen.com
/english/advisories/2005/3050
vdb-entry, vendor-advisory
- pridels0.blogspot.com /2005/12/sitekit-cms-multiple-xss-vuln.html
-
attrition.org
/pipermail/vim/2006-March/000611.html
mailing-list
Sources
- CVE List CVE-2005-4491
- NVD CVE-2005-4491
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.