CVE-2006-5985: Multiple cross-site scripting (XSS) vulnerabilities in admin/options.php in Extreme CMS 0.9, and possibly e...

Security readout for executives and security teams

This CVE describes cross-site scripting in Extreme CMS 0.9, and possibly earlier versions. If present, an attacker could inject script or HTML through options-page parameters. The public record has no CVSS score and notes unknown provenance, so urgency depends on whether this old CMS is still deployed. Exposure is likely limited to environments still running Extreme CMS 0.9 or possibly earlier, especially where admin/options.php is reachable. The bundle lists no CPEs, vendor-maintained affected-version range, or deployment context, so asset confirmation is required. Prioritize asset discovery first. This is not currently supported by known exploitation evidence, but any internet-facing legacy CMS should be treated as operational risk if still used. Mitigation focus: Inventory web assets for Extreme CMS 0.9 or earlier installations.; Check vendor or trusted archive guidance for any available update or retirement path.; Restrict access to administrative paths while exposure is assessed..

Prepared

Jun 29, 2026, 09:26 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.