CVE-2012-1664

The provided text describes SQL injection and XSS vulnerabilities in osCMax 2.5.0, with an example XSS payload. It lacks executable exploit code but outlines attack vectors.

The provided text describes multiple SQL injection and XSS vulnerabilities in osCMax 2.5.0, with example URLs demonstrating XSS payloads. No actual exploit code is present, only a vulnerability description and proof-of-concept URLs.

The provided text describes a cross-site scripting (XSS) vulnerability in osCMax 2.5.0, where unsanitized user input in the 'status' parameter of 'stats_monthly_sales.php' allows execution of arbitrary JavaScript code. The example demonstrates a basic XSS payload to steal cookies.

The provided text describes a vulnerability in osCMax 2.5.0, specifically SQL injection and XSS vulnerabilities due to insufficient input sanitization. It includes an example XSS payload but lacks executable exploit code.

The provided text describes a cross-site scripting (XSS) vulnerability in osCMax 2.5.0, where user-supplied input is not sufficiently sanitized. The example demonstrates an XSS payload injected via the 'pageTitle' parameter in the admin interface.

This exploit demonstrates a cross-site scripting (XSS) vulnerability in osCMax 2.5.0 by injecting a malicious script into the username field of a login form. The script executes when processed, potentially stealing cookie-based authentication credentials.

The provided text describes a cross-site scripting (XSS) vulnerability in osCMax 2.5.0, where user-supplied input is not sufficiently sanitized. The example URL demonstrates an XSS payload that could steal cookie-based authentication credentials.

This exploit demonstrates multiple cross-site scripting (XSS) vulnerabilities in osCMax 2.5.0 by injecting malicious scripts into form fields. The PoC shows how unsanitized input can lead to arbitrary JavaScript execution in the context of the admin panel.

The provided text describes a cross-site scripting (XSS) vulnerability in osCMax 2.5.0, where unsanitized user input in the 'zID' parameter allows execution of arbitrary JavaScript. The example demonstrates a basic XSS payload to steal cookies.