https://www.exploit-db.com/exploits/23859
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200412-744

NewsManagerLite2.5版本存在多个跨站脚本（XSS）漏洞。远程攻击者借助(1)comment_add.asp的email参数，(2)search.asp的search参数，或者(3)category_news_headline.asp的n参数注入任意的web脚本或者HTML。

source: http://www.securityfocus.com/bid/9935/info
  
Multiple vulnerabilities have been identified in the application that may allow an attacker to carry out SQL injection, cross-site scripting, and account hijacking attacks.
  
The issues exist in the 'comment_add.asp', 'search.asp', 'category_news_headline.asp', 'more.asp', 'category_news.asp', and 'ews_sort.asp' scripts. Further more a cookie account hijacking issue was also discovered in the application that may allow a remote attacker to gain administrative access to application's administrative interface.
  
News Manager Lite 2.5 is reported to be affected by these issues, however, other versions may be affected as well.

http://www.example.com/category_news_headline.asp?ID=2&n=[XSS]

来源:XF
名称:news-manager-xss(15548)
链接:http://xforce.iss.net/xforce/xfdb/15548
来源:BID
名称:9935
链接:http://www.securityfocus.com/bid/9935
来源:OSVDB
名称:4494
链接:http://www.osvdb.org/4494
来源:OSVDB
名称:4493
链接:http://www.osvdb.org/4493
来源:OSVDB
名称:4492
链接:http://www.osvdb.org/4492
来源:SECTRACK
名称:1009507
链接:http://securitytracker.com/id?1009507
来源:SECUNIA
名称:11180
链接:http://secunia.com/advisories/11180
来源:BUGTRAQ
名称:20040322VulnerabilitiesinNewsManagerLite2.5&NewsManagerLiteadministration;
链接:http://marc.theaimsgroup.com/?l=bugtraq&m;=107999733503496&w;=2