deardaniel/secdata-raw huggingface dataset:
Metasploit Module: Total.js CMS 12 Widget JavaScript Code Injection
Type: exploit
Path: modules/exploits/multi/http/totaljs_cms_widget_exec.rb
Platform: linux
Disclosure date: 2019-08-30
References: CVE-2019-15954, URL-https://seclists.org/fulldisclosure/2019/Sep/5, URL-https://github.com/beerpwn/CVE/blob/master/Totaljs_disclosure_report/report_final.pdf

Description:
This module exploits a vulnerability in Total.js CMS. The issue is that a user with
          admin permission can embed a malicious JavaScript payload in a widget, which is
          evaluated server side, and gain remote code execution.

Check method (fingerprinting):
code = CheckCode::Safe('The target is not vulnerable')

    res = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, 'admin', 'widgets')
    })

    unless res
      vprint_error('Connection timed out')
      return CheckCode::Unknown('Could not connect to the target')
    end

    # If the admin's login page is visited too many times, we will start getting
    # a 401 (unauthorized response). In that case, we only have a header to work
    # with.
    if res.headers['X-Powered-By'].to_s == 'Total.js'
      code = CheckCode::Detected('The target application was detected but requires authentication')
    end

    # If we are here, then that means we can still see the login page.
    # Let's see if we can extract a version.
    html = res.get_html_document
    element = html.at('title')
    return code unless element.respond_to?(:text)

    title = element.text.scan(/CMS v([\d\.]+)/).flatten.first
    return code unless title

    version = Rex::Version.new(title)

    if version <= Rex::Version.new('12')
      # If we are able to check the version, we could try the default cred and attempt
      # to execute malicious code and see how the application responds. However, this
      # seems to a bit too aggressive so I'll leave that to the exploit part.
      return CheckCode::Appears('The target is running a vulnerable version')
    end

    CheckCode::Safe('The target version is not vulnerable')
  end
Metasploit Module: Ruby On Rails DoubleTap Development Mode secret_key_base Vulnerability
Type: exploit
Path: modules/exploits/multi/http/rails_double_tap.rb
Platform: linux
Disclosure date: 2019-03-13
References: CVE-2019-5420, URL-https://hackerone.com/reports/473888, URL-https://github.com/mpgn/Rails-doubletap-RCE, URL-https://groups.google.com/forum/#!searchin/rubyonrails-security/CVE-2019-5420/rubyonrails-security/IsQKvDqZdKw/UYgRCJz2CgAJ, URL-https://www.zerodayinitiative.com/blog/2019/6/20/remote-code-execution-via-ruby-on-rails-active-storage-insecure-deserialization

Description:
This module exploits a vulnerability in Ruby on Rails. In development mode, a Rails
          application would use its name as the secret_key_base, and can be easily extracted by
          visiting an invalid resource for a path. As a result, this allows a remote user to
          create and deliver a signed serialized payload, load it by the application, and gain
          remote code execution.

Check method (fingerprinting):
check_code = CheckCode::Safe('The target is not vulnerable')
    app_name = get_application_name
    check_code = CheckCode::Appears('The target appears to be vulnerable') unless app_name.blank?
    test_payload = %Q|puts 1|
    rails_payload = generate_rails_payload(app_name, test_payload)
    result = send_serialized_payload(rails_payload)
    check_code = CheckCode::Vulnerable('The target is vulnerable') if result
    check_code
  rescue Msf::Exploit::Failed => e
    vprint_error(e.message)
    return check_code if e.message.to_s.include? NO_RAILS_ROOT_MSG

    CheckCode::Unknown('An error occurred while checking the target')
  end

  # Returns information about Rails.root if we retrieve an invalid path under rails.
Metasploit Module: Glossword v1.8.8 - 1.8.12 Arbitrary File Upload Vulnerability
Type: exploit
Path: modules/exploits/multi/http/glossword_upload_exec.rb
Platform: php
Disclosure date: 2013-02-05
References: CVE-2013-10067, EDB-24456, OSVDB-89960

Description:
This module exploits a file upload vulnerability in Glossword
          versions 1.8.8 to 1.8.12 when run as a standalone application.
          This application has an upload feature that allows an authenticated user
          with administrator roles to upload arbitrary files to the 'gw_temp/a/'
          directory.

Check method (fingerprinting):
base = target_uri.path
    peer = "#{rhost}:#{rport}"
    user = datastore['USERNAME']
    pass = datastore['PASSWORD']

    # login
    print_status("Authenticating as user '#{user}'")
    begin
      res = login(base, user, pass)
      if res
        if res.code == 200
          vprint_error("Authentication failed")
          return Exploit::CheckCode::Unknown('Could not authenticate to the target')
        elsif res.code == 301 and res.get_cookies =~ /sid([\da-f]+)=([\da-f]{32})/
          vprint_good("Authenticated successfully")
          return Exploit::CheckCode::Appears('The target appears to be vulnerable')
        end
      end
    rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout
      vprint_error("Connection failed")
    end
    return Exploit::CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: Atlassian Confluence Administrator Code Macro Remote Code Execution
Type: exploit
Path: modules/exploits/multi/http/atlassian_confluence_rce_cve_2024_21683.rb
Platform: unix
Disclosure date: 2024-05-21
References: CVE-2024-21683, URL-https://jira.atlassian.com/browse/CONFSERVER-95832, URL-https://realalphaman.substack.com/p/quick-note-about-cve-2024-21683-authenticated, URL-https://github.com/W01fh4cker/CVE-2024-21683-RCE

Description:
This module exploits an authenticated administrator-level vulnerability in Atlassian Confluence,
          tracked as CVE-2024-21683. The vulnerability exists due to the Rhino script engine parser evaluating
          tainted data from uploaded text files. This facilitates arbitrary code execution. This exploit will
          authenticate, validate user privileges, extract the underlying host OS information, then trigger
          remote code execution. All versions of Confluence prior to 7.17 are affected, as are many versions
          up to 8.9.0.

Check method (fingerprinting):
# Begin by retrieving the version string from the login page.
    version = get_confluence_version
    return CheckCode::Unknown('Failed to determine the Confluence version') unless version

    # Check the extracted version against all documented vulnerable versions.
    if version == Rex::Version.new('8.9.0') ||
       version.between?(Rex::Version.new('8.8.0'), Rex::Version.new('8.8.1')) ||
       version.between?(Rex::Version.new('8.7.0'), Rex::Version.new('8.7.2')) ||
       version.between?(Rex::Version.new('8.6.0'), Rex::Version.new('8.6.2')) ||
       version.between?(Rex::Version.new('8.5.0'), Rex::Version.new('8.5.8')) ||
       version.between?(Rex::Version.new('8.4.0'), Rex::Version.new('8.4.5')) ||
       version.between?(Rex::Version.new('8.3.0'), Rex::Version.new('8.3.4')) ||
       version.between?(Rex::Version.new('8.2.0'), Rex::Version.new('8.2.3')) ||
       version.between?(Rex::Version.new('8.1.0'), Rex::Version.new('8.1.4')) ||
       version.between?(Rex::Version.new('8.0.0'), Rex::Version.new('8.0.4')) ||
       version.between?(Rex::Version.new('7.20.0'), Rex::Version.new('7.20.3')) ||
       version.between?(Rex::Version.new('7.19.0'), Rex::Version.new('7.19.21')) ||
       version.between?(Rex::Version.new('7.18.0'), Rex::Version.new('7.18.3')) ||
       version.between?(Rex::Version.new('7.17.0'), Rex::Version.new('7.17.5')) ||
       # According to Atlassian, all versions < 7.17 are vulnerable.
       version.between?(Rex::Version.new('0.0.0'), Re
Metasploit Module: Apache Shiro v1.2.4 Cookie RememberME Deserial RCE
Type: exploit
Path: modules/exploits/multi/http/shiro_rememberme_v124_deserialize.rb
Platform: unix
Disclosure date: 2016-06-07
References: CVE-2016-4437, URL-https://github.com/Medicean/VulApps/tree/master/s/shiro/1
Targets: Unix Command payload, Windows Command payload

Description:
This vulnerability allows remote attackers to execute arbitrary code on vulnerable
          installations of Apache Shiro v1.2.4. Note that other versions of Apache Shiro may
          also be exploitable if the encryption key used by Shiro to encrypt rememberMe
          cookies is known.

          The gadget chain used for Java deserialization must be present on the target's classpath.
Metasploit Module: ChurchCRM Database Restore RCE 6.2.0
Type: exploit
Path: modules/exploits/multi/http/churchcrm_db_restore_rce.rb
Platform: linux
Disclosure date: 2025-12-17
Authors: LucasCsmt
References: CVE-2025-68109
Targets: Linux/unix Command (CmdStager), PHP (In-Memory), PHP (Fetch)

Description:
This module exploits a Remote Code Execution (RCE) vulnerability in ChurchCRM
          versions prior to 6.2.0. The vulnerability resides in the Database Restore
          functionality, which allows an authenticated user with administrative privileges
          to upload a malicious backup file. By bypassing upload restrictions via a
          crafted .htaccess file, the module enables PHP code execution in the target
          directory, ultimately providing the attacker with a Meterpreter shell.

Check method (fingerprinting):
vprint_status('Checking if the target is reachable...')

    res = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, 'session', 'begin')
    })

    unless [200, 301, 302].include?(res.code)
      return Exploit::CheckCode::Unknown("Unexpected HTTP response code: #{res.code}")
    end

    version = res.headers['CRM-VERSION']
    if version
      print_status("Found ChurchCRM version: #{version}")
      if Rex::Version.new(version) < Rex::Version.new('6.5.3')
        return Exploit::CheckCode::Appears("Vulnerable version #{version} detected via CRM-VERSION header.")
      else
        return Exploit::CheckCode::Safe("Version #{version} is not vulnerable.")
      end
    end
    if res.body.include?('ChurchCRM')
      return Exploit::CheckCode::Detected('ChurchCRM detected, but the version could not be determined.')
    end

    Exploit::CheckCode::Safe('The target does not appear to be ChurchCRM.')
  end

  # Build the payload that will be into the installation form
  #
  # @return : the payload
Metasploit Module: Cleo LexiCom, VLTrader, and Harmony Unauthenticated Remote Code Execution
Type: exploit
Path: modules/exploits/multi/http/cleo_rce_cve_2024_55956.rb
Platform: java
Disclosure date: 2024-12-09
References: CVE-2024-55956, URL-https://support.cleo.com/hc/en-us/articles/[PII_REDACTED]9735-Cleo-Product-Security-Update-CVE-2024-55956, URL-https://attackerkb.com/topics/geR0H8dgrE/cve-2024-55956/rapid7-analysis, URL-https://www.rapid7.com/blog/post/2024/12/10/etr-widespread-exploitation-of-cleo-file-transfer-software-cve-2024-50623/, URL-https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild
Targets: Java, Windows Command, Linux Command

Description:
This module exploits an unauthenticated file write vulnerability in Cleo LexiCom, VLTrader, and Harmony
          versions 5.8.0.23 and below.

Check method (fingerprinting):
res = send_request_cgi(
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path)
    )

    return CheckCode::Unknown('Connection failed') unless res

    # We expect the server to respond with an HTTP Server header like "Cleo LexiCom/5.8.0.0 (Windows Server 2022)".
    # Note, the target product may be either LexiCom, VLTrader, or Harmony.
    if res.headers.key?('Server') && (res.headers['Server'] =~ %r{cleo\s+(?:lexicom|vltrader|harmony)/(\d+\.\d+\.\d+\.\d+)}i)

      if Rex::Version.new(Regexp.last_match(1)) <= Rex::Version.new('5.8.0.23')
        return CheckCode::Appears(res.headers['Server'])
      end

      return CheckCode::Safe(res.headers['Server'])
    end

    CheckCode::Unknown('Could not connect to the target')
  end
Metasploit Module: WordPress wp-automatic Plugin SQLi Admin Creation
Type: exploit
Path: modules/exploits/multi/http/wp_automatic_sqli_to_rce.rb
Platform: php
Disclosure date: 2024-03-13
References: CVE-2024-27956, URL-https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wp-automatic/automatic-3920-unauthenticated-sql-injection, URL-https://patchstack.com/articles/critical-vulnerabilities-patched-in-wordpress-automatic-plugin/
Targets: PHP In-Memory, Unix/Linux Command Shell, Windows Command Shell

Description:
This module exploits an unauthenticated SQL injection vulnerability in the WordPress wp-automatic plugin (versions < 3.92.1)
          to achieve remote code execution (RCE). The vulnerability allows the attacker to inject and execute arbitrary SQL commands,
          which can be used to create a malicious administrator account. The password for the new account is hashed using MD5.
          Once the administrator account is created, the attacker can upload and execute a malicious plugin, leading to full control
          over the WordPress site.

Check method (fingerprinting):
return CheckCode::Unknown('Target does not appear to be running WordPress') unless wordpress_and_online?

    print_status('Attempting SQLi test to verify vulnerability...')

    create_sqli_instance

    begin
      if @sqli.test_vulnerable
        CheckCode::Vulnerable('Target is vulnerable to SQLi!')
      else
        CheckCode::Safe('Target is not vulnerable or the SQLi test failed.')
      end
    rescue SQLExecutionError => e
      print_error(e.message)
      CheckCode::Unknown('Failed to verify SQLi vulnerability due to an error.')
    end
  end
Metasploit Module: PlaySMS import.php Authenticated CSV File Upload Code Execution
Type: exploit
Path: modules/exploits/multi/http/playsms_uploadcsv_exec.rb
Platform: php
Disclosure date: 2017-05-21
References: CVE-2017-9101, URL-https://www.youtube.com/watch?v=KIB9sKQdEwE, EDB-42044

Description:
This module exploits an authenticated file upload remote code excution vulnerability
          in PlaySMS Version 1.4. This issue is caused by improper file contents handling in
          import.php (aka the Phonebook import feature). Authenticated Users can upload a CSV
          file containing a malicious payload via vectors involving the User-Agent HTTP header
          and PHP code in the User-Agent.
          This module was tested against PlaySMS 1.4 on VulnHub's Dina 1.0 machine and Windows 7.

Check method (fingerprinting):
begin
      res = send_request_cgi({
        'method' => 'GET',
        'uri' => normalize_uri(uri, 'index.php')
      })
    rescue
      vprint_error('Unable to access the index.php file')
      return CheckCode::Unknown('An error occurred while checking the target')
    end

    if res.code == 302 && res.headers['Location'].include?('index.php?app=main&inc=core_auth&route=login')
      return Exploit::CheckCode::Appears('The target appears vulnerable based on response headers')
    end

    return CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: Langflow RCE
Type: exploit
Path: modules/exploits/multi/http/langflow_rce_cve_2026_27966.rb
Disclosure date: 2026-02-25
References: CVE-2026-27966
Targets: Linux Command, Python payload

Description:
The CSV Agent node in Langflow hardcodes allow_dangerous_code=True, which automatically exposes LangChain's Python REPL tool (python_repl_ast).
          As a result, an attacker can execute arbitrary Python and OS commands on the server via prompt injection, leading to full Remote Code Execution (RCE).

Check method (fingerprinting):
res = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, 'api/v1/version')
    })
    return Exploit::CheckCode::Unknown('Unexpected server reply.') unless res&.code == 200

    json_version = res&.get_json_document&.fetch('version', nil)
    return Exploit::CheckCode::Unknown('Failed to parse version.') unless json_version

    version = Rex::Version.new(json_version)
    return Exploit::CheckCode::Unknown('Failed to get version.') unless version

    return Exploit::CheckCode.Safe("Version #{version} detected. Which is not vulnerable.") if version >= Rex::Version.new('1.8.0')

    # check if API key is valid
    res = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, 'api/v1/users/whoami'),
      'headers' => {
        'x-api-key' => datastore['APIKEY']
      }
    })
    return Exploit::CheckCode::Appears("Version #{version} detected and API key is valid. Which is vulnerable.") if res&.code == 200

    Exploit::CheckCode.Safe("Version #{version} detected and API key is invalid. Which is not vulnerable.")
  end
Metasploit Module: qdPM 9.1 Authenticated Arbitrary PHP File Upload (RCE)
Type: exploit
Path: modules/exploits/multi/http/qdpm_authenticated_rce.rb
Platform: php
Disclosure date: 2020-11-21
References: CVE-2020-7246, EDB-50175
Targets: Generic (PHP Payload), Linux x86, Linux x64, Windows x86, Windows x64

Description:
A remote code execution (RCE) vulnerability exists in qdPM 9.1 and earlier.
          An attacker can upload a malicious PHP code file via the profile photo functionality, by leveraging a path traversal
          vulnerability in the users['photop_preview'] delete photo feature, allowing bypass of .htaccess protection.
          NOTE: this issue exists because of an incomplete fix for CVE-2015-3884.

Check method (fingerprinting):
uri = normalize_uri(uri, '/index.php')
    res = send_request_raw({ 'uri' => uri })
    if res.nil?
      return Exploit::CheckCode::Unknown('No response received from the target')
    end

    login_page = res.get_html_document
    begin
      version_num = login_page.at('div[@class="copyright"]').at('a').text.tr('qdPM ', '').to_f
    rescue StandardError
      return Exploit::CheckCode::Unknown('No response received from the target')
    end
    version = Rex::Version.new(version_num)
    if version <= Rex::Version.new('9.1')
      return Exploit::CheckCode::Appears('The target is running a vulnerable version')
    else
      return Exploit::CheckCode::Safe('The target is not running a vulnerable version')
    end
  end
Metasploit Module: Baldr Botnet Panel Shell Upload Exploit
Type: exploit
Path: modules/exploits/multi/http/baldr_upload_exec.rb
Platform: PHP
Disclosure date: 2018-12-19
References: URL-https://krabsonsecurity.com/2019/06/04/taking-a-look-at-baldr-stealer/, URL-https://blog.malwarebytes.com/threat-analysis/2019/04/say-hello-baldr-new-stealer-market/, URL-https://www.sophos.com/en-us/medialibrary/PDFs/technical-papers/baldr-vs-the-world.pdf
Targets: Auto, <= v2.0, v2.2, v3.0 & v3.1

Description:
This module exploits an arbitrary file upload vulnerability within the Baldr
          stealer malware control panel when uploading victim log files (which are uploaded
          as ZIP files). Attackers can turn this vulnerability into an RCE by first
          registering a new bot to the panel and then uploading a ZIP file containing
          malicious PHP, which will then uploaded to a publicly accessible
          directory underneath the /logs web directory.

          Note that on versions 3.0 and 3.1 the ZIP files containing the victim log files
          are encoded by XORing them with a random 4 byte key. This exploit module gets around
          this restriction by retrieving the IP specific XOR key from panel gate before
          uploading the malicious ZIP file.

Check method (fingerprinting):
if select_target
      Exploit::CheckCode::Appears("Baldr Version: #{select_target.name}")
    else
      Exploit::CheckCode::Safe('The target version is not vulnerable')
    end
  end
Metasploit Module: CmsMadeSimple Authenticated File Manager RCE
Type: exploit
Path: modules/exploits/multi/http/cmsms_file_manager_auth_rce.rb
Platform: php
Disclosure date: 2023-06-07
References: CVE-2023-36969, EDB-51600

Description:
CMS Made Simple <= v2.2.21 allows an authenticated administrator to upload files
          with the .phar or .phtml extensions, enabling execution of PHP code
          leading to RCE. The file can be executed by accessing its URL in the
          /uploads/ directory.

          Tested on v2.2.21, v2.2.18, v2.2.17, v2.2.16, v2.2.15, v2.2.14.

Check method (fingerprinting):
res = send_request_cgi(
      'uri' => normalize_uri(target_uri.path, '', 'index.php'),
      'method' => 'GET'
    )
    unless res && res.code == 200
      vprint_error('Connection Failed')
      return CheckCode::Unknown('Could not connect to the target')
    end

    set_cookie = res.get_cookies
    return CheckCode::Safe('The target is not vulnerable') unless set_cookie&.match?(/^CMSSESSID/)

    html = res.get_html_document
    version = Rex::Version.new(html.at('p.copyright-info').text.scan(/\d+\.\d+\.\d+/).first)
    vprint_status("#{peer} - CMS Made Simple Version: #{version}")

    return CheckCode::Appears('The target is running a vulnerable version') if version <= Rex::Version.new('2.2.21')

    CheckCode::Detected('The target application was detected but the version could not be confirmed as vulnerable')
  end
Metasploit Module: Lucee Authenticated Scheduled Job Code Execution
Type: exploit
Path: modules/exploits/multi/http/lucee_scheduled_job.rb
Platform: win
Disclosure date: 2023-02-10
Authors: Alexander Philiotis
References: CVE-2025-34074, URL-https://docs.lucee.org/, URL-https://docs.lucee.org/reference/tags/execute.html, URL-https://docs.lucee.org/reference/tags/script.html
Targets: Windows Command, Unix Command

Description:
This module can be used to execute a payload on Lucee servers that have an exposed
          administrative web interface. It's possible for an administrator to create a
          scheduled job that queries a remote ColdFusion file, which is then downloaded and executed
          when accessed. The payload is uploaded as a cfm file when queried by the target server. When executed,
          the payload will run as the user specified during the Lucee installation. On Windows, this is a service account;
          on Linux, it is either the root user or lucee.
Metasploit Module: ATutor 2.2.1 SQL Injection / Remote Code Execution
Type: exploit
Path: modules/exploits/multi/http/atutor_sqli.rb
Platform: php
Disclosure date: 2016-03-01
References: CVE-2016-2555, URL-http://www.atutor.ca/, URL-http://sourceincite.com/research/src-2016-08/

Description:
This module exploits a SQL Injection vulnerability and an authentication weakness
          vulnerability in ATutor. This essentially means an attacker can bypass authentication
          and reach the administrator's interface where they can upload malicious code.

Check method (fingerprinting):
# the only way to test if the target is vuln
    if test_injection
      return Exploit::CheckCode::Vulnerable('SQL injection confirmed')
    else
      return Exploit::CheckCode::Safe('The target is not vulnerable')
    end
  end