CVE-2026-72898-metabase-sqli

CVE-2026-72898 — Metabase unauthentifizierte SQL-Injection Detektor + Analyse -black Unauthentifizierte SQL-Injection in Metabase über POST /api/session/resetpassword. CVSS 10.0 , im CISA-KEV-Katalog, wird in freier Wildbahn ausgenutzt. Ein nicht deklariertes Feld im Passwort-Reset-Request-Body...

CVE-2025-25964

CVE-2025-25964: Injeção SQL no Sistema de Gerenciamento de Informações Escolares v1.0 Introdução No cenário digital atual, a Injeção SQL SQLi continua sendo uma das vulnerabilidades mais comuns e perigosas encontradas em aplicações web. Este artigo discute uma vulnerabilidade crítica de Injeção S...

CVE-2022-34265

CVE-2022-34265 PoC for CVE-2022-34265 Description An issue was discovered in Django 3.2 before 3.2.14 and 4.0 before 4.0.6. The Trunc and Extract database functions are subject to SQL injection if untrusted data is used as a kind/lookupname value. Applications that constrain the lookup name and...

CVE-2023-24775-and-CVE-2023-24780

CVE-2023-24775-and-CVE-2023-24780 my python poc 2023-24780 and CVE-2023-24775 this sqli cve funadmin This is a repository with a poc exploit for python cve sqli funadmin. CVE-2023-24774 - https://nvd.nist.gov/vuln/detail/CVE-2023-24780 Vulnerable version of Funadmin v3.2.0 Vulnerability via id...

CVE-2026-42167-PoC

CVE reported by ZeroPath Research original writeup: https://zeropath.com/blog/proftpd-cve-2026-42167-auth-bypass-privesc-rce my version : https://jimmexploit.vercel.app/cve/proftpd-unauthenticated-sql-injection-leads-to-rce Description This repository contains a functional exploit for...

CVE-2026-42167-Exploit

CVE-2026-42167 Master Exploit Tool A professional security research tool for exploiting the CVE-2026-42167 vulnerability in ProFTPD's modsql module. This tool performs unauthenticated SQL injection to exfiltrate sensitive files from the server via time-based side-channel attacks. "Note: The...

cve-2026-6379

CVE-2026-6379 — WP Photo Album Plus :8080/?pageid=" --mode probe python3 ../pocs/exploit.py "http://:8080/?pageid=" --mode probe-calendar python3 ../pocs/exploit.py "http://:8080/?pageid=" --mode version python3 ../pocs/exploit.py "http://:8080/?pageid=" --mode hash A vulnerable target replies in...

CVE-2026-10170-RCE

Visitor Management System 1.0 – SQLi zu Remote Code Execution Angriffskette Schwachstelleninformationen...

CVE-2026-10110-SQLi

Student Details Management System 1.0 – SQL-Injection ohne Authentifizierung Informationen zur Schwachstelle...

CVE-2026-81277

Contributor SQL Injection in Suggestion Engine for WooCommerce = 2.0.11 versions...

CVE-2026-78288

Unauthenticated SQL Injection in Beautiful Taxonomy Filters = 2.4.6 versions...

CVE-2026-78285

Subscriber SQL Injection in Like Button Rating = 2.6.61 versions...

CVE-2026-32564

Subscriber SQL Injection in ACPT Pro - Custom Post Types Plugin for WordPress = 2.0.63 versions...

CVE-2026-32550

Subscriber SQL Injection in Kadence Shop Kit = 3.0.6 versions...

CVE-2026-42167-PoC

CVE-2026-42167 POC Pre-Authentification Remote Code Execution in ProFTPD via modsql SQL-Injection Autor: Van Glenndon Enad Ursprüngliche Entdeckung: ZeroPath Veröffentlicht: 1. Mai 2026 Schweregrad: Kritisch CVSS v3.1-Score: 8.1 CVSS v3.1-Vektor: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS...

CVE-2026-63030

wp2shell — WordPress Core Pre-Auth RCE CVE-2026-63030 Batch Route Confusion + CVE-2026-60137 SQL Injection Zero-dependency exploitation toolkit for the wp2shell vulnerability chain in WordPress Core. A single anonymous HTTP request achieves remote code execution on a default WordPress installatio...

CVE-2023-1454

CVE-2023-1454 jeecg-boot unauthorized SQL Injection Vulnerability CVE-2023-1454...

CVE-2024-9796

CVE-2024-9796 WordPress WP-Advanced-Search = 5.0.12 time-based blind IF - comment Payload: t=wpautosuggest&f=ifnow=sysdate,SLEEP9,0-- wXyW&l=5&type=0&e=utf-8&q=c&limit=5&timestamp=13672261755853'...

CVE-2021-25076

CVE-2021-25076-Exploit Wordpress Plugin WP User Frontend 3.5.26 - SQL-Injection Authenticated CVE description: The WP User Frontend WordPress plugin before 3.5.26 does not validate and escape the status parameter before using it in a SQL statement in the Subscribers dashboard, leading to an SQL...

CVE-2024-22120-RCE-with-gopher

Usage root@kitploit: python exploit.py --ip --sid --hostid --phpsessid --falsetime --truetime Summary This exploit was created to exploit an XXE XML External Entity. Through it, I read the backend code of the web service and found an endpoint where I could use gopher to make internal requests on...