CVE-2016-2555

CVE-2016-2555 Exploit This exploit targets a SQL Injection vulnerability and an authentication weakness vulnerability in ATutor 2.2.1. By exploiting these vulnerabilities, the attacker can upload malicious code to achieve Remote Code Execution RCE on the vulnerable server. Usage $ python3...

mirth-connect-security-poc

NextGen Connect 4.5.2 vulnerability PoCs Working proof-of-concept exploits for three network-reachable vulnerabilities in NextGen Connect Mirth Connect 4.5.2. The harnesses run the official container image, create only the channel configuration needed by the finding, execute the attack from a...

WordPress WP Booking System – Booking Calendar plugin <= 2.1.0.1 - Authenticated (Subscriber+) SQL Injection vulnerability

Authenticated Subscriber+ SQL Injection vulnerability discovered by Spy0x7 in WordPress Plugin WP Booking System versions = 2.1.0.1...

CVE-2025-5781

FreePBX CVE-2025-57819 Exploit Description This script exploits a vulnerability in FreePBX versions prior to 16.0.26.0 CVE-2025-57819, allowing remote attackers to execute arbitrary PHP code via a SQL injection flaw in the AJAX API endpoint. The exploit creates both a webshell and an auto-trigger...

CVE-2023-48084-Revised

CVE-2023-48084 — updated PoC Repository: MettHK/CVE-2023-48084-Revised Updated version of Hamibubu/CVE-2023-48084 with multithreading, binary-search extraction, and CLI flags for database / table / column selection. Not the original repository. This is a derivative/improved PoC. Credit for the...

CVE-2024-36058

CVE-2024-36058 — Koha Library Software CVE ID: CVE-2024-36058 Product: Koha Library Software Vulnerability Type: Time-Based Blind SQL Injection CWE-89 CVSS Score: 8.1 High Authenticated Affected Versions: Below 22.05.22 Credits: Karolis Narvilas Description Koha is an open-source integrated libra...

WP2Shell

WP2Shell - WordPress Pre-Auth RCE Exploit CVE-2026-63030 + CVE-2026-60137 Version: 4.0.0 Author: G0D150NE 📌 Overview WP2Shell is a full-chain exploit tool for WordPress pre-authentication remote code execution. It combines two critical vulnerabilities: CVE-2026-63030 - SQL Injection in REST API...

WordPress Smart Popup by Supsystic plugin <= 1.13.2 - Authenticated (Administrator+) SQL Injection vulnerability

Authenticated Administrator+ SQL Injection vulnerability discovered by Wordfence PRISM in WordPress Plugin Popup by Supsystic versions = 1.13.2...

exploits

Exploits Miscellaneous proof of concept exploit code written at Xiphos Research for testing purposes. Current Exploits index may be out of date phpMoAdmin Remote Code Execution CVE-2015-2208 LotusCMS Remote Code Execution OSVDB-75095 ElasticSearch Remote Code Execution CVE-2015-1427 ShellShock...

Exploits

Exploits Real world and CTFs exploit POCs. Real World CVE| Short description| Exploit ---|---|--- CVE-2017-5343| Wordpress SQL Injection| POC CVE-2018-8880| Unauthenticated Lutron Quantum Bacnet v2 network info exfiltration| POC CVE-2018-11629| Default and unremovable credentials in Homeworks QS...

Multimodal-web-attack-Dataset

MWAD: A Multimodal Web Attack Dataset for AI-Driven SQL Injection Detection Overview The Multimodal Web Attack Dataset MWAD is a novel labelled cybersecurity dataset developed as part of the author's research in cybersecurity at La Trobe University, Australia. The dataset generation methodology,...

CVE-2026-69084-PoC

CVE-2026-69084 / CVE-2026-69085 — SiYuan Arbitrary SQL Execution & SQLi CVE-2026-69084: Arbitrary SQL Execution via /api/search/searchEmbedBlock CVE-2026-69085: SQL Injection via /api/filetree/searchDocs CVSS 9.9 Critical each · CWE-89 · SiYuan --check 2. DB-write proof: CREATE TABLE + INSERT...

WordPress FireBox – WooCommerce Popup Builder, Exit Intent Popup, Email Optin & Cart Abandonment plugin <= 3.1.13 - Authenticated (Author+) SQL Injection vulnerability

Authenticated Author+ SQL Injection vulnerability discovered by Wordfence PRISM in WordPress Plugin FireBox versions = 3.1.13...

CVE-2026-108124

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in wp-post-author. This issue affects wp-post-author before 4.1.0...

CVE-2026-108125

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in wp-post-author. This issue affects wp-post-author version 4.0.0 prior to 4.1.0...

CVE-2026-108107

PHPNuxBill through 2025.3.20 contains an unauthenticated SQL injection vulnerability in the radius.php FreeRADIUS REST endpoint that interpolates request parameters into whereRaw queries. Attackers can send crafted username, macAddr or nasid parameters to the accounting or authenticate actions to...

CVE-2026-108100

HortusFox hortusfox-web before 6.2 contains an SQL injection vulnerability that allows API token holders to inject SQL by supplying crafted includeinfo values to the /api/locations/list endpoint. Attackers can place subqueries in includeinfo, which PlantsModel::getSpecificInfo concatenates into t...

EUVD-2026-95821

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in wp-post-author. This issue affects wp-post-author version 4.0.0 prior to 4.1.0...

CVE-2026-108125

The wp-post-author plugin is vulnerable to an SQL injection flaw due to the improper neutralization of special elements used in an SQL command. This security issue specifically affects wp-post-author version 4.0.0 prior to 4.1.0 . Exploitation of this vulnerability may result in high confidential...

CVE-2026-108125 WordPress Post Author Authenticated SQLi

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in wp-post-author. This issue affects wp-post-author version 4.0.0 prior to 4.1.0...