CVE-2023-2744

Exploit Title: WP Plugins WP ERP = 1.12.2 - SQL Injection Date: 15-10-2023 Exploit Author: Arvandy Software Link: https://wordpress.org/plugins/erp/ Vendor Homepage: https://wperp.com/ Version: 1.12.2 Tested on: Windows, Linux CVE: CVE-2023-2744 Product Description WP ERP is the first full-fledge...

CVE-2026-59550

CVE-2026-59550 - AWP Classifieds ≤ 4.4.7 unauthenticated SQL injection Unauthenticated time-based blind SQL injection in the WordPress plugin AWP Classifieds another-wordpress-classifieds-plugin, reachable through the plugin's anonymous guest AJAX ad-submission flow. | ---|--- CVE| CVE-2026-59550...

drupal-jsonapi-sqli-scanner

CVE-2026-9082 — Drupal PostgreSQL SQL Injection Mass Scanner & Exploitation Tool Unauthenticated SQL Injection in Drupal Core PostgreSQL JSON:API filter array key injection via PDO placeholder name abuse Overview CVE-2026-9082 is a Highly Critical SQL injection vulnerability in Drupal Core...

cve-2024-3552

Description The Plugin Web Directory Free WordPress prior to version 1.7.0 contains a SQL Injection vulnerability. The AJAX execution function is not properly filtered/sanitized, allowing an attacker to manipulate the SQL query or inject additional clauses UNION, time-based, error-based Context...

wp2shell

wp2shell Pre-authentication remote code execution for WordPress 6.9.0–6.9.4 and 7.0.0–7.0.1. Chains CVE-2026-63030 batch route confusion SQLi with CVE-2026-60137 customizer changeset re-entry to achieve unauthenticated administrator creation and OS command execution. No password cracking required...

CVE-2024-36840-Exploit

CVE-2024-36840: SQL Injection Vulnerability in Boelter Blue System Management Version 1.3 Exploit Details Exploit Title : SQL Injection Vulnerability in Boelter Blue System Management version 1.3 Original Google Dork : inurl:"Powered by Boelter Blue" didn't workedzero url in search Google Dork By...

vucsa

Vulnerable Client-Server Application VuCSA Vulnerable client-server application VuCSA is made for learning/presenting how to perform penetration tests of non-http client-server applications. It is written in Java with JavaFX graphical user interface. Currently, the vulnerable application contains...

mirth-connect-security-poc

NextGen Connect 4.5.2 vulnerability PoCs Working proof-of-concept exploits for three network-reachable vulnerabilities in NextGen Connect Mirth Connect 4.5.2. The harnesses run the official container image, create only the channel configuration needed by the finding, execute the attack from a...

CVE-2026-24031

CVE-2026-24031: Dovecot SQL authentication bypass authentication + user enumeration This repository contains a proof-of-concept authentication-bypass exploit for CVE-2026-24031 , a SQL injection in Dovecot's SQL-based authentication introduced as a regression in Dovecot 2.4.0 / 3.1.0. In the test...

Metabase-Setup-Endpoint-SQLi-Fix

CVE-2026-72898: Metabase Setup Endpoint SQLi Patch This repository contains the hotfix for CVE-2026-72898 , an unauthenticated SQL Injection vulnerability in the setup endpoint of self-hosted Metabase instances. Left unpatched, attackers can bypass the setup token validation, execute arbitrary...

CVE-2024-9465

CVE-2024-9465: Palo Alto Expedition Unauthenticated SQL Injection Proof of concept to exploit CVE-2024-9465 on vulnerable devices. Blog Post Root cause and indicators of compromise here: https://www.horizon3.ai/attack-research/palo-alto-expedition-from-n-day-to-full-compromise/ Usage % python3...

DSSS

Damn Small SQLi Scanner Damn Small SQLi Scanner DSSS is a fully functional SQL injection vulnerability scanner supporting GET and POST parameters written in under 100 lines of code. As of optional settings it supports HTTP proxy together with HTTP header values User-Agent, Referer and Cookie...

Multimodal-web-attack-Dataset

MWAD: A Multimodal Web Attack Dataset for AI-Driven SQL Injection Detection Overview The Multimodal Web Attack Dataset MWAD is a novel labelled cybersecurity dataset developed as part of the author's research in cybersecurity at La Trobe University, Australia. The dataset generation methodology,...

exploits-rconfig

exploits Three exploits for rconfig = 3.9.4 : CVE-2019-19509 : authenticated RCE CVE-2019-19585 : Local Privilege Escalation root CVE-2020-10220 : unauthenticated SQLi rconfigrootRCEunauth.py : chaining the three CVEs above to get root reverse shell without authentication...

joomla-cve-2018-6396

Joomla-CVE-2018-6396 Joomla! Component Google Map Landkarten PoC cve-2018-6396...

sqlmap

sqlmap sqlmap is an open source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers. It comes with a powerful detection engine, many niche features for the ultimate penetration tester, and a broad range of switche...

watchTowr-vs-FortiWeb-CVE-2025-25257

watchTowr-vs-FortiWeb-CVE-2025-25257 Detection Artifact Generator for FortiWeb CVE-2025-25257 See our blog post for technical details https://github.com/user-attachments/assets/e59f2b3b-2b9b-469f-b4a8-2b7df2ede194 Detection in Action python watchTowr-vs-FortiWeb-CVE-2025-25257.py --target...

CVE-2024-55988

CVE-2024-55988 Navayan CSV Export = 1.0.9 - Unauthenticated SQL Injection Description The Navayan CSV Export plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 1.0.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation o...

CVE-2026-76461

⚡ CVE-2026-76461 - Critical SQL Injection A critical, remotely exploitable SQL injection vulnerability in Cisco Secure Email Gateway's email parsing...

teler-waf

teler-waf teler-waf is a comprehensive security solution for Go-based web applications. It acts as an HTTP middleware, providing an easy-to-use interface for integrating IDS functionality with teler IDS into existing Go applications. By using teler-waf, you can help protect against a variety of...