POC-CVE-2025-1094

POC CVE-2025-1094: ثغرة SQL Injection في PostgreSQL psql Proof of Concept لثغرة SQL Injection خطيرة في عميل PostgreSQL libpq وأداة psql 📋 جدول المحتويات 1. مقدمة عن الثغرة 2. هيكل مجلدات المشروع 3. تحليل الحمولة الهجومية Payload 4. دليل الاستخدام 5. طرق الإصلاح والوقاية 1. مقدمة عن الثغرة الوصف...

EUVD-2026-94757

In Brocade SANnav before 3.0.0a, an SQL Injection vulnerability in various external API inventories have a vulnerability that allows an authenticated attacker to inject malicious data into some of the REST API -query parameters...

CVE-2026-5048

The HPE B-Series SANnav Management Portal (specifically versions prior to v3.0.0a and 3.0.1 ) is vulnerable to an SQL Injection flaw. An authenticated attacker can exploit this vulnerability by injecting malicious data into certain REST API -query parameters within various external API inventorie...

CVE-2026-5048

In Brocade SANnav before 3.0.0a, an SQL Injection vulnerability in various external API inventories have a vulnerability that allows an authenticated attacker to inject malicious data into some of the REST API -query parameters...

Magento-CVE-2019-7139-SQLi-PoC

CVE-2019-7139 PoC : Injection SQL Magento Ce dépôt contient un exploit proof-of-concept PoC pour CVE-2019-7139 PRODSECBUG-2198, une vulnérabilité d'injection SQL non authentifiée dans Magento, découverte par Charles Fol d'Ambionics Security. Détails de la vulnérabilité ID CVE : CVE-2019-7139...

CMS-Made-Simple-2.2.10---SQL-Injection

CMS-Made-Simple-2.2.10 - حقن SQL ثغرات Google Dorks لاكتشاف حقن SQL في CMS Made Simple الإصدار 2.2.10 فما دون CVE-2019-9053. تم بناؤه لأغراض التدقيق الأمني والتحقق من التصحيحات...

CVE-2025-67261

CVE-2025-67261 - Injection SQL aveugle basée sur le contenu dans Abacre Retail Point of Sale 14.0.0.396 Abacre Retail Point of Sale 14.0.0.396 est vulnérable à une injection SQL aveugle basée sur le contenu. La vulnérabilité se trouve dans la fonction Recherche de la page Commandes. La fonction «...

rails-cve-2012-5664-test

عرض توضيحي لثغرة Rails CVE-2012-5664 يعرض هذا التطبيق التوضيحي كيفية عمل ثغرة Rails CVE-2013-5664. مزيد من المعلومات: http://blog.phusion.nl/2013/01/03/rails-sql-injection-vulnerability-hold-your-horses-here-are-the-facts...

django-cve-2025-64459

Django CVE-2025-64459 هذا التطبيق يوضح الثغرة CVE-2025-64459 التي تؤثر على إصدارات متعددة من Django. تم إصلاح هذه الثغرة في الإصدارات الأحدث من Django. SQL Injection SQL Injection حقن SQL هو عندما يتم التعامل مع المدخلات المقدمة من المستخدم كجزء من استعلام SQL، مما يسمح للمهاجم بتغيير طريقة عمل...

CVE-2025-2011

CVE-2025-2011 PoC Par : X3RX3S Mais fièrement arraché par Ash Wesker qui a utilisé GPT sur mon code avec sa bannière ; voir ici --- https://github.com/Ashwesker/Blackash-CVE-2025-2011 Vous pouvez même voir mon pseudo dans 'son' code --' Objectif : Un outil de preuve de concept pour tester une...

spip-exploits

Casse-Spip CVE-2026-72708, CVE-2026-72709, CVE-2026-72710 D'une injection SQL non authentifiée à l'exécution de code à distance Exploit pour CVE-2026-72708, CVE-2026-72709 et CVE-2026-72710 découvertes par Franck Chevalier Wayko Pour une analyse technique complète, lisez l'article complet sur le...

Wordpress Email Subscribers by Icegram Express - SQL Injection

The Email Subscribers by Icegram Express - Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'run' function of the 'IGESSubscribersQuery' class in all versions up to, and including, 5.7.14 due to insufficient escaping ...

Lighttpd 1.4.34 SQL Injection and Path Traversal

A SQL injection vulnerability in modmysqlvhost.c in lighttpd before 1.4.35 allows remote attackers to execute arbitrary SQL commands via the host name related to requestcheckhostname. id: CVE-2014-2323 info: name: Lighttpd 1.4.34 SQL Injection and Path Traversal author: geeknik severity: critical...

Grafana Post-Auth DuckDB - SQL Injection To File Read

The SQL Expressions experimental feature of Grafana allows for the evaluation of duckdb queries containing user input. These queries are insufficiently sanitized before being passed to duckdb, leading to a command injection and local file inclusion vulnerability. Any user with the VIEWER or highe...

Riello Netman 204 - SQL Injection

The three endpoints /cgi-bin/dbdatalogw.cgi, /cgi-bin/dbeventlogw.cgi, and /cgi-bin/dbmultimetrw.cgi are vulnerable to SQL injection without prior authentication. This enables an attacker to modify the collected log data in an arbitrary way. id: CVE-2024-8877 info: name: Riello Netman 204 - SQL...

FreePBX - Remote Code Execution

FreePBX 15, 16, and 17 contain a remote code execution caused by insufficiently sanitized user-supplied data in endpoints, letting unauthenticated attackers manipulate the database and execute code remotely, exploit requires no authentication. id: CVE-2025-57819 info: name: FreePBX - Remote Code...

GeoServer OGC Filter - SQL Injection

GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. GeoServer includes support for the OGC Filter expression language and the OGC Common Query Language CQL as part of the Web Feature Service WFS and Web Map Service WMS protocols. CQL is...

LearnPress < 4.2.7.1 - SQL Injection

The LearnPress - WordPress LMS Plugin plugin for WordPress is vulnerable to SQL Injection via the 'conlyfields' parameter of the /wp-json/learnpress/v1/courses REST API endpoint in all versions up to, and including, 4.2.7 due to insufficient escaping on the user supplied parameter and lack of...

Jeecg-Boot v3.5.1 - SQL Injection

SQL injection vulnerability via the title parameter at /sys/dict/loadTreeData in jeecg-boot v3.5.1. id: CVE-2023-38992 info: name: Jeecg-Boot v3.5.1 - SQL Injection author: ritikchaddha severity: critical description: | SQL injection vulnerability via the title parameter at /sys/dict/loadTreeData...

phpMyAdmin < 5.0.3 - SQL Injection

phpMyAdmin before 4.9.6 and 5.x before 5.0.3 contains a SQL injection caused by improper processing of SQL statements in the search feature, letting attackers inject malicious SQL, exploit requires crafted search input. id: CVE-2020-26935 info: name: phpMyAdmin 5.0.3 - SQL Injection author: 0xAko...