282438 matches found
CVE-2023-41652
CVE-2023-41652 RSVPMarker = 10.6.6 - Unauthenticated SQL Injection Description: The RSVPMarker plugin for WordPress is vulnerable to SQL Injection via the 'email' parameter in versions up to, and including, 10.6.6 due to insufficient escaping on the user supplied parameter and lack of sufficient...
CVE-2022-45808
CVE-2022-45808 LearnPress Plugin = 5.0.1...
CVE-2025-63572
Description A SQL injection vulnerability was discovered in the endpoint responsible for searching for platform clients Zentrajuris v.1.0. User input sent to the search parameter is concatenated directly into a SQL query without proper sanitization/parameterization, allowing the attacker to...
CVE-2023-1454-EXP
CVE-2023-1454-EXP CVE-2023-1454 jeecg-boot Unauthorized SQL injection vulnerability JeecgBoot is a low-code development platform based on a code generator. The latest unauthorized SQL injection in the Java low-code platform jeecg-bootv3.5.0 for enterprise web applications. In addition to exploiti...
CVE-2021-43650
CVE-2021-43650 Webrun = 3.6.0.42 SQLi Description Webrun is a web-based management application. In version 3.6.0.42 it was possible to identify and report a SQL Injection vulnerability that occurs during the login process, more specifically we will inject the payload in the POST parameter called...
engeman-web-language-combobox-sqli
Engeman Web = 12.0.0.2 Password Recovery Page Load Unauthenticated SQL Injection Proof of concept for exploitation of the vulnerability described in CVE-2025-8220, which concerns the possibility of SQL Injection during the password recovery page load in the Engeman Web software. Description A...
CVE-2022-0739-Exploitation
CVE-2022-0739-Exploitation An exploitation of CVE-2022-0739. It about BookingPress WordPress plugin before 1.0.11. By using bookingpressfrontgetcategoryservices AJAX action available to unauthenticated users, leading to an unauthenticated SQL Injection. Since the plugin fails to properly sanitize...
CVE-2023-34362
CVE-2023-34362 POC for CVE-2023-34362 affecting MOVEit Transfer Technical Analysis A technical root cause analysis of the vulnerability can be found on the blog: Summary This POC abuses an SQL injection to obtain a sysadmin API access token and then uses that access to abuse a deserialization cal...
CVE-2026-9209
Versions of mJobTime through build 15.7.3.32 are vulnerable to an unauthenticated SQL execution vulnerability within the Login.aspx admin panel handlers. Specifically, the runQueryButton postback and exportSqlQuery_Server PageMethod fail to enforce server-side authentication, relying instead on a...
EUVD-2026-95035
mJobTime through build 15.7.3.32 contains an unauthenticated SQL execution vulnerability in the Login.aspx admin panel handlers, where the runQueryButton postback and exportSqlQueryServer PageMethod execute caller-supplied SQL against the backing Sybase SQL Anywhere database using DBA/sysadmin...
CVE-2026-9209 mJobTime 15.7.3.32 Unauthenticated SQL Execution RCE via Login.aspx
mJobTime through build 15.7.3.32 contains an unauthenticated SQL execution vulnerability in the Login.aspx admin panel handlers, where the runQueryButton postback and exportSqlQueryServer PageMethod execute caller-supplied SQL against the backing Sybase SQL Anywhere database using DBA/sysadmin...
CVE-2019-9053-Exploit-Python-3
CVE-2019-9053 Exploit Python 3 This repository contains an exploit for the vulnerability CVE-2019-9053 found in the CMS Made Simple CMSMS software. The exploit has been modified to work with Python 3 and is compatible with CMSMS version 2.2.9 and below. Description CVE-2019-9053 is a Time-Based...
CVE-2025-63585
CVE-2025-63585 Blind Time-Based SQL Injection in /action/rtcomments/status parameter: timestamp A blind, time-based SQL injection vulnerability was found in the timestamp parameter of the /action/rtcomments/status endpoint. An authenticated attacker who can supply this parameter may be able to...
Multi-Stage-Exploitation-and-Detection-Engineering-Analysis-of-CVE-2023-34362-in-MOVEit-Transfer
CVE-2023-34362 MOVEit Transfer Vulnerability Analysis Project Overview This repository contains an academic technical analysis of CVE-2023-34362, a critical SQL injection vulnerability affecting MOVEit Transfer. The project was prepared for CYB625 – Ethical Hacking & Penetration Testing. Importan...
Simple-CTF-Writeup
Simple-CTF-Writeup Professional TryHackMe Simple CTF walkthrough covering enumeration, CMS Made Simple SQL Injection CVE-2019-9053, credential recovery, SSH access, privilege escalation via Vim, and root compromise. TryHackMe - Simple CTF Writeup A complete walkthrough of the Simple CTF room on...
CVE-2023-49496_PoC
CVE-2023-49496PoC Description UCServer is an advanced converged communication server. Shanghai Shupin Information Technology Co., Ltd. UCServer has a SQL injection vulnerability. Attackers can exploit this vulnerability to obtain sensitive database information. POC POST /login/wwxcorpInfo/ HTTP/1...
Exploit for Authentication Bypass Using an Alternate Path or Channel in Sangoma Freepbx
freepbx-rce-detector Triage scanner for CVE-2025-57819, t...
-exploit-lab
-exploit-lab Exploits Python cve-2019-0708 – by HackHeart 🧠 Code Review & Porting - Python 2 → Python 3 This exploit was originally written in Python 2, which is no longer supported by modern systems. To ensure compatibility and maintain future-proof tooling, the entire codebase has been carefull...
poc_cve-2026-42208
CVE-2026-42208 — LiteLLM Pre-Authentication SQL Injection A lab environment for reproducing and detecting CVE-2026-42208 , a critical pre-authentication SQL injection vulnerability in LiteLLM where unsanitized Bearer tokens reach a raw PostgreSQL query. Vulnerability Overview Field| Details ---|-...