CVE-2026-9209

Versions of mJobTime through build 15.7.3.32 are vulnerable to an unauthenticated SQL execution vulnerability within the Login.aspx admin panel handlers. Specifically, the runQueryButton postback and exportSqlQuery_Server PageMethod fail to enforce server-side authentication, relying instead on a...

EUVD-2026-95035

mJobTime through build 15.7.3.32 contains an unauthenticated SQL execution vulnerability in the Login.aspx admin panel handlers, where the runQueryButton postback and exportSqlQueryServer PageMethod execute caller-supplied SQL against the backing Sybase SQL Anywhere database using DBA/sysadmin...

CVE-2026-9209 mJobTime 15.7.3.32 Unauthenticated SQL Execution RCE via Login.aspx

mJobTime through build 15.7.3.32 contains an unauthenticated SQL execution vulnerability in the Login.aspx admin panel handlers, where the runQueryButton postback and exportSqlQueryServer PageMethod execute caller-supplied SQL against the backing Sybase SQL Anywhere database using DBA/sysadmin...

CVE-2019-9053-Exploit-Python-3

CVE-2019-9053 Exploit Python 3 This repository contains an exploit for the vulnerability CVE-2019-9053 found in the CMS Made Simple CMSMS software. The exploit has been modified to work with Python 3 and is compatible with CMSMS version 2.2.9 and below. Description CVE-2019-9053 is a Time-Based...

CVE-2025-63585

CVE-2025-63585 Blind Time-Based SQL Injection in /action/rtcomments/status parameter: timestamp A blind, time-based SQL injection vulnerability was found in the timestamp parameter of the /action/rtcomments/status endpoint. An authenticated attacker who can supply this parameter may be able to...

Multi-Stage-Exploitation-and-Detection-Engineering-Analysis-of-CVE-2023-34362-in-MOVEit-Transfer

CVE-2023-34362 MOVEit Transfer Vulnerability Analysis Project Overview This repository contains an academic technical analysis of CVE-2023-34362, a critical SQL injection vulnerability affecting MOVEit Transfer. The project was prepared for CYB625 – Ethical Hacking & Penetration Testing. Importan...

Simple-CTF-Writeup

Simple-CTF-Writeup Professional TryHackMe Simple CTF walkthrough covering enumeration, CMS Made Simple SQL Injection CVE-2019-9053, credential recovery, SSH access, privilege escalation via Vim, and root compromise. TryHackMe - Simple CTF Writeup A complete walkthrough of the Simple CTF room on...

CVE-2023-49496_PoC

CVE-2023-49496PoC Description UCServer is an advanced converged communication server. Shanghai Shupin Information Technology Co., Ltd. UCServer has a SQL injection vulnerability. Attackers can exploit this vulnerability to obtain sensitive database information. POC POST /login/wwxcorpInfo/ HTTP/1...

Exploit for Authentication Bypass Using an Alternate Path or Channel in Sangoma Freepbx

freepbx-rce-detector Triage scanner for CVE-2025-57819, t...

-exploit-lab

-exploit-lab Exploits Python cve-2019-0708 – by HackHeart 🧠 Code Review & Porting - Python 2 → Python 3 This exploit was originally written in Python 2, which is no longer supported by modern systems. To ensure compatibility and maintain future-proof tooling, the entire codebase has been carefull...

poc_cve-2026-42208

CVE-2026-42208 — LiteLLM Pre-Authentication SQL Injection A lab environment for reproducing and detecting CVE-2026-42208 , a critical pre-authentication SQL injection vulnerability in LiteLLM where unsanitized Bearer tokens reach a raw PostgreSQL query. Vulnerability Overview Field| Details ---|-...

CVE-2022-0739

CVE-2022-0739 BookingPressWordPress Plugin SQLInjection BookingPress before 1.0.11...

CVE-2024-9264-Fixed

🛠️ CVE-2024-9264 - Fixed Grafana RCE Exploit This is a fixed version of the proof-of-concept exploit for CVE-2024-9264 , a critical remote code execution vulnerability in Grafana via SQL expressions and DuckDB. 🔗 Original advisory: Grafana Security Release ❌ Original PoC: Broken due to syntax...

CVE-2025-2011-poc

WordPress Depicter Plugin 3.6.1 - SQL Injection usage: exploit.py -h -u URL -D DATABASE -T TABLE -C COLUMN...

Simple_CMS_SQLi

This repository does not have a README...

CVE-2026-105076

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Appsbd Vitepos vitepos-lite allows Blind SQL Injection.This issue affects Vitepos: from n/a through 3.6.1...

CVE-2026-4060-PoC

CVE-2026-4060 — Geo Mashup ≤ 1.13.18 Unauthenticated SQL Injection PoC -blue Unauthenticated attackers can inject arbitrary SQL into the ORDER BY clause via the sort parameter of the Geo Mashup render-map endpoint, enabling time-based blind extraction of sensitive database information. Table of...

Zimbra10_SQL_Injection

This repository does not have a README...

CVE-2024-0399

CVE-2024-0399 - WooCommerce Customers Manager 29.4 - Post-Authenticated SQL Injection Exploit Title: WooCommerce Customers Manager 29.4 - Post-Authenticated SQL Injection Date: 2024-03-25 Exploit Author: Ivan Spiridonov - xbz0n Software Link:...

CVE-2023-1514-SQL-Injection-Teampass-

CVE-2023-1514-SQL-Injection-Teampass Usage: python .\CVE-2023-1514.py url...