CVE-2026-32580

The WordPress WooCommerce Lottery plugin in versions

EUVD-2026-93241

Unauthenticated SQL Injection in WooCommerce Lottery = 2.2.9 versions...

CVE-2026-32580 WordPress WooCommerce Lottery plugin <= 2.2.9 - SQL Injection vulnerability

Unauthenticated SQL Injection in WooCommerce Lottery = 2.2.9 versions...

CVE-2026-32557 WordPress WooCommerce Appointments plugin <= 5.3.2 - SQL Injection vulnerability

Unauthenticated SQL Injection in WooCommerce Appointments = 5.3.2 versions...

EUVD-2026-93230

Unauthenticated SQL Injection in WooCommerce Appointments = 5.3.2 versions...

CVE-2026-32557

The WooCommerce Appointments plugin for WordPress versions

EUVD-2026-93229

Subscriber SQL Injection in WP2LEADS = 3.5.7 versions...

CVE-2026-25434 WordPress WP2LEADS plugin <= 3.5.7 - SQL Injection vulnerability

Subscriber SQL Injection in WP2LEADS = 3.5.7 versions...

CVE-2026-25434

The WP2LEADS plugin for WordPress (versions

BSQLinjector

BSQLinjector BSQLinjector utiliza el método ciego para recuperar datos de bases de datos SQL. Recomiendo usar el interruptor "--test" para ver claramente cómo se ve el payload configurado antes de enviarlo a una aplicación. Opciones: --file Mandatory - File containing valid HTTP request and SQL...

vuln-bank

Vulnerable Bank Application 🏦 A deliberately vulnerable web application for practicing application security testing of Web, APIs and LLMs, secure code review and implementing security in CI/CD pipelines. ⚠️ WARNING: This application is intentionally vulnerable and should only be used for...

TheDoc

TheDoc es un automatizador de SQLMAP simple pero muy útil con buscador de administradores integrado, crackeador de hashes usando hashcat y más! Capacidades: Cuenta el total de inyecciones intentadas. Rastrea el dominio dado en busca de vulnerabilidades. Extrae información de la base de datos...

mariadb-13-rce-lab

MariaDB 13.0.1-rc RCE Lab Remote code execution on the unmodified, stock MariaDB 13.0.1-rc Docker image as uid 999 mysql. Two exploit variants: Variant| File| Requirements| Notes ---|---|---|--- Pure SQL recommended| exploitpuresql.py| a low-priv MariaDB account + TCP| no host access, no docker, ...

CVE-2026-26980-Ghost-CMS-Api

CVE-2026-26980 PoC de Inyección SQL en Ghost CMS Este repositorio contiene una herramienta de prueba de concepto basada en Go para demostrar y validar la vulnerabilidad de inyección SQL en la API de Contenido de Ghost CMS descrita por CVE-2026-26980. La implementación se basa en el flujo de...

SQLiDetector

SQLiDetector Script simple en Python compatible con el perfil BurpBounty que te ayuda a detectar inyecciones SQL "basadas en errores" enviando múltiples solicitudes con 14 payloads y verificando 152 patrones regex para diferentes bases de datos...

CVE-2026-4889

The eLoanApp platform by RDL Technologies contains a SQL injection (SQLi) vulnerability in the '/ajax/users.php?op=verify' endpoint. The vulnerability exists in the 'logina' POST parameter, which is susceptible to both boolean-based and time-based SQL injection. Successful exploitation enables an...

CVE-2026-4889 SQL Injection (SQLi) in eLoanApp Platform by RDL Technologies

SQL injection SQLi vulnerability in the eLoanApp application, specifically in the POST parameter 'logina' of the user process endpoint '/ajax/users.php?op=verify'. The parameter is vulnerable to boolean-based and time-based SQL injection. Successfully exploiting this vulnerability would allow an...

EUVD-2026-93227

SQL injection SQLi vulnerability in the eLoanApp application, specifically in the POST parameter 'logina' of the user process endpoint '/ajax/users.php?op=verify'. The parameter is vulnerable to boolean-based and time-based SQL injection. Successfully exploiting this vulnerability would allow an...

CVE-2026-105807

A vulnerability was found in SourceCodester Simple Student Information System 1.0. This affects an unknown part of the file searchquery.php. Performing a manipulation results in sql injection. The attack can be initiated remotely...

wp2shell-detect

wp2shell-detect Blackbox, non-intrusive detector for wp2shell — the pre-authentication RCE chain in WordPress core disclosed on 2026-07-17: CVE-2026-63030 — route confusion in the REST batch endpoint /wp-json/batch/v1: a sub-request whose path fails wpparseurl lands in the validation array but no...