Wordpress Email Subscribers by Icegram Express - SQL Injection

The Email Subscribers by Icegram Express - Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'run' function of the 'IGESSubscribersQuery' class in all versions up to, and including, 5.7.14 due to insufficient escaping ...

MasterStudy LMS WordPress Plugin <= 3.2.5 - SQL Injection

The MasterStudy LMS WordPress Plugin for Online Courses and Education plugin for WordPress is vulnerable to union based SQL Injection via the 'user' parameter of the /lms/stm-lms/order/items REST route in all versions up to, and including, 3.2.5 due to insufficient escaping on the user supplied...

VICIdial - SQL Injection

An unauthenticated attacker can leverage a time-based SQL injection vulnerability in VICIdial to enumerate database records. By default, VICIdial stores plaintext credentials within the database. id: CVE-2024-8503 info: name: VICIdial - SQL Injection author: s4e-io severity: critical description:...

CVE-2026-14962

CVE-2026-14962 Wordpress Plugin ELEX WooCommerce Request a Quote unauthenticated SQL injection ELEX WooCommerce Request a Quote WordPress plugin elex-request-a-quote ≤ 2.4.0 — unauthenticated SQL injection via the public elexraqaddtoquote AJAX action. For authorized testing only. Do not run this...

CVE-2025-69295

CVE-2025-69295 — Vulnerabilidad de inyección SQL ciega en TeconceTheme Coven Core CVE-2025-69295 es una vulnerabilidad de inyección SQL que afecta al componente Coven Core del tema de WordPress TeconceTheme Coven Core. La vulnerabilidad existe debido a la neutralización incorrecta de la entrada...

CVE-2024-57521-SQL-Injection-PoC

Inyección SQL Autenticada en RuoYi v4.7.9 Bypass de CVE-2024-42900 Introducción Descubrí una vulnerabilidad de Inyección SQL Ciega en la funcionalidad createTable de RuoYi Framework v4.7.9. Esto permite a un administrador autenticado ejecutar comandos SQL arbitrarios a través del parámetro sql...

CVE-2026-100312: Improper Neutralization of Special Elements used in an SQL Command

A security flaw has been discovered in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. The impacted element is an unknown function of the file /updateguest.php. Performing a manipulation of the argument gname/editassid results in sql injection. It is possib...

CVE-2026-94130: Improper Neutralization of Special Elements used in an SQL Command

Joomla Extension - joomlaboat.com - Unauthenticated SQL injection in YouTube Gallery extension 5.7.3 - An SQL injection vulnerability in video search functionality and sorting allowed attackers to inject SQL commands in read queries...

CVE-2026-97162: Improper Neutralization of Special Elements used in an SQL Command

Joomla Extension - lomart.fr - Various SQL injection vectors in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29...

CVE-2026-100315: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. Affected is an unknown function of the file mydetailsfaculty.php. The manipulation of the argument myfid results in sql injection. The attack can be launched remotely. The explo...

FreePBX-CVE-2025-57819-CVE-2025-61678

FreePBX-CVE-2025-57819-CVE-2025-61678 Chains CVE-2025-57819 stacked query SQL injection and CVE-2025-61678 authenticated file upload in FreePBX Endpoint Manager to achieve Remote Code Execution RCE. For educational use only. References:...

CVE-2022-23305_POC

CVE-2022-23305 Log4j JDBCAppender POC de inyección SQL Esta es una aplicación muy sencilla basada en Spring Boot que demuestra la vulnerabilidad CVE-2022-23305. Utiliza Apache Maven, Spring Boot, Spring MVC y la base de datos en memoria H2 para registrar una entrada simple, tomada como un parámet...

cve-2024-37765

Description MachForm up to version 19 is affected by an authenticated Blind SQL injection in the user account settings page. SQL injection attacks consist in inserting SQL queries through the usage of an input data field from the client application. This kind of attack allows to obtain access to...

MultiExploit

Multi-Service Vulnerability Scanner Supported Vulnerabilities & Attack Vectors Microsoft SQL Server Vulnerabilities CVE-2023-21173 : Remote Code Execution in SQL Server 2022 Potential exploitation of: Weak authentication configurations Misconfigured server principals xpcmdshell abuse Advanced...

CVE-2026-24031

CVE-2026-24031: Bypass de autenticación SQL en Dovecot autenticación + enumeración de usuarios Este repositorio contiene un exploit de prueba de concepto para eludir la autenticación de CVE-2026-24031 , una inyección SQL en la autenticación basada en SQL de Dovecot introducida como regresión en...

CVE-2024-6043

CVE-2024-6043 CVE-2024-6043 CVE-2024-6043 概述 该Python工具利用CVE-2024-6043漏洞，该漏洞影响SourceCodester Best House Rental Management System 1.0。漏洞允许远程攻击者通过adminclass.php文件中的登录功能，针对username参数执行SQL注入。该工具自动化检测易受攻击的端点并注入payload以绕过认证的过程。 功能 - 自动路径检测：该工具检查目标服务器上是否存在易受攻击的adminclass.php文件。 -...

CVE-2024-55270

学生管理系统 1.0 CVE-2024-55270 概述 学生管理系统（SMS）是一款基于 PHP 和 MySQL 开发的 Web 应用程序，用于管理学生信息。本仓库包含该系统的源代码和详细信息，同时附有安全漏洞报告。 审计员： Shoaib Alam - LinkedIn 个人资料 安全漏洞报告 描述 在学生管理系统中检测到了一个盲 SQL 注入 漏洞。该问题影响应用程序搜索功能中的 searchdata 参数。 易受攻击的端点： /studentms/admin/search.php 易受攻击的参数： searchdata 由于输入清理不充分，searchdata 参数容易受到盲 S...

CVE-2024-9465

CVE-2024-9465 Checkpoint SQL Injection via Time-Based Attack CVE-2024-9465 SHODAN SEARCH https://www.shodan.io/search?query=html%3A%22Expedition+Project%22 html:"Expedition Project" FOFA SEARCH https://en.fofa.info/ body="Expedition Project" || title="Expedition Project" USAGE python3...

One-Liner-Collections

One-Liner-Collections This Repositories contains list of One Liners with Descriptions and Installation requirements ──────────────────────────────────────────────────────────────────────── SQL Injection Installation Requirements 1. Subfinder : https://github.com/projectdiscovery/subfinder 2. GAU ...

cve-2026-3180

CVE-2026-3180 - WordPress Contest Gallery 28.1.4 - 未认证盲SQL注入 描述 在WordPress插件Contest Gallery版本28.1.4及更早版本 中发现了一个盲SQL注入（Blind SQL Injection）漏洞。该问题源于对参数cglmail的不安全使用，其中函数sanitizeemail在邮件地址的本地部分保留了单引号字符（'）。 因此，用户控制的输入未经prepare正确参数化便直接进入wpdb-getrow，使得未认证的攻击者能够执行基于布尔的盲SQL注入。 漏洞详情 属性| 值 ---|--- CVE ID|...