cve-2024-50330-ivanti_epm_sqli_reproduction

CVE-2024-50330: Ivanti Endpoint Manager EPM Inyección SQL a RCE Resumen CVE-2024-50330 es una vulnerabilidad de inyección SQL crítica sin autenticación previa en Ivanti Endpoint Manager EPM que permite a un atacante remoto no autenticado lograr la ejecución remota de código en el servidor objetiv...

CVE-2026-10290-SQLI

Hotel and Tourism Reservation System - Unauthenticated SQL Injection in tour.php Vulnerability Details Field| Details ---|--- Title| Hotel and Tourism Reservation System - SQL Injection via tour GET Parameter Vendor| code-projects.org Vendor URL|...

CVE-2026-63030-CVE-2026-60137-wp2shell-poc

wp2shell — WordPress REST API Time-Based Blind SQLi → RCE Proof‑of‑Concept Description pocwptot.py is a proof‑of‑concept PoC to exploit a time‑based blind SQL injection vulnerability on the WordPress REST API batch endpoint, and perform an escalation chain up to Remote Code Execution RCE...

CVE-2026-38812-RuoYi-SQL-Injection

CVE ID CVE-2026-38812 PRODUCT RuoYi VERSION v4.8.2 PROBLEM TYPE SQL Injection DESCRIPTION RuoYi v4.8.2 is vulnerable to SQL Injection via the /tool/gen/createTable endpoint...

CMS-Made-Simple-2.2.9-CVE-2019-9053

CMS-Made-Simple-2.2.9 - SQL-Injection-Exploit - CVE-2019-9053 Description This repository contains an exploit for an unauthenticated SQL injection vulnerability in CMS Made Simple versions 2.2.9 and earlier. This vulnerability, identified under CVE-2019-9053 , allows an attacker to retrieve...

CVE-2026-88854

CVE-2026-88854 — OrdaSoft Joomla Gallery SQL Injection Python 3 PoC scanner/exploit for CVE-2026-88854 in OrdaSoft OS Responsive Image Gallery for Joomla. | ---|--- Component| comosgallery, comosgallerylight Affected| 1.0.0 – 6.2.6 Fixed in| 6.2.7+ CVSS 4.0| 9.3 Critical Auth| None public...

CVE-2026-57517-CWP

CVE-2026-57517 CWP Exploit This repository contains a Go-based proof-of-concept tool for testing a known Control Web Panel CWP vulnerability scenario related to CVE-2026-57517. The implementation targets a blind SQL injection path and includes optional webshell deployment and command execution fl...

CVE-2026-65761

CVE-2026-65761 - Inyección SQL en EasyStore Pro a través de filtersortby prueba de concepto Este repositorio proporciona una prueba de concepto educativa para CVE-2026-65761, una vulnerabilidad de inyección SQL sin autenticación que afecta a las versiones 1.0.0 a 2.0.2 inclusive de la extensión...

CVE-2024-11728

CVE-2024-11728 KiviCare – Clinic & Patient Management System EHR WordPress Plugin Unauthenticated SQL Injection PoC This repository contains a Proof of Concept PoC script for exploiting an SQL Injection vulnerability in the KiviCare – Clinic & Patient Management System EHR WordPress Plugin,...

CVE-2026-100739

A vulnerability was detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This impacts an unknown function of the file viewresult.php. Performing a manipulation of the argument seno results in sql injection. Remote exploitation of the attack is...

CVE-2026-100739

A SQL injection vulnerability exists in the mathurvishal CloudClassroom-PHP-Project (up to commit 5dadec098bfbbf3300d60c3494db3fb95b66e7be). The flaw impacts an unknown function within the viewresult.php file, specifically allowing for exploitation via manipulation of the seno argument. This vuln...

CVE-2026-100739 mathurvishal CloudClassroom-PHP-Project viewresult.php sql injection

A vulnerability was detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This impacts an unknown function of the file viewresult.php. Performing a manipulation of the argument seno results in sql injection. Remote exploitation of the attack is...

CVE-2026-63030

CVE-2026-63030 + CVE-2026-60137 — WP2Shell RCE sin autenticación previa en WordPress Core mediante confusión de rutas por lotes REST + SQLi Descripción general CVE-2026-63030 CVSS 9.8 y CVE-2026-60137 CVSS 9.1 forman una cadena crítica de ejecución remota de código sin autenticación previa en...

CVE-2019-9053-working-

CVE-2019-9053-working script- CMS Made Simple 2.2.10 - SQL Injection . Actual working version Updated the script to work with latest python versions Added Exception Handling for each function You can also calibrate time.sleep inside the exception handling blocks depending on response and connecti...

CVE-2025-68055-poc

CVE-2025-68055 Authenticated SQL injection in Hydra Booking Plugin get function, Hydra Booking hardcodes user input directly into the raw sql request instead of using prepare to sanitize input, leading to Time-Based Blind SQL injection. Exploit A simple run command as such will tell you whether o...

CVE-2026-72898

CVE-2026-72898 PoC : Inyección SQL no autenticada en Metabase Inyección SQL previa a la autenticación en Metabase que conduce a la toma de control del administrador Prueba de concepto para CVE-2026-72898, una inyección SQL crítica no autenticada en el endpoint de restablecimiento de contraseña de...

POC-GeoLeak-CVE-2026-52715

GeoLeak — PoC de CVE-2026-52715 Proof of Concept educativa de GeoLeak CVE-2026-52715, inyeccion SQL no autenticada CVSS 9.3 en el plugin GEO my WordPress = 4.5.5 para WordPress. Los parametros swlatlng y nelatlng de los limites del mapa se interpolan sin saneado en la clausula WHERE. Laboratorio...

CVE-2025-5287

CVE-2025-5287 Likes and Dislikes Plugin = 1.0.0 - Inyección SQL no autenticada Descripción El plugin Likes and Dislikes Plugin para WordPress es vulnerable a inyección SQL a través del parámetro 'post' en todas las versiones hasta la 1.0.0 incluida, debido a un escapado insuficiente en el parámet...

CVE-2023-34468

CVE-2023-34468 — Apache NiFi ExecuteSQL H2 RUNSCRIPT RCE PoC Short Python PoC for abusing an editable Apache NiFi ExecuteSQL processor with an H2 RUNSCRIPT payload to trigger remote command execution through a Bash reverse shell. For authorized testing and research only. Do not use against system...

pgadmin-ai-assistant-sql-injection-cve-2026-17351-lexer-differential-bypass

CVE-2026-17351 — Bypass de solo lectura del Asistente de IA de pgAdmin 4 mediante diferencia de lexer PoC para CVE-2026-17351, un bypass crítico CVSS 9.0 de inyección SQL en el Asistente de IA de pgAdmin 4. Resumen de la vulnerabilidad Las versiones de pgAdmin 4 desde la 9.13 hasta la 9.16 utiliz...