CVE-2025-41373

CVE-2025-41373 – SQL Injection in Gandia Integra Total Author: Byte Reaper CVE: CVE-2025-41373 Vulnerability: Authenticated SQL Injection Affected Path: /encuestas/integrawebv4/integra/html/view/hislistadoacciones.php?idestudio= Description: This endpoint concatenates the idestudio parameter...

CVE-2025-8971

CVE-2025-8971 SQL Injection Author: Byte Reaper Description : This exploit for CVE-2025-8971, a SQL injection vulnerability in itsourcecode Online Tour and Travel Management System 1.0. The vulnerability exists in /admin/operations/travellers.php and can be exploited remotely via the val-username...

CVE-2025-8471

CVE-2025-8471 SQL Injection PoC Author : Byte Reaper CVE : CVE-2025-8471 Vulnerability : SQL Injection in “projectworlds Online Admission System v1.0” Description : A blind SQL injection exists in adminlogin.php?aid=. This PoC sends a series of GET requests with various payloads—both two-stage...

CVE-2026-78804_Dolibarr_authenticated_SQL_injection

Dolibarr — PoC de inyección SQL autenticada Inyección SQL que afecta a la funcionalidad de gestión de stock de productos a través del parámetro seuilstockalerte. Versiones afectadas Probado y confirmado en: 19.0.4 20.0.4 21.0.4 22.0.5 23.0.3 24.0.0 Funcionaba hasta el reporte. Parámetro vulnerabl...

CVE-2025-26794-exploit

CVE-2025-26794: Exim ETRN SQL Injection Exploit A proof-of-concept exploit tool for CVE-2025-26794, demonstrating SQL injection vulnerability in Exim 4.98 mail server via the ETRN command when using SQLite DBM storage. ⚠️ Legal Disclaimer FOR AUTHORIZED SECURITY TESTING ONLY This tool is provided...

CVE-2025-9172

Exploit: Time-Based SQL Injection via /vibes/v1/beacon unauthenticated Browser Console PoC async = const url = 'http://localhost/wordpress/index.php?restroute=/vibes/v1/beacon'; async function sendresource const body = type: 'navigation', resource, // injected into SQL unprepared authenticated: 0...

CVE-2024-55099-Online-Nurse-Hiring-System-v1.0-SQL-Injection-Vulnerability-

CVE-2024-55099-Online-Nurse-Hiring-System-v1.0-SQL-Injection-Vulnerability Exploit Author: ugurkarakoc Vendor Homepage https://phpgurukul.com/online-nurse-hiring-system-using-php-and-mysql Software Link https://phpgurukul.com/?sdmprocessdownload=1&downloadid=17826 Overview...

ColorOS-CVE-2025-10184

信息来源 漏洞原理及解决方案技术原理 漏洞说明 类型：数据库注入攻击1=1 AND 效果：任意APP读取短信数据。 无需权限、无需用户交互、无感知读取 影响：本机的所有短信信息、短信验证码泄露 涉及范围：OPPO 及其子品牌一加、realme 影响范围：根据maoyixuan提交的机型显示， 17年发布的ColorOS 6.0.1存在漏洞，此漏洞可能伴随了OPPO的OEM生涯 修复情况：10月4日开始对ColorOS 15推送系统文件更新：15.0.0.860Patch01|1.9MB，10月9日对ColorOS 12-14推送 测试漏洞：国内下载...

CVE-2026-24417

CVE-2026-24417: OpenSTAManager has a Time-Based Blind SQL Injection with Amplified Denial of Service Overview Field| Details ---|--- CVE ID| CVE-2026-24417 Severity| HIGH Advisory| View Advisory Discovered by| Lukasz Rybak Affected Products devcode-it/openstamanager versions: 2.9.8 CWE...

CVE-2026-30655

CVE-2026-30655 — SQL Injection in esiclivre password reset Summary A SQL injection vulnerability exists in the password reset endpoint of esiclivre. An unauthenticated attacker can inject SQL via the cpfcnpj POST parameter, potentially resulting in unauthorized access to sensitive information...

CVE-2025-11177

Trigger the SQLi with a time-based payload in the public login curl -w '\nTIME:%timetotal\n' -s \ -d 'log=anything%27%3B%20SELECT%20pgsleep5%3B%20--&pwd=irrelevant&wp-submit=Log+In' \ -d 'redirectto=' \ -d 'testcookie=1' \ 'http://target/wp-login.php'...

CVE-2026-25513

CVE-2026-25513: FacturaScripts has SQL Injection in API ORDER BY Clause Overview Field| Details ---|--- CVE ID| CVE-2026-25513 Severity| HIGH Advisory| View Advisory Discovered by| Lukasz Rybak Affected Products facturascripts/facturascripts versions: 2025.81 CWE Classification CWE-20: Improper...

CVE-2026-24416

CVE-2026-24416: OpenSTAManager has a Time-Based Blind SQL Injection in Article Pricing Module Overview Field| Details ---|--- CVE ID| CVE-2026-24416 Severity| HIGH Advisory| View Advisory Discovered by| Lukasz Rybak Affected Products devcode-it/openstamanager versions: = 2.9.8 CWE Classification...

CVE-2026-2413

CVE-2026-2413 Ally – Web Accessibility & Usability = 4.0.3 - Inyección SQL no autenticada a través de la ruta de URL Descripción El plugin Ally – Web Accessibility & Usability para WordPress es vulnerable a inyección SQL a través de la ruta de URL en todas las versiones hasta la 4.0.3 inclusive...

CVE-2026-96883

pgcollection is an open source extension to PostgreSQL. A type confusion issue in AWS pgcollection 2.0.0 through 2.1.1 might allow an authenticated remote user to execute arbitrary code as the postgres operating system user via crafted SQL statements that rely on mismatched type metadata in...

CVE-2026-96883

pgcollection is an open source extension to PostgreSQL. A type confusion issue in AWS pgcollection 2.0.0 through 2.1.1 might allow an authenticated remote user to execute arbitrary code as the postgres operating system user via crafted SQL statements that rely on mismatched type metadata in...

UBUNTU-CVE-2026-96883

pgcollection is an open source extension to PostgreSQL. A type confusion issue in AWS pgcollection 2.0.0 through 2.1.1 might allow an authenticated remote user to execute arbitrary code as the postgres operating system user via crafted SQL statements that rely on mismatched type metadata in...

CVE-2026-78070

Inyección SQL mediante Shortcode ORDER BY en plgcontentdpcalendar DPCalendar Free ≤ 10.11.2 — Un usuario con rol Autor extrae la base de datos completa mediante inyección ciega basada en tiempo RESUMEN El plugin de contenido plgcontentdpcalendar analiza los shortcodes events order="..."/events...

CVE-2026-24419

CVE-2026-24419: OpenSTAManager has a SQL Injection in the Prima Nota module Overview Field| Details ---|--- CVE ID| CVE-2026-24419 Severity| HIGH Advisory| View Advisory Discovered by| Lukasz Rybak Affected Products devcode-it/openstamanager versions: = 2.9.8 CWE Classification CWE-89: Improper...

sqli-hunter-CVE-2024-51482-PoC

sqli-hunter-CVE-2024-51482-PoC Python scripts for exploiting CVE-2024-51482 SQLi in ZoneMinder — HTB CCTV sqli-hunter — CVE-2024-51482 Description This script automates the extraction of databases, tables, columns, and credentials by exploiting CVE-2024-51482, a Boolean-based SQL Injection...