CVE-2024-30998

PHPGurukul Men Salon Management System 2.0 Welcome to the PHPGurukul Men Salon Management System 2.0 repository. This project aims to provide a robust system for Men Salon Management. Security Vulnerabilities CVE-2024-30998 Description: Vulnerable to SQL Injection via 'email' parameter. Affected...

CVE-2024-32640-SQLI-MuraCMS

And exploited SQL injection vulnerabilities in Mura/Masa CMS. Save this script as CVE-2024-32640.sh and make it executable: root@kitploit: chmod +x CVE-2024-32640.sh Run it using: root@kitploit: ./CVE-2024-32640-SQLI-MuraCMS.sh --url https://example.com/ --ghauri '--dump --threads 10' @Helltakerc...

CVE-2021-25076

CVE-2021-25076-Exploit Wordpress Plugin WP User Frontend 3.5.26 - SQL-Injection Authenticated CVE description: The WP User Frontend WordPress plugin before 3.5.26 does not validate and escape the status parameter before using it in a SQL statement in the Subscribers dashboard, leading to an SQL...

CVE-2021-37832

CVE 2021-37832 Hotel Druid 3.0.2 SQL Injection Vulnerability A SQL injection vulnerability exists in version 3.0.2 of Hotel Druid when SQLite is being used as the application database. A malicious attacker can issue SQL commands to the SQLite database through the vulnerable idappartamenti...

DiagTrackEoP

DiagTrackEoP Just another way to abuse SeImpersonate privilege. This PoC is based on this blog by @crisprss. In this blog @crisprss showed some interesting method to abuse SeImpersonate privilege using AzureAttestService which comes with recent verions of SQL server, PoC for that can be found her...

teler-waf

teler-waf teler-waf is a comprehensive security solution for Go-based web applications. It acts as an HTTP middleware, providing an easy-to-use interface for integrating IDS functionality with teler IDS into existing Go applications. By using teler-waf, you can help protect against a variety of...

CVE-2022-24124

Preface Casdoor is a centralized single sign-on SSO authentication platform based on OAuth 2.0/OIDC ID CVE ID: CVE-2022-24124 CNPD ID: CNPD-202201-7304 Affected Versions Severity: High 7.5 HIGH POC/EXP: Publicly available Casdoor POC:...

CVE-2024-43965

CVE-2024-43965 SendGrid for WordPress = 1.4 - Unauthenticated SQL Injection Description The SendGrid for WordPress plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 1.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparati...

CVE-2022-31061

CVE-2022-31061 PoC for GLPI CVE-2022-31061 A Proof of Concept for GLPI = 9.3.0 and 10.0.2 - Unauthenticated SQL injection on login page Legal disclaimer : Use of this script for attacking à target without mutual consent is illegal. It's is the end user responsibility to obey all applicables laws...

CVE-2024-0566

CVE-2024-0566 Smart Manager 8.27.0 - Post-Authenticated SQL Injection Exploit Title: Smart Manager 8.27.0 - Post-Authenticated SQL Injection Date: 2024-01-18 Exploit Author: Ivan Spiridonov - xbz0n Vendor Homepage: https://www.storeapps.org/ Software Link:...

CVE-2022-37210

CVE-2022-37210 CVE-2022-37210 POC Suggested description JFinal CMS 5.1.0 is affected by: SQL Injection. These interfaces do not use the same component, nor do they have filters, but each uses its own SQL concatenation method, resulting in SQL injection. Additional Information...

CVE-2024-2387

CVE-2024-2387 Advanced Form Integration – Connect WooCommerce and Contact Form 7 to Google Sheets and other platforms = 1.82.0 - SQL Injection to Reflected Cross-Site Scripting via integrationid Description The Advanced Form Integration – Connect WooCommerce and Contact Form 7 to Google Sheets an...

CVE-2020-15052

CVE-2020-15052 : Artica Proxy before 4.28.030418 Community Edition allows SQL Injection. Product Description: Artica Tech offers a powerful but simple-to-use solution, usually the preserve of Large and Multinational companies. With a starting price of just 99€ and more than 62 000 active servers,...

CVE-2020-9483

CVE-2020-9483 PoC of SQL Injection vulCVE-2020-9483,Apache SkyWalking Usage:python3 CVE-2020-9483.py -ip 127.0.0.1 You can use this script to get Database version by SQL Injection Click star if you like this script 如果觉得这个PoC帮助了你，希望能点个star Result： XD...

cve-2026-9082-drupal-postgresql-rce

CVE-2026-9082 Drupal PostgreSQL SQLi to RCE This repository contains a local lab and a short exploit for the Drupal JSON:API PostgreSQL SQL injection described in the Ambionics article. The important part of the exploit is the PostgreSQL escalation: once the injection can evaluate a SELECT...

rConfig_rce

rConfig 3.9 Combined SQL Injection and Command Injection PoC Overview This PoC targets rConfig version 3.9.4 and demonstrates exploitation through a combination of SQL Injection and Remote Command Injection vulnerabilities. It automates the process of: 1. Extracting database name via SQLi 2...

CVE-2024-42327_Zabbix_SQLi

🛡️ Zabbix 7.0.0 SQL Injection Exploit Script A Python script to exploit a Zabbix 7.0.0 authenticated SQL injection vulnerability, supporting multiple modes of action including user data extraction, session token leaks, remote command execution RCE, and custom query injection. ⚠️ DISCLAIMER: This...

CVE-2024-7854

CVE-2024-7854 Woo Inquiry = 0.1 - Unauthenticated SQL Injection Description: The Woo Inquiry plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 0.1 due to insufficient escaping on the user supplied parameter 'dbid' and lack of sufficient preparation on the...

SmartAsset-SQLinj-CVE-2020-26525

SmartAsset-SQLinj-CVE-2020-26525 Damstra Smart Asset 2020.7 has SQL injection via the API/api/Asset originator parameter. Smart Asset - version 2020.7 CVE-2020-26525 ========================== HTTP Request: GET /API/api/Asset?assetCode=XXX-08-X-01-06-01&...

CVE-2025-57529

CPAS-bug CPAS audit management information system has SQL injection vulnerability Beijing YouDataSum Technology Co., Ltd. domain: http://youdatasum.com info root@kitploit: CVE-ID: CVE-2025-57529 affected version: findArchiveReportByDah@RequestParamvalue = "pageNum", defaultValue = "0" int pageNum...