CVE-2026-67401

CVE-2026-67401 SQL injection in cPanel EmailTrack. Authenticated cPanel user with mail privileges writes arbitrary files as root via SQLite ATTACH DATABASE. One request to root. Haven't tested on a real target, code is only put together from public information and basic diff'ing. Do your due...

CVE-2026-29782-OpenSTAManager-RCE

CVE-2026-29782 — OpenSTAManager auth-SQLi → PHP object injection → RCE PoC for remote code execution inOpenSTAManager ≤ 2.10.1. oauth2.php looks up a zzoauth2 row by the attacker-controlled state GET parameter and calls unserialize on its accesstoken column without anallowedclasses restriction...

CVE-2026-78837

CVE-2026-78837 Description An SQL injection vulnerability in the apformid parameter in AppNitro MachForm v30 allows attackers to access sensitive database information via a crafted SQL statement. Affected Component Tested on MachForm - Version 30 Attack Type Remote Attack Vectors An unauthenticat...

CVE-2026-72898

CVE-2026-72898 Metabase password-reset unauthenticated SQL injection ★ CVE-2026-72898 Metabase /api/session/resetpassword unauthenticated blind SQLi PoC ★ https://github.com/user-attachments/assets/4efe5ae3-2a41-4567-815b-ee3f731a5a59 Overview CVE-2026-72898 is an unauthenticated SQL injection in...

CVE-2026-72898-metabase-sqli

CVE-2026-72898 — Metabase unauthenticated SQL injection detector + analysis -black Unauthenticated SQL injection in Metabase via POST /api/session/resetpassword. CVSS 10.0 , in the CISA KEV catalog, exploited in the wild. An undeclared field in the password-reset request body reaches the...

NeutrinoBotHack

NeutrinoBotHack Blind SQL injection in Neutrino panel...

CVE-2026-42167

CVE-2026-42167: SQL Injection in ProFTPD modsql 📋 Executive Summary CVE-2026-42167 is a critical SQL injection vulnerability in ProFTPD's modsql module that allows authentication bypass , backdoor user injection , and remote code execution RCE. Attribute| Value ---|--- Type| SQL Injection CWE-89...

CVE-2026-42167-PoC

CVE reported by ZeroPath Research original writeup: https://zeropath.com/blog/proftpd-cve-2026-42167-auth-bypass-privesc-rce my version : https://jimmexploit.vercel.app/cve/proftpd-unauthenticated-sql-injection-leads-to-rce Description This repository contains a functional exploit for...

CVE-2026-42167-Exploit

CVE-2026-42167 Master Exploit Tool A professional security research tool for exploiting the CVE-2026-42167 vulnerability in ProFTPD's modsql module. This tool performs unauthenticated SQL injection to exfiltrate sensitive files from the server via time-based side-channel attacks. "Note: The...

cve-2026-6379

CVE-2026-6379 — WP Photo Album Plus :8080/?pageid=" --mode probe python3 ../pocs/exploit.py "http://:8080/?pageid=" --mode probe-calendar python3 ../pocs/exploit.py "http://:8080/?pageid=" --mode version python3 ../pocs/exploit.py "http://:8080/?pageid=" --mode hash A vulnerable target replies in...

CVE-2026-10110-SQLi

Student Details Management System 1.0 - SQL Injection Unauthenticated Vulnerability Information Field| Details ---|--- Product| Student Details Management System Vendor| code-projects.org Version| 1.0 Vulnerability Type| SQL Injection CWE-89 CVE ID| Pending CVSS Score| 9.8 Critical...

CVE-2026-42167-PoC

CVE-2026-42167 POC Pre-Authentication Remote Code Execution in ProFTPD via modsql SQL Injection Author: Van Glenndon Enad Original Discovery: ZeroPath Published: May 1, 2026 Severity: Critical CVSS v3.1 Score: 8.1 CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS v2 Score: 7.6...

CVE-2026-10170-RCE

Visitor Management System 1.0 - SQLi to Remote Code Execution Attack Chain Vulnerability Information Field| Details ---|--- Product| Visitor Management System Vendor| code-projects.org Version| 1.0 Vulnerability Classes| SQL Injection CWE-89 + Unrestricted File Upload CWE-434 CVE ID| Pending CVSS...

CVE-2021-35042

CVE-2021-35042: Django SQL injection vulnerability I. Overview Django is an open-source Web Application Framework written in Python, built on the MVC Model - View - Controller model. It was originally built to manage news content websites owned by the Lawrence publishing corporation, as a CMS...

CVE-2021-32099

poc : http://127.0.0.1:8888/pandoraconsole/include/chartgenerator.php?sessionid=%27%20union%20SELECT%201,2,%27idusuario|s:5:%22admin%22;%27%20as%20data%20--%20SgGO https://blog.sonarsource.com/pandora-fms-742-critical-code-vulnerabilities-explained...

CVE-2026-7394-SQLI

SQL Injection in Pizzafy Ecommerce System — admin/vieworder.php Details Field| Value ---|--- Vendor| SourceCodester Product| Pizzafy Ecommerce System using PHP and MySQL Version| 1.0 Vulnerability| SQL Injection CWE| CWE-89 CVSSv3 Score| 7.2 High Attack Vector| Network Auth Required| Yes...

CVE-2026-55871

GYM One is open-source gym management software for fitness centers, personal trainers, and sports clubs. Prior to 1.4.1, GYM One's admin/users/index.php concatenates the searchname and searchemail GET parameters into both the user-list query and the COUNT query used for pagination without prepare...

CVE-2024-42327

PoC for CVE-2024-42327 / ZBX-25623 A non-admin user account on the Zabbix frontend with the default User role, or with any other role that gives API access can exploit this vulnerability. An SQLi exists in the CUser class in the addRelatedObjects function, this function is being called from the...

CVE-2023-1454-Jeecg-Boot-qurestSql-SQLvuln

CVE-2023-1454 Jeecg-Boot-qurestSql-SQLvuln jmreport/qurestSql Unauthorized SQL Injection Batch Scan PoC. Jeecg-Boot is a rapid development platform based on Spring Boot and Jeecg-Boot-Plus. The latest version jeecg-boot 3.5.0 has been exposed with multiple SQL injection vulnerabilities. Usage...

CVE-2020-7471

CVE-2020-7471 This repository provides the environment and POC for CVE-2020-7471 Potential SQL injection via StringAggdelimiter vulnerability. Affected Django versions 1.11 to 1.11.28 exclusive 2.2 to 2.2.10 exclusive 3.0 to 3.0.3 exclusive Before downloading and using, the following operations a...