NEX-Forms Plugin < 7.9.7 - SQL Injection

The NEX-Forms WordPress plugin before 7.9.7 does not properly sanitise and escape user input before using it in SQL statements, leading to SQL injections. The attack can be executed by anyone who is permitted to view the forms statistics chart, by default administrators, however can be configured...

Garage Management System 1.0 - SQL Injection

Garage Management System 1.0 contains a SQL injection vulnerability in /login.php via manipulation of the argument username with input [email protected]' AND SELECT 6427 FROM SELECTSLEEP5LwLu AND 'hsvT'='hsvT. An attacker can possibly obtain sensitive information from a database, modify data, and/or execut...

mssqli-duet

MSSQLi-DUET - MSSQL Injection-based Domain User Enumeration Tool SQL injection script for MSSQL that extracts domain users from an Active Directory environment based on RID bruteforcing. Supports various forms of WAF bypass techniques through the implementation of SQLmap tamper functions...

CVE-2026-122038

A flaw was found in EmployeeRecruitmentSystem. A remote, unauthenticated attacker can submit specially crafted input to the Requirement Board Update Handler source/reqformprocessing.php, leading to a Structured Query Language SQL injection vulnerability. This flaw allows an attacker to execute...

BinGoo

,--="=--, / ." .-. "./ / ,/ : : /\ \ | /o\ :: /o\ | / -'| :=" "=: | \ / .-"-. \ | / .-"-. .--- --| /,.-'-.,\ |-- ---. /-===- / | / | | | | | | ' | | / \ / | | | | | | | | | | | | | || |/| || | || / / '-----v1--------------By-Hood3dRob1n----' Welcome to the BinGoo README file! This should give you...

ghauri

Like Ghauri, consider supporting the developer Ghauri An advanced cross-platform tool that automates the process of detecting and exploiting SQL injection security flaws. Requirements Python 3 Python pip3 Installation cd to ghauri directory. install requirements: python3 -m pip install --upgrade ...

CVE-2026-111492

A flaw was found in MatchPoint. The application's push notification handler constructs database queries by concatenating untrusted input received from push notification messages, resulting in a SQL Structured Query Language injection vulnerability. An attacker capable of sending crafted messages ...

CVE-2026-100365

A flaw was found in SuiteCRM. An authenticated remote user with report generation access can supply crafted field labels that are concatenated directly into database queries without proper validation. This vulnerability enables SQL injection SQLi, allowing an attacker to achieve unauthorized...

ScanQLi

ScanQLi ScanQLi is a simple SQL injection scanner with somes additionals features. This tool can't exploit the SQLi, it just detect them. Tested on Debian 9 Features Classic Blind Time based GBK soon Recursive scan follow all hrefs of the scanned web site Cookies integration Adjustable wait delay...

Optiva-Framework

Optiva-Framework 🕵️ Web Application Scanner 💉 Author : Joker-Security dev-labs ✔️ Description : You can use this Framework on your website to check the security of your website by finding the vulnerability in your website or you can use this tool to Get admin panel search SQL injection by dork As...

SafeLine

SafeLine - Make your web apps secure 🏠 Website | 📖 Docs | 🔍 Live Demo | 🙋‍♂️ Discord | 中文版 🏆 Achievements 👋 INTRODUCTION SafeLine is a self-hosted WAFWeb Application Firewall to protect your web apps from attacks and exploits. A web application firewall helps protect web apps by filtering and...

CVE-2025-14598

CVE-2025-14598 CVSS: 9.8 Remote Unauthenticated SQL Injection leading to Remote Code Execution. Executive Summary A SQL Injection vulnerability was identified in the login functionality of BET e-Portal, a software solution widely deployed across educational institutions for student information an...

CVE-2026-81815

A flaw was found in Apache OFBiz. A remote, unauthenticated attacker can exploit a Structured Query Language SQL injection vulnerability by submitting a specially crafted search request. This issue occurs because the entity engine improperly sanitizes input values when building database queries o...

CVE-2025-71456

A flaw was found in vtenext. A Structured Query Language SQL injection vulnerability exists in the Fax module due to improper validation of the fieldname parameter. An authenticated remote attacker with low privileges can exploit this flaw by sending a specially crafted request to execute arbitra...

EUVD-2026-117816

SQL injection in the push notification handler of the MatchPoint Android app, which processes messages from Firebase Cloud Messaging and constructs queries by concatenating untrusted data. An attacker capable of interacting with the component could manipulate queries and access sensitive...

CVE-2025-71458

FTS3 Web Monitoring (fts-monitoring ) versions 3.12.0 through 3.13.2 and 3.14.0 are vulnerable to an unauthenticated SQL injection in the /linkinfo endpoint. The flaw resides in the get_linkinfo function, where an attacker can inject SQL via the source_se and dest_se query parameters. This allows...

CVE-2026-63774

The Subnet Solutions PowerSYSTEM Center is vulnerable to an SQL Injection (CWE-89) due to insufficient input validation in the report designer . This flaw allows an authenticated user to execute unauthorized SQL commands. The vulnerability carries a CRITICAL severity rating (CVSS 4.0 score of 9.4...

lazyweb

LazyWeb - Vulnerable Web Application LazyWeb is a demonstration web application designed to showcase common server-side application vulnerabilities. Each vulnerability is categorized with its respective difficulty rating to provide a comprehensive learning experience for developers and security...

bbqsql

BBQSQL A Blind SQL Injection Exploitation Tool Table Of Contents What is BBQSQL? Overview of Readme High Level Usage Install BBQSQL Options Query Syntax Overview HTTP Parameters Export Config Import Config Custom Hooks Found a Bug? Can I Help? What's Up with the Name? What is BBQSQL? Blind SQL...

sqlifinder

SQL Injection scanner made with python. Features • Install • Usage • sqlifinder is a tool with the function of detecting GET-based sql injection vulnerabilities in web applications using waybackurls, web crawlers and sql injection payloads. Features Fast and powerful scanner Include web crawler a...