Grafana-Final-Scanner

Grafana Final Scanner A command-line vulnerability scanner for Grafana. It fingerprints the installed Grafana version, runs a set of version-aware CVE checks, audits common configuration weaknesses, stores results in a local database, and can serve them through a small web dashboard. Legal This...

wifiphisher

About Wifiphisher is a rogue Access Point framework for conducting red team engagements or Wi-Fi security testing. Using Wifiphisher, penetration testers can easily achieve a man-in-the-middle position against wireless clients by performing targeted Wi-Fi association attacks. Wifiphisher can be...

xsscrapy

xsscrapy Fast, thorough, XSS/SQLi spider. Give it a URL and it'll test every link it finds for cross-site scripting and some SQL injection vulnerabilities. See FAQ for more details about SQLi detection. From within the main folder run: ./xsscrapy.py -u http://example.com If you wish to login then...

Blisqy

1. Blisqy Blisqy is a tool to aid Web Security researchers to find Time-based Blind SQL injection on HTTP Headers and also exploitation of the same vulnerability. The exploitation enables slow data siphon from a database currently supports MySQL/MariaDB only using bitwise operation on printable...

andor

andor Blind SQL Injection Tool with Golang Usage Download andor.go and go to the folder where the file andor.go located. And type this to command prompt: go run andor.go --url "http://deneme.com/index.php?id=1" Note: Get parameter value must be correct, otherwise it will not work...

CVE-2026-49845

A flaw was found in Apache Hive Metastore. Authenticated users with access to Hive Metastore APIs can exploit a SQL injection vulnerability by submitting crafted partition names in metastore Remote Procedure Call RPC requests when direct SQL is enabled. This allows them to read, modify, or affect...

CVE-2026-44265

A flaw was found in Elo. This vulnerability allows an attacker to achieve arbitrary code execution or Structured Query Language SQL injection by supplying malicious input to the programmatic Abstract Syntax Tree AST interface. Because the interface inserts unvalidated input directly into generate...

CVE-2026-1907

A flaw was found in Kong Gateway. A SQL injection vulnerability exists in its clustering communication logic when operating in Hybrid Mode. An authenticated attacker with network access to the Control Plane clustering port and a valid client certificate can exploit this flaw by sending specially...

CVE-2026-107384

A flaw was found in MariaDB Connector/Node.js. When the permitSetMultiParamEntries configuration setting is enabled, object keys are inserted into Structured Query Language SQL statements without proper escaping. A remote attacker can exploit this flaw by providing crafted input containing...

CVE-2026-107385

A flaw was found in MariaDB Connector/Node.js. When handling text-protocol database queries, the connector improperly escapes quote characters using backslashes without checking if the database session has backslash escaping disabled. A remote attacker can supply crafted input into query...

CVE-2026-103946

A flaw was found in Nessus. A remote authenticated attacker could exploit a Structured Query Language SQL injection vulnerability by submitting specially crafted requests to the application. Successful exploitation could lead to unauthorized data modification and information disclosure, allowing...

CVE-2026-115418

A flaw was found in @aws-cdk/aws-redshift-alpha. A SQL injection vulnerability in the database-query custom resource handlers allows an attacker capable of modifying construct property values to execute arbitrary SQL statements with superuser privileges on the Amazon Redshift cluster. By supplyin...

CVE-2026-111866

A flaw was found in manong. Due to improper input sanitization in the func.php script, the application is vulnerable to Structured Query Language SQL injection. A remote attacker can exploit this flaw by sending specially crafted input to affected database functions, allowing them to manipulate...

CVE-2026-110733

A flaw was found in the Apache SIS SQL storage module. When sorting a stream of features, the application appends sort clauses to database queries after the ORDER BY statement without properly quoting identifier characters. An attacker capable of supplying a crafted sort clause could exploit this...

CVE-2026-97377

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, the legacy SOAP portal method portalgetentrylist propagates caller-controlled where and orderby values into SQL query construction without sufficient neutralization....

CVE-2026-69145

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, AOR report generation reloads the value stored in aorfields.field and concatenates it into report SQL without strict field validation. An authenticated user able to...

CVE-2026-71548

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, AORReport::buildreportquerywhere incorporates a report editor's parametervalue when valuetype=Field without sufficient validation. An authenticated user who can save...

CVE-2026-69141

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, the CasesController actiongetkbarticles action interpolates $POST'search' into a CASE WHEN ... LIKE expression and the SQL WHERE clause. Although securexss normally...

CVE-2026-69140

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, GetLatestRevision.php interpolates getlatestforid directly into an SQL UPDATE statement. Although securexss normally entity-encodes quotes, an input prefixed with an...

CVE-2026-69142

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, the jjwgMaps map marker endpoint uses the authenticated caller's distance value in the mapmarkers action without strict numeric validation or parameterization. An...