CVE-2024-34222

Human Resource Management System 1.0 Submitter: Kha Do Vulnerability SQL injection Description SQL injection vulnerability in /hrm/country.php in SourceCodester Human Resource Management System 1.0 allow attackers to execute arbitrary SQL commands via the searccountry parameters. Affected compone...

CVE-2022-34265

CVE-2022-34265 Usage start docker-compose build docker-compose up -d stop docker-compose down PoC verification of Django vulnerability CVE-2022-34265 A vulnerability CVE-2022-34265 in Django was disclosed on July 5, 2022 US time. This article describes our discussion of this vulnerability and the...

FUXA <= 1.1.12 - Unauthenticated SQL Injection

FUXA = 1.1.12 contains a SQL injection caused by unsanitized input in /api/signin, letting attackers execute arbitrary SQL commands, exploit requires sending crafted input to the endpoint. id: CVE-2023-31719 info: name: FUXA = 1.1.12 - Unauthenticated SQL Injection author: Securin severity:...

Mingsoft MCMS 5.1 - SQL Injection

Mingsoft MCMS 5.1 contains a SQL injection vulnerability in POST /ms/cms/content/list.do via the contentCategoryId parameter mapped to categoryId in ContentBizImpl.java / IContentDao.xml. The original PoC uses a time-based SLEEP payload. Snyk's write-up uses an authenticated request PR:Low, while...

rConfig 3.9.4 - SQL Injection

rConfig 3.9.4 and previous versions has unauthenticated compliancepolicyelements.inc.php SQL injection. Because nodes' passwords are stored by default in cleartext, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices. id: CVE-2020-10547 info: nam...

Piwigo 13.7.0 - SQL Injection

Piwigo is open source photo gallery software. Prior to version 13.8.0, there is a SQL Injection vulnerability in the login of the administrator screen. The SQL statement that acquires the HTTP Header User-Agent is vulnerable at the endpoint that records user information when logging in to the...

TurboMeeting - Boolean-based SQL Injection

A Boolean-based SQL injection vulnerability in the "RHUB TurboMeeting" web application. This vulnerability could allow an attacker to execute arbitrary SQL commands on the database server, potentially allowing them to access sensitive data or compromise the server. id: CVE-2024-38289 info: name:...

CVE-2024-43468_mTLS_go

CVE-2024-43468 SCCM SQL Injection Exploit mTLS client certs from MacOS keychain version Go implementation of CVE-2024-43468 exploit that uses macOS Keychain for mTLS authentication without need to export keys from keychain. Additionally: Added proxy support to not use problematic proxychains. Add...

Webasyst Shop-Script CMS SQL Injection

The vulnerability of the Webasyst framework for designing content management systems and the Shop-Script CMS system lies in the lack of protective measures for the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL code remotely...

Webasyst Shop-Script CMS SQL Injection

The vulnerability of the Webasyst framework for designing content management systems and the Shop-Script CMS system lies in the lack of protective measures for the SQL query structure. Exploiting this vulnerability allows an attacker operating remotely to execute arbitrary SQL code...

Webasyst Shop-Script CMS SQL Injection

The vulnerability of the Webasyst framework for designing content management systems and the Shop-Script CMS system lies in the lack of protective measures for the SQL query structure. Exploiting this vulnerability allows an attacker operating remotely to execute arbitrary SQL code...

Webasyst Shop-Script CMS SQL Injection

The vulnerability of the Webasyst framework for designing content management systems and the Shop-Script CMS system lies in the lack of protective measures for the SQL query structure. Exploiting this vulnerability allows an attacker operating remotely to execute arbitrary SQL code...

CVE-2024-43917

CVE-2024-43917 This script demonstrates an SQL injection vulnerability found in the TI WooCommerce Wishlist plugin for WordPress, versions up to 2.8.2 CVE-2024-43917. The vulnerability allows unauthenticated users to execute arbitrary SQL commands on the website’s database, potentially exposing...

CVE-2026-126489

OpenEMR before 8.5.0 contains a second-order SQL injection vulnerability in the IPPF contraceptive issue feature because issueippfconsave concatenates layoutoptions fieldid values into a REPLACE INTO query as column names. Authenticated administrators can add a malicious fieldid via editlayout.ph...

CVE-2026-126482

OpenEMR before 8.5.0 contains an SQL injection vulnerability in SLEOB::slInvoiceNumber in src/Billing/SLEOB.php, which concatenates the CLP01 claim identifier from uploaded X12 835 ERA files into a query without escaping or parameter binding. Authenticated users with billing permissions, or a...

sparx_hack

Multiple vulnerabilities in Sparx Pro Cloud Server and Enterprise Architect Exploit code for executing arbitrary SQL command in Sparx PCS server without authentication. NOTE: the key is NOT correct to prevent s|rIpt kIddi3 from easy hacking ;- Full writeup:...

EUVD-2026-125135

OpenEMR before 8.5.0 contains a second-order SQL injection vulnerability in the IPPF contraceptive issue feature because issueippfconsave concatenates layoutoptions fieldid values into a REPLACE INTO query as column names. Authenticated administrators can add a malicious fieldid via editlayout.ph...

CVE-2026-126489

OpenEMR versions prior to 8.5.0 are vulnerable to a second-order SQL injection in the IPPF contraceptive issue feature. The root cause is that the issue_ippf_con_save function concatenates layout_options field_id values directly into a REPLACE INTO query as column names without proper neutralizat...

CVE-2026-126489 OpenEMR before 8.5.0 SQL Injection via IPPF Contraceptive Issue Feature

OpenEMR before 8.5.0 contains a second-order SQL injection vulnerability in the IPPF contraceptive issue feature because issueippfconsave concatenates layoutoptions fieldid values into a REPLACE INTO query as column names. Authenticated administrators can add a malicious fieldid via editlayout.ph...

django-cve-2025-64459

Django CVE-2025-64459 This application demonstrates CVE-2025-64459 affecting multiple Django versions. This vulnerability has been patched in newer releases of Django. SQL Injection SQL Injection is when user-provided input is treated as part of a SQL query, allowing an attacker to change how the...