cs4239-cve-2020-15873

CVE-2020-15873 CVE-2020-15873 的概念验证 - LibreNMS librenms librenms 开发 调试 LibreNMS Docker 实例 1. 获取容器的 shell： $ sudo docker exec -it librenmsvuln /bin/bash 2. 读取 LibreNMS 生成的日志： $ tail -f /opt/librenms/logs/librenms.log 调试 MariaDB Docker 实例 1. 获取容器的 shell： $ sudo docker exec -it librenmsdbvuln...

CVE-2026-41573 OpenAM LDAP Injection via `_queryId` Parameter

Open Access Management OpenAM is an access management solution. Prior to 16.1.1, IdentityResourceV1.queryCollection passes the queryId parameter from /json/realm/users to CrestQuery with escapeQueryId disabled, bypassing protection added for CVE-2021-29156. The unescaped value reaches...

CVE-2026-28576-poc

CVE-2026-28576：Android 通讯录提供程序中的 SQL 注入 选中一个联系人，泄露全部联系人：一个 targetSdk 兼容性开关将单联系人选择器授权变成完整的通讯录数据库泄露。 Android 17 通过 setStrictColumns / setStrictGrammar 强化了通讯录提供程序以抵御 SQL 注入——但该强化措施被置于一个受 targetSdk 限制的兼容性变更之后（ENFORCESTRICTSQLCHECKS，id 484953293，enableAfterTargetSdk="36"）。任何以 SDK 36...

CVE-2021-22911

CVE-2021-22911 Pre-Auth Blind NoSQL Injection leading to Remote Code Execution in Rocket Chat 3.12.1 The getPasswordPolicy method is vulnerable to NoSQL injection attacks and does not require authentication/authorization. It can be used to take over accounts by leaking password reset tokens. Taki...

CVE-2014-9173

CVE-2014-9173: Google Document Embedder - Time-Based Blind SQL Injection Exploitation Author: ratiros01 Original PoC: https://www.exploit-db.com/exploits/35371...

CVE-2024-32640

CVE-2024-32640 MySQL Blind SQL Injection Proof of Concept This Python script demonstrates a time-based blind SQL injection exploit for MySQL databases , specifically designed for CVE-2024-32640. It can be used to verify vulnerability in a target URL, and if the vulnerability exists, extract...

CVE-2025-7404-CalibreWeb-0.6.24-BlindCommandInjection

CVE-2025-7404-CalibreWeb-0.6.24-BlindCommandInjection CVE-2025-7404 exploit...

CVE-2023-48084

CVE-2023-48084 Python exploit for the CVE-2023-48084 - Nagios XI before version 5.11.3 was discovered to contain a SQL injection vulnerability via the bulk modification tool. The exploit uses /admin/bannermessage-ajaxhelper.php?action=acknowledgebannermessage&id= to execute SQL queries, and...

CVE-2021-3262

CVE-2021-3262 TripSpark VEO Transportation / NovusEDU における SQL インジェクション TripSpark VEO Transportation に同梱されている公開の「Student Busing Information」参照ページは、認証なしの POST ボディ入力を受け取り、パラメータ化もサーバーサイド検証も行わずに SQL Server クエリへ連結します。editOEN パラメータ（生徒番号フィールド）がインジェクション可能です。...

CVE-2024-13483

CVE-2024-13483 LTL Freight Quotes – SAIA Edition = 2.2.10 - Unauthenticated SQL Injection Description The LTL Freight Quotes – SAIA Edition plugin for WordPress is vulnerable to SQL Injection via the 'editid' and 'dropshipeditid' parameters in all versions up to, and including, 2.2.10 due to...

CVE-2026-16482 rtMedia for WordPress, BuddyPress and bbPress <= 4.7.11 - Unauthenticated SQL Injection via 'compare' Parameter

The rtMedia for WordPress, BuddyPress and bbPress plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'compare' parameter in all versions up to, and including, 4.7.11 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...

CVE-2025-13673

CVE-2025-13673 — Tutor LMS SQL Injection Lab Unauthenticated SQL Injection in Tutor LMS WordPress plugin = 3.9.6 via the couponcode parameter. Quick Start root@kitploit: 1. Clone and start the lab git clone https://github.com/dinosn/CVE-2025-13673.git cd CVE-2025-13673 ./setup.sh Deploys WordPres...

CVE-2026-72708

SPIP before 4.4.18 contains an unauthenticated blind SQL injection vulnerability in the SQL escaping layer that allows unauthenticated attackers to inject arbitrary SQL by supplying a crafted annee parameter value matching a word character followed by an open parenthesis, which bypasses escaping...

CVE-2026-72708 SPIP < 4.4.18 Unauthenticated Blind SQL Injection via sitemap.xml.html

SPIP before 4.4.18 contains an unauthenticated blind SQL injection vulnerability in the SQL escaping layer that allows unauthenticated attackers to inject arbitrary SQL by supplying a crafted annee parameter value matching a word character followed by an open parenthesis, which bypasses escaping...

CVE-2026-72708

SPIP before 4.4.18 contains an unauthenticated blind SQL injection vulnerability in the SQL escaping layer that allows unauthenticated attackers to inject arbitrary SQL by supplying a crafted annee parameter value matching a word character followed by an open parenthesis, which bypasses escaping...

CVE-2026-72708

SPIP before 4.4.18 is affected by an unauthenticated blind SQL injection in the public sitemap endpoint. The root cause lies in the MySQL escaper spip_mysql_cite() (in ecrire/req/mysql.php), which returns values unescaped when the target column is a date type and the input matches a word characte...

CVE-2026-52614

CVE-2026-52614 - RuoYi v4.8.3 filterKeyword Bypass SQL Injection 中文 | English Authorization required / 仅限授权测试 This repository is intended for security research and authorized testing only. Do not use it against systems without explicit permission. 本仓库仅用于安全研究与已获明确授权的测试。请勿对未授权系统使用。 中文说明 漏洞简介 RuoYi...

CVE-2023-30258-Magnus-Billing-v7-Command-Injection-PoC

CVE-2023-30258 — Magnus Billing v7 命令注入（PoC） Magnus Billing v7.3.0 存在未经身份验证的命令注入漏洞。icepay.php 中的 democ GET 参数未经过滤直接传递给 shell 函数，从而允许以 Web 服务器用户身份执行任意命令。该注入为盲注——输出不会反映在 HTTP 响应中——因此本漏洞利用脚本将每条命令的输出重定向到 webroot 内的文件中，并通过 HTTP 将其取回。 工作原理 1. 向 /mbilling/lib/icepay/icepay.php?democ=;; 发送 GET 请求。 2...

CVE-2026-24416

CVE-2026-24416: OpenSTAManager の商品価格設定モジュールにおける Time-Based Blind SQL Injection 概要...

CVE-2026-78082

Joomla Extension - joomshaper.com - Unauthenticated SQL Injection in Property Search and Map Filtering in SP Property 4.1.4 - The property search and listing query builders assembled several WHERE and ORDER BY clauses zipcode, sorting, pricerangedropdown, and psizerangedropdown by directly...