ScanQLi

ScanQLi ScanQLi 是一个简单的 SQL 注入扫描器，附带一些额外功能。 该工具无法利用 SQLi，仅用于检测它们。 在 Debian 9 上测试通过 功能 经典注入 盲注 基于时间的注入 GBK（即将推出） 递归扫描（跟随扫描网站的所有 href 链接） Cookie 集成...

CVE-2022-42098

KLiK-SocialMediaWebsite 版本 v1.0.1 漏洞说明： KLiK-SocialMediaWebsite v1.0.1 在 profile.php 的 id 参数存在 SQL 注入漏洞。 攻击向量： KLiK-SocialMediaWebsite v1.0.1 一旦创建用户，也可以通过 KLiK 用户页面在 KLiK 上查找人员。profile.php 的 'id' 参数可被滥用，用于注入任意 SQL 查询。 受影响： http://ipaddress/KLiK/profile.php?id=userid GET /KLiK/login.php Payload：...

wp2shell

wp2shell Inyección SQL ciega por confusión de ruta batch en REST de WordPress — cadena de explotación automatizada. CVE-2026-63030 / CVE-2026-60137 | ---|--- Afectado| WordPress 6.9.0 – 6.9.4 y 7.0.0 – 7.0.1 Corregido| WordPress 6.9.5 / 7.0.2 Sumidero| SQL authornotin vía parámetro authorexclude...

cve-2020-7471-Time_Blind_SQLi-

Questo repository non contiene un README...

CVE-2025-2812

CVE-2025-2812 — Vulnerabilità di SQL Injection in "Bilet Satış Otomasyonu" di Mydata Bilişim Ltd. Şti 📌 CVE-ID: CVE-2025-2812 📢 Avviso USOM: tr-25-0099 🛡️ Tipo di vulnerabilità: CWE-89 - SQL Injection Boolean-based Blind 🏢 Prodotto interessato: Bilet Satış Otomasyonu – Mydata Bilişim Ltd. Şti 🌐 UR...

CVE-2019-13027

CVE-2019-13027 Dettagli per la divulgazione di CVE-2019-13027 Cronologia contatti con il vendor: 1 luglio 2019 - Nessuna risposta, nessuna email di risposta. 4 luglio 2019 - Nessuna risposta, nessuna email di risposta. 8 luglio 2019 - Email inviata, Github creato. 11 luglio 2019 - Nessuna rispost...

CVE_2026_2576_PoC

CVE-2026-2576 — Business Directory Plugin SQLi PoC Unauthentifizierte zeitbasierte Blind-SQL-Injection Business Directory Plugin für WordPress ≤ 6.4.21 Inhaltsverzeichnis Überblick über die Schwachstelle Technische Analyse Lab-Anforderungen Lab-Einrichtung Ausführen des PoC Erwartete Ausgabe...

WordPress-NotificationX-CVE-2024-1698

Configurazione root@kitploit: docker-compose up --build Pulizia root@kitploit: docker-compose down Test root@kitploit: Measure-Command curl.exe http://localhost/wp-json/notificationx/v1/analytics -Method Post -Body 'nxid=1337&type=clicks=IFASCIISUBSTRINGselect userpass from wpusers where...

interactsh

An OOB interaction gathering server and client library Features • Usage • • • •...

Exploit_CVE-2021-24762

exploitcve-2021-24762 Dieses Repository zeigt einen Exploit für CVE-2021-24762. Es handelt sich um einen Blind-SQLi-Exploit, der in der Standardkonfiguration das Admin-Passwort ausliest. Während ich ein Labor auf Basis von WordPress mit dem PerfectSurvey-Plugin durchführte, blieb ich bei einer...

CVE-2026-74011 WordPress InfiniteWP Client plugin <= 1.13.9 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in revmakx InfiniteWP Client allows Blind SQL Injection. This issue affects InfiniteWP Client: from n/a through 1.13.9...

EUVD-2026-63324

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in revmakx InfiniteWP Client allows Blind SQL Injection. This issue affects InfiniteWP Client: from n/a through 1.13.9...

CVE-2026-74011

A Blind SQL Injection vulnerability exists in the InfiniteWP Client WordPress plugin by revmakx, affecting versions through 1.13.9 . The flaw stems from improper neutralization of special elements in SQL commands, allowing an authenticated attacker (high privileges required) to extract data from ...

EUVD-2026-62663

ISPConfig contains an authenticated SQL injection vulnerability in the Remote API. The primaryid parameter passed to delete and update API methods is concatenated directly into SQL WHERE clauses without integer casting or parameterized query binding. The built-in SQL injection scanner does not...

CVE-2025-14603 Use of user input in raw SQL queries in vsDesk leading to blind SQL injection

The application component processes user-supplied parameters insecurely, passing them into SQL queries. This can enable blind SQL injection, potentially exposing database contents or causing the application to become unresponsive. Apply patch from vendor https://vsdesk.ru/ . Versions 14.0101 and...

EUVD-2025-210741

The application component processes user-supplied parameters insecurely, passing them into SQL queries. This can enable blind SQL injection, potentially exposing database contents or causing the application to become unresponsive. Apply patch from vendor https://vsdesk.ru/ . Versions 14.0101 and...

CVE-2026-20327 Cisco Unified Intelligence Center SQL Injection Vulnerability

A vulnerability in the web-based management interface of Cisco Unified Intelligence Center could allow an authenticated, local attacker to perform a blind SQL injection attack against an affected device. This vulnerability is due to insufficient validation of user-supplied input. An attacker coul...

Cisco Unified Intelligence Center SQL Injection Vulnerability

A vulnerability in the web-based management interface of Cisco Unified Intelligence Center could allow an authenticated, local attacker to perform a blind SQL injection attack against an affected device. This vulnerability is due to insufficient validation of user-supplied input. An attacker coul...

PT-2026-78522

A vulnerability in the web-based management interface of Cisco Unified Intelligence Center could allow an authenticated, local attacker to perform a blind SQL injection attack against an affected device. This vulnerability is due to insufficient validation of user-supplied input. An attacker coul...

PT-2026-78543

Name of the Vulnerable Software and Affected Versions ISPConfig affected versions not specified Description An authenticated SQL injection exists in the Remote API. The primary id parameter used in delete and update API methods is concatenated directly into SQL WHERE clauses without integer casti...