CVE-2019-13027

CVE-2019-13027 Details zur Offenlegung von CVE-2019-13027 Zeitplan des Kontakts mit dem Anbieter: 1. Juli 2019 - Keine Antwort, keine E-Mail. 2. Juli 2019 - Keine Antwort, keine E-Mail. 3. Juli 2019 - E-Mail gesendet, GitHub erstellt. 4. Juli 2019 - Keine Antwort des Anbieters. Schwachstelle...

CVE-2026-89304 Paymendo Bank Transfer <= 1.1 - Unauthenticated Blind SQLi via 'paymendo_bank_transfer_completed_payment' Parameter

The paymendo WordPress plugin through 1.1 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform blind SQL injection attacks...

CVE-2026-89213

The Llavero.io WordPress plugin (versions through 0.1.4 ) is vulnerable to an unauthenticated Blind SQL injection due to improper sanitization and escaping of the 'cill_login' parameter in a SQL statement. An attacker can exploit this flaw to read data from the database . While the vulnerability ...

CVE-2026-88930

The Social Web Suite WordPress plugin (versions through 4.1.12 ) is vulnerable to SQL injection attacks. The root cause is twofold: the plugin fails to require a shared secret before accepting authorized requests, and it fails to properly sanitise and escape a parameter used in an SQL statement. ...

CVE-2026-88930 Social Web Suite <= 4.1.12 - Unauthenticated Blind SQLi via Unset Shared Secret

The Social Web Suite WordPress plugin through 4.1.12 does not require its shared secret to be set before accepting requests authorised by it, and does not sanitise and escape a parameter before using it in an SQL statement, allowing unauthenticated users to perform SQL injection attacks...

interactsh

An OOB interaction gathering server and client library Features • Usage • Interactsh Client • Interactsh Server • Interactsh Integration • Join Discord Interactsh is an open-source tool for detecting out-of-band interactions. It is a tool designed to detect vulnerabilities that cause external...

cve-2020-7471-Time_Blind_SQLi-

Dieses Repository hat keine README-Datei...

CVE-2025-2812

CVE-2025-2812 — SQL-Injection-Schwachstelle in "Bilet Satış Otomasyonu" von Mydata Bilişim Ltd. Şti 📌 CVE-ID: CVE-2025-2812 📢 USOM-Ankündigung: tr-25-0099 🛡️ Schwachstellentyp: CWE-89 - SQL-Injection Boolean-basierte Blind 🏢 Betroffenes Produkt: Bilet Satış Otomasyonu – Mydata Bilişim Ltd. Şti 🌐...

ScanQLi

ScanQLi ScanQLi è un semplice scanner per SQL injection con alcune funzionalità aggiuntive. Questo strumento non può sfruttare le SQLi, le rileva soltanto. Testato su Debian 9 Caratteristiche Classica Blind Time based GBK presto Scansione ricorsiva segue tutti i link del sito web scansionato...

WordPress-NotificationX-CVE-2024-1698

Einrichtung docker-compose up --build Aufräumen docker-compose down Testen Measure-Command curl.exe http://localhost/wp-json/notificationx/v1/analytics -Method Post -Body 'nxid=1337&type=clicks=IFASCIISUBSTRINGselect userpass from wpusers where id=1,1,1=36,SLEEP10,null-- -'...

CVE-2022-42098

KLiK-SocialMediaWebsite Version v1.0.1 Schwachstellen-Erklärung: KLiK-SocialMediaWebsite v1.0.1 weist SQL-Injection-Schwachstellen in profile.php beim Parameter id auf. Angriffsvektoren: KLiK-SocialMediaWebsite v1.0.1: Sobald ein Benutzer erstellt wurde, können über die KLiK-Benutzerseite Persone...

CVE_2026_2576_PoC

CVE-2026-2576 — Business Directory Plugin SQLi PoC Unauthentifizierte zeitbasierte Blind-SQL-Injection Business Directory Plugin für WordPress ≤ 6.4.21 Inhaltsverzeichnis Überblick über die Schwachstelle Technische Analyse Lab-Anforderungen Lab-Einrichtung Ausführen des PoC Erwartete Ausgabe...

Exploit_CVE-2021-24762

exploitcve-2021-24762 Dieses Repository zeigt einen Exploit für CVE-2021-24762. Es handelt sich um einen Blind-SQLi-Exploit, der in der Standardkonfiguration das Admin-Passwort ausliest. Während ich ein Labor auf Basis von WordPress mit dem PerfectSurvey-Plugin durchführte, blieb ich bei einer...

wp2shell

wp2shell Blinde SQL-Injection durch Routenkonfusion im WordPress-REST-Batch – automatisierte Exploit-Kette. CVE-2026-63030 / CVE-2026-60137 | ---|--- Betroffen| WordPress 6.9.0 – 6.9.4 und 7.0.0 – 7.0.1 Behoben| WordPress 6.9.5 / 7.0.2 Sink| authornotin-SQL über desynchronisierten...

WordPress jet-form-builder-stripe-gateway plugin < 1.1.0 - Unauthenticated Blind SQLi vulnerability

Unauthenticated Blind SQLi vulnerability discovered by Jakub Herman in WordPress Plugin Jet Form Builder Stripe Gateway versions 1.1.0...

CVE-2022-4997

The jet-form-builder-stripe-gateway WordPress plugin versions prior to 1.1.0 is vulnerable to an unauthenticated Blind SQL Injection . The root cause is the failure to sanitize and escape a payment token before utilizing it in a SQL statement. This flaw allows unauthenticated attackers to extract...

CVE-2022-4997 JetFormBuilder Stripe Gateway < 1.1.0 - Unauthenticated Blind SQLi via Payment Token

The jet-form-builder-stripe-gateway WordPress plugin before 1.1.0 does not sanitise and escape a payment token before using it in a SQL statement, allowing unauthenticated users to extract arbitrary data from the database, including password hashes...

CVE-2026-52745 CordysCRM: Customer Public Pool Sorting Field SQL Injection

CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior to 1.7.0, the POST /account-pool/page endpoint allows an authenticated caller with MODULESETTING:UPDATE to place a crafted sort.name value into a dynamic SQL ORDER BY expression...

CVE-2026-77928 ClipBucket < 5.5.3-#182 Blind SQL Injection via Private Message Deletion Endpoint

ClipBucket v5 before 5.5.3-182 contains a blind SQL injection vulnerability that allows authenticated users to extract arbitrary database contents by submitting the msgid parameter as an array to bypass the cleanrequests sanitization function in ClipBucket.class.php. Attackers can pass unsanitize...

CVE-2026-77927

ClipBucket v5 before 5.5.3-#182 is vulnerable to blind SQL injection via the photo deletion endpoint. Authenticated users can submit the check_photo parameter as an array, bypassing the clean_requests() sanitization function in ClipBucket.class.php. The unsanitized array elements flow through the...