CVE-2024-7928

CVE-2024-7928: ثغرة قراءة الملفات التعسفية في FastAdmin V1.3.4.20220530 CVEHunter هي أداة لاكتشاف الثغرات واستغلالها لاسترجاع تفاصيل قاعدة البيانات لمثيلات FastAdmin المتأثرة بـ CVE-2024-7928، وتتميز بالدقة والتنفيذ المتزامن غير المتزامن مقارنةً بأدوات إثبات المفهوم الأخرى PoCs. التثبيت...

CVE-2025-69295

CVE-2025-69295 — ثغرة حقن SQL أعمى في TeconceTheme Coven Core CVE-2025-69295 هي ثغرة حقن SQL SQL Injection تؤثر على مكوّن Coven Core من قالب ووردبريس TeconceTheme Coven Core. توجد الثغرة بسبب عدم التعقيم السليم للمدخلات التي يقدمها المستخدم قبل استخدامها في استعلامات SQL، مما يسمح للمهاجمين بحقن...

CVE-2024-7928

CVE-2024-7928 إثبات مفهوم POC لـ CVE-2024-7928. سيحاول استرجاع تفاصيل قاعدة البيانات لنسخ FastAdmin. طريقة الاستخدام FOFA : app="FASTADMIN" تثبيت متطلبات السكربت: root@kitploit: pip install -r requirements.txt هدف واحد: root@kitploit: python CVE-2024-7928.py -u https://target:9090 فحص جماعي:...

CVE-2024-7928

CVE-2024-7928 إثبات المفهوم لـ CVE-2024-7928. سيحاول استرداد تفاصيل قاعدة البيانات لمثيلات FastAdmin. نظرة عامة هذه أداة فحص واستغلال جماعي لـ CVE-2024-7928: FastAdmin حتى الإصدار 1.3.3.20220121 يسمح للمهاجمين غير المصادق عليهم بتنفيذ تجاوز الدليل Directory Traversal. تعتمد هذه الأداة على هذا الب...

CVE-2024-34472

CVE-2024-34472 Description: Un utilisateur authentifié peut exploiter une vulnérabilité d'injection SQL aveugle présente dans le fichier mliRealtimeEmails.php. Le paramètre ordemGrid dans une requête POST vers /mailinspector/mliRealtimeEmails.php ne désinfecte pas correctement les entrées,...

PT-2026-70154

A stored SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the tools = label creator permission to execute arbitrary SQL via the image name field of a patron card layout. The image name value is stored verbatim in the layout XML...

CVE-2026-12987

The Events Manager WordPress plugin before 7.3.7 does not safely handle booking-registration data on sites using No-User-Account Booking Mode: a booker-supplied registration field is stored as booking meta and later deserialized without restricting allowed classes, enabling PHP object injection...

EUVD-2026-41057

Guardian language-system passes the id GET parameter directly into an unsanitized SQL query in media.php line 17: SELECT id, filename, extension, type, duration, owner, private FROM files where id = '".$GET'id'."'. An authenticated attacker can perform error-based SQL injection to extract...

CVE-2017-20244 Wow Forms WordPress Plugin 2.1 SQL Injection

Wow Forms WordPress Plugin version 2.1 contains an SQL injection vulnerability that allows unauthenticated attackers to read arbitrary database information by exploiting an unescaped POST parameter. Attackers can inject SQL code through the 'mwpformid' parameter in requests to the admin-ajax.php...

CVE-2018-25411

CVE-2018-25411 affects MGB OpenSource Guestbook 0.7.0.2. The vulnerability is an SQL injection in the email.php endpoint vulnerable to crafted payloads via the id parameter, allowing unauthenticated attackers to execute arbitrary SQL and potentially enumerate database tables and columns. The issu...

CVE-2018-25411 MGB OpenSource Guestbook 0.7.0.2 SQL Injection via email.php

MGB OpenSource Guestbook 0.7.0.2 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the 'id' parameter. Attackers can send GET requests to email.php with crafted SQL payloads in the 'id' parameter to...

MB Connect Line mbCONNECT24和MB Connect Line mymbCONNECT24 SQL注入漏洞

MB Connect Line mbCONNECT24 and MB Connect Line mymb CONNECTION24 are products of the German company MB Connect Line. MB Connect Line mbCONNECT24 is a remote service portal. This product supports features such as remote access, data recording, and alerts. MB Connect Line mymb CONNECTION24 is an...

CVE-2026-42871

WeGIA is a web manager for charitable institutions. In versions prior to 3.7.0, atendido/familiardocfamiliar.php displays an overly descriptive error message, including database-related details. This verbosity leads to information disclosure, which could assist a potential attacker in mapping the...

EUVD-2026-29186

WeGIA is a web manager for charitable institutions. In versions prior to 3.7.0, atendido/familiardocfamiliar.php displays an overly descriptive error message, including database-related details. This verbosity leads to information disclosure, which could assist a potential attacker in mapping the...

CVE-2026-32321

ClipBucket v5 is an open source video sharing platform. An authenticated time-based blind SQL injection vulnerability exists in ClipBucket prior to 5.5.3 80 within the actions/ajax.php endpoint. Due to insufficient input sanitization of the userid parameter, an authenticated attacker can execute...

EUVD-2026-12960

ClipBucket v5 is an open source video sharing platform. An authenticated time-based blind SQL injection vulnerability exists in ClipBucket prior to 5.5.3 80 within the actions/ajax.php endpoint. Due to insufficient input sanitization of the userid parameter, an authenticated attacker can execute...

PT-2026-26155

ClipBucket v5 is an open source video sharing platform. An authenticated time-based blind SQL injection vulnerability exists in ClipBucket prior to 5.5.3 80 within the actions/ajax.php endpoint. Due to insufficient input sanitization of the userid parameter, an authenticated attacker can execute...

📄 WordPress Backup Migration 1.3.7 Database Disclosure

WordPress Backup Migration plugin version 1.3.7 allows unauthenticated users to access sensitive backup files, potentially exposing the full database and website content. An attacker can retrieve backup archives without authentication...

Fleet has an SQL Injection vulnerability via backtick escape in ORDER BY parameter

Summary A SQL Injection vulnerability in Fleet’s software versions API allowed authenticated users to inject arbitrary SQL expressions via the orderkey query parameter. Due to unsafe use of goqu.I when constructing the ORDER BY clause, specially crafted input could escape identifier quoting and b...

CVE-2019-25462

Web Ofisi Rent a Car v3 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'klima' parameter. Attackers can send GET requests to with malicious 'klima' values to extract sensitive database information or...