blind-sql-bitshifting

Blind SQL Injection via Bitshifting This is a module that performs blind SQL injection by using the bitshifting method to calculate characters instead of guessing them. It requires 7/8 requests per character, depending on the configuration. Usage root@kitploit: import blind-sql-bitshifting as x...

sqlmap

sqlmap sqlmap is an open source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers. It comes with a powerful detection engine, many niche features for the ultimate penetration tester, and a broad range of switche...

msmailprobe

msmailprobe Office 365 and Exchange Enumeration It is widely known that OWA Outlook Webapp is vulnerable to time-based user enumeration attacks. This tool leverages all known, and even some lesser-known services exposed by default Exchange installations to enumerate users. It also targets Office...

msmailprobe

msmailprobe Enumerazione di Office 365 e Exchange È ampiamente noto che OWA Outlook Webapp è vulnerabile ad attacchi di enumerazione degli utenti basati sul tempo. Questo strumento sfrutta tutti i servizi noti, e anche alcuni meno conosciuti, esposti dalle installazioni predefinite di Exchange pe...

CVE-2021-39377

OPENSIS 8.0 VULNERABILIDADE DE INJEÇÃO DE SQL CVE-2021-39377 Existe uma vulnerabilidade de injeção de SQL na versão 8.0 do openSIS quando o MySQL MariaDB é usado como banco de dados da aplicação. Um atacante malicioso pode executar comandos SQL no banco de dados MySQL MariaDB por meio do parâmetr...

CVE-2026-81676

A vulnerability in the endpoint ‘/ws/apitribuna/ultimosVideos’ where the limitvideos parameter is directly concatenated into a MariaDB SQL query without proper sanitization or parameterization. By injecting SQL syntax into this parameter, a remote attacker can cause SQL syntax errors and...

EUVD-2026-67012

A vulnerability in the endpoint ‘/ws/apitribuna/ultimosVideos’ where the limitvideos parameter is directly concatenated into a MariaDB SQL query without proper sanitization or parameterization. By injecting SQL syntax into this parameter, a remote attacker can cause SQL syntax errors and...

CVE-2026-81676 Multiple Vulnerabilities in TOOOLS' iSquad

A vulnerability in the endpoint ‘/ws/apitribuna/ultimosVideos’ where the limitvideos parameter is directly concatenated into a MariaDB SQL query without proper sanitization or parameterization. By injecting SQL syntax into this parameter, a remote attacker can cause SQL syntax errors and...

CVE-2026-81676

CVE-2026-81676 is an error-based SQL injection in TOOOLS' iSquad , affecting the endpoint /ws/apitribuna/ultimosVideos. The limit_videos parameter is directly concatenated into a MariaDB SQL query without sanitization or parameterization, allowing a remote, unauthenticated attacker to inject SQL ...

CVE-2026-23980-Exploit

CVE-2026-23980 - Apache Superset Iniezione SQL Autenticata root@kitploit: / \ | | | | | || | \\ sqlExpression va direttamente alla query. nessuna parametrizzazione. nessuna speranza. Apache Superset ChartDataRestApi.data - QueryContext.getdfpayload - SqlaTable.getsqlaquery - colonna adhoc...

CVE-2026-65761

CVE-2026-65761 - SQL-инъекция в EasyStore Pro через filtersortby proof-of-concept Этот репозиторий предоставляет учебный proof-of-concept для CVE-2026-65761 — неаутентифицированной SQL-инъекции, затрагивающей версии с 1.0.0 по 2.0.2 включительно расширения EasyStore для Joomla. Уязвима только...

MAL-006

MAL-006: XML External Entity in "Try It" in WSO2 ESB Ein fehlerbasierter XML-External-Entity-Angriff XXE wurde im WSO2-ESB-Tool "Try It" identifiziert. Warum keine CVE? Der Anbieter antwortete, dass es empfohlen wird, "Try It" in der Produktion zu deaktivieren, und es erfolgte keine öffentliche...

CVE-2021-41647

CVE-2021-41647 CVE-2021-41647 Online-Food-Ordering-Web-App의 SQL 인젝션 Online-Food-Ordering-Web-App는 인증되지 않은 오류 기반 및 시간 기반 블라인드 SQL 인젝션 공격에 취약합니다. /login.php 페이지의 username 매개변수는 사용자 입력을 검증하지 않으므로, 공격자는 간단한 우회 기법으로 로그인을 우회할 수 있습니다. 애플리케이션 링크 Online-Food-Ordering-Web-App 영향을 받는 구성 요소 및 매개변수 URL:...

CVE-2026-23723-POC

CVE-2026-23723 PoC - Auxiliar de Exploração de SQL Injection Autenticada no WeGIA SQL Injection Autenticada Baseada em Erro no WeGIA ≤ 3.6.1 GHSA-xfmp-2hf9-gfjp | Aviso Oficial Autor Original do POC / Relator : ViniCastro2001 GHSA Publicado por : nilsonLazarin mantenedor do projeto Este script...

FreePBX-SQLi-RCE

FreePBX CVE-2025-57819 - 未授权 SQLi到RCE PoC 仅供教育与安全研究使用 - 请参见下方的法律声明 针对FreePBX中CVE-2025-57819（一个关键的未授权SQL注入漏洞）的利用概念验证，该漏洞可实现远程代码执行。本PoC在 官方补丁发布后 发布，仅用于安全研究和授权测试。 概述 FreePBX 15.x、16.x 和 17.x（低于补丁版本的版本）在端点的AJAX处理程序中存在未授权SQL注入漏洞。此漏洞链可实现： 1. 通过SQL注入创建管理员账户 2. 通过经过认证的cron任务注入部署Webshell 3...

CVE-2023-25157-GeoServer-SQLi-Lab

GeoServer & GeoTools SQL Injection CVE-2023-25157 & CVE-2023-25158 — مختبر الثغرات وتقرير PoC بيئة تدريب عملي Vulnerable Lab وتقرير تحليل واستغلال مفصل لثغرة حقن SQL Error-based في GeoServer CVE-2023-25157 ومكتبة GeoTools CVE-2023-25158. تقرير التحليل والاستغلال المفصل يُرجى الاطلاع على الوثيقة...

CVE-2025-10351-POC

CVE-2025-10351 POC - SQL-Injection-Exploit 💉 POC für CVE-2025-10351: Eine nicht authentifizierte SQL-Injection-Schwachstelle, die einen bestimmten Endpunkt im Melis Platform Framework betrifft. 🔗 Referenzen 📄 CVE-2025-10351 auf MITRE 📄 Melis Platform Warnung auf INCIBE Spanisches Nationales...

CVE-2025-66417-POC

CVE-2025-66417 Prova de Conceito CVE-2025-66417 root@kitploit: POST /front/inventory.php HTTP/1.1 Host: Accept-Encoding: gzip, deflate, br Accept: text/html Connection: keep-alive Content-Type: text/xml Content-Length: 429 getparams...

Microfinance-Management-System-V1.0-SQL-Injection-Vulnerability-Unauthenticated

Microfinance Management System V1.0 Vulnerabilità di SQL Injection Non autenticato 1. Descrizione: Microfinance Management System consente SQL Injection tramite il parametro 'customernumber' in /mims/updatecustomer.php. Sfruttando questo problema, un attaccante potrebbe compromettere...

CVE-2025-32429-Checker

Verificador de Vulnerabilidade CVE-2025-32429 Um scanner de vulnerabilidades baseado em Python para detectar a vulnerabilidade de injeção SQL CVE-2025-32429 em plataformas XWiki. Funcionalidades Escaneamento de Alvo Único : Verificar alvos individuais com a opção -t Escaneamento em Lote : Escanea...