CVE-2025-66417-POC

CVE-2025-66417 Prova de Conceito CVE-2025-66417 root@kitploit: POST /front/inventory.php HTTP/1.1 Host: Accept-Encoding: gzip, deflate, br Accept: text/html Connection: keep-alive Content-Type: text/xml Content-Length: 429 getparams...

Microfinance-Management-System-V1.0-SQL-Injection-Vulnerability-Unauthenticated

Microfinance Management System V1.0 Vulnerabilità di SQL Injection Non autenticato 1. Descrizione: Microfinance Management System consente SQL Injection tramite il parametro 'customernumber' in /mims/updatecustomer.php. Sfruttando questo problema, un attaccante potrebbe compromettere...

CVE-2025-32429-Checker

Verificador de Vulnerabilidade CVE-2025-32429 Um scanner de vulnerabilidades baseado em Python para detectar a vulnerabilidade de injeção SQL CVE-2025-32429 em plataformas XWiki. Funcionalidades Escaneamento de Alvo Único : Verificar alvos individuais com a opção -t Escaneamento em Lote : Escanea...

CVE-2021-40353

CVE-2021-40353 CVE-2021-40353 Vulnérabilité d'injection SQL dans openSIS 8.0 https://vulners.com/cve/CVE-2021-40353 Une vulnérabilité d'injection SQL existe dans la version 8.0 d'openSIS lorsque MySQL ou MariaDB est utilisé comme base de données de l'application. Un attaquant peut alors émettre l...

SQLiDetector

SQLiDetector Einfaches Python-Skript, unterstützt mit einem BurpBouty-Profil, das hilft, SQL-Injection Error Based zu erkennen, indem mehrere Anfragen mit 14 Payloads gesendet und nach 152 Regex-Mustern für verschiedene Datenbanken gesucht wird. root@kitploit:...

CVE-2023-1454

CVE-2023-1454 Сценарий обнаружения уязвимости CVE-2023-1454 Данный материал предоставлен только для ознакомления. Несанкционированное использование технической информации и инструментов, описанных в статье, для вторжения в любые компьютерные системы запрещено. Автор не несет ответственности за...

php_filter_chains_oracle_exploit

PHP filter chains: lettura di file da oracolo basato su errori Una CLI per sfruttare parametri affetti dalla lettura di file causata dall'oracolo basato su errori delle catene di filtri PHP. Può essere usata per esfiltrare il contenuto di un file locale quando viene passato a funzioni vulnerabili...

CVE-2019-14529

CVE-2019-14529 Vulnerabilità di SQL Injection multipla nel progetto OpenEMR Funzione vulnerabile nel file: /openemr/interface/forms/eyemag/save.php Condizioni : qualsiasi utente autorizzato Versioni vulnerabili: 5.0.2, Corretta nella versione 5.0.2. Descrizione Ci sono due funzioni: 1. "storePDF"...

php_filter_chain_oracle_poc

phpfilterchainoraclepoc Visão Geral A equipe Synacktiv publicou um artigo de pesquisa aprofundado, PHP Filter Chains: File Read from Error-Based Oracle , inicialmente divulgado no DownUnder CTF 2022. Esta pesquisa foi baseada em um desafio de @hashkitten, onde os participantes precisavam vazar o...

Advanced-SQL-Injection-Cheatsheet

Cheat sheet per SQL Injection basata su errori MySQL Questa è probabilmente la vulnerabilità più semplice nell'ambito dell'attacco SQL Injection. Un attaccante può enumerare e dumpare il database MySQL sfruttando i messaggi di errore SQL a suo vantaggio. Rilevare la...

CVE-2026-24418

CVE-2026-24418 OpenSTAManager = 2.9.8 — Fehlerbasierte SQL-Injection im Scadenzario-Massenverarbeitungsmodul Übersicht Feld| Details ---|--- CVE ID| CVE-2026-24418 Schweregrad| HOCH 8.8 CWE| CWE-89: SQL-Injection Betroffene Versionen| OpenSTAManager = 2.9.8 Angreifbarer Parameter| idrecords...

php_filter_chains_oracle_exploit_for_CVE-2023-6199

PHP filter chains: lettura di file da un oracolo basato su errori. Script aggiornato per sfruttare CVE-2023-6199 Una CLI per sfruttare parametri affetti dalla lettura di file causata dall'oracolo basato su errori delle catene di filtri PHP. Può essere utilizzata per divulgare il contenuto di un...

ghauri

Like Ghauri, consider supporting the developer...

CVE-2026-76635

baserCMS before 5.3.0 contains a SQL injection vulnerability in BcDatabaseService.php that allows authenticated administrators to inject attacker-controlled table names and configuration values directly into SQL statements across sequence update, CSV export, and table management operations...

EUVD-2026-63365

baserCMS before 5.3.0 contains a SQL injection vulnerability in BcDatabaseService.php that allows authenticated administrators to inject attacker-controlled table names and configuration values directly into SQL statements across sequence update, CSV export, and table management operations...

CVE-2026-73670

The CVE describes a SQL injection in a CMS affecting the admin/db_data.php component (line 509) that allows authenticated administrators to inject arbitrary SQL into a SHOW COLUMNS FROM statement via an unsanitized table_name parameter (GET/POST). Attack techniques include table traversal, time-b...

CVE-2026-72782

Craft CMS versions = 5.0.0-RC1 before 5.10.6 and = 4.0.0-RC1 before 4.18.2 interpolate environment variables and secrets via $ENVVAR strings in the elementId parameter into Twig templates before rendering, even when the Twig sandbox is enabled. An authenticated attacker with control panel access...

CVE-2026-72782

Craft CMS versions = 5.0.0-RC1 before 5.10.6 and = 4.0.0-RC1 before 4.18.2 interpolate environment variables and secrets via $ENVVAR strings in the elementId parameter into Twig templates before rendering, even when the Twig sandbox is enabled. An authenticated attacker with control panel access...

CVE-2026-72782 Craft CMS 5.0.0-RC1 before 5.10.6 Environment Variable Leak

Craft CMS versions = 5.0.0-RC1 before 5.10.6 and = 4.0.0-RC1 before 4.18.2 interpolate environment variables and secrets via $ENVVAR strings in the elementId parameter into Twig templates before rendering, even when the Twig sandbox is enabled. An authenticated attacker with control panel access...

CVE-2026-72782 Craft CMS 5.0.0-RC1 before 5.10.6 Environment Variable Leak

Craft CMS versions = 5.0.0-RC1 before 5.10.6 and = 4.0.0-RC1 before 4.18.2 interpolate environment variables and secrets via $ENVVAR strings in the elementId parameter into Twig templates before rendering, even when the Twig sandbox is enabled. An authenticated attacker with control panel access...