CVE-2025-58788

SINK: The searchProducts function does not validate input, leading to a SQL Injection vulnerability in the $term variable. The dropdownDataSearch function with $type= 'product' allows to control the $term variable while calling the searchProducts function. POC:...

CVE-2022-28346

CVE-2022-28346 SQL injection in QuerySet.annotate, aggregate, and extra Setup: Run ./setup.sh for initial setup Open the docker image to initiate the database: docker exec -it containerid /bin/bash And run the following commands: python manage.py makemigrations cve202228346 python manage.py migra...

SSI-CVE-2022-21661

SSI-CVE-2022-21661 Information System's Security 2nd Assignment Study and exploit the vulnerability CVE-2022-21661 that allows SQL Injections through plugins POST requests to WordPress versions below 5.8.3. Configuring the environment To start and configure the environment, you should just run:...

wp2shell-Wordpress-TOWN

wp2shell by : lucifer0xf Unauthenticated Remote Code Execution for WordPress Core POC CVE-2026-63030 + CVE-2026-60137 wp2shell exploit for critical vulnerability chain in WordPress core. It chains a REST API batch route confusion bug with an SQL injection in WPQuery to achieve unauthenticated...

CVE-2023-25157-GeoServer-SQLi-Lab

GeoServer & GeoTools SQL Injection CVE-2023-25157 & CVE-2023-25158 — Vulnerability Lab & PoC Report Practical environment Vulnerable Lab and detailed exploitation analysis report for SQL Injection Error-based vulnerability in GeoServer CVE-2023-25157 and the GeoTools library CVE-2023-25158...

CVE-2025-5287

CVE-2025-5287 Likes and Dislikes Plugin = 1.0.0 - Unauthenticated SQL Injection Description The Likes and Dislikes Plugin plugin for WordPress is vulnerable to SQL Injection via the 'post' parameter in all versions up to, and including, 1.0.0 due to insufficient escaping on the user supplied...

CVE-2024-21514

CVE-2024-21514 PoC and Bulk Scanner Overview POC for CVE-2024-21514 : SQL Injection issue was identified in the Divido payment extension for OpenCart, which is included by default in version 3.0.3.9 This POC is create by M Ali and it's based on this Security Advisory by Snyk. How to Use Minimum...

CVE_2026_2576_PoC

CVE-2026-2576 — Business Directory Plugin SQLi PoC Unauthenticated Time-Based Blind SQL Injection Business Directory Plugin for WordPress ≤ 6.4.21 Table of Contents Vulnerability Overview Technical Analysis Lab Requirements Lab Setup Running the PoC Expected Output Patch Analysis References...

CVE-2024-36039_PoC

CVE-2024-36039: PyMySQL Object Injection to SQL Injection PoC A complete, reproducible Proof of Concept PoC laboratory for CVE-2024-36039 , demonstrating how an Object Injection vulnerability in PyMySQL versions = 1.1.0 can be escalated to a full SQL Injection using MariaDB's ODBC Escape Sequence...

CVE-2024-38793-PoC

CVE-2024-38793-PoC Proof of Concept code for exploitation of CVE-2024-38793 Best Restaurant Menu by PriceListo = 1.4.1 - Authenticated Contributor+ SQL Injection. Proof Of Concept This is a proof of concept exploit for the vulnerability CVE-2024-38793, an SQL injection vulnerability for versions ...

CVE-2023-25157

Vulnerability Description Due to the lack of input filtering, remote unauthenticated attackers can craft malformed filter syntax, bypass GeoServer's lexical parsing, leading to SQL injection, obtaining sensitive information from the server, and possibly gaining database server privileges. Affecte...

CVE-2025-10351-POC

CVE-2025-10351 POC - SQL Injection Exploit 💉 POC for CVE-2025-10351: An unauthenticated SQL Injection vulnerability that affects a specific endpoint in Melis Platform Framework. 🔗 References 📄 CVE-2025-10351 on MITRE 📄 Melis Platform Warning on INCIBE Spanish National Cybersecurity Institute 🚀...

CVE-2021-25076

CVE-2021-25076-Exploit Wordpress Plugin WP User Frontend 3.5.26 - SQL-Injection Authenticated CVE description: The WP User Frontend WordPress plugin before 3.5.26 does not validate and escape the status parameter before using it in a SQL statement in the Subscribers dashboard, leading to an SQL...

CVE-2025-69458

CVE-2025-69458 – Movie Rating System 1.0 SQLi to RCE Unauthenticated WriteUp CVE-2025-69458 – ExploitDB 50622...

Zimbra10_SQL_Injection

This repository does not have a README...

rConfig 3.9 - SQL Injection

An issue was discovered in rConfig through 3.9.4. The web interface is prone to a SQL injection via the commands.inc.php searchColumn parameter. id: CVE-2020-10220 info: name: rConfig 3.9 - SQL Injection author: ritikchaddha,theamanrawat severity: critical description: | An issue was discovered i...

django_sqli_target_CVE-2025-64459

This repository does not have a README...

CVEs

Rhino CVE Proof-of-Concept Exploits A collection of proof-of-concept exploit scripts written by the team at Rhino Security Labs for various CVEs. CVE-2026-46546: Frappe LMS Header Tag Injection Leading to Open Redirect CVE-2026-39405: Frappe LMS Path Traversal in SCORM Package Upload Leading to...

exploit-joomla

exploit-joomla A simple exploit that exploits CVE-2015-7297, CVE-2015-7857 and CVE-2015-7858 to list users with DB password. Exploit Title : Joomla 3.2 to 3.4.4 Remote SQL Injection Mass Exploit Date : 12-09-2020 Requirements : Python 3.4.x , Requests module python -m pip install requests Code...

CVE-2025-56381

CVE-2025-56381 — Authenticated SQL Injection in ERPNext / Frappe via orderby and groupby Parameters 📌 Summary ERPNext v15.67.0 and Frappe Framework v15.72.4 contain multiple authenticated SQL injection vulnerabilities in the frappe.desk.reportview.get API endpoint. Malicious input to the orderby ...