CVE-2021-32099

poc : http://127.0.0.1:8888/pandoraconsole/include/chartgenerator.php?sessionid=%27%20union%20SELECT%201,2,%27idusuario|s:5:%22admin%22;%27%20as%20data%20--%20SgGO https://blog.sonarsource.com/pandora-fms-742-critical-code-vulnerabilities-explained...

CVE-2024-43917

CVE-2024-43917 This script demonstrates an SQL injection vulnerability found in the TI WooCommerce Wishlist plugin for WordPress, versions up to 2.8.2 CVE-2024-43917. The vulnerability allows unauthenticated users to execute arbitrary SQL commands on the website’s database, potentially exposing...

codeql-workshop-cve-2021-21380

CodeQL workshop for Java: Finding a SQL injection In this workshop we will use syntactical and semantic reasoning to find a SQL injection in the XWiki platform's rating component documented by CVE-2021-21380 Contents CodeQL workshop for Java: Finding a SQL injection Contents Prerequisites and set...

CVE-2024-2876

CVE-2024-2876 Description Of Vulnerability: The Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin for WordPress is vulnerable to SQL Injection via the ‘run’ function of the ‘IGESSubscribersQuery’ class in all versions up to, and...

CVE-2025-2011

CVE-2025-2011 PoC By: X3RX3S But Proudly ripped by Ash Wesker that GPT'd my code with his banner ; see here --- https://github.com/Ashwesker/Blackash-CVE-2025-2011 You can even see my handle in 'his' code --' Purpose: A proof-of-concept tool to test for an SQL injection vulnerability CVE-2025-201...

CVE-2019-14314

CVE-2019-14314 CVE-2019-14314 - NextGEN Gallery 3.2.10 Authenticated SQL Injection Usage usage: cve201914314.py -h url loginuser loginpass username CVE-2019-14314 Hash Extractor positional arguments: url Wordpress blog URL loginuser Username to login with loginpass Password to login with username...

CVE-2021-45041

CVE-2021-45041 PoC for CVE-2021-45041 aka SCRMBT-177 - Authenticated SQL-Injection in SuiteCRM = 8.0.0. Defaults to False --help Show this message and exit. https://github.com/manuelz120/CVE-2021-45041 Example usage: .venv ➜ CVE-2021-45041 git:main ✗ ./exploit.py --host http://localhost --usernam...

CVE-2022-0739

CVE-2022-0739 Proof-of-Concept exploit SQLI BookingPress before 1.0.11 DISCLAIMER Usage of this program without prior mutual consent can be considered as an illegal activity. It is the final user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability...

CVE-2025-7605

CVE-2025-7605 code-projects AVL Rooms Project V1.0/profile.php SQL injection NAME OF AFFECTED PRODUCTS AVL Rooms Vendor Homepage https://code-projects.org/avl-rooms-in-php-css-javascript-and-mysql-free-download/ submitter dazhi Vulnerable File /profile.php VERSIONS V1.0 Software Link...

Axelor-vulnerability-CVE-2025-50341

CVE-2025-50341: Sql Injection on Axelor CVE ID: CVE-2025-50341 Reporter: Milad Seddigh Product: Axelor Affected Versions: v5.2.4 Impact: Sql Injection → exfiltrating database content. Summary A Boolean-based SQL injection vulnerability was discovered in the “domain” parameter of the Axelor. An...

CVE-2026-49048-JoomCCK-SQLi

CVE-2026-49048 — JoomCCK 6.4.0 Unauthenticated SQL Injection CVSS 9.8 CVE: CVE-2026-49048 Status: Public disclosure. Reported to Joomla Security Strike Team JSST — Ticket 282420. Advisory Summary Field| Value ---|--- Advisory ID| JOOMCCK-2026-001 CVE| CVE-2026-49048 Product| JoomCCK comjoomcck —...

CVE-2026-63030

Wordpress Core / SQLi 6.9.0 - 6.9.4 7.0.0 - 7.0.1 PoC is now published. It was created for educational/research purposes only! Use it at your own risk!...

CVE-2025-66947

CVE-2025-66947 Time Based Blind SQL Injection in krishanmuraiji SMS v1.0 ⏱️ Visual comparison: normal response vs 6s delayed response 🔍 Summary TL;DR: A GET parameter in an admin module allows time-based SQL injection via response delays. A 𝗧𝗶𝗺𝗲 𝗯𝗮𝘀𝗲𝗱 𝗯𝗹𝗶𝗻𝗱 𝗦𝗤𝗟 𝗶𝗻𝗷𝗲𝗰𝘁𝗶𝗼𝗻 𝘃𝘂𝗹𝗻𝗲𝗿𝗮𝗯𝗶𝗹𝗶𝘁𝘆 exists in...

CVE-2024-32136

BWL Advanced FAQ Manager 2.0.3 - Post-Authenticated SQL Injection Exploit Title: BWL Advanced FAQ Manager 2.0.3 - Post-Authenticated SQL Injection Date: 14 Apr 2024 Exploit Author: Ivan Spiridonov xbz0n Software Link: https://codecanyon.net/item/bwl-advanced-faq-manager/5007135 Version: 2.0.3...

RootQuest-CTF-Box-Multi-Stage-Exploitation-VM

RootQuest CTF Box — Multi-Stage Exploitation VM 💀 Kalaichelvan Thieveshkar CB013248 · Staffordshire University · COMP50003 - Cyber Security II Overview RootQuest is a purpose-built CTF virtual machine that contains a 10-stage , sequential attack path spanning 5 security domains. Each challenge...

CVE-2025-5287

CVE-2025-5287 PoC Unauthenticated SQL Injection exploit for WordPress Likes and Dislikes Plugin ≤ 1.0.0 📖 Description This Python script is a proof-of-concept PoC exploit for CVE-2025-5287 , targeting a vulnerability in the WordPress Likes and Dislikes Plugin ≤ 1.0.0. The vulnerability allows...

PoC

PoC Repo for proof of concept exploits and tools. BMCRSCDRCE Unauthenticated remote command execution exploit for BMC Server Automation's RSCD agent. The exploit works against servers affected by CVE-2016-1542 detected by Nessus. This is now a Metasploit module, see...

EverShop-Lab-CVE-2026-25993

CVE-2026-25993 — EverShop Second-Order SQL Injection Lab Prerequisites Docker Engine 24+ with Docker Compose v2+ 2 GB free RAM Deploy cd EverShop-Lab/ docker compose up Wait 2 minutes for first build clones EverShop v2.1.0, compiles, runs migrations, seeds data. App will be available at...

CVE-2025-1094-Lab-Setup

🛠️ CVE-2025-1094 Lab Setup ⚠️ Disclaimer This lab is for educational and research purposes only. Do NOT use any of the information or techniques demonstrated here on systems you do not own or have explicit permission to test. Unauthorized use of these methods may violate laws and result in severe...

CVE-2026-78837

CVE-2026-78837 Description An SQL injection vulnerability in the apformid parameter in AppNitro MachForm v30 allows attackers to access sensitive database information via a crafted SQL statement. Affected Component Tested on MachForm - Version 30 Attack Type Remote Attack Vectors An unauthenticat...