watchTowr-vs-FortiWeb-CVE-2025-25257

watchTowr-vs-FortiWeb-CVE-2025-25257 Detection Artifact Generator for FortiWeb CVE-2025-25257 See our blog post for technical details https://github.com/user-attachments/assets/e59f2b3b-2b9b-469f-b4a8-2b7df2ede194 Detection in Action python watchTowr-vs-FortiWeb-CVE-2025-25257.py --target...

SimpleCTF-THM-Walkthrough

SimpleCTF-THM-Relatory First CTF successfully completed! This repo documents my walkthrough of TryHackMe's Simple CTF. It covers network reconnaissance Nmap, web exploitation CVE-2019-9053, and credential cracking. As a dev, it was great to pivot from SQLi to a Root shell by leveraging Sudo...

Metinfo-6.1.2-SQL-injection

Metinfo-6.1.2-SQL-injection Metinfo 6.1.2 SQL injection script 0-sec.org...

CVE-2026-11349

Modern Events Calendar Lite = 7.33.0 — Unauthenticated SQL Injection via meclistloadmore attsinclude / attsexclude Summary Detail| Value ---|--- Plugin| Modern Events Calendar Lite Slug| modern-events-calendar-lite Author| Webnus Affected| = 7.33.0 the current vendor-distributed Lite release. Bug...

testenv

SQL injection test environment A collection of web pages vulnerable to SQL injection flaws and more: conf/ - operating system configuration files used by deployment.sh. dbs/ - standalone databases for some database management systems e.g. Microsoft Access. libs/ - web API libraries to connect to...

CVE-2023-41652

CVE-2023-41652 RSVPMarker = 10.6.6 - Unauthenticated SQL Injection Description: The RSVPMarker plugin for WordPress is vulnerable to SQL Injection via the 'email' parameter in versions up to, and including, 10.6.6 due to insufficient escaping on the user supplied parameter and lack of sufficient...

CVE-2024-36837

CVE-2024-36837 / CNVD-2024-30128 POC write URL in url.txt and run CVE-2024-36837.py CVE-2024-36837 In my freshman year, I found that an educational institution used CRMEB Mall as an online store in an Internet protection action. After testing, sql injection vulnerability was found. After setting ...

cve-2026-9082

CVE-2026-9082 Type : SQL Injection CWE-89 Affected Product : Drupal Core Database Abstraction API Drupal Advisory : SA-CORE-2026-004 Published : May 20, 2026 Severity : Highly Critical Drupal 20/25 | NVD CVSS 6.5 What Is It? CVE-2026-9082 is a SQL Injection vulnerability in Drupal's core database...

Linux Distros Unpatched Vulnerability : CVE-2026-119562

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - phpMyAdmin through 5.2.3 contains an sql injection vulnerability that allows authenticated users to inject SQL by supplying unescaped colextra and colattribute...

WordPress BuddyPress 14.5.2 Blind SQL Injection

WordPress BuddyPress version 14.5.2 and earlier contain a blind SQL injection vulnerability. The supplied proof of concept authenticates as a Subscriber, writes a crafted profile visibility field identifier, and measures or reports resulting database-query evidence...

CVE-2026-62048: Liquid Web / StellarWP BookIt: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Liquid Web /…

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Liquid Web / StellarWP BookIt bookit allows SQL Injection.This issue affects BookIt: from n/a through 2.6.0.6...

ASB-A-463363325

In multiple functions of SearchRequestDatabaseUtil.java, there is a possible way to access protected data due to SQL injection. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation...

PT-2026-134915

Name of the Vulnerable Software and Affected Versions BookIt versions prior to 2.6.0.6 Description An SQL Injection issue exists in the booking plugin, where improper neutralization of special elements used in an SQL command allows an attacker to inject malicious database commands. This could...

VulnCheck KEV: CVE-2020-10220

An issue was discovered in rConfig through 3.9.4. The web interface is prone to a SQL injection via the commands.inc.php searchColumn parameter...

CVE-2025-22783

CVE-2025-22783 1️⃣ Component type WordPress plugin 2️⃣ Component details Component name SEO Plugin by Squirrly SEO Vulnerable version = 12.4.01 Component slug squirrly-seo Component link https://wordpress.org/plugins/squirrly-seo/ 3️⃣ OWASP 2017: TOP 10 Vulnerability class A3: Injection...

Multi-Stage-Exploitation-and-Detection-Engineering-Analysis-of-CVE-2023-34362-in-MOVEit-Transfer

CVE-2023-34362 MOVEit Transfer Vulnerability Analysis Project Overview This repository contains an academic technical analysis of CVE-2023-34362, a critical SQL injection vulnerability affecting MOVEit Transfer. The project was prepared for CYB625 – Ethical Hacking & Penetration Testing. Importan...

woo

Woocommerce 3.3 to 5.5 - Unauthenticated SQL Injection https://wpscan.com/vulnerability/1212fec8-1fde-41e5-af70-abdd7ffe5379 Exploit woocommerce SQLI and grab user and password hash Commands usage: woo.py -h -u URL -f FILE -p PROXY -i WID optional arguments: -h, --help show this help message and...

CVE-2024-1071-PoC-Script

CVE-2024-1071 Exploit Script 🚀 🌟 Disclaimer This Proof of Concept POC is made for educational and ethical testing purposes only. Usage of this tool for attacking targets without prior mutual consent is illegal. It is the end user’s responsibility to obey all applicable local, state, and federal...

CVE-2022-0739

CVE-2022-0739 BookingPressWordPress Plugin SQLInjection BookingPress before 1.0.11...

CVE-2022-39066

CVE-2022-39066 Firmware details: wainnerversion: BDPOSTEMF286RMODULEV1.0.0B12 crversion: CRITPOSTEMF286RV1.0.0B10 Prerequisites requests pip install requests SQL injection The vulnerability is a SQL injection present in the handler PHONEBLOCKADD in the webserver goahead binary. Possible exploits:...