CVE-2026-6433

CVE-2026-6433 — Proof of Concept FlipperCode — Custom CSS, JS & PHP · Unauthenticated SQL injection → RCE via eval Affected: FlipperCode Custom CSS, JS & PHP ≤ 2.0.7 · WordPress plugin surface via admin-ajax.php At a glance Item| Detail ---|--- Vector| Unauthenticated SQLi tunneled through plugin...

CVE-2026-42647-Lab

CVE-2026-42647 - JoomSport Unauthenticated Time-Based Blind SQL Injection via sortf Executive Summary This repository contains a local Docker lab for reproducing and validating CVE-2026-42647, an unauthenticated SQL injection vulnerability affecting the WordPress plugin JoomSport - for Sports: Te...

pharmacy-sqli-CVE-2026-7392

Pharmacy Sales and Inventory System 1.0 - CVE-2026-7392 SQL Injection SourceCodester Pharmacy Sales and Inventory System V1.0 pure PHP/MySQL version CVE : CVE-2026-7392 Endpoint : /ajax.php?action=deletesupplier id parameter Type : SQL Injection CWE-89 CVSS 3.1 : 6.3 Medium Author : oretnom23...

SleuthQL

SleuthQL Description SleuthQL is a python3 script to identify parameters and values that contain SQL-like syntax. Once identified, SleuthQL will then insert SQLMap identifiers into each parameter where the SQL-esque variables were identified. Supported Request Types SleuthQL requires an export of...

WP2Shell-Scanner

WP2Shell Scanner A command line tool that checks whether a WordPress site is exposed to WP2Shell CVE-2026-63030 and CVE-2026-60137. It reads the WordPress version and REST API surface over read-only requests and reports a verdict. It does not exploit anything. !WARNING For authorised testing only...

CVE-2026-25746_SqlInjectionVulnerabilityOpenEMR7.0.4

CVE-2026-25746 - SQL Injection Vulnerability in OpenEMR Weakness CWE-89 Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize ...

CVE-2021-39377

OPENSIS 8.0 SQL INJECTION VULNERABILITY CVE-2021-39377 A SQL Injection vulnerability exists in version 8.0 of openSIS when MySQL MariaDB is being used as the application database. A malicious attacker can issue SQL commands to the Mysql MariaDB database through the vulnerable username= parameter...

CVE-2021-37832

CVE 2021-37832 Hotel Druid 3.0.2 SQL Injection Vulnerability A SQL injection vulnerability exists in version 3.0.2 of Hotel Druid when SQLite is being used as the application database. A malicious attacker can issue SQL commands to the SQLite database through the vulnerable idappartamenti...

CVE-2024-54761

BigAnt Office Messenger 5.6.06 RCE via SQL Injection SQL injection vulnerability in BigAnt Messenger causes RCE vulnerability. Follow the steps to exploit. Usage: CVE-2024-54761.py -h -r RHOST -p RPORT -u USERNAME -P PASSWORD options: -h, --help show this help message and exit -r, --rhost RHOST...

sqlmap-ai

SQLMap AI Assistant An AI-powered wrapper around SQLMap that makes SQL injection testing more accessible and automated. Features Core Features AI-Assisted Testing - Intelligent vulnerability analysis and recommendations Adaptive Testing - Step-by-step testing that adapts to target responses...

CVE-2022-24124

POC for CVE-2022-24124 Exploit Code for CVE-2022-24124 aka Casdoor SQL Injection Exploit Links: ExploitDB-50792 PacketStormSecurity Expected outcome: Dump SQL database version on host running Casdoor 1.13.1 Intended only for educational and testing in corporate environments. Exploit Usage...

MOVEit-Transfer-Data-Breach-Analysis.

MOVEit-Transfer-Data-Breach-Analysis. ​Detailed analysis of the 2023 MOVEit Transfer data breach CVE-2023-34362 for CS50 Cybersecurity. This project explores the technical impact of unauthenticated SQL Injection and its consequences for global data privacy, affecting 2,700+ organizations. Special...

Bash-exploit-for-CVE-2022-0739

Bash exploit for CVE-2022-0739 Unauthenticated SQL Injection for BookingPress 1.0.11. Usage: ./exploit.sh options Options: -u, --url VALUE Set the URL ex: http://example.com required -e, --event-dir VALUE Set the event directory ex: events -h, --help Display this help message...

CVE-2026-48842

CVE-2026-48842 PoC — Roundcube virtuserquery pre-auth SQLi Poc for CVE-2026-48842 , a pre-auth SQL injection in the optional virtuserquery plugin of Roundcube Webmail. The tool does two things and refuses to guess about either: 1. Confirms the injection with a true/false differential not a single...

CVE-2026-5076

CVE-2026-5076 - ARMember Password Reset Vulnerability Vulnerability Information Item| Detail ---|--- CVE ID| CVE-2026-5076 Plugin| ARMember – Membership Plugin & Content Restriction Affected Version| Premium = 7.3.1 Patched Version| 7.3.2 CVSS Score| 9.8 Critical CWE| CWE-640: Weak Password...

CVE-2025-25257

Table of Contents Overview Vulnerability Details Proof of Concept PoC Trolled2 Trolled3 Overview CVE-2025-25257 is a pre-authentication SQL Injection vulnerability in Fortinet FortiWeb Fabric Connector versions 7.0 through 7.6.x. This flaw allows attackers to inject malicious SQL commands into th...

AOSP-DownloadProviderDbDumper

AOSP-DownloadProviderDbDumper PoC Exploiting SQL Injection in Android's Download Provider CVE-2018-9493 Security Advisory https://ioactive.com/wp-content/uploads/2019/04/IOActive-Security-Advisory-Androids-Download-Provider-SQL-Injection-CVE-2018-9493.pdf More Information...

CVE-2022-23046

CVE-2022-23046 PhpIPAM v1.4.4 allows an authenticated admin user to inject SQL sentences in the "subnet" parameter while searching a subnet via app/admin/routing/edit-bgp-mapping-search.php. Installation 1. Build git clone https://github.com/dnr6419/CVE-2022-23046.git cd CVE-2022-23046 &&...

CVE-2023-2594

CVE-2023-2594 https://vulners.com/cve/CVE-2023-2594 A vulnerability, which was classified as critical, was found in SourceCodester Food Ordering Management System 1.0. Affected is an unknown function of the component Registration. The manipulation of the argument username leads to sql injection. ...

Microfinance-Management-System-V1.0-SQL-Injection-Vulnerability-Unauthenticated

Microfinance Management System V1.0 SQL Injection Vulnerability Unauthenticated 1. Description: Microfinance Management System allows SQL Injection via parameter 'customernumber' in /mims/updatecustomer.php. Exploiting this issue could allow an attacker to compromise the application, access or...