CVE-2024-1071

CVE-2024-1071 CVE-2024-1071 Ultimate Member Unauthorized Database Access / SQLi PoC is now published. It was created for educational/research purposes only! Use it at your own risk!...

CVE-2022-28346

CVE-2022-28346 Django QuerySet.annotate, aggregate, extra SQL Injection Environment Initialization 1.python manage.py makemigrations 2.python manage.py migrate 3.访问http://x.x.x.x:8000/ 插入初始化数据 Vulnerability Reproduction 访问http://x.x.x.x:8000/demo POC: http://x.x.x.x:8000/demo?field=demo.name" FRO...

CLEANSTART-2025-GV56895 Tutor LMS plugin for WordPress is vulnerable to time-based SQL Injection via the ‘question_id’ parameter in versions up to, and including, 2

Security vulnerability affects the postgresql15 package. The Tutor LMS plugin for WordPress is vulnerable to time-based SQL Injection via the ‘questionid’ parameter in versions up to, and including, 2...

CVE-2026-21643

CVE-2026-21643 Checker & Nuclei Template This repository contains detection tools for CVE-2026-21643 , a pre-authentication SQL Injection vulnerability in FortiClient EMS 7.4.4. The vulnerability exists in the /api/v1/initconsts and /api/v1/auth/signin endpoints, where the Site HTTP header is...

CVE-2023-25157

CVE-2023-25157 - GeoServer SQL Injection - PoC CVE: CVE-2023-25157 Date: 06/06/2023 Vendor/Software: GeoServer Severity: 9.8/10 - This script is a proof of concept for OGC Filter SQL Injection vulnerabilities in GeoServer, a popular open-source software server for sharing geospatial data. It send...

CVE-2023-41507

CVE-2023-41507 CVE-2023-41507 - Super Store Finder v3.6 was discovered to contain multiple SQL injection vulnerabilities in the store locator component via the products, distance, lat, and lng parameters. Vulnerability Type SQL Injection Vendor of Product Super Store Finder Affected Product Code...

wp2shell

wp2shell Exploit WordPress REST API route confusion CVE-2026-63030 + SQL injection CVE-2026-60137 in the batch endpoint to achieve Remote Code Execution. Vulnerabilities Route Confusion CVE-2026-63030 The WordPress REST API batch endpoint /batch/v1 does not properly isolate request routing. By...

CVE-2025-25257

CVE-2025-25257 CVE‑2025‑25257 is a critical pre-authentication SQL injection vulnerability affecting Fortinet FortiWeb’s Fabric Connector component. It impacts FortiWeb versions: 7.6.0–7.6.3 7.4.0–7.4.7 7.2.0–7.2.10 ≤ 7.0.10 Technical Details The issue resides in the getfabricuserbytoken function...

CVE

CVE's Table CVE Number| Type| Company/Product| Description| Article Link| Repository Link ---|---|---|---|---|--- CVE-2026-9680| SQLi| Alibaba RDS MCP Servers| TBA| TBA| TBA CVE-2026-50335| LPE| Windows July 2026| TBA| TBA| TBA GHSA-73cv-556c-w3g6| SQLi| Apache Pinot MCP 3.1.0| Missing sanitizati...

wp2shell

wp2shell by: ek0ms savi0r Unauthenticated Remote Code Execution for WordPress Core POC CVE-2026-63030 + CVE-2026-60137 wp2shell exploit for a critical vulnerability chain in WordPress core. It chains a REST API batch route confusion bug with an SQL injection in WPQuery to achieve unauthenticated...

CVE-2019-9053-working-

CVE-2019-9053-working script- CMS Made Simple 2.2.10 - SQL Injection . Actual working version Updated the script to work with latest python versions Added Exception Handling for each function You can also calibrate time.sleep inside the exception handling blocks depending on response and connecti...

CVE-2026-49079

CVE-2026-49079 CVE-2026-49079 JetSearch SQL Injection Exploit...

CVE-2024-2876

CVE-2024-2876 - SQL Injection Vulnerability in Email Subscribers by Icegram Express Overview CVE-2024-2876 is a critical security vulnerability found in the "Email Subscribers by Icegram Express" plugin for WordPress. This vulnerability affects versions up to and including 5.7.14 and poses...

cve-2026-5147-exp

cve-2026-5147 Exploitation Script For authorized vulnerability validation and lab practice: performs MySQL boolean-based blind injection EXP / INSTR or ASCII and time-based blind injection if + ascii + sleep against SQL injection endpoints, with optional extraction of version, database name,...

CVE-2022-0439

CVE-2022-0439 CVE-2022-0439 - Email Subscribers & Newsletters 5.3.2 - Subscriber+ Blind SQL injection Must Have sqlmap installed & a valid username & password with subscriber+ Usage usage: CVE-2022-0439.py -h -w URL -u USERNAME -p PASSWORD options: -h, --help show this help message and exit -w UR...

POC-CVE-2026-65971

CVE-2026-65971 — SQL Injection in Livewire PowerGrid via sortDirection Proof-of-concept and full technical write-up for CVE-2026-65971 / GHSA-7fgc-3h6c-698r , an SQL injection in power-components/livewire-powergrid reachable through the public Livewire property sortDirection. | ---|--- CVE|...

CVE-2026-54597

CVE-2026-54597 - ITFlow Time-Based Blind SQL Injection Severity: High Advisory: GHSA-m63v-j7fw-hq2h Affected: ITFlow agent/ajax.php — expires parameter Fixed in: Commit 63d8691 Author: iltosec Summary A time-based blind SQL injection vulnerability in ITFlow's share link generation handler. The...

CVE-2024-36840-Exploit

CVE-2024-36840: SQL Injection Vulnerability in Boelter Blue System Management Version 1.3 Exploit Details Exploit Title : SQL Injection Vulnerability in Boelter Blue System Management version 1.3 Original Google Dork : inurl:"Powered by Boelter Blue" didn't workedzero url in search Google Dork By...

CVE-2024-2876

CVE-2024-2876 - SQL Injection Vulnerability in Email Subscribers by Icegram Express Overview CVE-2024-2876 is a critical security vulnerability found in the "Email Subscribers by Icegram Express" plugin for WordPress. This vulnerability affects versions up to and including 5.7.14 and poses...

CVE-2020-7471

CVE-2020-7471 This repository provides the environment and POC for CVE-2020-7471 Potential SQL injection via StringAggdelimiter vulnerability. Affected Django versions 1.11 to 1.11.28 exclusive 2.2 to 2.2.10 exclusive 3.0 to 3.0.3 exclusive Before downloading and using, the following operations a...