EUVD-2026-114595

The FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via the 'bwfancartid' parameter in all versions up to, and including, 3.8.5.2 due to insufficient escaping on the user supplied parameter and...

CVE-2026-119163 FunnelKit Automations <= 3.8.5.2 - Unauthenticated SQL Injection via 'bwfan_cart_id' Parameter

The FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via the 'bwfancartid' parameter in all versions up to, and including, 3.8.5.2 due to insufficient escaping on the user supplied parameter and...

Exploit-CVE-2025-24799

Exploit-CVE-2025-24799 CVE-2025-24799 Exploit: GLPI - Unauthenticated SQL Injection Installation git clone https://github.com/MatheuZSecurity/Exploit-CVE-2025-24799 cd Exploit-CVE-2025-24799 pip3 install -r requirements.txt python3 exploit.py -h Join in Rootkit Researchers...

CVE-2026-42208-Lab

CVE-2026-42208 — LiteLLM Pre-Auth SQL Injection Timing PoC Local Docker lab and least-harm PoC for CVE-2026-42208, a pre-authentication SQL injection vulnerability in LiteLLM Proxy's API key verification path. This repository demonstrates the difference between a vulnerable LiteLLM instance and a...

CVE-2024-34226

Visitor Management System 1.0 Submitter: Kha Do Vulnerability SQL injection Description SQL injection vulnerability in /php-sqlite-vms/?page=managevisitor&id=1 in SourceCodester Visitor Management System 1.0 allow attackers to execute arbitrary SQL commands via the id parameters. Affected compone...

CVE-2022-31061

CVE-2022-31061 PoC for GLPI CVE-2022-31061 A Proof of Concept for GLPI = 9.3.0 and 10.0.2 - Unauthenticated SQL injection on login page Legal disclaimer : Use of this script for attacking à target without mutual consent is illegal. It's is the end user responsibility to obey all applicables laws...

CVE-2023-23279

SQL injection in Canteen Management System v1.0. Bug author: Tuannq Discovered Day: 5/1/2023 Vendors: https://www.sourcecodester.com/php/15688/canteen-management-system-project-source-code-php.html Login account: [email protected]/rootadmin Super Admin account Vulnerability File:...

geoserver-CVE-2023-25157

geoserver CVE-2023-25157 White Hat 3rd Cohort Class 30 Kim Jeong-woo github link - https://github.com/custiya/geoserver-CVE-2023-25157 Vulnerability Summary CVE-2023-25157 is an SQLi vulnerability that occurred in GeoServer, an open-source map data service web application. Occurs in some versions...

CVE-2026-10110-SQLi

Student Details Management System 1.0 - SQL Injection Unauthenticated Vulnerability Information Field| Details ---|--- Product| Student Details Management System Vendor| code-projects.org Version| 1.0 Vulnerability Type| SQL Injection CWE-89 CVE ID| Pending CVSS Score| 9.8 Critical...

CVE-2020-14295

CVE-2020-14295 CVE-2020-14295 proof of concept. The original post can be found at exploit-db. Install requirements python3 -m pip install -r requirements.txt Usage $ python3 cactisqlirce.py --help usage: cactisqlirce.py -h -t -u -p --lhost --lport Cacti 1.2.12 - SQL Injection / Remote Code...

PAYLOAD-LISTS

Payloads List of payloads: SSTI-injection payloads XXE payloads XSS payloads Server Side Request ForgerySSRF SQL injection payloads Open Redirect payloads NoSQL injection payloads LDAP injection payloads File inclusion payloads Command injection payloads CRLF injection payloads Code injection...

CVE-2024-10354

Source code Petrol pump management software free download | SourceCodester Description SQL Injection vulnerability in sourcecodester Petrol pump management software v1.0, A vulnerability has been found that is rated as high risk, affecting some unknown functionality of the admin\print.php file,...

CVE-2023-48084

CVE-2023-48084 Python exploit for the CVE-2023-48084 - Nagios XI before version 5.11.3 was discovered to contain a SQL injection vulnerability via the bulk modification tool. The exploit uses /admin/bannermessage-ajaxhelper.php?action=acknowledgebannermessage&id= to execute SQL queries, and...

FreePBX-Vulns-December-25

FreePBX Vulnerabilities - December 2025 This repository contains Nuclei templates for detecting three critical vulnerabilities in FreePBX: CVE-2025-61675 : Authenticated SQL Injection CVSS 8.6 - Affects endpoint module CVE-2025-61678 : Authenticated Arbitrary File Upload CVSS 8.6 - Affects endpoi...

CVE-2022-3689

CVE-2022-3689 Analysis Report Overview CVE-2022-3689 is an SQL injection vulnerability found in a specific WordPress plugin, which allows an attacker to exploit security vulnerabilities in web applications to insert malicious SQL code into the database. This can lead to serious security issues su...

Valve-Press-CVE-2024-27956-RCE

Valve-Press-CVE-2024-27956-RCE Valve Press - CVE-2024-27956-RCE - SQL Injection...

CVE-2026-10170-RCE

Visitor Management System 1.0 - SQLi to Remote Code Execution Attack Chain Vulnerability Information Field| Details ---|--- Product| Visitor Management System Vendor| code-projects.org Version| 1.0 Vulnerability Classes| SQL Injection CWE-89 + Unrestricted File Upload CWE-434 CVE ID| Pending CVSS...

CVE-2026-63030

CVE-2026-63030 - WordPress REST API Batch Route Confusion PoC Description Proof-of-concept exploit for CVE-2026-63030, a pre-authentication vulnerability in WordPress versions 6.9.0 through 7.0.1. It chains: REST API batch route confusion validation vs dispatch mismatch SQL injection via...

CVE-2026-72898-metabase-sqli

CVE-2026-72898 — Metabase unauthenticated SQL injection detector + analysis -black Unauthenticated SQL injection in Metabase via POST /api/session/resetpassword. CVSS 10.0 , in the CISA KEV catalog, exploited in the wild. An undeclared field in the password-reset request body reaches the...

django-cve-2025-64459

Django CVE-2025-64459 This application demonstrates CVE-2025-64459 affecting multiple Django versions. This vulnerability has been patched in newer releases of Django. SQL Injection SQL Injection is when user-provided input is treated as part of a SQL query, allowing an attacker to change how the...