CVE-2023-24203-and-CVE-2023-24204

CVE-2023-24203-and-CVE-2023-24204 Introduction In the ever-evolving landscape of cybersecurity, web applications remain a prime target for attackers seeking to exploit vulnerabilities. Recently, two critical vulnerabilities were discovered in the SourceCodester Simple Customer Relationship...

WhatsUp Gold HasErrors SQL Injection - Authentication Bypass

In WhatsUp Gold versions released before 2024.0.0, a SQL Injection vulnerability allows an unauthenticated attacker to retrieve the users encrypted password. id: CVE-2024-6670 info: name: WhatsUp Gold HasErrors SQL Injection - Authentication Bypass author: DhiyaneshDK,princechaddha severity:...

CVE-2021-41648

CVE-2021-41648 CVE-2021-41648 SQL Injection in online-shopping-system The online-shopping-system is vulnerable to un-authenticated error/boolean-based blind & error based SQL Injection attacks. The proId parameter on the /action.php page does not sanitize the user input, an attacker can extract...

CVE-2026-30951

CVE-2026-30951 Sequelize JSON Cast SQL Injection ★ CVE-2026-30951 Sequelize ORM SQL Injection PoC ★ https://github.com/user-attachments/assets/30b19211-890a-4780-acd9-04856ec98381 Overview CVE-2026-30951 is a SQL Injection vulnerability in Sequelize v6 , a widely used Node.js ORM. The vulnerabili...

CVE-2019-9053

CVE-2019-9053 Improved code of Daniele Scanu SQL Injection exploit Following changes applied: Added time control variable -t or --time that enables user to extend the timing of SQL injection useful if a network connection in between hosts is subject of delays with packet transmission Network...

Fix-CVE-2026-60137-CVE-2026-63030-in-wordpress

Plugin Acyber Wordpress !WARNING Temporary Emergency Mitigation for CVE-2026-60137 & CVE-2026-63030 wp2shell کاهش مخاطره اضطراری و موقت برای زنجیره آسیب‌پذیری wp2shell 🇬🇧 English Description This lightweight WordPress plugin serves as a temporary virtual patch mitigation against the critical...

CVE-2026-48842

CVE-2026-48842 — Roundcube virtuserquery pre-auth SQLi Python 3 checker for CVE-2026-48842 in Roundcube Webmail optional virtuserquery plugin. PoCbit This PoC is listed on PoCbit — CVE-2026-48842 on pocbit.org. Running the PoC prints a PoCbit header; JSONL lines include pocbit / pocbitpage. |...

cachet_2.4.0-dev

CVE-2021-39174 Cachet 2.4.0-dev A python3 script for CVE-2021-39174 Cachet 2.4.0-dev Information Disclosure and RCE via Twig Server Side Template Injection. For the RCE the API KEY for the user is needed. Check out the Leave Songs link below which covers how to get the API KEY via SQL Injection...

CVE-2021-35042

CVE-2021-35042 SQL injection via QuerySet.orderby untrusted input Setup: Start the instances using: docker-compose up Now open the following URL to load sample data: http://localhost:8000/vulapp/setup Then go to the vulnerable page at: http://localhost:8000/vulapp/ Exploit the parameter at:...

CVE-2024-51030

CVE-2024-51030 Description A SQL injection vulnerability in manageclient.php and viewcab.php of Sourcecodester Cab Management System 1.0 allows remote attackers to execute arbitrary SQL commands via the id parameter, leading to unauthorized access and potential compromise of sensitive data within...

CVE-2025-29529

SQLi ITC Multiplan CVE-2025-29529 Discovery On February 21, 2025, an SQL injection vulnerability was identified in the “Multiplan” platform developed by ITC Systems during a client engagement. Affected Versions This vulnerability has been only been tested on v3.7.4.1002 Attack Vector The...

POC-GeoLeak-CVE-2026-52715

GeoLeak — PoC for CVE-2026-52715 Educational Proof of Concept for GeoLeak CVE-2026-52715, an unauthenticated SQL injection CVSS 9.3 in the GEO my WordPress = 4.5.5 plugin for WordPress. The swlatlng and nelatlng map boundary parameters are interpolated without sanitization into the WHERE clause...

CVE-2026-26988-LibreNMS-SQLi

CVE-2026-26988 – LibreNMS Unauthenticated SQL Injection PoC Unauthenticated SQL Injection in LibreNMS ajaxtable.php via IPv6 address search parameter. Affected versions : LibreNMS ≤ 25.12.0 Fixed in : LibreNMS ≥ 26.1 commit 15429580baba03ed1dd377bada1bde4b7a1175a1 CVSS v4.0 : 9.3 Critical...

opendcim-exploit

openDCIM - SQLi to RCE via Config Poisoning Remote code execution chain targeting openDCIM's install.php LDAP configuration form. Built on the VulnCheck go-exploit framework. Vulnerability Chain | CVE| CWE| Description ---|---|---|--- 1| CVE-2026-28515| CWE-862| install.php performs no role check...

CVE-2026-119418

CakePHP through 5.4.3 contains an sql injection vulnerability that allows attackers to inject SQL by supplying unvalidated frame offsets and directions to WindowExpression::range and frame. Attackers can pass crafted values through applications forwarding user input into the OVER clause to execut...

CVE-2026-119419

CakePHP through 5.4.3 contains an sql injection vulnerability that allows attackers to inject SQL by supplying unvalidated collation values to StringExpression and IdentifierExpression. Attackers controlling a collation name passed to the constructor or setCollation can append SQL after the...

cve-2026-28576

CVE-2026-28576: Android Contacts Provider SQL Injection and Systemic Exfiltration Executive Summary CVE-2026-28576 is a critical access control vulnerability in the Android Contacts Provider framework ContactsProvider2.queryLocal. The flaw enables an unprivileged application installed locally wit...

CVE-2026-63030-Wp2Shell

CVE-2026-63030 wp2shell — WordPress Core Pre-Auth RCE REST API batch route confusion chained with CVE-2026-60137 SQL injection TL;DR — An unauthenticated attacker can chain a WordPress REST API batch-routing bug with a SQL injection in WPQuery to reach full remote code execution on a stock...

CVE-2026-79752

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · CVE-2026-79752 Write-up: https://abraxaslabs.tech/research/CVE-2026-79752 CVE-2026-79752 CakePHP 5.2.13 - cakephp I am @abraxasnull. Loopback lab. The client is CVE-2026-79752-Abraxas-Labs.py. CAST AS literal...

CVE-2026-101110

CVE-2026-101110 — OrdaSoft Book Library Free unauthenticated SQL injection Python 3 PoC for CVE-2026-101110 — OrdaSoft Book Library Free for Joomla ≤ 6.4.6. Upgrade to 6.4.7+. | ---|--- PoCbit| https://pocbit.org/pocs/cve-2026-101110 Catalog| https://pocbit.org/pocs/ Component| combooklibrary Fil...