265335 matches found
CVE-2026-120530
The WebToffee WP Backup and Migration plugin for WordPress is vulnerable to SQL Injection in all versions up to and including 1.6.1 . The flaw exists because the 'description' parameter lacks sufficient escaping and the existing SQL query is not properly prepared. Authenticated attackers with sub...
EUVD-2026-118971
The GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI plugin for WordPress is vulnerable to generic SQL Injection via the 'input. Gravity Forms name-field part, or list-field row' parameter in all versions up to, and including, 8.1.1 due to insufficient...
EUVD-2026-118964
The WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps plugin for WordPress is vulnerable to generic SQL Injection via the 'engine' parameter in all versions up to, and including, 5.5.90 due to insufficient escaping on the user supplied parameter and lack of sufficient...
CVE-2026-121536
The WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps plugin for WordPress is vulnerable to a generic SQL Injection in all versions up to and including 5.5.90 . The root cause is insufficient escaping of the 'engine' parameter and a lack of sufficient preparation on the ex...
NginxHunter
NginxHunter Description NginxHunter is a comprehensive tool designed to analyze Nginx access logs for security vulnerabilities and suspicious activities. It detects SQL injection attempts, scanner tools, sensitive path accesses, exploitation attempts, webshells, and more. Ideal for system...
CVE-2024-8529
CVE-2024-8529 LearnPress – WordPress LMS Plugin = 4.2.7 - Unauthenticated SQL Injection via 'cfields' Description The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to SQL Injection via the 'cfields' parameter of the /wp-json/lp/v1/courses/archive-course REST API endpoint in...
CVE-2026-121858
The Event Tickets with Ticket Scanner WordPress plugin before 3.2.9 does not properly escape a search value before using it in SQL queries in several of its admin listings, allowing users with access to its admin area administrators by default, or any role granted access in its settings to perfor...
CVE-2022-24707
PoC for CVE-2022-24707 SQL Injection Vulnerability on Puncher plugin. A POST request can be crafted to exploit SQL Injection and leak database contents. This is tested on Anuko Time Tracker 1.20.0.5640. python3 exploit.py --help usage: exploit.py -h --username USERNAME --password PASSWORD --host...
ncrack
ncrack Ncrack is a high-speed network authentication cracking tool. It was built to help companies secure their networks by proactively testing all their hosts and networking devices for poor passwords. Security professionals also rely on Ncrack when auditing their clients. Ncrack was designed...
CVE-2024-42327_Zabbix_SQLi
🛡️ Zabbix 7.0.0 SQL Injection Exploit Script A Python script to exploit a Zabbix 7.0.0 authenticated SQL injection vulnerability, supporting multiple modes of action including user data extraction, session token leaks, remote command execution RCE, and custom query injection. ⚠️ DISCLAIMER: This...
pyt
.. image:: https://travis-ci.org/python-security/pyt.svg?branch=master :target: https://travis-ci.org/python-security/pyt .. image:: https://readthedocs.org/projects/pyt/badge/?version=latest :target: http://pyt.readthedocs.io/en/latest/?badge=latest .. image::...
CVE-2026-121858 Event Tickets with Ticket Scanner < 3.2.9 - Authenticated SQLi via DataTables Search
The Event Tickets with Ticket Scanner WordPress plugin before 3.2.9 does not properly escape a search value before using it in SQL queries in several of its admin listings, allowing users with access to its admin area administrators by default, or any role granted access in its settings to perfor...
EUVD-2026-118948
The Event Tickets with Ticket Scanner WordPress plugin before 3.2.9 does not properly escape a search value before using it in SQL queries in several of its admin listings, allowing users with access to its admin area administrators by default, or any role granted access in its settings to perfor...
CVE-2026-121858
The Event Tickets with Ticket Scanner WordPress plugin, in versions before 3.2.9 , is vulnerable to SQL injection . The issue arises because the plugin fails to properly escape search values before utilizing them in SQL queries across several admin listings . This allows authenticated users with ...
php_code_analysis
this script will scan your code the script can find 1. checkfileupload issues 2. hostheaderinjection 3. SQl injection 4. insecure deserialization 5. openredirect 6. SSRF 7. XSS 8. LFI 9. commandinjection features 1. fast 2. simple report usage: python code.py file.php -this will scan one file...
nginx_log_check
nginxlogcheck Nginx log security analysis script Features Top 20 address statistics SQL injection analysis Scanner alert analysis Vulnerability exploitation detection Sensitive path access File inclusion attack Webshell Find Top 20 URLs by response length Find rare script file access Find 302...
Pybelt
NOTE: This project is no longer updated, this will be the last push to this project, if you would like more info, feel free to ping me on Twitter: @staysalty Pybelt Pybelt is an open source hackers tool belt complete with: A port scanner SQL injection scanner Dork checker Hash cracker Hash type...
TarantuBench
TarantuBench v1 A benchmark for evaluating AI agents on web security challenges, generated by the TarantuLabs engine. What is this? TarantuBench is a collection of 100 vulnerable web applications, each containing a hidden flag TARANTU.... An agent's job is to find and extract the flag by...
CVE-2022-0739
CVE-2022-0739 Proof-of-Concept exploit SQLI BookingPress before 1.0.11 Usage Supply the URL to where the Booking Press plugin is in use on the application. bash exploit.sh '' e.g. Hashes are redacted in this demo ┌──user@user-/ └─$ bash sqliexploit.sh 'http://localhost/calendar/' / / / / \ / / /...