EUVD-2026-118637

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary SQL commands due to SQL injection...

CVE-2026-17134

IBM API Connect versions 12.1.0.0 through 12.1.1.2 are affected by multiple vulnerabilities that could allow a remote authenticated attacker to execute arbitrary SQL commands. This is caused by an SQL injection vulnerability (CWE-89), which can lead to high levels of confidentiality and integrity...

CVE-2026-17132

IBM API Connect versions 12.1.0.0 through 12.1.1.2 are susceptible to a vulnerability where a remote authenticated attacker can execute arbitrary SQL commands . This is caused by the improper neutralization of special elements used in an SQL command (CWE-89). The security impact is rated as CRITI...

EUVD-2026-118636

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary SQL commands due to improper neutralization of special elements used in an SQL command...

EUVD-2026-118909

The Affiliate Program Suite — SliceWP Affiliates plugin for WordPress is vulnerable to generic SQL Injection via the 'email' parameter in all versions up to, and including, 1.2.14 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

CVE-2026-120043

The Affiliate Program Suite — SliceWP Affiliates plugin for WordPress is vulnerable to SQL Injection in versions up to and including 1.2.14 . The flaw resides in the 'email' parameter due to insufficient escaping and a lack of proper preparation on the existing SQL query. Unauthenticated attacker...

libinjection

libinjection SQL / SQLI tokenizer parser analyzer. For C and C++ PHP Python Lua Java external port LuaJIT/FFI https://github.com/p0pr0ck5/lua-ffi-libinjection external port See https://www.client9.com/ for details and presentations. Simple example: include include include include "libinjection.h"...

ghauri

Like Ghauri, consider supporting the developer Ghauri An advanced cross-platform tool that automates the process of detecting and exploiting SQL injection security flaws. Requirements Python 3 Python pip3 Installation cd to ghauri directory. install requirements: python3 -m pip install --upgrade ...

CVE-2022-37209

CVE-2022-37209 CVE-2022-37209 POC Suggested description JFinal CMS 5.1.0 is vulnerable to SQL Injection. These interfaces do not use the same component, nor do they have filters, but each uses its own SQL concatenation method, resulting in SQL injection. Additional Information...

CVE-2024-49681

CVE-2024-49681 WP Sessions Time Monitoring Full Automatic = 1.0.9 - Unauthenticated SQL Injection Description: The WP Sessions Time Monitoring Full Automatic plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 1.0.9 due to insufficient escaping on the user suppli...

CVE-2025-66039_CVE-2025-61675_CVE-2025-61678_reePBX

FreePBX CVE-2025 Vulnerability Scanner ⚠️ DISCLAIMER FOR EDUCATIONAL AND AUTHORIZED TESTING ONLY This tool is provided "AS IS" for educational and research purposes only Authors are NOT responsible for any misuse or illegal activities Unauthorized access to computer systems is ILLEGAL Only use on...

bluemonday

bluemonday bluemonday is a HTML sanitizer implemented in Go. It is fast and highly configurable. bluemonday takes untrusted user generated content as an input, and will return HTML that has been sanitised against an allowlist of approved HTML elements and attributes so that you can safely include...

mssqli-duet

MSSQLi-DUET - MSSQL Injection-based Domain User Enumeration Tool SQL injection script for MSSQL that extracts domain users from an Active Directory environment based on RID bruteforcing. Supports various forms of WAF bypass techniques through the implementation of SQLmap tamper functions...

CVE-2017-8917-Joomla

CVE-2017-8917-Joomla Python script to exploit the CVE-2017-8917 SQL injection Vulnerability in Joomla! 3.7.0 Created for educational purposes only. Used for the TryHackMe Dailybugle CTF Advisory All the scripts/binaries in this repository should be used for authorized penetration testing and/or...

CVE-2024-13184

CVE-2024-13184 The Ultimate WordPress Toolkit – WP Extended = 3.0.12 - Unauthenticated SQL Injection via Login Attempts Module Description The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to time-based SQL Injection via the Login Attempts module in all versions ...

bbqsql

BBQSQL A Blind SQL Injection Exploitation Tool Table Of Contents What is BBQSQL? Overview of Readme High Level Usage Install BBQSQL Options Query Syntax Overview HTTP Parameters Export Config Import Config Custom Hooks Found a Bug? Can I Help? What's Up with the Name? What is BBQSQL? Blind SQL...

pythia-sql-clairvoyance

Production-ready SQL injection scanner with 6 detection methods, AI-powered remediation, SARIF output, and CI/CD integration. Quick Start · Documentation · Docker · AI Analysis · Star on GitHub In Action Live scan · PHP vulnerable shop · 11 findings detected · safe mode · 2265.56s !Pythia — HTML...

CVE-2021-40353

CVE-2021-40353 CVE-2021-40353 openSIS 8.0 SQL Injection Vulnerability https://vulners.com/cve/CVE-2021-40353 A SQL injection vulnerability exists in version 8.0 of openSIS when MySQL or MariaDB is used as the application database. An attacker can then issue the SQL command through the USERNAME...

CVE-2023-49954.github.io

SQL Injection in 3CX CRM Integration For the CRM integration, 3CX ships templates for connecting to various databases. In these templates, placeholders FirstName,SearchText,Email are used to populate the queries. User input is not sanitized and thus enables SQL injections. Affected Versions no...

BinGoo

,--="=--, / ." .-. "./ / ,/ : : /\ \ | /o\ :: /o\ | / -'| :=" "=: | \ / .-"-. \ | / .-"-. .--- --| /,.-'-.,\ |-- ---. /-===- / | / | | | | | | ' | | / \ / | | | | | | | | | | | | | || |/| || | || / / '-----v1--------------By-Hood3dRob1n----' Welcome to the BinGoo README file! This should give you...