CVE-2025-40677

Exploit Title: Summar Employee Portal Prior to 3.98.0 Authenticated SQL Injection - CVE-2025-40677 Google Dork: inurl:"/MemberPages/quienesquien.aspx" Date: 09/22/2025 Exploit Author: Peter Gabaldon - https://pgj11.com/ Vendor Homepage: https://www.summar.es/ Software Link:...

CVE-2024-27304-PoC

CVE-2024-27304-PoC references DEF CON 32 - SQL Injection Isn't Dead Smuggling Queries at the Protocol Level - Paul Gerste pgx SQL Injection via Protocol Message Size Overflow webapp A simple web application with login functionality. Only administrators can log in. This application uses PostgreSQL...

CVE-2026-103355

The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) WordPress plugin is vulnerable to Blind SQL Injection in versions up to and including 2.0.20 . The root cause is the improper neutralization of special elements used in an SQL command. This vulnerability allows an attacker to ...

EUVD-2026-92089

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Unlimited Elements Unlimited Elements For Elementor Free Widgets, Addons, Templates unlimited-elements-for-elementor allows Blind SQL Injection.This issue affects Unlimited Elements For Elementor...

CVE-2026-103355 WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.20 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Unlimited Elements Unlimited Elements For Elementor Free Widgets, Addons, Templates unlimited-elements-for-elementor allows Blind SQL Injection.This issue affects Unlimited Elements For Elementor...

CVE-2026-103355 WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.20 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Unlimited Elements Unlimited Elements For Elementor Free Widgets, Addons, Templates unlimited-elements-for-elementor allows Blind SQL Injection.This issue affects Unlimited Elements For Elementor...

CVE-2026-72898-safe-detection

CVE-2026-72898-safe-detection Simple script to achieve safe and non-destructive active detection of CVE-2026-72898 SQLi in Metabase It attempts to determine if a Metabase instance is vulnerable to the SQL injection vulnerability in the password reset endpoint. The script is designed to be safe an...

WordPress ProfileGrid plugin <= 6.0.0.2 - SQL Injection vulnerability

SQL Injection vulnerability discovered by neurotx in WordPress Plugin ProfileGrid versions = 6.0.0.2...

PoC-CVE-2024-44349

PoC-CVE-2024-44349 Vulnerability found and tested in Anteeo WMS - v4.7.31 The vulnerability allows threat actors to craft an SQL command inside the username parameter and disclose data in the underlying database. The impacted versions of ANTEEO B2B WMS are from v.4.7.x to v.4.7.34 excluded. Usage...

CVE-2019-13027

CVE-2019-13027 تفاصيل الكشف عن CVE-2019-13027 الجدول الزمني للتواصل مع البائع: 1 يوليو 2019 - لا رد، لا بريد إلكتروني. 4 يوليو 2019 - لا رد، لا بريد إلكتروني. 8 يوليو 2019 - تم إرسال البريد الإلكتروني، وتم إنشاء مستودع Github. 11 يوليو 2019 - لا استجابة من البائع. تم الكشف عن الثغرة. نوع الثغرة ح...

CVE-2025-22964

CVE-2025-22964: حقن SQL أعمى زمني في DDSN Interactive cm3 Acora CMS الإصدار 10.1.1 يحتوي DDSN Interactive cm3 Acora CMS الإصدار 10.1.1 على ثغرة حقن SQL أعمى زمني ناتجة عن عدم كفاية تعقيم المدخلات والتحقق منها في معامل "table". يسمح هذا الخلل للمهاجمين بحقن استعلامات SQL خبيثة من خلال دمج المدخلات...

MOVEit Transfer - SQL Injection

In Progress MOVEit Transfer before 2020.1.11 12.1.11, 2021.0.9 13.0.9, 2021.1.7 13.1.7, 2022.0.7 14.0.7, 2022.1.8 14.1.8, and 2023.0.4 15.0.4, a SQL injection vulnerability has been identified in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain unauthorized...

WhatsUp Gold HasErrors SQL Injection - Authentication Bypass

In WhatsUp Gold versions released before 2024.0.0, a SQL Injection vulnerability allows an unauthenticated attacker to retrieve the users encrypted password. id: CVE-2024-6670 info: name: WhatsUp Gold HasErrors SQL Injection - Authentication Bypass author: DhiyaneshDK,princechaddha severity:...

Rudder Server < 1.3.0-rc.1 - SQL Injection

Rudder-server is part of RudderStack, an open source Customer Data Platform CDP. Versions of rudder-server prior to 1.3.0-rc.1 are vulnerable to SQL injection. This issue may lead to Remote Code Execution RCE due to the rudder role in PostgresSQL having superuser permissions by default. Version...

PT-2026-104625

A security flaw has been discovered in mooSocial up to 3.2.4. This issue affects some unknown processing of the file /stores/all-products. Performing a manipulation of the argument rating results in sql injection. The attack may be initiated remotely. The exploit has been released to the public a...

PT-2026-104657

A vulnerability was identified in kishor-23 food-waste-management-system 411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b2c492dc9904de5be1ad9389bd79b87f82c. This affects an unknown function of the file admin/admin.php of the component Order Assignment Block. The manipulation of the argument order...

PT-2026-104621

A vulnerability was found in Comsenz Discuz! X5.0-20260801/X5.0-20260820/X5.0-20260910. Affected by this issue is the function modmedalsubmit of the file upload/source/app/admin/child/medals/mod.php of the component Admin Medal Moderation. The manipulation of the argument delete results in sql...

PT-2026-104653

A vulnerability was determined in kishor-23 food-waste-management-system 411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b2c492dc9904de5be1ad9389bd79b87f82c. The impacted element is an unknown function of the file admin/donate.php. Executing a manipulation of the argument location can lead to sql...

CVE-2026-105167: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was determined in kishor-23 food-waste-management-system 411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b2c492dc9904de5be1ad9389bd79b87f82c. The impacted element is an unknown function of the file admin/donate.php. Executing a manipulation of the argument location can lead to sql...

PT-2026-104615

Name of the Vulnerable Software and Affected Versions Unlimited Elements For Elementor versions prior to 2.0.21 Description Unlimited Elements for Elementor contains a blind SQL injection flaw. This issue allows unauthenticated remote attackers to extract arbitrary database records by failing to...