CVE-2025-6783

WHERE句に常に真となる条件を注入し、全ての行が一致するようにします: curl -i -X POST \ -H "Content-Type: application/json" \ -H "forms-id: poc-001' OR '1'='1' -- " \ -H "domain-id: example.com" \ -d ' "emabedtype":"iframe", "shortcodetitle":"INJECTED", "shortcodetag":"xss", "active":0 ' ...

CVE-2026-104053 itsourcecode Pet Shop Management System admin_reservefilter.php sql injection

A vulnerability was identified in itsourcecode Pet Shop Management System 1.0. The impacted element is an unknown function of the file adminreservefilter.php. Such manipulation of the argument filter leads to sql injection. It is possible to launch the attack remotely. The exploit is publicly...

CVE-2026-104053

The itsourcecode Pet Shop Management System 1.0 is vulnerable to SQL injection via an unknown function in the admin_reservefilter.php file. The flaw occurs because the filter argument is improperly handled, allowing for remote exploitation. While the documents do not provide specific remediation ...

CVE-2026-104053 itsourcecode Pet Shop Management System admin_reservefilter.php sql injection

A vulnerability was identified in itsourcecode Pet Shop Management System 1.0. The impacted element is an unknown function of the file adminreservefilter.php. Such manipulation of the argument filter leads to sql injection. It is possible to launch the attack remotely. The exploit is publicly...

EUVD-2026-91156

A vulnerability was identified in itsourcecode Pet Shop Management System 1.0. The impacted element is an unknown function of the file adminreservefilter.php. Such manipulation of the argument filter leads to sql injection. It is possible to launch the attack remotely. The exploit is publicly...

EUVD-2026-91158

A vulnerability was determined in itsourcecode Pet Shop Management System 1.0. The affected element is an unknown function of the file adminrejectcompleted.php. This manipulation of the argument ID causes sql injection. It is possible to initiate the attack remotely. The exploit has been publicly...

CVE-2026-104052

The Pet Shop Management System 1.0 is vulnerable to SQL injection via an unknown function within the admin_reject_completed.php file. The flaw is triggered by the manipulation of the ID argument , allowing an attacker to initiate the attack remotely . Publicly disclosed exploits for this vulnerab...

EUVD-2026-91138

ClipBucket v5 through 5.5.3-197 contains an sql injection vulnerability that allows authenticated users with admanageraccess permission to inject SQL via the delete parameter in adminarea/adsmanager.php. Attackers can supply time-based blind payloads concatenated into AdsManager::DeleteAd queries...

CVE-2026-103766

ClipBucket v5 through 5.5.3-197 contains an sql injection vulnerability that allows authenticated users with admanageraccess permission to inject SQL via the delete parameter in adminarea/adsmanager.php. Attackers can supply time-based blind payloads concatenated into AdsManager::DeleteAd queries...

PT-2026-104126

The Dc Woocommerce Multi Vendor plugin for WordPress is vulnerable to SQL Injection via the 'order by' parameter of the /multivendorx/v1/compliance/report-abuse REST endpoint in versions up to and including 5.0.18. This is due to insufficient escaping on the user supplied parameter and lack of...

PT-2026-104065

A vulnerability was identified in itsourcecode Pet Shop Management System 1.0. The impacted element is an unknown function of the file admin reservefilter.php. Such manipulation of the argument filter leads to sql injection. It is possible to launch the attack remotely. The exploit is publicly...

PT-2026-104072

A vulnerability was detected in SourceCodester Online Reviewer Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /reviewer 0/admins/assessments/activities/btn functions.php?action=activity. The manipulation of the argument Title results in sql injection...

PT-2026-104151

The Event Tickets and Registration plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parameter in all versions up to, and including, 5.29.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This...

PT-2026-104092

The BuildKit WordPress plugin before 1.0.29 does not properly sanitise and escape data submitted by contributor-level users before storing it and later using it in a SQL query, allowing a Contributor to inject SQL that runs against the database once the resulting content is published and viewed b...

PT-2026-104064

A vulnerability was determined in itsourcecode Pet Shop Management System 1.0. The affected element is an unknown function of the file admin reject completed.php. This manipulation of the argument ID causes sql injection. It is possible to initiate the attack remotely. The exploit has been public...

cve-2025-6907

CVE‑2025‑6907 SQLi エクスプロイトツール ファイル: exploit.c 作者: Byte Reaper ターゲットサービス: CODEPROJECT タイプ: SQL インジェクション 🔎 概要 これは、CODEPROJECT サービス内の CVE‑2025‑6907 脆弱性を対象とした、スタンドアロンの C 言語ベースの SQL インジェクションエクスプロイトです。 複数の高度な技術を組み合わせています: 自動ペイロード列挙（ブールベースおよび時間ベースのチェックを含む） ディレクトリ/プロセス検査のためのインラインアセンブリシステムコール メモリマッピングダンプ...

CVE-2025-7753

🚨 CVE-2025-7753 — SQLインジェクション PoC Exploit 作者: Byte Reaper Telegram: @ByteReaper0 CVE: CVE‑2025‑7753 脆弱性: 認証不要、時間ベースSQLインジェクション 🔍 概要 Online Appointment Booking System 1.0 Code‑Projects のファイル /admin/adddoctor.php に深刻なSQLインジェクション脆弱性が存在します。username...

CVE-2025-6860

CVE-2025-6860 エクスプロイトツール C言語で書かれた概念実証のコマンドラインツールで、staffcommision.php（パラメータ fromdate と todate）のSQLインジェクション脆弱性 CVE‑2025‑6860 を検出（および初歩的な悪用）します。HTTPリクエストに libcurl を利用し、一般的なペイロードとユーザーエージェントをローテーションし、応答からSQLエラーパターンをスキャンし、カラフルでシステムコール駆動のコンソール出力を生成します。 特徴 自動ペイロードローテーション fromdate と todate...

frevvomapexec

frevvomapexec frevvomapexec は、Square 9 GlobalForms 6.2 において、指定した秒数の遅延を注入することでブラインドSQLインジェクションの脆弱性の存在を確認するスクリプトです。脆弱性が正当であることを確認するため、エンドユーザーは計算（例：大きい秒数から小さい秒数を引く）を行う必要があります。その計算結果がパラメータ（-s）で指定した値とおおよそ一致した場合、あなたは晴れてSQLインジェクションの所有者となります。また、SQLmap...

CVE-2025-32429

CVE-2025-32429 XWiki SQLインジェクション PoC 著者: Byte Reaper Telegram: @ByteReaper0 CVE: CVE‑2025‑32429 脆弱性: XWiki LiveData REST API におけるブラインドSQLインジェクション 影響を受けるファイル: getdeleteddocuments.vm（sortパラメータ） 説明 XWiki PlatformのLiveData RESTエンドポイントにおいて、getdeleteddocuments.vm の sort...