CVE-2024-3217-POC

CVE-2024-3217-POC Mitre Description The WP Directory Kit plugin for WordPress is vulnerable to SQL Injection via the 'attributevalue' and 'attributeid' parameters in all versions up to, and including, 1.3.0 due to insufficient escaping on the user supplied parameter and lack of sufficient...

SQLbit

SQL Blind Injection Tool A tool for blind SQL injections that uses multithreaded bitwise comparisons to find values of cells in SQL-tables. Works with SQLite at least and supports cookies. It's able to: Search cell values by columns in a table Search characters count in a cells by columns in a...

CVE-2024-44812-PoC

Vendor SourceCodester Affected Product Link https://www.sourcecodester.com/php/14717/online-complaint-site-using-phpmysqli-full-source-code.html CVE ID: CVE-2024-44812 Description: SQL Injection vulnerability in Online Complaint Site v.1.0 allows a remote attacker to escalate privileges via the...

sqlmap

sqlmap sqlmap is an open source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers. It comes with a powerful detection engine, many niche features for the ultimate penetration tester, and a broad range of switche...

CVE-2023-25157

CVE-2023-25157 This is a simple Python Script to Find the Latest GeoServer SQL Injection Vulnerability. You can use the Scripts on hosts to check for infected path. Installation: 1. git clone https://github.com/0x2458bughunt/CVE-2023-25157/ 2. cd CVE-2023-25157 3. chmod +x geoserver.sh Note: You...

slowql

SlowQL The fastest offline SQL static analyzer. Built in Rust for zero false positives. Catch SQL injection, performance regressions, missing indexes, unbounded queries, compliance violations, and 282+ more issues before they reach production. No database connection required. What SlowQL Does...

CVE-2025-25257

CVE-2025-25257 - FortiWeb Pre-Auth SQL Injection to RCE 07/09/2025 by TheStingR Disclaimer: This proof-of-concept PoC is provided for authorized security testing and research purposes only. Unauthorized use against systems you do not own or have explicit permission to test is illegal. Users are...

andor

andor Blind SQL Injection Tool with Golang Usage Download andor.go and go to the folder where the file andor.go located. And type this to command prompt: go run andor.go --url "http://deneme.com/index.php?id=1" Note: Get parameter value must be correct, otherwise it will not work...

soplanning-1.52-exploits

Exploit Title: SOPlanning v1.52.00 'groupesave.php' XSS Reflected XSS Application: SOPlanning Version: 1.52.00 Date: 4/22/24 Exploit Author: Joseph McPeters Liquidsky Vendor Homepage: https://www.soplanning.org/en/ Software Link: https://sourceforge.net/projects/soplanning/ Tested on: Linux CVE:...

CVE-2024-21514

CVE-2024-21514 PoC and Bulk Scanner Overview POC for CVE-2024-21514 : SQL Injection issue was identified in the Divido payment extension for OpenCart, which is included by default in version 3.0.3.9 This POC is create by M Ali and it's based on this Security Advisory by Snyk. How to Use Minimum...

brutemap

Brutemap .. image:: https://brutemap-dev.github.io/static/brutemap-logo.jpg :target: https://brutemap-dev.github.io :alt: Brutemap Logo |Build Status| |Python| |License| .. |Build Status| image:: https://travis-ci.org/brutemap-dev/brutemap.svg?branch=master :target:...

Reproduce-CVE-2024-21513

Reproduce-CVE-2024-21513 Overview This project demonstrates the vulnerability CVE-2024-21513 in the langchain-experimental package, specifically in versions =0.0.15 and 0.0.21. The vulnerability allows arbitrary code execution via the VectorSQLDatabaseChain component when retrieving values from t...

cloudquery

CloudOps, without the chaos CloudQuery is a cloud asset inventory built for platform teams. Sync your cloud infrastructure metadata into your data warehouse, powering insights and automation. Unify data and provide context across AWS, Azure, GCP, and 70+ cloud and SaaS sources such as Wiz, Finout...

CVE-2023-24775-and-CVE-2023-24780

CVE-2023-24775-and-CVE-2023-24780 my python poc 2023-24780 and CVE-2023-24775 this sqli cve funadmin This is a repository with a poc exploit for python cve sqli funadmin. CVE-2023-24774 - https://nvd.nist.gov/vuln/detail/CVE-2023-24780 Vulnerable version of Funadmin v3.2.0 Vulnerability via id...

Appsmith-1.98-Stored-XSS-Exploit

CVE-2026-7299 - Appsmith 1.98 Stored XSS SQL Autocomplete innerHTML Sink Automated exploit for a stored cross-site scripting vulnerability in Appsmith's SQL query editor. A workspace Developer can inject arbitrary JavaScript via database table names that execute in any other workspace member's...

pyt

.. image:: https://travis-ci.org/python-security/pyt.svg?branch=master :target: https://travis-ci.org/python-security/pyt .. image:: https://readthedocs.org/projects/pyt/badge/?version=latest :target: http://pyt.readthedocs.io/en/latest/?badge=latest .. image::...

CVE-2019-14314

CVE-2019-14314 CVE-2019-14314 - NextGEN Gallery 3.2.10 Authenticated SQL Injection Usage root@kitploit: usage: cve201914314.py -h url loginuser loginpass username CVE-2019-14314 Hash Extractor positional arguments: url Wordpress blog URL loginuser Username to login with loginpass Password to logi...

CVE-2022-23046

CVE-2022-23046 PhpIPAM v1.4.4 allows an authenticated admin user to inject SQL sentences in the "subnet" parameter while searching a subnet via app/admin/routing/edit-bgp-mapping-search.php. Installation 1. Build root@kitploit: git clone https://github.com/dnr6419/CVE-2022-23046.git cd...

mssqlproxy

mssqlproxy mssqlproxy is a toolkit aimed to perform lateral movement in restricted environments through a compromised Microsoft SQL Server via socket reuse. The client requires impacket and sysadmin privileges on the SQL server. Please read this article carefully before continuing. It consists of...

CVE-2025-1094-PoC-Postgre-SQLi

Analysis of CVE-2025-1094 and Emulation Setup This detailed examination, conducted on March 14, 2025, explores CVE-2025-1094, a hypothetical high-severity SQL injection vulnerability in PostgreSQL, based on the provided emulation setup and proof-of-concept PoC execution. The analysis covers the...