EverShop-Lab-CVE-2026-25993

CVE-2026-25993 — EverShop二阶SQL注入实验室 前提条件 Docker Engine 24+ 及 Docker Compose v2+ 2 GB 可用内存 部署 cd EverShop-Lab/ docker compose up 首次构建需要等待约2分钟（克隆EverShop v2.1.0，编译，运行迁移，填充数据）。 应用将在 http://localhost:3000 可用。 凭据 字段| 值 ---|--- 管理员邮箱| [email protected] 管理员密码| password123 停止/重置 Stop the lab keep da...

Exploit for SQL Injection in Wordpress

WP2Shell — Unauthenticated SQL Injection Proof of Concept C...

CVE-2023-54400

Fumasoft Fumeng Cloud contains a SQL injection vulnerability in the AjaxMethod.ashx endpoint that allows unauthenticated remote attackers to inject arbitrary SQL through the Name parameter of the getEmpByname action without any authentication. Attackers can exploit UNION-based SQL injection...

cs4239-cve-2020-15873

CVE-2020-15873 CVE-2020-15873 的概念验证 - LibreNMS librenms librenms 开发 调试 LibreNMS Docker 实例 1. 获取容器的 shell： $ sudo docker exec -it librenmsvuln /bin/bash 2. 读取 LibreNMS 生成的日志： $ tail -f /opt/librenms/logs/librenms.log 调试 MariaDB Docker 实例 1. 获取容器的 shell： $ sudo docker exec -it librenmsdbvuln...

cve-2026-9082

CVE-2026-9082 类型 ：SQL 注入 CWE-89 受影响产品 ：Drupal 核心（数据库抽象 API） Drupal 公告 ：SA-CORE-2026-004 发布时间 ：2026 年 5 月 20 日 严重性 ：高度严重（Drupal 20/25 | NVD CVSS 6.5） 这是什么？ CVE-2026-9082 是 Drupal 核心数据库抽象 API 中的一个 SQL 注入 漏洞。Drupal 的数据库层封装了 PDO 并在查询到达数据库之前对所有查询进行净化处理。此漏洞针对 PostgreSQL 后端 绕过了这一净化机制——精心构造的 HTTP...

CVE-2026-23921

CVE-2026-23921 — Zabbix 基于时间的盲注 SQL 注入 受影响版本： Zabbix 50 THEN pgsleep3 ELSE pgsleep0 END-- 用法 PostgreSQL 后端（默认） python exploitCVE-2026-23921.py \ --url http://TARGET/apijsonrpc.php \ --user Admin --password zabbix --db pgsql MySQL 后端 python exploitCVE-2026-23921.py \ --url...

CVE-2025-4396

CVE-2025-4396 — Relevanssi SQL注入（时间型盲注） 免责声明： 本仓库仅供授权的渗透测试、安全研究和教育目的 使用。未经授权访问计算机系统是非法的且不道德的行为。 概述 一个针对WordPress插件Relevanssi 4.24.4 中时间型盲SQL注入漏洞的概念验证利用。该实现特别解决了以下加固环境中的问题： 逗号被过滤 — 破坏了标准的SUBSTRstr, pos, len和IFcond, true, false语法 贪婪睡眠行为 — 导致MySQL在评估完整表达式之前执行SLEEP，产生误报 背景...

CVE-2026-102569

ClipBucket v5 through 5.5.3-197 contains a time-based blind SQL injection vulnerability in the admin video edit function where the videoid parameter is concatenated into an UPDATE statement without proper escaping. An authenticated administrator with videomoderation permission can inject arbitrar...

CVE-2026-102570

ClipBucket v5 through 5.5.3-197 contains a time-based blind SQL injection vulnerability in the language update function where the languageid parameter is concatenated unescaped into the WHERE clause of an UPDATE statement. An authenticated administrator with basicsettings permission can inject...

CVE-2026-102491

A vulnerability was identified in mahonelau kykms up to 8f130c2d85842d5b44caae78cc46d65e505949f7. The impacted element is the function QueryGenerator.doMultiFieldsOrder of the file QueryGenerator.java of the component SqlInjectionUtil. The manipulation of the argument column leads to sql injectio...

CVE-2015-20122

Seeyon A6 collaborative office automation platform contains an unauthenticated SQL injection vulnerability in the attachids parameter of the file attachment download endpoint that allows remote attackers to extract arbitrary database contents without prior authentication. Attackers can inject...

EUVD-2023-60696

Fumasoft Fumeng Cloud contains a SQL injection vulnerability in the AjaxMethod.ashx endpoint that allows unauthenticated remote attackers to inject arbitrary SQL through the Name parameter of the getEmpByname action without any authentication. Attackers can exploit UNION-based SQL injection...

CVE-2023-54400

Fumasoft Fumeng Cloud is vulnerable to a SQL injection flaw in the AjaxMethod.ashx endpoint. Specifically, the getEmpByname action fails to properly sanitize the Name parameter, allowing unauthenticated remote attackers to execute arbitrary SQL commands against the Microsoft SQL Server backend. E...

CVE-2023-54400 Fumeng Cloud SQL Injection via AjaxMethod.ashx getEmpByname

Fumasoft Fumeng Cloud contains a SQL injection vulnerability in the AjaxMethod.ashx endpoint that allows unauthenticated remote attackers to inject arbitrary SQL through the Name parameter of the getEmpByname action without any authentication. Attackers can exploit UNION-based SQL injection...

CVE-2023-54400 Fumeng Cloud SQL Injection via AjaxMethod.ashx getEmpByname

Fumasoft Fumeng Cloud contains a SQL injection vulnerability in the AjaxMethod.ashx endpoint that allows unauthenticated remote attackers to inject arbitrary SQL through the Name parameter of the getEmpByname action without any authentication. Attackers can exploit UNION-based SQL injection...

CVE-2015-20122 Seeyon A6 OA Unauthenticated SQL Injection via downloadAtt.jsp

Seeyon A6 collaborative office automation platform contains an unauthenticated SQL injection vulnerability in the attachids parameter of the file attachment download endpoint that allows remote attackers to extract arbitrary database contents without prior authentication. Attackers can inject...

CVE-2015-20122

The Seeyon A6 collaborative office automation platform is vulnerable to an unauthenticated SQL injection within the attach_ids parameter of the file attachment download endpoint. By injecting UNION-based SQL statements through the attach_ids request parameter in downloadAtt.jsp, remote attackers ...

EUVD-2015-9427

Seeyon A6 collaborative office automation platform contains an unauthenticated SQL injection vulnerability in the attachids parameter of the file attachment download endpoint that allows remote attackers to extract arbitrary database contents without prior authentication. Attackers can inject...

CVE-2015-20122 Seeyon A6 OA Unauthenticated SQL Injection via downloadAtt.jsp

Seeyon A6 collaborative office automation platform contains an unauthenticated SQL injection vulnerability in the attachids parameter of the file attachment download endpoint that allows remote attackers to extract arbitrary database contents without prior authentication. Attackers can inject...

Final-project-SQL-injection-pipeline

SQL 注入检测 — 混合机器学习流水线 硕士论文源代码： 利用机器学习增强 Web 应用防火墙以检测 SQL 注入 | ---|--- 作者| Lilliane Linnet Musoke 机构| 雷丁大学计算机科学系 专业| 数据科学与高级计算理学硕士 导师| Atta Badii 教授 提交日期| 2024年9月17日 本仓库内容 两条新颖的混合机器学习流水线，每条均以独立的 Jupyter notebook 实现，用于检测 Web 应用流量中的 SQL 注入（SQLi）攻击： 1. DistilBERTStackedEnsemblepipeline.ipynb —...