CVE-2026-2413

CVE-2026-2413 Ally – Web Accessibility & Usability = 4.0.3 - Unauthenticated SQL Injection via URL Path Description The Ally – Web Accessibility & Usability plugin for WordPress is vulnerable to SQL Injection via the URL path in all versions up to, and including, 4.0.3. This is due to insufficien...

CVE-2026-78070

SQL Injection via ORDER BY Shortcode in plgcontentdpcalendar DPCalendar Free ≤ 10.11.2 — Author-level User Extracts Full Database via Time-Based Blind Injection SUMMARY The plgcontentdpcalendar content plugin parses events order="..."/events shortcodes embedded in Joomla article bodies. The order...

CVE-2026-24419

CVE-2026-24419: OpenSTAManager has a SQL Injection in the Prima Nota module Overview Field| Details ---|--- CVE ID| CVE-2026-24419 Severity| HIGH Advisory| View Advisory Discovered by| Lukasz Rybak Affected Products devcode-it/openstamanager versions: = 2.9.8 CWE Classification CWE-89: Improper...

CVE-2026-33910_SqlInjectionVulnerabilityOpenEMR8.0.0.2

CVE-2026-33910 - SQL Injection Vulnerability in OpenEMR Weakness CWE-89 Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize ...

CVE-2025-10351-POC

CVE-2025-10351 POC - SQL Injection Exploit 💉 POC for CVE-2025-10351: An unauthenticated SQL Injection vulnerability that affects a specific endpoint in Melis Platform Framework. 🔗 References 📄 CVE-2025-10351 on MITRE 📄 Melis Platform Warning on INCIBE Spanish National Cybersecurity Institute 🚀...

sqli-hunter-CVE-2024-51482-PoC

sqli-hunter-CVE-2024-51482-PoC Python scripts for exploiting CVE-2024-51482 SQLi in ZoneMinder — HTB CCTV sqli-hunter — CVE-2024-51482 Description This script automates the extraction of databases, tables, columns, and credentials by exploiting CVE-2024-51482, a Boolean-based SQL Injection...

CVE-2026-60137-and-CVE-2026-63030

wp2shell Lab — CVE-2026-60137 & CVE-2026-63030 WordPress Core Pre-Auth RCE lab — khai thác thật, RCE server. WARNING: Lab chạy WordPress VULNERABLE. Không expose ra internet. Cấu trúc . ├── docker-compose.yml Lab: WordPress 6.9.4 + MariaDB 11 + phpMyAdmin ├── exploit/ PoC exploit clone từ GitHub ...

CVE-2023-25157

Lab CVE-2023-25157 va CVE-2023-25158 Lab nay dung GeoServer/PostGIS de nghien cuu OGC Filter SQL injection trong moi truong cuc bo, co tach ro operator/setup mode va attacker mode. CVE-2023-25157: be mat GeoServer product, request WFS/WMS di vao JDBC filter encoding. CVE-2023-25158: root cause o...

Exploit-CVE-2023-6063-PoC-Vuln

CVE-2023-6063 — WP Fastest Cache SQL Injection PoC -red Proof of Concept PoC for CVE-2023-6063 , an unauthenticated, time-based blind SQL injection vulnerability affecting WP Fastest Cache ≤ 1.2.2. The vulnerability can be triggered through the wordpressloggedin cookie and may allow an attacker t...

CVE-2026-67401

CVE-2026-67401 SQL injection in cPanel EmailTrack. Authenticated cPanel user with mail privileges writes arbitrary files as root via SQLite ATTACH DATABASE. One request to root. Haven't tested on a real target, code is only put together from public information and basic diff'ing. Do your due...

CVE-2026-67401-cPanel-EmailTrack-SQLi

CVE-2026-67401 — cPanel & WHM EmailTrack SQL Injection → Root RCE IOC Scanner, Mitigation Tool & Remediation Guide for the cPanel EmailTrack SQL Injection Vulnerability Keywords: CVE-2026-67401, cPanel exploit, cPanel SQL injection, WHM vulnerability, EmailTrack SQLi, Track Delivery SQL injection...

CVE-2026-79387-PbootCMS-SQL-Injection

CVE-2026-79387: SQL Injection in PbootCMS V3.2.5 User Management Module Overview Field| Detail ---|--- CVE ID| CVE-2026-79387 Product| PbootCMS Affected Versions| 3.2.0 – 3.2.5, and possibly earlier Vulnerability Type| SQL Injection CWE-89 Attack Vector| Remote Authenticated CVSS Severity| High...

CVE-2026-79303

CVE-2026-79303 Boolean-blind SQL injection Description : Dynamic SQL statements are generated without the required data validation and without using parameterized statements or stored procedures. Impact : SQLi CVSSv3.1 vector : AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H 9.9 Critical CWE : CWE-89: Improp...

CVE-2026-29782-OpenSTAManager-RCE

CVE-2026-29782 — OpenSTAManager auth-SQLi → PHP object injection → RCE PoC for remote code execution inOpenSTAManager ≤ 2.10.1. oauth2.php looks up a zzoauth2 row by the attacker-controlled state GET parameter and calls unserialize on its accesstoken column without anallowedclasses restriction...

CVE-2026-78837

CVE-2026-78837 Description An SQL injection vulnerability in the apformid parameter in AppNitro MachForm v30 allows attackers to access sensitive database information via a crafted SQL statement. Affected Component Tested on MachForm - Version 30 Attack Type Remote Attack Vectors An unauthenticat...

CVE-2026-72898

CVE-2026-72898 Metabase password-reset unauthenticated SQL injection ★ CVE-2026-72898 Metabase /api/session/resetpassword unauthenticated blind SQLi PoC ★ https://github.com/user-attachments/assets/4efe5ae3-2a41-4567-815b-ee3f731a5a59 Overview CVE-2026-72898 is an unauthenticated SQL injection in...

CVE-2026-72898-metabase-sqli

CVE-2026-72898 — Metabase unauthenticated SQL injection detector + analysis -black Unauthenticated SQL injection in Metabase via POST /api/session/resetpassword. CVSS 10.0 , in the CISA KEV catalog, exploited in the wild. An undeclared field in the password-reset request body reaches the...

CVE-2026-42167

CVE-2026-42167: SQL Injection in ProFTPD modsql 📋 Executive Summary CVE-2026-42167 is a critical SQL injection vulnerability in ProFTPD's modsql module that allows authentication bypass , backdoor user injection , and remote code execution RCE. Attribute| Value ---|--- Type| SQL Injection CWE-89...

CVE-2026-42167-PoC

CVE reported by ZeroPath Research original writeup: https://zeropath.com/blog/proftpd-cve-2026-42167-auth-bypass-privesc-rce my version : https://jimmexploit.vercel.app/cve/proftpd-unauthenticated-sql-injection-leads-to-rce Description This repository contains a functional exploit for...

CVE-2026-42167-Exploit

CVE-2026-42167 Master Exploit Tool A professional security research tool for exploiting the CVE-2026-42167 vulnerability in ProFTPD's modsql module. This tool performs unauthenticated SQL injection to exfiltrate sensitive files from the server via time-based side-channel attacks. "Note: The...