EUVD-2026-96737

The Mobile builder WordPress plugin through 1.4.2 does not sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks...

CVE-2026-103695

The Mobile builder WordPress plugin versions up to and including 1.4.2 is vulnerable to an unauthenticated SQL injection attack. The root cause is the failure to properly sanitize and escape the 'vendor_id' parameter before its use in a SQL statement. This flaw allows unauthorized users to execut...

CVE-2026-103695 Mobile Builder <= 1.4.2 - Unauthenticated SQLi via 'vendor_id' Parameter

The Mobile builder WordPress plugin through 1.4.2 does not sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks...

andor

andor Herramienta de inyección SQL ciega con Golang Uso Descarga andor.go y ve a la carpeta donde se encuentra el archivo andor.go. Luego escribe esto en el símbolo del sistema: go run andor.go --url "http://deneme.com/index.php?id=1" Nota: El valor del parámetro Get debe ser correcto, de lo...

php_code_analysis

este script analizará tu código el script puede encontrar 1. problemas de carga de archivos checkfileupload 2. inyección en cabecera de host hostheaderinjection 3. inyección SQL 4. deserialización insegura insecure deserialization 5. redirección abierta openredirect 6. SSRF 7. XSS 8. LFI 9...

lazyrecon

| | | |/ | /| | | | / / |/ | \ | | | / / | | | | | | / | | | ||\ |/ \ || ||/|| |v2 |/ Lazyrecon v2 es una herramienta de descubrimiento de subdominios que encuentra y resuelve subdominios válidos y luego realiza fuzzing de SSRF/LFI/SQLi, fuerza bruta y escaneo de puertos. Tiene una...

sqlmc

SQLMC - Controllo Massivo di SQL Injection Demo Informazioni Questo strumento è solo per scopi educativi, l'uso di SQLMC per attaccare target senza il preventivo consenso reciproco è illegale. Gli sviluppatori non si assumono alcuna responsabilità e non sono responsabili per qualsiasi uso impropr...

tulpar

Tulpar es un escáner de vulnerabilidades web de código abierto diseñado para automatizar las pruebas de penetración web. Tulpar tiene las siguientes características. Sql Injection GET Method XSS GET Method Crawl E-mail Disclosure Credit Card Disclosure Whois Command Injection GET Method Directory...

webpwn3r

webpwn3r Questo progetto non è mantenuto da anni ed è stato scritto quando stavo imparando Python, ma ancora oggi piace alla gente :D. Supporta solo python2.7 WebPwn3r - Scanner di sicurezza per applicazioni web. Di Ebrahim Hegazy - @Zigoo0 Ringraziamenti: @lnxg33k, @dia2diab @Aelhemily, @okamalo...

testenv

Entorno de pruebas de inyección SQL Una colección de páginas web vulnerables a fallos de inyección SQL y más: conf/ - archivos de configuración del sistema operativo utilizados por deployment.sh. dbs/ - bases de datos independientes para algunos sistemas de gestión de bases de datos p. ej...

w3af

sqlmap sqlmap es una herramienta para pruebas de penetración "penetration testing" de software libre que automatiza el proceso de detección y explotación de fallos mediante inyección de SQL además de tomar el control de servidores de bases de datos. Contiene un poderoso motor de detección, así co...

PT-2026-110054

Name of the Vulnerable Software and Affected Versions Llavero.io versions prior to 0.1.5 Description An issue exists where the software fails to properly sanitize and escape the cill login parameter before incorporating it into a SQL statement. This allows unauthenticated attackers to execute SQL...

CVE-2026-89213: Improper Neutralization of Special Elements used in an SQL Command

The Llavero.io WordPress plugin through 0.1.4 does not properly sanitise and escape a parameter before using it in a SQL statement, which allows unauthenticated attackers to perform SQL injection attacks and read data from the database...

CVE-2026-108571: Improper Neutralization of Special Elements used in an SQL Command

A weakness has been identified in Xinhu Rainrock RockOA up to 2.7.6. This impacts the function kqjcmdModel::returnchuli of the file webmain/task/openapi/openkqjAction.php of the component Openkqj Action. This manipulation of the argument ID causes sql injection. The attack is possible to be carri...

CVE-2026-89195: Improper Neutralization of Special Elements used in an SQL Command

The Site Setup Wizard WordPress plugin through 1.5.8 does not properly sanitise and escape a parameter before using it in a SQL statement, which allows unauthenticated attackers to perform SQL injection attacks and read data from the database...

CVE-2026-108541: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability has been found in highwarden Super Store Finder up to 3.8. Affected is an unknown function of the file /products/superstorefinder/index.php. The manipulation of the argument lat/lng leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclos...

PT-2026-110064

Name of the Vulnerable Software and Affected Versions paymendo WordPress plugin versions prior to 1.2 Description The plugin fails to properly sanitize and escape the paymendo bank transfer completed payment parameter before incorporating it into a SQL query. This flaw allows unauthenticated user...

CVE-2026-89232: Improper Neutralization of Special Elements used in an SQL Command

The Recordbrowser WordPress plugin through 1.1.7 does not sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated attackers to append additional SQL queries and extract sensitive information from the database...

CVE-2026-108569: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was identified in Furion .NET Framework up to 4.9.9.92. The impacted element is the function String.Replace of the file framework/Furion/Templates/Extensions/StringRenderExtensions.cs. The manipulation of the argument Name leads to sql injection. Remote exploitation of the attack ...

PT-2026-110187

Name of the Vulnerable Software and Affected Versions erzhongxmu Jeewms versions prior to 3.7 Description A remote SQL injection issue exists within the Autocomplete Data Handler component. The flaw is located in the getTreeData function of the...