CVE-2026-42208-Lab

CVE-2026-42208 — LiteLLM Pre-Auth SQL Injection Timing PoC Local Docker lab and least-harm PoC for CVE-2026-42208, a pre-authentication SQL injection vulnerability in LiteLLM Proxy's API key verification path. This repository demonstrates the difference between a vulnerable LiteLLM instance and a...

CVE-2026-118378 Tabularis before 0.28.0 SQL Injection via MCP describe_table table_name

Tabularis before 0.28.0 contains an SQL injection vulnerability in its SQLite driver that allows MCP clients to execute stacked statements by supplying a crafted tablename to the describetable tool. Attackers, including AI agents steered by untrusted content, can close the quoted PRAGMA argument...

CVE-2026-118378 Tabularis before 0.28.0 SQL Injection via MCP describe_table table_name

Tabularis before 0.28.0 contains an SQL injection vulnerability in its SQLite driver that allows MCP clients to execute stacked statements by supplying a crafted tablename to the describetable tool. Attackers, including AI agents steered by untrusted content, can close the quoted PRAGMA argument...

CVE-2026-118378

Tabularis before version 0.28.0 is vulnerable to an SQL injection in its SQLite driver . This flaw allows MCP clients to execute stacked statements by providing a crafted table_name to the describe_table tool. Specifically, an attacker can close the quoted PRAGMA argument and append additional co...

EUVD-2026-111554

Tabularis before 0.28.0 contains an SQL injection vulnerability in its SQLite driver that allows MCP clients to execute stacked statements by supplying a crafted tablename to the describetable tool. Attackers, including AI agents steered by untrusted content, can close the quoted PRAGMA argument...

CVE-2026-118378

Tabularis before 0.28.0 contains an SQL injection vulnerability in its SQLite driver that allows MCP clients to execute stacked statements by supplying a crafted tablename to the describetable tool. Attackers, including AI agents steered by untrusted content, can close the quoted PRAGMA argument...

CVE-2023-25157

CVE-2023-25157 GeoServer OGC Filter SQL Injection Vulnerabilities...

ABO.CMS-Login-SQLi-CVE-2024-25227

ABO.CMS-Login-SQLi-CVE-2024-25227 Unauthenticated SQLi and Login Bypass CVE-2024-25227 Date: 23/02/2024 Tested on ABO.CMS 5.8 Vendor: ABO.CMS Vendor URL:https://abocms.ru ABO.CMS 5.8 is vulnerable to SQL Injection via the tblogin parameter, admin login page. The affected component is "tblogin"...

CVE-2026-6182-SQLI-auth

SQL Injection Authentication Bypass - Simple Content Management System PHP Description A SQL Injection vulnerability exists in the admin login page of Simple Content Management System PHP. The user parameter is not sanitized before being passed to the SQL query, allowing an unauthenticated attack...

drupal-cve-2026-9082-checker

DRUPAL CVE-2026-9082 CHECKER Drupal CVE-2026-9082 Blind SQL Injection Checker Installation git clone https://github.com/N45HT/drupal-cve-2026-9082-checker.git cd drupal-cve-2026-9082-checker pip install -r requirements.txt References https://vulners.com/cve/CVE-2026-9082...

CVE-2025-5287

CVE-2025-5287 Likes and Dislikes Plugin = 1.0.0 - Unauthenticated SQL Injection Description The Likes and Dislikes Plugin plugin for WordPress is vulnerable to SQL Injection via the 'post' parameter in all versions up to, and including, 1.0.0 due to insufficient escaping on the user supplied...

Gallery-Plugin-SQL-Injection

Exploit Title: Wordpress Video Gallery - YouTube Gallery and Vimeo Gallery Plugin SQL Injection Date: 2024-07-05 Exploit Author: tmrswrr Category : Webapps Vendor Homepage: https://total-soft.com/wp-video-gallery/ Version 2.3.6 1. Access the Admin Panel: Navigate to the admin panel of your...

RootQuest-CTF-Box-Multi-Stage-Exploitation-VM

RootQuest CTF Box — Multi-Stage Exploitation VM 💀 Kalaichelvan Thieveshkar CB013248 · Staffordshire University · COMP50003 - Cyber Security II Overview RootQuest is a purpose-built CTF virtual machine that contains a 10-stage , sequential attack path spanning 5 security domains. Each challenge...

CVE-2026-10110-SQLi

Student Details Management System 1.0 - SQL Injection Unauthenticated Vulnerability Information Field| Details ---|--- Product| Student Details Management System Vendor| code-projects.org Version| 1.0 Vulnerability Type| SQL Injection CWE-89 CVE ID| Pending CVSS Score| 9.8 Critical...

Published-CVE

Published-CVE This repository contains descriptions and exploits for two security vulnerabilities: 1. CVE-2023-33580: Stored Cross-Site Scripting XSS in the Student Study Center Management System V1.0, allowing attackers to execute arbitrary JavaScript code. 2. CVE-2023-33584: SQL Injection SQLI ...

Cisco-UCM-SQLi-Scripts

CVE-2019-15972 Cisco UCM SQLi Scripts Scripts that can be used to exploit CVE-2019-15972 which was an Authenticated SQLi issue in Cisco Unified Call Manager UCM. Enumerate tables - enumerate all tables on the underlying database and place the table names in a text file Extract tables - take the...

wp2shell

wp2shell — Pre-Auth RCE in WordPress core Unauthenticated WordPress core RCE PoC chaining CVE-2026-63030 + CVE-2026-60137. Authorized testing only. wp2shell.py is a single-file, standard-library-only proof of concept that chains two WordPress core vulnerabilities into unauthenticated remote code...

CVE-2020-13996

Exploit Title: Joomla J2 Store 3.3.11 - 'filterorderDir' SQL Injection Authenticated Date: 2020-04-17 Exploit Author: Mehmet Kelepçe / Gais Cyber Security Vendor Homepage: https://www.j2store.org/ Software Link: https://www.j2store.org/download.html Reference:...

CVE-2023-48788

CVE-2023-48788 Fortinet FortiClient EMS SQL Injection Vulnerabilitiy An exploit proof of concept for FortiClient EMS CVE-2023-48788 Blog Post More details here: https://www.horizon3.ai/attack-research/cve-2023-48788-fortinet-forticlientems-sql-injection-deep-dive Usage $ python3 CVE-2023-48788.py...

CVE-2025-50383

CVE-2025-50383 Description A low-privileged authenticated user can exploit this vulnerability by sending a crafted HTTP POST request with a malicious orderby parameter e.g., orderby=IF1=1,SLEEP5,1. This can trigger time-based blind SQL injection, resulting in unauthorized SQL execution on the...