Sequelize-1day-CVE-2023-25813

CVE-2023-25813 CVE Information CVE Number : CVE-2023-25813 Description : In Sequelize versions prior to 6.19.1, input passed through the replacements option is not properly escaped, which can lead to SQL Injection depending on the query structure. Affected Versions : Sequelize 6.19.0 and below...

CVE-2019-1698

TRAN CONG DANH - SVTT - Mentor: LUU VAN LAN - CVE-2019-1698 - Day Started: 30/07/2024 Check the diff code betwween ver has vuln and ver of code with fix vuln: Code reference 1: https://plugins.trac.wordpress.org/changeset/3040809/notificationx/trunk/includes/Core/Rest/Analytics.php Code reference...

CVE-2023-42284

Disclaimer For educational purpose only! Details Proof of concept for CVE-2023-42284. Tyk Gateway is vulnerable to SQL injection. Fixed in 5.0.7 version. The URL parameter ‘apiversion’ of the "https:///api/errors/count/...?res=day&p=...&apiversion=&apiid=..."is vulnerable to Blind SQL injection...

CVE-2024-51482-POC

ZoneMinder Authenticated Time Based SQLi POC - CVE-2024-51482 ⚠️ For educational and authorized security research only. Running this tool against systems you do not own or lack written permission to test is illegal. Table of Contents ZoneMinder Authenticated Time Based SQLi POC - CVE-2024-51482...

SafeLine

SafeLine - Make your web apps secure 🏠 Website | 📖 Docs | 🔍 Live Demo | 🙋‍♂️ Discord | 中文版 🏆 Achievements 👋 INTRODUCTION SafeLine is a self-hosted WAFWeb Application Firewall to protect your web apps from attacks and exploits. A web application firewall helps protect web apps by filtering and...

CVE-2023-24203-and-CVE-2023-24204

CVE-2023-24203-and-CVE-2023-24204 Introduction In the ever-evolving landscape of cybersecurity, web applications remain a prime target for attackers seeking to exploit vulnerabilities. Recently, two critical vulnerabilities were discovered in the SourceCodester Simple Customer Relationship...

Blinder

Blinder Blidner is a small python library to automate time-based blind SQL injection by using a pre defined queries as a functions to automate a rapid PoC development. Installation You can install Blinder using the following command: pip install blinder Or by downloading the source and importing ...

College-Management-System-course_code-SQL-Injection-Authenticated

College Management System - 'coursecode' SQL Injection Authenticated 1. Description: College Management System 1.0 allows SQL Injection via parameter 'coursecode' in /College-Management-System/admin/asign-single-student-subjects.php. Exploiting this issue could allow an attacker to compromise the...

POC-CVE-2026-63030-CVE-2026-60137-

PoC: WP2Shell — CVE-2026-63030 & CVE-2026-60137 -red?style=for-the-badge 📌 Overview WP2Shell is a critical exploit chain in WordPress Core source code that allows a remote unauthenticated attacker to gain full control of the server Full Server Takeover / RCE. The exploit chain combines two securi...

slowql

SlowQL The fastest offline SQL static analyzer. Built in Rust for zero false positives. Catch SQL injection, performance regressions, missing indexes, unbounded queries, compliance violations, and 282+ more issues before they reach production. No database connection required. What SlowQL Does...

semcms

Introduction to Semcms SEMCMS is a foreign trade website content management system CMS that supports multiple languages. v4.8 Download Link: http://www.sem-cms.com/TradeCmsdown/php/semcmsphp4.8.zip Causes of vulnerabilities: /xcR45qAdmin/SEMCMSMenu.php Line 66 Vulnerability code: query"SELECT FRO...

CVE-2024-57430

CVE-2024-57430 An SQL injection vulnerability in the pjActionGetUser function of PHPJabbers Cinema Booking System v2.0 allows attackers to manipulate database queries via the column parameter. Exploiting this flaw can lead to unauthorized information disclosure, privilege escalation, or database...

wp2shell-poc

wp2shell PoC The first ever poc of the pre-auth timing-based SQL injection PoC for the WordPress REST API batch-route confusion chain CVE-2026-63030 + CVE-2026-60137 Achieved command execution, without just trying to crack the admins password. Affected: WordPress 6.9.0–6.9.4 and 7.0.0–7.0.1. Fixe...

CVE-2024-40498

CVE-2024-40498 Affected Application online-shopping-system-advanced 1.0 https://github.com/PuneethReddyHC/online-shopping-system-advanced Description The file register.php handles user registration. At line 117, the POST parameters "$address1" and $address2" are unsanitized, unlike the e-mail,...

CVE-2023-46017-Code-Projects-Blood-Bank-1.0-SQL-Injection-Vulnerability

CVE-2023-46017-Code-Projects-Blood-Bank-1.0-SQL-Injection-Vulnerability Exploit Author: ersinerenler Vendor Homepage https://code-projects.org/blood-bank-in-php-with-source-code Software Link https://download-media.code-projects.org/2020/11/BloodBankInPHPWithSourcecode.zip Overview Code-Projects...

CVE-2019-9053-port-py3

CVE-2019-9053 Exploit - Python 3 This is a Python 3 port of the CVE-2019-9053 exploit, which targets CMS Made Simple CMSMS versions before 2.2.10. The vulnerability allows for SQL injection through the News module interface. Example Output Tested on the TryHackMe Simple CTF Challenge. Description...

Scanner-and-Patcher

Scanner and Patcher Overview: The Scanner and Patcher project is built as part of the AlphaSecure framework, which has been presented and published at ACM IC3 2024 under the title AlphaSecure: A State-of-the-Art Framework for Web Application Vulnerabilities Detection and Patch Recommendation Usin...

CVE-2024-9326-PoC

CVE-2024-9326 PoC Exploit Script This PoC script is designed to verify the presence of CVE-2024-9326, a high SQL Injection vulnerability in PHPGurukul Online Shopping Portal v2.0. It automates the exploitation process to determine if the target web application is vulnerable, allowing security...

CVE-2022-37204

CVE-2022-37204 CVE-2022-37204 POC Suggested description RESERVED JFinal CMS 5.1.0 is vulnerable to SQL Injection. Additional Information https://github.com/AgainstTheLight/someEXPofjfinalcms/blob/main/jfinalcms/sql7.md Vulnerability Type SQL Injection Vendor of Product the development group...

pysqli

PySQLi - Python SQL injection framework 1. Overview PySQLi is a python framework designed to exploit complex SQL injection vulnerabilities. It provides dedicated bricks that can be used to build advanced exploits or easily extended/improved to fit the case. 2. Why another SQLi framework ? Simple...