CVE-2021-36396-Moodle-Time-Based-SQLi-Exploit

CVE-2021-36396 Exploit Description This repository holds a Python-based exploit targeting CVE-2021-36393, a severe vulnerability found within Moodle's recent courses feature. The flaw resides in the 'sort' parameter, enabling SQL injection attacks that can lead to unauthorized database access...

blindy

Blindy Simple script for running brute-force blind MySql injection Note: this script was created for fun, helpful in some ctf challenges : description The script will run through queries listed in sets in provided file and try to brute-force any place where placeholder is found. GET & POST http...

ninjasworkout

Damn Vulnerable NodeJS Application Quick Start Download the Repo = run npm i Afer Installing all dependency just run the application node app.js or nodemon app.js ADDED BUGS Prototype Pollution ✅1 No SQL Injection ✅2 Cross site Scripting ✅3 Broken Access Control ✅4 Broken Session Management ✅5 We...

Blinder

Blinder Blidner is a small python library to automate time-based blind SQL injection by using a pre defined queries as a functions to automate a rapid PoC development. Installation You can install Blinder using the following command: pip install blinder Or by downloading the source and importing ...

sqlmap

sqlmap sqlmap is an open source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers. It comes with a powerful detection engine, many niche features for the ultimate penetration tester, and a broad range of switche...

CVE-2026-108821

A security vulnerability exists in Tencent WeKnora (up to version 0.8.1 ) within the SQL Validator component. Specifically, the validateSubquery function in the file internal/utils/inject.go is susceptible to SQL injection via remote manipulation. Public exploits for this vulnerability have been ...

CVE-2026-108821 Tencent WeKnora SQL Validator inject.go validateSubquery sql injection

A security vulnerability has been detected in Tencent WeKnora up to 0.8.1. Impacted is the function validateSubquery of the file internal/utils/inject.go of the component SQL Validator. The manipulation leads to sql injection. The attack is possible to be carried out remotely. The exploit has bee...

CVE-2024-32640-SQLI-MuraCMS

Muraider - Automating the detection & Exploitation of CVE-2024-32640 \ SQLi in Mura/Masa CMS Usage Detection: python3 CVE-2024-32640.py --url https://target.com/ Ghauri Exploitation Pass '-g' or '--ghauri' as argument: Parse in any arguments that you wish to use with Ghauri, following their...

Judge-Jury-and-Executable

Judge Jury and Executable A Threat Hunting Forensics Tool Features: Scan a mounted filesystem for threats right away Or gather a system baseline before an incident, for extra threat hunting ability Can be used before, during or after an incident For one to many workstations Scans the MFT, bypassi...

bbqsql

BBQSQL A Blind SQL Injection Exploitation Tool Table Of Contents What is BBQSQL? Overview of Readme High Level Usage Install BBQSQL Options Query Syntax Overview HTTP Parameters Export Config Import Config Custom Hooks Found a Bug? Can I Help? What's Up with the Name? What is BBQSQL? Blind SQL...

CVE-2026-42647-Lab

CVE-2026-42647 - JoomSport Unauthenticated Time-Based Blind SQL Injection via sortf Executive Summary This repository contains a local Docker lab for reproducing and validating CVE-2026-42647, an unauthenticated SQL injection vulnerability affecting the WordPress plugin JoomSport - for Sports: Te...

slowql

SlowQL The fastest offline SQL static analyzer. Built in Rust for zero false positives. Catch SQL injection, performance regressions, missing indexes, unbounded queries, compliance violations, and 282+ more issues before they reach production. No database connection required. What SlowQL Does...

CVE-2026-1907

A SQL Injection SQLi affects the Kong Gateway Enterprise and Open Source clustering communication logic when operating in Hybrid Mode. The issue can be triggered by sending specially crafted RPC requests to the Control Plane CP, leading to potential unauthorized database access. Leveraging the...

cve-2020-0618

CVE-2020-0618 Honeypot Detects and logs attempts to exploit CVE-020-0618 SQL Reporting Services RCE Serves content and headers like SSRS would, in order to increase chance of indexing on search engines e.g. google, shodan etc. Based on the great work of MDSec and x1sec Installation Get the code...

wp2shell-poc

wp2shell PoC The first ever poc of the pre-auth timing-based SQL injection PoC for the WordPress REST API batch-route confusion chain CVE-2026-63030 + CVE-2026-60137 Achieved command execution, without just trying to crack the admins password. Affected: WordPress 6.9.0–6.9.4 and 7.0.0–7.0.1. Fixe...

CVE-2020-0618_DETECTION

CVE-2020-0618 - Microsoft SQL Server Reporting Services SSRS RCE Detection PoC 📜 Description This is a simple PoC to detect CVE-2020-0618 , a Remote Code Execution vulnerability affecting Microsoft SQL Server Reporting Services SSRS. The vulnerability exists due to improper path validation in the...

CVE-2018-17254

CVE-2018-17254 Exploit Title: Joomla JCK Editor 6.4.4 - 'parent' SQL Injection Googke Dork: inurl:/plugins/editors/jckeditor/plugins/jtreelink/ Vendor Homepage: http://docs.arkextensions.com/downloads/jck-editor Version: 6.4.4 Tested on: Debian 10 Ubuntu Windows 11/10 CVE : CVE-2018-17254 PHP...

Barcha

🚀 Barcha Barcha is your Swiss‑Army knife for SQL Injection reconnaissance 🔍. Written in Go, it automates: Shodan enumeration of SSL hosts 🕵️‍♂️ Liveness & redirect checks ignores bad certs 🔄 Automated Ghauri tests for each host 🛡️ SQLite logging of every scan 🔖 🌟 Features 📡 Shodan Dork :...

r3con

R3CON Multifunctional Web Recon & Vulnerability Scanner Tool r3con is a Multifunctional Web Recon & Vulnerability Scanner Tool and incredibly fast crawler that can find multiple vulnerabilitys and gather information. Check for vulnerabilities Reflected XSS Multi-threaded crawling Open-redirection...

Netgear-ssl-vpn-20211222-CVE-2022-29383

Netgear-ssl-vpn-20211222 CVE-2022-29383 NETGEAR ProSafe SSL VPN SQL injection vulnerability exists in scgi-bin/platform.cgi Firmware version： FVS336Gv2 - FVS336Gv3 sqlmap command SQL Injection Vulnerability : USERDBDomains.Domainname...