drupal-jsonapi-sqli-scanner

CVE-2026-9082 — Drupal PostgreSQL SQL 인젝션 대량 스캐너 & 익스플로잇 도구 Drupal 코어PostgreSQL의 인증이 필요 없는 SQL 인젝션 PDO 플레이스홀더 이름 악용을 통한 JSON:API 필터 배열 키 주입 개요 CVE-2026-9082 는 Drupal 코어 에서 Drupal 8.011.3.9 을 실행하는 모든 PostgreSQL 기반 사이트에 영향을 미치는 매우 치명적인Highly Critical SQL 인젝션 취약점입니다. 2026-05-22에 CISA 알려진 악용 취약점KEV...

SQLiScanner

SQLiScanner 简介 叕一款基于SQLMAP和Charles的SQL 注入漏洞扫描工具 支持 Har 文件的扫描搭配 Charles 使用: Tools=Auto Save 特性 邮箱通知 任务统计 sqlmap 复现命令生成 依赖 Python 3.x Django 1.9 PostgreSQL Celery sqlmap redis 支持平台 Linux osx 截图...

sqliv

SQLiv 大规模SQL注入扫描器 功能 1. 使用Bing、Google或Yahoo通过SQL注入dork进行多域名扫描 2. 通过提供特定域名（含爬取）进行定向扫描 3. 反向域名扫描 SQLi扫描和域名信息检查均采用多进程处理 因此脚本在扫描大量URL时速度极快 快速教程和截图见下方 项目贡献提示见底部 安装 1. git clone https://github.com/the-robot/sqliv.git 2. sudo python2 setup.py -i 依赖项 bs4 termcolor google nyawc 预装系统 BlackArch Linux 快速教程 1...

explo

explo explo 是一个简单工具，用于以人类和机器可读的格式描述 Web 安全问题。通过定义请求/条件工作流，explo 能够利用安全问题，而无需编写脚本。这使得复杂的漏洞能够以简单可读且可执行的格式共享。 例如，提取 csrf 令牌并在表单中使用： root@kitploit: name: getcsrf description: extract csrf token module: http parameter: url: http://example.com/contact method: GET header: user-agent: Mozilla/5.0 extract...

AutoSQLi

AutoSQLi, 스크립트 키디들이 웹사이트를 해킹하는 새로운 방법 기능 저장 시스템 - 완벽한 저장 시스템이 있으며, PC가 충돌해도 다시 시작할 수 있습니다. - 기술이 멋집니다. 도킹 Dorking - 명령줄에서 하나의 dork: 예 - 파일에서: 아니오 - 대화형 마법사에서: 예 와프 탐지 Waffing - Ekultek 덕분에, WhatWaf는 이제 JSON 출력 기능을 갖추고 있습니다. - 거의 완료되었습니다 : - 업데이트: WhatWaf가 AutoSQLi와 완전히 호환됩니다. Sqlmap이 다음 큰...

sqlmap-ai

SQLMap AI アシスタント SQLMapのAI搭載ラッパー。SQLインジェクションテストをより手軽に、自動化します。 機能 コア機能 AI支援テスト - インテリジェントな脆弱性分析と推奨事項 適応型テスト - ターゲットの応答に適応する段階的テスト 拡張HTMLレポート - 脆弱性の詳細を含む、美しく詳細なレポート パラメータ指定 - -pオプションで特定のパラメータをテスト（元のSQLMapと同様） WAFバイパス - ファイアウォール回避のためのタンパースクリプト自動選択 データベース列挙 - データベース、テーブル、カラムの完全な探索 リクエストファイル対応 -...

CVE-2026-77392

A weakness has been identified in SourceCodester Dynamic Input Field Generator Using HTML, CSS, and PHP 1.0. This impacts the function saveUser of the file /public/submit.php. This manipulation of the argument Researcher causes sql injection. The attack may be initiated remotely. The exploit has...

CVE-2023-1454-EXP

JeecgBoot SQL CVE-2023-1454 exp 1. Описание уязвимости В версии 3.5.0 jeecg-boot существует уязвимость SQL-инъекции, которая возникает из-за проблем безопасности в файле jmreport/qurestSql. Через параметр apiSelectId происходит SQL-инъекция. 2. Использование root@kitploit: python3...

EUVD-2026-63793

A weakness has been identified in SourceCodester Dynamic Input Field Generator Using HTML, CSS, and PHP 1.0. This impacts the function saveUser of the file /public/submit.php. This manipulation of the argument Researcher causes sql injection. The attack may be initiated remotely. The exploit has...

CVE-2026-77392

The "Researcher" argument in the saveUser function of /public/submit.php (SourceCodester Dynamic Input Field Generator v1.0) is passed unsanitized to SQL queries, enabling remote SQL injection. CVSS 6.3 (MEDIUM). A public PoC exploit exists at https://gist.github.com/rionyxraiza/6b22a5e02da6b8581...

CVE-2026-77392 SourceCodester Dynamic Input Field Generator Using HTML, CSS, and PHP submit.php saveUser sql injection

A weakness has been identified in SourceCodester Dynamic Input Field Generator Using HTML, CSS, and PHP 1.0. This impacts the function saveUser of the file /public/submit.php. This manipulation of the argument Researcher causes sql injection. The attack may be initiated remotely. The exploit has...

wp2shell-PoC

wp2shell-PoC ⚠ 이 도구는 교육 또는 버그 바운티 목적으로만 제작되었습니다. 통제된 환경 외에서의 무단 사용은 엄격히 금지됩니다. 개요 WordPress Core에 영향을 주는 wp2shell 취약점 체인CVE-2026-63030 및 CVE-2026-60137 결합의 개념 증명입니다. 이 프로젝트는 REST API Batch 라우트 혼동 취약점과 WPQuery SQL 삽입 간의 상호 작용을 시연하여, 인증 없이 WordPress 전체를 장악하고 원격 코드 실행RCE에 이르는 경로를 보여줍니다. 전체 권고문은여기에서...

EUVD-2026-63775

Improper input validation and Exposure of sensitive information through data queries vulnerability in Genians Genian NAC V4.0, Genians Genian NAC V5.0, and Genians Genian ZTNA V6.0 allows SQL Injection and Authentication Bypass. This issue affects Genian NAC V4.0: from 4.0.0 before 4.0.175Revisio...

EUVD-2026-63690

Improper neutralization of special elements used in an sql command 'sql injection' in Azure SQL Database allows an authorized attacker to elevate privileges over a network...

EUVD-2026-63624

Improper neutralization of special elements used in an sql command 'sql injection' in Azure SQL Database allows an authorized attacker to elevate privileges over a network...

CVE-2026-16520

Improper input validation and Exposure of sensitive information through data queries vulnerability in Genians Genian NAC V4.0, Genians Genian NAC V5.0, and Genians Genian ZTNA V6.0 allows SQL Injection and Authentication Bypass. This issue affects Genian NAC V4.0: from 4.0.0 before 4.0.175Revisio...

php:8.2 security, bug fix, and enhancement update

An update is available for module.libzip, php, module.php-pecl-rrd, php-pecl-apcu, module.php-pecl-apcu, libzip, php-pecl-zip, module.php-pecl-zip, php-pecl-rrd, module.php, php-pear, module.php-pear, php-pecl-xdebug3, module.php-pecl-xdebug3. This update affects Rocky Linux 8. A Common...

Cisco Unified Intelligence Center < 12.6 / 12.6.x < 12.6(2) ES08 / 15.0.x < 15.0(1) SU2 SQL Injection (cisco-sa-cuic-sql-inject-2qbfWSm5)

A vulnerability in the web-based management interface of Cisco Unified Intelligence Center could allow an authenticated, local attacker to perform a blind SQL injection attack against an affected device. This vulnerability is due to insufficient validation of user-supplied input. An attacker coul...

RockyLinux 8 : php:8.2 (RLSA-2026:57574)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:57574 advisory. php: ext-pgsql: PHP: SQL injection via improper backslash escaping CVE-2026-17543 php: PHP: Denial of Service via circular symbolic links in phar archiv...

The vulnerability of the Metabase data visualization and reporting software lies in the lack of security measures for query structures, allowing attackers to enhance their privileges and execute arbitrary code.

The vulnerability of the Metabase data visualization and reporting software relates to the lack of measures taken to protect the SQL query structure during the processing of the resetpassword parameter. Exploiting this vulnerability allows a malicious actor to enhance their privileges and execute...