CVE-2024-39250

CVE-2024-39250 PoC nuclei template Efrotech's http://www.efrotech.com/ TimeTrax https://etimetrax.com/ is a Human Resources attendance tracking program, and I found an unauthenticated SQL Injection vulnerability. It is easy to execute the attack vector, so I created a nuclei template...

CVE-2025-28346

Vulnerability Type SQL Injection Description A Time-Based Blind SQL Injection vulnerability was discovered in Ticket-Booking-App - 1.0 that allows an attacker to execute arbitrary SQL queries on the underlying database. The vulnerable parameter does not properly sanitize user-supplied input,...

CVE-2024-48245

CVE-2024-48245 SQL Injection Vulnerability in Vehicle Management System 1.0 - 1.3 Description Vehicle Management System 1.0 is vulnerable to SQL Injection. Low-authenticated guest users or administrative accounts can exploit vulnerable POST parameters in several endpoints to execute arbitrary SQL...

CVE-2023-38891

CVE-2023-38891 Authenticated SQL Injection Vulnerability in VTiger Open Source CRM v7.5 Discovered by: Jacob Elliott 07/13/23 Summary In the Reports module in VTiger CRM v7.5.0, there is insufficient checking of the selected fields for the report which are stored and then later reintroduced as a...

FreePBX-CVE-2025-57819-RCE

FreePBX 16 — Unauthenticated SQLi to RCE Proof-of-concept exploit chaining two FreePBX vulnerabilities to go from zero access to remote code execution on FreePBX 16. CVE| Component| Impact ---|---|--- CVE-2025-57819| Endpoint module loader brand parameter| Unauthenticated stacked SQL injection...

CVE-2024-37791

CVE-2024-37791 CVE-2024-37791 Project address: Preparatory work: Log in to the backend - get cookie Vulnerability URL: http://127.0.0.1:8093/s/article/Content/index?classid=&keyword= Vulnerability parameter: keyword payload: %27andselectfromselect+ifasciisubstrdatabase,1,1%3E97,sleep1,0a//union/...

WP-Contest-Gallery-28.1.4-Exploit

⚠️ Under Testing This PoC is actively being tested and refined. Features may change between releases. CVE-2026-3180 WordPress Contest Gallery — Unauthenticated Blind SQL Injection Proof-of-concept assessment tool for CVE-2026-3180 Author: Sudeepa Wanigarathna · Original discovery: cardosource...

CVE-2023-33817---SQL-Injection-found-in-HotelDruid-3.0.5

CVE-2023-33817 - SQL Injection found in HotelDruid V3.0.5 HotelDruid v3.0.5 are vulnerable to SQL injection. An attacker could issue arbitrary sql command to retrieve data in databases or even execute remote code execution on target database system This is my second repo. Don't beat me if i didn'...

-CVE-2021-26904

CVE-2021-26904 LMA ISIDA Retriever 5.2 allows SQL Injection Suggested description : "ISIDA RETRIEVER v5.2" SQL Injection Vulnerable functionality : ISIDA RETRIEVER Platform is vulnerable to SQL Injection Vulnerable URL and paramert : website.com/index.php?title=Injection Vulnerable URL and parame...

CVE-2025-44608

CVE-2025-44608 CloudClassroom-PHP Project v1.0 is vulnerable to RCE via SQL Injection. Vendor: https://github.com/mathurvishal/CloudClassroom-PHP-Project Software Link: https://github.com/mathurvishal/CloudClassroom-PHP-Project/archive/refs/heads/master.zip PoC Step 1: Navigate to the affected UR...

CVE-2021-41649

CVE-2021-41649 CVE-2021-41649 SQL Injection in online-shopping-system The online-shopping-system is vulnerable to un-authenticated error/boolean-based blind & error based SQL Injection attacks. The catid parameter on the /homeaction.php page does not sanitize the user input, an attacker can extra...

CVE-2025-7558-PoC

CVE-2025-7558-PoC Summary A vulnerability labeled as critical has been found in code-projects Voting System 1.0. The affected element is an unknown function of the file /admin/positionsadd.php. Such manipulation of the argument Description leads to sql injection. This vulnerability is documented ...

wp2shell-poc2

wp2shell-poc Proof-of-concept for an unauthenticated SQL injection in WordPress core that chains to remote code execution, via REST batch route confusion CVE-2026-63030. The exploit needs no credentials and no configuration beyond a reachable target. It reaches the injection through a single...

CVE-2022-21661

CVE-2022-21661 POC Video | WordPress Core 5.8.2 - 'WPQuery' SQL Injection CVE-2022-21661 : EDB : https://www.exploit-db.com/exploits/50663...

CVE-2024-2876

CVE-2024-2876 - SQL Injection Vulnerability in Email Subscribers by Icegram Express Overview CVE-2024-2876 is a critical security vulnerability found in the "Email Subscribers by Icegram Express" plugin for WordPress. This vulnerability affects versions up to and including 5.7.14 and poses...

CVE-2019-9053

CVE 2019-9053 Detail Description This code is an implementation of a Time-Based Blind SQL Injection attack in Python 3. The attack is designed to exploit a SQL injection vulnerability in a Content Management System CMS Made Simple 2.2.8 through an HTTP request. Exploit Use: exploit.py -u...

CVE-2026-63030-wp2r00t

wp2r00t - WordPress REST Batch Route-Confusion SQLi PoC A self-contained proof-of-concept for the unauthenticated blind SQL injection reachable through the WordPress REST batch endpoint /wp-json/batch/v1. It is an independent implementation built from the published vulnerability mechanics. Offici...

WordPress--CVE-2022-21661

CVE-2022-21661 POC Video | WordPress Core 5.8.2 - 'WPQuery' SQL Injection CVE-2022-21661 EDB : https://www.exploit-db.com/exploits/50663...

CVE-2023-4542

poc The D-LINK-DAR-8000-10 Online behavior audit gateway has rce vulnerabilities official website:http://www.dlink.com.cn/ version:D-LINK DAR-8000-10 See the login page. Construct url:...

CVE-2023-51504

CVE-2023-51504 This is a dockerized reproduction of the MotoCMS SQL injection cf exploit db Description MotoCMS Version 3.4.3 SQL Injection via the keyword parameter on the link https://template189526.motopreview.com/store/category/search/?keyword=1 Reproducing the vulnerability involved defining...