CVE-2019-20059

CVE-2019-20059 Yetishare SQL Injection in sSortDir0 parameter - v3.5.2 - v4.5.4. Apart from an admin being able to exploit this, it could also be used in a CSRF attack to trick an admin user into running malicious queries. Files affected paymentmanage.ajax.php paymentsubscriptionmanage.ajax.php...

CVE-2022-27414

CVE-2022-27414 - SQL-Injection College Website CMS v1.0 - CVE-2022-27414 - SQL Injection CVE url https://vulners.com/cve/CVE-2022-27414 PoC below Vulnerable Code starts from line 9 in "cwms\departments\index.php" query"SELECT FROM departmentlist where deleteflag = 0 and status = 1 order by name...

CVE-2024-32136

BWL Advanced FAQ Manager 2.0.3 - Post-Authenticated SQL Injection Exploit Title: BWL Advanced FAQ Manager 2.0.3 - Post-Authenticated SQL Injection Date: 14 Apr 2024 Exploit Author: Ivan Spiridonov xbz0n Software Link: https://codecanyon.net/item/bwl-advanced-faq-manager/5007135 Version: 2.0.3...

CVE-2022-24124

POC for CVE-2022-24124 Exploit Code for CVE-2022-24124 aka Casdoor SQL Injection Exploit Links: ExploitDB-50792 PacketStormSecurity Expected outcome: Dump SQL database version on host running Casdoor 1.13.1 Intended only for educational and testing in corporate environments. Exploit Usage...

CVE-2025-22783

CVE-2025-22783 1️⃣ Component type WordPress plugin 2️⃣ Component details Component name SEO Plugin by Squirrly SEO Vulnerable version = 12.4.01 Component slug squirrly-seo Component link https://wordpress.org/plugins/squirrly-seo/ 3️⃣ OWASP 2017: TOP 10 Vulnerability class A3: Injection...

AOSP-DownloadProviderDbDumperSQLiWhere

AOSP-DownloadProviderDbDumperSQLiWhere PoC Exploiting SQL Injection in Android's Download Provider in Selection Parameter CVE-2019-2198 Security Advisory Android AOSP Download Provider SQL Injection in Query Selection Parameter CVE-2019-2198 Demo...

CVE-2024-1512

CVE-2024-1512 Proof of Concept Vulnerability Overview CVE-2024-1512 exposes a critical vulnerability in the MasterStudy LMS WordPress Plugin, specifically within the implementation of the /lms/stm-lms/order/items REST route. The issue arises from the plugin's failure to properly escape the 'user'...

Exploit-Joomla

ep4-redes CVE-2017-8917 SQL injection Vulnerability in Joomla! 3.7.0 exploit Explanation about the vulnerability: https://blog.sucuri.net/2017/05/sql-injection-vulnerability-joomla-3-7.html...

AOSP-DownloadProviderDbDumperSQLiLimit

AOSP-DownloadProviderDbDumperSQLiLimit PoC Exploiting SQL Injection in Android's Download Provider in Sort Parameter CVE-2019-2196 Security Advisory Android AOSP Download Provider SQL Injection in Query Sort Parameter CVE-2019-2196 Demo...

CVE-2022-21661

CVE-2022-21661 1. Introduction WordPress v4.1v5.8.2 WPQuery SQL Injection POC 2. Usage poc -h 192.168.1.1 // 单个扫描 poc -f host.txt // 批量扫描 3. Disclaimer This tool is intended only for learning, research, and self-assessment. It must not be used for illegal purposes. Please comply with relevant...

Blisqy

1. Blisqy Blisqy is a tool to aid Web Security researchers to find Time-based Blind SQL injection on HTTP Headers and also exploitation of the same vulnerability. The exploitation enables slow data siphon from a database currently supports MySQL/MariaDB only using bitwise operation on printable...

cve-2025-57819-exploit

CVE-2025-57819 Exploit Metadata Severity: Critical 9.8 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Type: Unauthenticated SQL Injection → Remote Code Execution Affected Software: FreePBX endpoint module...

drupal-jsonapi-sqli-scanner

CVE-2026-9082 — Drupal PostgreSQL SQL Injection Mass Scanner & Exploitation Tool Unauthenticated SQL Injection in Drupal Core PostgreSQL JSON:API filter array key injection via PDO placeholder name abuse Overview CVE-2026-9082 is a Highly Critical SQL injection vulnerability in Drupal Core...

CVE-2024-9264

🚨 CVE-2024-9264 - Grafana SQL injection leading to Remote Code Execution RCE and file Read Exploit tool for CVE-2024-9264, a critical vulnerability in Grafana allow authenticated attcker to execute sql query leading to RCE 🛡️ This tool is strictly for educational purposes and authorized penetratio...

wp2shell

wp2shell — WordPress Core Pre-Auth RCE CVE-2026-63030 Batch Route Confusion, CVSS 7.5 + CVE-2026-60137 SQL Injection, CVSS 9.1 A pre-authentication remote code execution chain in WordPress Core that requires no plugins, no special configuration, and works on default installs. Affected Versions...

RedTeamBrasil-CVE-2025-64459

connector-sqli Automated SQL Injection exploitation in Django's ORM Q-object connector · CVE-2025-64459 🎥 RedTeam Brasil channel — offensive security, hands-on, in Portuguese. ██████╗ ████████╗██████╗ connector-sqli ██╔══██╗╚══██╔══╝██╔══██╗ Django Q connector SQLi ██████╔╝ ██║ ██████╔╝...

CVE-2024-8309

Proof of Concept for Langchain CVE-2024–8309 Vulnerability Overview This setup demonstrates a proof of concept for the prompt injection vulnerability in the GraphCypherQAChain class that allows SQL injection in a Neo4j database. Components: 1. Neo4j Database : Runs Neo4j. 2. Backend FastAPI :...

CVE-2023-25157-and-CVE-2023-25158

GeoServer & GeoTools SQL Injection CVE-2023-25157 & CVE-2023-25158 This repository contains a detailed description and replication steps of the SQL Injection vulnerabilities found in the GeoServer platform and GeoTools Library. The vulnerability has been assigned the identifier CVE-2023-25157 for...

CVE-2022-30511

CVE-2022-30511 School Dormitory Management System 1.0 - Unauthenticated SQL Injection Exploit Title: School Dormitory Management System 1.0 - Unauthenticated SQL Injection Date: 2022-05-25 CVE: CVE-2022-30511 Exploit Author: Abdulaziz Saad @b4zb0z Vendor Homepage: https://www.sourcecodester.com/...

CVE-2021-43408

CVE-2021-43408: WordPress Plugin Duplicate Post version 1.1.9 - SQL Injection I. Overview 1. What is WordPress WordPress is an open-source CMS Content Management System software, a content management system. Instead of using HTML encoding language, WP is written in the PHP programming language...