WordPress Newsletters <= 4.13 - Unauthenticated SQL Injection

Newsletters WordPress plugin = 4.13 contains a time-based SQL injection caused by insufficient escaping of the 'wpmlsubscriberid' parameter, letting unauthenticated attackers extract sensitive database information. id: CVE-2026-3018 info: name: WordPress Newsletters = 4.13 - Unauthenticated SQL...

XStore Theme < 9.7.3 - SQL Injection

The Xstore WordPress theme before 9.7.3 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection id: CVE-2026-3326 info: name: XStore Theme 9.7.3 - SQL Injection author: VixianSchool...

NocoBase - SQL Injection

NocoBase @nocobase/plugin-collection-sql versions prior to 2.0.39 are vulnerable to SQL injection via the sqlCollection:update endpoint. The checkSQL function, which blocks dangerous SQL keywords and ensures only SELECT statements are allowed, is not called during collection updates. id:...

SiYuan <=3.7.2 - SQL Injection

SiYuan before v3.7.3 contains a SQL injection caused by direct concatenation of the keyword parameter in /api/filetree/searchDocs endpoint, letting attackers with publish RoleReader token or unauthenticated in publish mode read and modify database content. id: CVE-2026-69085 info: name: SiYuan...

Vendure Core - SQL Injection

Vendure, an open-source headless commerce platform built on Node.js/TypeScript, contains a critical SQL injection vulnerability in its Shop API. The languageCode query parameter is interpolated directly into a raw SQL CASE expression in ProductService.findOneBySlug without parameterization or inp...

Cerberus

Cerberus A powerful vulnerability scanner. Subdomain enumeration uses aioDNS with asyncio for asynchronous fast scanning. It covers the target's full asset scope for batch vulnerability scanning, middleware information collection, automatic proxy IP collection, and automatically uses proxy IPs to...

CVE-2026-108956

A vulnerability was identified in code-projects Online Reviewer System 1.0. The affected element is an unknown function of the file /reviewer/system/system/admins/manage/users/btnfunctions.php of the component User Update Handler. Such manipulation leads to sql injection. The attack may be launch...

CVE-2022-31296

CVE-2022-31296 Online Discussion Forum Site 1.0 - Blind SQL Injection Exploit Title: Online Discussion Forum Site 1.0 - Blind SQL Injection Date: 2022-06-13 CVE: CVE-2022-31296 Exploit Author: Abdulaziz Saad @b4zb0z Vendor Homepage: https://www.sourcecodester.com/ Software Link:...

CVE-2025-22953

CVE-2025-22953 – Epicor HCM Unauthenticated Blind SQL Injection Update – Patch Released by Epicor Epicor has officially released a patch addressing this vulnerability. All affected users are strongly advised to apply the update immediately. 🔗 Epicor Security Patch Announcement Summary An...

CVE-2022-37201

CVE-2022-37201 CVE-2022-37201 POC POC First of all you should install sqlmap you need set target domain or IP your cookie the run the shell sqlmap -u http://targetDomainOrIP/jfinalcms/jfinalcms/admin/contact/list --thread 8 --batch --smart --random-agent --data "...

CVE-2024-27956

WP Automatic Plugin SQL Injection Exploit CVE-2024-27956 A proof-of-concept exploit for the SQL injection vulnerability in WP Automatic plugin CVE-2024-27956 affecting WordPress sites. 📌 Description This exploit targets a critical unauthenticated SQL injection vulnerability in the WP Automatic...

CVE-2024-39304

Description This script is a PoC for CVE-2024-39304, where a SQLi is possible due to a lack of sanitization in the ChurchCRM project. Usage python3 CVE-2024-39304.py -u -p -b -v Example: python3 CVE-2024-39304.py -u FirstLast -p Password123 -b http://localhost/churchcrm -v Links...

CVE-2026-108956 code-projects Online Reviewer System User Update btn_functions.php sql injection

A vulnerability was identified in code-projects Online Reviewer System 1.0. The affected element is an unknown function of the file /reviewer/system/system/admins/manage/users/btnfunctions.php of the component User Update Handler. Such manipulation leads to sql injection. The attack may be launch...

CVE-2026-108956

A SQL injection vulnerability exists in the code-projects Online Reviewer System 1.0 within the User Update Handler component. The flaw is located in an unknown function of the file /reviewer/system/system/admins/manage/users/btn_functions.php. This vulnerability can be exploited remotely to mani...

EUVD-2026-98235

A vulnerability was identified in code-projects Online Reviewer System 1.0. The affected element is an unknown function of the file /reviewer/system/system/admins/manage/users/btnfunctions.php of the component User Update Handler. Such manipulation leads to sql injection. The attack may be launch...

CVE-2024-1071

CVE-2024-1071 CVE-2024-1071 Ultimate Member Unauthorized Database Access / SQLi PoC is now published. It was created for educational/research purposes only! Use it at your own risk!...

SqliSniper

Features • Installation • Usage • Running SqliSniper • Contributing • SqliSniper is a robust Python tool designed to detect time-based blind SQL injections in HTTP request headers. It enhances the security assessment process by rapidly scanning and identifying potential vulnerabilities using...

litellm-sqli-scanner

LiteLLM SQL Injection Scanner CVE-2026-42208 — SQL injection in LiteLLM Proxy Detects and validates CVE-2026-42208: SQL injection vulnerability in LiteLLM Proxy's database layer. For authorized security testing only. Features CVE-2026-42208 SQL injection detection LiteLLM Proxy version...

CVE-2025-52399-SQLi-Institute-of-Current-Students

CVE-2025-52399 - SQL Injection in Institute of Current Students Summary The loginlinkfaculty endpoint in the Institute-of-Current-Students application is vulnerable to SQL Injection via the fid POST parameter. The parameter is not properly sanitized before being used in a SQL query, allowing remo...

CVE-2025-32429

CVE-2025-32429 – SQL Injection in PHP PDO Prepared Statements This repository contains a proof-of-concept exploit for CVE-2025-32429 , a vulnerability affecting PHP PDO prepared statements when emulation is enabled. 📄 References Original research by Assetnote:...