261004 matches found
PT-2026-113688
The Fast Courier WordPress plugin before 5.2.4 does not sanitize and escape a value before using it in a SQL query on an unauthenticated REST route, allowing unauthenticated attackers to perform SQL injection and read arbitrary data from the database...
CVE-2024-21513
CVE-2024-21513 PoC for CVE-2024-21513 Original exploit documented by Snyk Security Research Exploit CVE-2024-21513 is a vulnerability in langchain-experimental where unvalidated SQL query results were passed to Python's eval, enabling remote code execution through SQL-based input injection. PoC...
CVE-2022-34265
CVE-2022-34265 PoC for CVE-2022-34265 Description An issue was discovered in Django 3.2 before 3.2.14 and 4.0 before 4.0.6. The Trunc and Extract database functions are subject to SQL injection if untrusted data is used as a kind/lookupname value. Applications that constrain the lookup name and...
CVE-2024-13485
CVE-2024-13485 LTL Freight Quotes – ABF Freight Edition = 3.3.7 - Unauthenticated SQL Injection Description The LTL Freight Quotes – ABF Freight Edition plugin for WordPress is vulnerable to SQL Injection via the 'editid' and 'dropshipeditid' parameters in all versions up to, and including, 3.3.7...
CVE-2021-25076
CVE-2021-25076-Exploit Wordpress Plugin WP User Frontend 3.5.26 - SQL-Injection Authenticated CVE description: The WP User Frontend WordPress plugin before 3.5.26 does not validate and escape the status parameter before using it in a SQL statement in the Subscribers dashboard, leading to an SQL...
CVE-2026-110083
Adobe Experience Manager is affected by an Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized...
CVE-2026-63165
The Omnispace Agora Project version prior to 26.10.0 is vulnerable to a SQL injection flaw within its calendar functionality. The root cause is the lack of sanitization for the sortEvents parameter, which is directly concatenated into an ORDER BY clause in the app/ModCalendar/CtrlCalendar.php fil...
CVE-2026-63165 Omnispace Agora Project < 26.10.0 SQL Injection via sortEvents Parameter
Omnispace Agora Project before 26.10.0 contains a SQL injection vulnerability in the calendar functionality that allows attackers to inject malicious SQL by manipulating the sortEvents parameter, which is concatenated into the ORDER BY clause without sanitization in...
CVE-2026-63152 Omnispace Agora Project < 26.10.0 Second-Order SQL Injection via _idCategoryFilter
Omnispace Agora Project before 26.10.0 contains a second-order SQL injection vulnerability that allows authenticated attackers to inject malicious SQL via the idCategoryFilter parameter, which is persisted into the session and later concatenated into a SQL statement without parameterization...
CVE-2026-63152
The Omnispace Agora Project (versions prior to 26.10.0 ) is vulnerable to a second-order SQL injection in the _idCategoryFilter parameter. Authenticated attackers can inject a malicious payload that is persisted into the session. This payload is subsequently concatenated into a SQL statement with...
CVE-2026-110083
Adobe Experience Manager is impacted by an SQL Injection vulnerability (CWE-89 ) caused by the improper neutralization of special elements used in an SQL command. A low-privileged attacker could exploit this issue without user interaction to bypass security measures, potentially gaining unauthori...
CVE-2026-63146
The Omnispace Agora Project (versions prior to 26.10.0 ) is vulnerable to a PHP code injection flaw. The root cause involves unescaped, attacker-controlled values being written into the config.inc.php file via the File::updateConfigFile() and DbInstall::dbControl() functions during installation. ...
CVE-2024-36837
CVE-2024-36837 / CNVD-2024-30128 POC write URL in url.txt and run CVE-2024-36837.py CVE-2024-36837 In my freshman year, I found that an educational institution used CRMEB Mall as an online store in an Internet protection action. After testing, sql injection vulnerability was found. After setting ...
CVE-2022-40347_Intern-Record-System-phone-V1.0-SQL-Injection-Vulnerability-Unauthenticated
CVE-2022-40347: Intern Record System - 'phone', 'email', 'deptType' and 'name' SQL Injection Unauthenticated Exploit Title: Intern Record System - 'phone', 'email', 'deptType' and 'name' SQL Injection Unauthenticated Date: 2022-06-09 Exploit Author: Hamdi Sevben Vendor Homepage:...
CVE-2024-42327
PoC and Exploit for CVE-2024-42327 / ZBX-25623 A non-admin user account on the Zabbix frontend with the default User role, or with any other role that gives API access can exploit this vulnerability. An SQLi exists in the CUser class in the addRelatedObjects function, this function is being calle...
CVE-2026-88075
Improper neutralization of special elements used in an sql command 'sql injection' in Microsoft Configuration Manager allows an authorized attacker to elevate privileges over a network...
CVE-2026-70266
Improper neutralization of special elements used in an sql command 'sql injection' in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network...
CVE-2026-70049
Improper neutralization of special elements used in an sql command 'sql injection' in Microsoft Configuration Manager allows an authorized attacker to elevate privileges over an adjacent network...
CVE-2023-24775-and-CVE-2023-24780
CVE-2023-24775-and-CVE-2023-24780 my python poc 2023-24780 and CVE-2023-24775 this sqli cve funadmin This is a repository with a poc exploit for python cve sqli funadmin. CVE-2023-24774 - https://nvd.nist.gov/vuln/detail/CVE-2023-24780 Vulnerable version of Funadmin v3.2.0 Vulnerability via id...
