261801 matches found
CVE-2025-69216
CVE-2025-69216: OpenSTAManager has a SQL Injection in Scadenzario Print Template Overview Field| Details ---|--- CVE ID| CVE-2025-69216 Severity| HIGH Advisory| View Advisory Discovered by| Lukasz Rybak Affected Products devcode-it/openstamanager versions: = 2.9.8 CWE Classification CWE-89:...
CVE-2023-46954
CVE-2023-46954 SQL Injection vulnerability in Relativity Server 2022 v.12.1.537.3 Patch 2 and earlier allows a remote attacker to execute arbitrary code via the name parameter. Vulnerability Type SQL Injection Vendor of Product Relativity ODA LLC Affected Product Code Base Relativity Server 2022...
LetMeFuckIt-Scanner
LetMeFuckIt Scanner AutoPWNED Scanner and Exploit Magento The Scanner explores the SQLi Vulnerability 1.9.1.0 CE of Magento. The vulnerability was fixed in Patch SUPEE-5344 , however, the scanner is used to locate and test systems that did not apply the security patch. LetMeFuckIt was written in...
CVE-2024-50629_50631
CVE-2024-5062950631 Pre-auth RCE N-day exploitation of Synology BeeStation. Detail: https://kiddo-pwn.github.io/blog/2025-11-30/writing-sync-popping-cron https://github.com/user-attachments/assets/8e2ef59c-4f60-4308-8cd4-6d7ce0ba72e1 $ python3 poc.py 192.168.88.248 192.168.88.254 LISTENER listeni...
exploits-rconfig
exploits Three exploits for rconfig = 3.9.4 : CVE-2019-19509 : authenticated RCE CVE-2019-19585 : Local Privilege Escalation root CVE-2020-10220 : unauthenticated SQLi rconfigrootRCEunauth.py : chaining the three CVEs above to get root reverse shell without authentication...
CVE-2022-28346
CVE-2022-28346 Django QuerySet.annotate, aggregate, extra SQL Injection Environment Initialization 1.python manage.py makemigrations 2.python manage.py migrate 3.访问http://x.x.x.x:8000/ 插入初始化数据 Vulnerability Reproduction 访问http://x.x.x.x:8000/demo POC: http://x.x.x.x:8000/demo?field=demo.name" FRO...
CVE-2024-1071-SQL-Injection
Proof of concept CVE-2024-1071: WordPress Vulnerability Exploited Disclaimer : This Proof of Concept POC is made for educational and ethical testing purposes only. Usage of this tool for attacking targets without prior mutual consent is illegal. It is the end user’s responsibility to obey all...
CVE-2024-24401
Vulnerability Report CVE Disovered by: Jarod Jaslow MAWK DESIGNED TO BE RUN ON KALI LINUX Notes Nagios has patched version 2024R1.0.1 in all recent downloads. To determine if a target is vulnerable, ensure they are using an older download of 2024R1.0.1. The updated script checks to make sure that...
geoserver-CVE-2023-25157
geoserver CVE-2023-25157 White Hat 3rd Cohort Class 30 Kim Jeong-woo github link - https://github.com/custiya/geoserver-CVE-2023-25157 Vulnerability Summary CVE-2023-25157 is an SQLi vulnerability that occurred in GeoServer, an open-source map data service web application. Occurs in some versions...
lab-cve-2025-57819
Work in Progress FreePBX CVE-2025-57819 Lab - Unauth SQLi → RCE Chain Nuclei POC Spin up a reproducible FreePBX 15 lab Docker to validate CVE-2025-57819 — a critical unauthenticated SQL injection in userman AJAX endpoints that can be chained to RCE. Includes a working Nuclei template...
CVE-2022-21661
CVE-2022-21661 CVE-2022-21661 docker and poc functions.php needs to replace the original functions.php in the image, and mount it directly in docker-compose.yml poc POST /wp-admin/admin-ajax.php HTTP/1.1 Host: your-ip:8080 User-Agent: Mozilla/5.0 Windows NT 10.0; Win64; x64; rv:132.0 Gecko/201001...
CVE-2025-22785
CVE-2025-22785 Course Booking System = 6.0.5 - Unauthenticated SQL Injection Description The Course Booking System plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 6.0.5 due to insufficient escaping on the user supplied parameter and lack of sufficient...
CVE-2023-1545
CVE-2023-1545 Simple SQL Injection Python script for Teampass prior to versions 3.0.0.23, leveraging CVE-2023-1545. More information on this blog. Usage Just use set the URL where Teampass is running as unique argument: python3 CVE-2023-1545.py http://example.com:8080 Discliamer Use it for ethica...
CVE-2025-65950
CVE-2025-65950: WBCE CMS is Vulnerable to Time-Based Blind SQL Injection through groups Parameter Overview Field| Details ---|--- CVE ID| CVE-2025-65950 Severity| CRITICAL Advisory| View Advisory Discovered by| Lukasz Rybak Affected Products WBCE/WBCECMS Details Summary A critical SQL Injection...
hakuin
Hakuin is a Blind SQL Injection BSQLI optimization and automation framework written in Python 3. It abstracts away the extraction logic and allows users to easily and efficiently dump databases from vulnerable web applications. To speed up the process, Hakuin utilizes a variety of optimization...
wp_bookingpress_1.0.11
CVE-2022-0739 CVE-2022-0739 Wordpress BookingPress Plugin 1.0.11 Unauthenticated SQL Injection Getting Started Executing program With python3 python3 sqli.py -u 'http://wordpress.site' -p 'wpnoncevalue' Help For help menu: python3 sqli.py -h Disclaimer All the code provided on this repository is...
CVE-2024-42327
PoC for CVE-2024-42327 / ZBX-25623 A non-admin user account on the Zabbix frontend with the default User role, or with any other role that gives API access can exploit this vulnerability. An SQLi exists in the CUser class in the addRelatedObjects function, this function is being called from the...
CVE-2023-49546
CVE-2023-49546 Customer Support System 1.0 - SQL Injection Vulnerability in the "email" Parameter During "savestaff" Operation Description : A SQL Injection vulnerability exists in version 1 of the Customer Support System. A malicious attacker can issue SQL commands to the MySQL database when...
CVE-2023-31717
CVE-2023-31717 It is possible to do SQL Injection into the HTTP POST id parameter passed in the body as json, being able to extract confidential information from the SQLite database Payload - "id":"n7c734712-aabf4eb3' AND 2630=LIKECHAR65,66,67,68,69,70,71,UPPERHEXRANDOMBLOB500000000/2 AND...