CVE-2021-35042

CVE-2021-35042 Django SQL injection bug Question: explore how exploitable is it? Answer: I'm terrified Install poetry install poetry run ./manage.py migrate poetry run ./manage.py loaddata dummydata.json Interactive Demo poetry run ./manage.py runserver Ordering by random fields go to...

CVE-2024-10140

CVE-2024-10140 The script exploits a SQL Injection vulnerability found in the endpoint /php/managesupplier.php?action=delete&id=32. The vulnerability allows an attacker to inject arbitrary SQL commands through the id parameter, potentially compromising the database and exposing sensitive...

CVE-2024-8529

CVE-2024-8529 LearnPress – WordPress LMS Plugin = 4.2.7 - Unauthenticated SQL Injection via 'cfields' Description The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to SQL Injection via the 'cfields' parameter of the /wp-json/lp/v1/courses/archive-course REST API endpoint in...

CVE-2024-4443-Poc

CVE-2024-4443-Poc CVE-2024-4443 Business Directory Plugin – Easy Listing Directories for WordPress execute \business-directory-plugin\includes\helpers\class-listing-search.php:88 WPBDPListingSearch-traversetree \business-directory-plugin\includes\helpers\class-listing-search.php:185...

MOVEit-Exploit

MOVEit Exploit an exploit of POC for CVE-2023-34362 affecting MOVEit Transfer Note this project is done... Our instagram page . Our youtube chanel . Our twitter page CVE-2023-34362 POC for CVE-2023-34362 affecting MOVEit Transfer Disclaimer This software has been created purely for the purposes o...

CVE-2024-54820

Vulnerability: Unauthenticated SQL Injection - Clear Credentials Dump Author : Javier Carabantes Affected Software : XOne Web Monitor Software : https://xone.es/ Affected Version : 02.10.2024.530 framework 1.0.4.9 Description An unauthenticated SQL injection vulnerability has been discovered in t...

Geoserver-CVE-2023-25157

Geoserver SQL Injection Exploit In this year, a cve got published for Geoserver with the ID CVE-2023-25157. I saw this vulnerability in one of my projects and tried to exploit it. And here it is, the complete exploit. In this repohttps://github.com/0x2458bughunt/CVE-2023-25157 you can use the...

CVE-2026-112017

JeecgBoot before 3.9.5 contains an sql injection vulnerability that allows authenticated attackers to bypass the SqlInjectionUtil keyword blocklist by inserting newline characters into dictionary and online report SQL fragments. Attackers can send newline-separated payloads to endpoints like...

MOVEit-Transfer-Data-Breach-Analysis.

MOVEit-Transfer-Data-Breach-Analysis. ​Detailed analysis of the 2023 MOVEit Transfer data breach CVE-2023-34362 for CS50 Cybersecurity. This project explores the technical impact of unauthenticated SQL Injection and its consequences for global data privacy, affecting 2,700+ organizations. Special...

CVE-2026-40083

SQL Injection in Cacti managers.php A proof-of-concept exploit for CVE-2026-40083, a SQL Injection vulnerability in Cacti's managers.php that allows any authenticated user with SNMP Manager permissions to read the entire MySQL database including user credentials and password hashes. Usage: Verify...

CVE-2024-9264

🚨 CVE-2024-9264 - Grafana SQL injection leading to Remote Code Execution RCE and file Read Exploit tool for CVE-2024-9264, a critical vulnerability in Grafana allow authenticated attcker to execute sql query leading to RCE 🛡️ This tool is strictly for educational purposes and authorized penetratio...

CVE-2024-51428-PoC

CVE-2024-51428 - ZoneMinder Blind SQL Injection PoC Python wrapper for sqlmap designed to exploit CVE-2024-51428 in ZoneMinder. This tool automates detection and exploitation of a Blind SQL Injection vulnerability while keeping the output clean and focused on useful data. The script hides sqlmap...

CVE-2026-112017 JeecgBoot before 3.9.5 SQL Injection via SqlInjectionUtil Newline Bypass

JeecgBoot before 3.9.5 contains an sql injection vulnerability that allows authenticated attackers to bypass the SqlInjectionUtil keyword blocklist by inserting newline characters into dictionary and online report SQL fragments. Attackers can send newline-separated payloads to endpoints like...

EUVD-2026-103470

JeecgBoot before 3.9.5 contains an sql injection vulnerability that allows authenticated attackers to bypass the SqlInjectionUtil keyword blocklist by inserting newline characters into dictionary and online report SQL fragments. Attackers can send newline-separated payloads to endpoints like...

CVE-2026-112017 JeecgBoot before 3.9.5 SQL Injection via SqlInjectionUtil Newline Bypass

JeecgBoot before 3.9.5 contains an sql injection vulnerability that allows authenticated attackers to bypass the SqlInjectionUtil keyword blocklist by inserting newline characters into dictionary and online report SQL fragments. Attackers can send newline-separated payloads to endpoints like...

CVE-2026-112017

The JeecgBoot framework (versions before 3.9.5 ) is vulnerable to an SQL Injection flaw within the SqlInjectionUtil component. The root cause is a newline bypass that allows authenticated attackers to circumvent the keyword blocklist by inserting newline characters into dictionary and online repo...

CVE-2025-50383

CVE-2025-50383 Description A low-privileged authenticated user can exploit this vulnerability by sending a crafted HTTP POST request with a malicious orderby parameter e.g., orderby=IF1=1,SLEEP5,1. This can trigger time-based blind SQL injection, resulting in unauthorized SQL execution on the...

CVE-2026-110895

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in DevItems Support Genix support-genix-lite allows SQL Injection.This issue affects Support Genix: from n/a through 1.4.54...

CVE-2026-109894

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Arraytics Booktics booktics allows SQL Injection.This issue affects Booktics: from n/a through 1.0.29...

wp2shell-poc

How does this work at all How this PoC differs from the public wp2shell exploits all pocs weaponize the same two bugs - the REST batch route confusion CVE-2026-63030 and the authornotin SQL injection CVE-2026-60137 - with the same double-nested batch shape. What differs between them is the RCE pa...