ghauri

Like Ghauri, consider supporting the developer...

CVE-2022-31061

CVE-2022-31061 GLPI CVE-2022-31061 用 PoC GLPI = 9.3.0 かつ 10.0.2 向けの Proof of Concept - ログインページにおける非認証 SQL インジェクション 法的免責事項 : 相互の同意なしに本スクリプトを対象への攻撃に使用することは違法です。 自分の地域に適用されるすべての法律に従うことはエンドユーザーの責任です。 開発者は一切の責任を負わず、本プログラムによって引き起こされた誤用または損害についても責任を負いません。 背景 : 公開情報 :...

CVE-2024-51482-ZoneMinder-CCTV-HTB-Reliable-EXP

README Hackthebox Machine: CCTV アプリケーション: ZoneMinder 説明 同じ文字に対して複数回の時間ベースのブラインドインジェクションを実行し、最も頻繁に現れる結果を選択することで、エラーを大幅に削減し信頼性を向上させますが、時間がかかります。...

CVE-2019-10708

Scms - SQL Injection exploit.pyはCVE-2019-10708脆弱性に対するPoCであり、multiprocessingを用いて注入を実行し、データベース名とバックエンド管理者のアカウント・パスワードを取得します（20190401より前のバージョンを推奨） Usage root@kitploit: 注入可能かテスト python3 exploit.py http:localhost/js/scms.php --test sleep時間を60秒に設定し、データベースを取得 python3 exploit.py http:localhost/js/scms.ph...

CVE-2026-63030-CVE-2026-60137-wp2shell-poc

wp2shell — WordPress REST API Time-Based Blind SQLi → RCE 概念実証 説明 pocwptot.py は、WordPress REST API のバッチエンドポイントにおける time‑based blind SQL injection の脆弱性を悪用し、Remote Code Execution RCE に 至るエスカレーションチェーンを実行する proof‑of‑concept PoC です。 対象の脆弱性: CVE-2026-63030 CVE-2026-60137 重要な警告...

TimeInjector

TimeInjector Time injector는 bash로 작성된 CVE-2018-14714 익스플로잇 스크립트입니다. 타겟이 취약한지 확인하기 위해, 스크립트는 먼저 타겟에 접근 가능한지와 로그인 세션을 설정할 수 있는지 확인합니다. 그 후, 특정 페이지의 존재를 확인하고 시간 기반 인젝션을 수행하여 시스템이 원격 코드 실행RCE에 취약한지 확인합니다. 시스템이 명령어예: sleep 3를 실행할 때 느리게 응답하면, 타겟이 취약할 수 있음을 나타냅니다. 이는 서버가 주입된 명령어를 처리하는 데 더 많은 시간이 소요되기...

Astra Linux – Vulnerability in Zabbix

The Zabbix server can execute commands for configured scripts. After the command is executed, an audit entry is added to the “Audit Log”. Since the “clientip” field is not sanitized, it is possible to inject SQL code into the “clientip” field, resulting in time-based blind SQL injection attacks...

CVE-2026-71287

Cacti's sanitizesqlcolumn lib/functions.php sanitizes user-supplied ORDER BY column names using the regex . Because this allowlist retains letters, digits, underscore, parentheses, and dot intended to support expressions like COUNTid and table.column, a payload such as passes through completely...

CVE-2026-71288 Koha SQL Injection via order_by and {order}_ovalue Parameters in guided_reports.pl

Koha's guided report builder reports/guidedreports.pl reads the CGI parameter and, for each value, a dynamically-named parameter, and concatenates both directly into an SQL ORDER BY clause with no allowlist or validation. Since ORDER BY columns cannot be bound via prepared-statement placeholders,...

CVE-2026-71287

Cacti CVE-2026-71287 involves a flaw in sanitize_sql_column() in lib/functions.php. The function filters ORDER BY column names with preg_replace('/[^a-zA-Z0-9_().]/', '', $column), which leaves letters, digits, underscore, parentheses, and dot. This allows payloads like SLEEP(5) to pass unmodifie...

CVE-2026-15018

The Database Collation Fix plugin for WordPress is vulnerable to time-based SQL Injection via the 'force-collation-algorithm' parameter in all versions up to, and including, 1.2.10 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

CVE-2026-15018 Database Collation Fix <= 1.2.10 - Unauthenticated SQL Injection via 'force-collation-algorithm' Parameter

The Database Collation Fix plugin for WordPress is vulnerable to time-based SQL Injection via the 'force-collation-algorithm' parameter in all versions up to, and including, 1.2.10 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

PT-2026-65700

A pre-authentication blind SQL injection vulnerability in Koollab LMS allowed an unauthenticated attacker to use a time-based SQL oracle via the SSO OAuth endpoint to read sensitive database contents, including personally identifiable information, credentials, and valid JWT tokens that may enable...

CVE-2026-15670

The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' parameter in all versions up to, and including, 3.9.7 due to insufficient escaping on the user supplied parameter and lack of...

EUVD-2026-49696

The ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' parameter in all versions up to, and including, 3.4.5 due to insufficient escaping on the user supplied parameter and lack of sufficient...

CVE-2026-16811

The ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' parameter in all versions up to, and including, 3.4.5 due to insufficient escaping on the user supplied parameter and lack of sufficient...

CVE-2026-6251

The Chaty Pro plugin for WordPress is vulnerable to Authenticated Time-Based Blind SQL Injection in versions up to and including 3.5.5. This is due to the fetchcustomfield function in admin/class-admin-base.php retrieving the widgetid POST parameter via filterinputINPUTPOST, ... and directly...

PT-2026-65404

The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' parameter in all versions up to, and including, 3.9.7 due to insufficient escaping on the user supplied parameter and lack of...

CVE-2026-8082

CVE-2026-8082 affects the bpost-shipping-platform WordPress plugin before 3.2.3. The issue is improper sanitization of a parameter used in a SQL query during WooCommerce order submission, allowing unauthenticated attackers to perform time-based blind SQL injection on stores running this plugin. R...

📄 WordPress Exact Links 3.0.7 Unauthenticated Blind SQL Injection

WordPress Exact Links URL Shortener plugin version 3.0.7 contains an unauthenticated time-based blind SQL injection vulnerability through REST. A remote attacker can inject SQL through the vulnerable parameter and infer database contents through response timing. This proof of concept exploit...