CVE-2023-48084-Revised

CVE-2023-48084 — updated PoC Repository: MettHK/CVE-2023-48084-Revised Updated version of Hamibubu/CVE-2023-48084 with multithreading, binary-search extraction, and CLI flags for database / table / column selection. Not the original repository. This is a derivative/improved PoC. Credit for the...

CVE-2025-61246

CVE-2025-61246 - SQL Injection Vulnerability in Online Shopping System Overview This repository contains a Proof of Concept PoC for CVE-2025-61246 , a critical SQL Injection vulnerability discovered in the Online Shopping System PHP application. The vulnerability allows an unauthenticated attacke...

Jeeves

Jeeves Usage • Installation Jeeves is made for looking to Time-Based Blind SQLInjection through recon. Contents: Installation Usage Adding Headers Using Proxy Making Post Request Multiple ways of usage - Installation & Requirements: Installing Jeeves 💀 $ go install...

CVE-2025-45346

CVE-2025-45346 – Bacula-Web Time-Based SQL Injection PostgreSQL Version Extraction 📝 Overview Vulnerability Title : Time-Based Blind SQL Injection in Bacula-Web Product : Bacula-Web Versions Affected : Confirmed in versions supporting PostgreSQL backend CVE ID : CVE-2025-45346 Severity : High...

sqlmap

sqlmap sqlmap is an open source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers. It comes with a powerful detection engine, many niche features for the ultimate penetration tester, and a broad range of switche...

CVE-2025-4396

CVE-2025-4396 — Relevanssi SQL Injection Time-Based Blind Disclaimer: This repository is intended for authorized penetration testing, security research, and educational purposes only. Unauthorized access to computer systems is illegal and unethical. Overview A proof-of-concept exploit for a...

CVE-2026-24416

CVE-2026-24416: OpenSTAManager has a Time-Based Blind SQL Injection in Article Pricing Module Overview Field| Details ---|--- CVE ID| CVE-2026-24416 Severity| HIGH Advisory| View Advisory Discovered by| Lukasz Rybak Affected Products devcode-it/openstamanager versions: = 2.9.8 CWE Classification...

CVE-2026-24417

CVE-2026-24417: OpenSTAManager has a Time-Based Blind SQL Injection with Amplified Denial of Service Overview Field| Details ---|--- CVE ID| CVE-2026-24417 Severity| HIGH Advisory| View Advisory Discovered by| Lukasz Rybak Affected Products devcode-it/openstamanager versions: 2.9.8 CWE...

Advance Product Search <= 1.4.4 - Unauthenticated Time-Based Blind SQL Injection

Advance Product Search 1.4.4 and earlier is vulnerable to unauthenticated time-based blind SQL injection. The plugin rebuilds the WordPress search SQL by hand and uses $wpdb-esclike which escapes LIKE wildcards but not single quotes, allowing injection through the ?s= parameter. id: CVE-2026-5607...

Quotes llama <= 3.1.5 - SQL Injection

Quotes llama 3.1.5 and earlier contains a time-based blind SQL injection vulnerability caused by improper control of a SQL identifier. The selectsearch AJAX handler registered for guests via wpajaxnoprivselectsearch reads the attacker-controlled 'sc' parameter from $POST and substitutes it into t...

Geo Mashup <= 1.13.18 - SQL Injection

Geo Mashup WordPress plugin = 1.13.18 is vulnerable to time-based SQL injection via the sort parameter. The issue exists because the sort value is insufficiently sanitized in render-map.php/template tag code paths. id: CVE-2026-4060 info: name: Geo Mashup = 1.13.18 - SQL Injection author:...

Spam protection, AntiSpam, FireWall by CleanTalk < 5.153.4 - Unauthenticated Blind SQL Injection

It was possible to exploit an Unauthenticated Time-Based Blind SQL Injection vulnerability in the Spam protection, AntiSpam, FireWall by CleanTalk WordPress Plugin before 5.153.4. The updatelog function in lib/Cleantalk/ApbctWP/Firewall/SFW.php included a vulnerable query that could be injected v...

WP Fast Total Search <= 1.80.280 - Unauthenticated Time-Based Blind SQL Injection

WP Fast Total Search fulltext-search versions up to and including 1.80.280 contain an unauthenticated time-based blind SQL injection. The wpajaxnoprivwpftsautocomplete handler reads the formdatas parameter and feeds it into a WPQuery. The plugin's indexsqlwhere builds its cluster query with...

phpMyFAQ <= 4.1.1 - SQL Injection

phpMyFAQ before 4.1.2 contains an unauthenticated SQL injection vulnerability in BuiltinCaptcha::garbageCollector and BuiltinCaptcha::saveCaptcha methods that interpolate unsanitized User-Agent headers into DELETE and INSERT queries. Unauthenticated attackers can exploit the public GET /api/captc...

CVE-2025-7605

CVE-2025-7605 code-projects AVL Rooms Project V1.0/profile.php SQL injection NAME OF AFFECTED PRODUCTS AVL Rooms Vendor Homepage https://code-projects.org/avl-rooms-in-php-css-javascript-and-mysql-free-download/ submitter dazhi Vulnerable File /profile.php VERSIONS V1.0 Software Link...

CVE-2025-5287

CVE-2025-5287 PoC Unauthenticated SQL Injection exploit for WordPress Likes and Dislikes Plugin ≤ 1.0.0 📖 Description This Python script is a proof-of-concept PoC exploit for CVE-2025-5287 , targeting a vulnerability in the WordPress Likes and Dislikes Plugin ≤ 1.0.0. The vulnerability allows...

CVE-2023-23488-PoC

CVE-2023-23488-PoC Unauthenticated SQL Injection - Paid Memberships Pro 2.9.8 WordPress Plugin Running this script against a WordPress instance with Paid Membership Pro plugin tells you if the target is vulnerable. As the SQL injection technique required to exploit it is Time-based blind, instead...

CVE-2025-45809-PoC

CVE-2025-45809 — LiteLLM SQL Injection via /key/block Time-Based Blind SQLi LiteLLM v1.65.4 versions before v1.81.0 /key/block and /key/unblock endpoints have a SQL injection vulnerability in the key parameter. Attackers can use time-based blind injection techniques to steal database content and...

CVE-2025-7606

CVE-2025-7606 code-projects AVL Rooms Project V1.0/city.php SQL injection NAME OF AFFECTED PRODUCTS AVL Rooms Vendor Homepage https://code-projects.org/avl-rooms-in-php-css-javascript-and-mysql-free-download/ submitter dazhi Vulnerable File /city.php VERSIONS V1.0 Software Link...

CVE-2026-42647-Lab

CVE-2026-42647 - JoomSport Unauthenticated Time-Based Blind SQL Injection via sortf Executive Summary This repository contains a local Docker lab for reproducing and validating CVE-2026-42647, an unauthenticated SQL injection vulnerability affecting the WordPress plugin JoomSport - for Sports: Te...