CVE-2025-7605

CVE-2025-7605 code-projects AVL Rooms Project V1.0/profile.php injeção SQL NOME DOS PRODUTOS AFETADOS AVL Rooms Homepage do Fornecedor https://code-projects.org/avl-rooms-in-php-css-javascript-and-mysql-free-download/ Submetido por dazhi Arquivo Vulnerável /profile.php VERSÃOÕES V1.0 Link do...

CVE-2025-50383

CVE-2025-50383 Descrizione Un utente autenticato con privilegi ridotti può sfruttare questa vulnerabilità inviando una richiesta HTTP POST appositamente modificata con un parametro orderby malevolo ad esempio, orderby=IF1=1,SLEEP5,1. Ciò può innescare un attacco SQL injection cieco basato sul...

CVE-2024-1207

Booking Calendar = 9.9 - SQL Injection non autenticata CVE-2024-1207 https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/booking/booking-calendar-99-unauthenticated-sql-injection POC: root@kitploit: POST /wp-admin/admin-ajax.php HTTP/1.1 Host: vulnerablesite.com User-Agent:...

CVE-2025-61246

CVE-2025-61246 - SQL-Injection-Schwachstelle im Online-Shopping-System Übersicht Dieses Repository enthält einen Proof of Concept PoC für CVE-2025-61246 , eine kritische SQL-Injection-Schwachstelle, die in der PHP-Anwendung Online Shopping System entdeckt wurde. Die Schwachstelle ermöglicht es...

commend_sqli

CVE-2023-XXXXX Vorgeschlagene Beschreibung Die Weboberfläche von G8-VOIPREC Commend VoIPRec ist anfällig für zeitbasierte blinde SQL-Injektionen im Parameter „Code“ auf der Anmeldeseite. Zusätzliche Informationen PoC: POST /cgi-bin/SecComRecX.cgi HTTP/1.1 Host: 192.168.88.10 User-Agent: Mozilla/5...

WordPress-NotificationX-CVE-2024-1698

Configurazione root@kitploit: docker-compose up --build Pulizia root@kitploit: docker-compose down Test root@kitploit: Measure-Command curl.exe http://localhost/wp-json/notificationx/v1/analytics -Method Post -Body 'nxid=1337&type=clicks=IFASCIISUBSTRINGselect userpass from wpusers where...

CMS-Made-Simple-2.2.9-Unauthenticated-SQL-Injection-Exploit-CVE-2019-9053-

CMS Made Simple = 2.2.9 SQL Injection Exploit CVE-2019-9053 📌 Beschreibung Dieses Exploit zielt auf eine nicht authentifizierte SQL-Injection-Schwachstelle in CMS Made Simple = 2.2.9 CVE-2019-9053 ab. Die Schwachstelle ermöglicht es Angreifern, vertrauliche Informationen wie Benutzername, E-Mail,...

CVE-2019-9053-POC

CMS Made Simple ⚠️ Avvertenza: Questo script è solo a scopo educativo e di test autorizzato. Non utilizzarlo su sistemi di cui non sei proprietario o per cui non hai esplicita autorizzazione. L'autore e i collaboratori non sono responsabili per eventuali abusi o danni causati da questo strumento. ...

CVE-2024-57430

CVE-2024-57430 Eine SQL-Injection-Schwachstelle in der Funktion pjActionGetUser des PHPJabbers Cinema Booking System v2.0 ermöglicht es Angreifern, Datenbankabfragen über den Parameter column zu manipulieren. Die Ausnutzung dieses Fehlers kann zu unbefugter Offenlegung von Informationen,...

CVE-2024-51482-POC

ZoneMinder PoC SQLi basata sul tempo autenticato - CVE-2024-51482 ⚠️ Solo per scopi educativi e ricerca di sicurezza autorizzata. Eseguire questo strumento su sistemi di cui non si è proprietari o senza autorizzazione scritta è illegale. Indice ZoneMinder PoC SQLi basata sul tempo autenticato -...

CVE-2025-28346

Tipo di Vulnerabilità SQL Injection Descrizione È stata scoperta una vulnerabilità di Time-Based Blind SQL Injection in Ticket-Booking-App - 1.0 che consente a un attaccante di eseguire query SQL arbitrarie sul database sottostante. Il parametro vulnerabile non sanifica correttamente l'input...

Exploit for CVE-2026-74251

Unauthenticated SQL Injection via Attribute Filter in Phoca Ca...

CVE-2026-50769

The CRM+ application before and including version 2025.6 from Brainformatik is vulnerable to SQL Injection time-based vulnerability. The check conflict endpoint index.php?module=Appointments&action=CheckConflictOfDates&ajaxSkipHeader=true which is used to check any conflicts for user calendar is...

CVE-2026-74251

Joomla Extension - phoca.cz - Unauthenticated SQL injection via attribute filter in Phoca Cart 5.0.0-6.1.6 - The a attribute and s specification GET array parameters on Phoca Cart's public shop items page are concatenated raw into SQL WHERE clauses without parameterization or escaping. An...

CVE-2026-74251 Joomla Extension - phoca.cz - Unauthenticated SQL injection via attribute filter in Phoca Cart 5.0.0-6.1.6

Joomla Extension - phoca.cz - Unauthenticated SQL injection via attribute filter in Phoca Cart 5.0.0-6.1.6 - The a attribute and s specification GET array parameters on Phoca Cart's public shop items page are concatenated raw into SQL WHERE clauses without parameterization or escaping. An...

CVE-2026-74251

The CVE affects Phoca Cart (Phoca.cz) on Joomla, specifically versions 5.0.0–6.1.16. The vulnerability is an unauthenticated SQL injection where a[] (attribute) and s[] (specification) GET parameters from Phoca Cart’s public shop items page are concatenated directly into SQL WHERE clauses without...

CVE-2026-74251

Joomla Extension - phoca.cz - Unauthenticated SQL injection via attribute filter in Phoca Cart 5.0.0-6.1.6 - The a attribute and s specification GET array parameters on Phoca Cart's public shop items page are concatenated raw into SQL WHERE clauses without parameterization or escaping. An...

EUVD-2026-59941

Joomla Extension - phoca.cz - Unauthenticated SQL injection via attribute filter in Phoca Cart 5.0.0-6.1.6 - The a attribute and s specification GET array parameters on Phoca Cart's public shop items page are concatenated raw into SQL WHERE clauses without parameterization or escaping. An...

CVE-2026-74251 Joomla Extension - phoca.cz - Unauthenticated SQL injection via attribute filter in Phoca Cart 5.0.0-6.1.6

Joomla Extension - phoca.cz - Unauthenticated SQL injection via attribute filter in Phoca Cart 5.0.0-6.1.6 - The a attribute and s specification GET array parameters on Phoca Cart's public shop items page are concatenated raw into SQL WHERE clauses without parameterization or escaping. An...

PT-2026-73150

Joomla Extension - phoca.cz - Unauthenticated SQL injection via attribute filter in Phoca Cart 5.0.0-6.1.6 - The a attribute and s specification GET array parameters on Phoca Cart's public shop items page are concatenated raw into SQL WHERE clauses without parameterization or escaping. An...