CVE-2026-63030-CVE-2026-60137-wp2shell-poc

wp2shell — Proof‑of‑Concept di Blind SQL Injection temporizzata su WordPress REST API → RCE Descrizione pocwptot.py è un proof‑of‑concept PoC per sfruttare la vulnerabilità di blind SQL injection basata sul tempo nell'endpoint batch delle WordPress REST API, ed eseguire una catena di escalation...

CVE-2022-31061

CVE-2022-31061 GLPI CVE-2022-31061 के लिए PoC GLPI = 9.3.0 और 10.0.2 के लिए एक Proof of Concept - लॉगिन पृष्ठ पर बिना प्रमाणीकरण के SQL injection कानूनी अस्वीकरण : इस स्क्रिप्ट का उपयोग बिना आपसी सहमति के किसी लक्ष्य पर हमला करने के लिए करना अवैध है। अपने स्थान के लिए सभी लागू कानूनों का पालन करन...

CVE-2024-51482-ZoneMinder-CCTV-HTB-Reliable-EXP

README Macchina Hackthebox: CCTV Applicazione: ZoneMinder Descrizione Eseguire più iniezioni blind basate sul tempo per lo stesso carattere e selezionare il risultato più frequente riduce significativamente gli errori e migliora l'affidabilità, sebbene sia dispendioso in termini di tempo...

CVE-2019-10708

Scms - SQL Injection exploit.py è un PoC per la vulnerabilità CVE-2019-10708, implementa l'iniezione tramite multiprocessing per ottenere i nomi dei database e le credenziali dell'amministratore del backend si consiglia una versione precedente al 20190401. Utilizzo root@kitploit: 測試是否可注入 python3...

TimeInjector

TimeInjector Time injector ist ein Exploit-Skript für CVE-2018-14714 in Bash Um festzustellen, ob das Ziel angreifbar ist, überprüft das Skript zunächst, ob das Ziel erreichbar ist und eine Anmeldesitzung hergestellt werden kann. Danach prüft es die Existenz bestimmter Seiten und führt eine...

ghauri

Like Ghauri, consider supporting the developer...

CVE-2026-71287

Cacti's sanitizesqlcolumn lib/functions.php sanitizes user-supplied ORDER BY column names using the regex . Because this allowlist retains letters, digits, underscore, parentheses, and dot intended to support expressions like COUNTid and table.column, a payload such as passes through completely...

CVE-2026-71288 Koha SQL Injection via order_by and {order}_ovalue Parameters in guided_reports.pl

Koha's guided report builder reports/guidedreports.pl reads the CGI parameter and, for each value, a dynamically-named parameter, and concatenates both directly into an SQL ORDER BY clause with no allowlist or validation. Since ORDER BY columns cannot be bound via prepared-statement placeholders,...

CVE-2026-71287

Cacti CVE-2026-71287 involves a flaw in sanitize_sql_column() in lib/functions.php. The function filters ORDER BY column names with preg_replace('/[^a-zA-Z0-9_().]/', '', $column), which leaves letters, digits, underscore, parentheses, and dot. This allows payloads like SLEEP(5) to pass unmodifie...

CVE-2026-15018

The Database Collation Fix plugin for WordPress is vulnerable to time-based SQL Injection via the 'force-collation-algorithm' parameter in all versions up to, and including, 1.2.10 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

CVE-2026-15018 Database Collation Fix <= 1.2.10 - Unauthenticated SQL Injection via 'force-collation-algorithm' Parameter

The Database Collation Fix plugin for WordPress is vulnerable to time-based SQL Injection via the 'force-collation-algorithm' parameter in all versions up to, and including, 1.2.10 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

PT-2026-65700

A pre-authentication blind SQL injection vulnerability in Koollab LMS allowed an unauthenticated attacker to use a time-based SQL oracle via the SSO OAuth endpoint to read sensitive database contents, including personally identifiable information, credentials, and valid JWT tokens that may enable...

CVE-2026-15670

The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' parameter in all versions up to, and including, 3.9.7 due to insufficient escaping on the user supplied parameter and lack of...

EUVD-2026-49696

The ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' parameter in all versions up to, and including, 3.4.5 due to insufficient escaping on the user supplied parameter and lack of sufficient...

CVE-2026-16811

The ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' parameter in all versions up to, and including, 3.4.5 due to insufficient escaping on the user supplied parameter and lack of sufficient...

CVE-2026-6251

The Chaty Pro plugin for WordPress is vulnerable to Authenticated Time-Based Blind SQL Injection in versions up to and including 3.5.5. This is due to the fetchcustomfield function in admin/class-admin-base.php retrieving the widgetid POST parameter via filterinputINPUTPOST, ... and directly...

CVE-2026-8082

CVE-2026-8082 affects the bpost-shipping-platform WordPress plugin before 3.2.3. The issue is improper sanitization of a parameter used in a SQL query during WooCommerce order submission, allowing unauthenticated attackers to perform time-based blind SQL injection on stores running this plugin. R...

📄 WordPress Exact Links 3.0.7 Unauthenticated Blind SQL Injection

WordPress Exact Links URL Shortener plugin version 3.0.7 contains an unauthenticated time-based blind SQL injection vulnerability through REST. A remote attacker can inject SQL through the vulnerable parameter and infer database contents through response timing. This proof of concept exploit...

📄 WordPress WP Extended 3.0.12 Unauthenticated Blind SQL Injection

WordPress WP Extended plugin version 3.0.12 contains an unauthenticated time-based blind SQL injection vulnerability through X-Forwarded-For. A remote attacker can inject SQL through the vulnerable parameter and infer database contents through response timing. This proof of concept exploit...

📄 WordPress WP Directory Kit 1.4.3 Unauthenticated Blind SQL Injection

WordPress WP Directory Kit plugin version 1.4.3 contains an unauthenticated time-based blind SQL injection vulnerability. A remote attacker can inject SQL through the vulnerable parameter and infer database contents through response timing. This proof of concept exploit demonstrates the vulnerabl...