667 matches found
Jeeves
Jeeves Usage • Installation Jeeves is made for looking to Time-Based Blind SQLInjection through recon. Contents: Installation Usage Adding Headers Using Proxy Making Post Request Multiple ways of usage - Installation & Requirements: Installing Jeeves 💀 root@kitploit: $ go install...
sqlmap
sqlmap sqlmap is an open source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers. It comes with a powerful detection engine, many niche features for the ultimate penetration tester, and a broad range of switche...
CVE-2023-38890
CVE-2023-38890 Description Online Shopping Portal Project V3.1 allows remote attackers to execute arbitrary SQL commands/queries via the login form, leading to unauthorized access and potential data manipulation. This vulnerability arises due to insufficient validation of user-supplied input in t...
CVE-2024-37791
CVE-2024-37791 CVE-2024-37791 Project address: Preparatory work: Log in to the backend - get cookie Vulnerability URL: http://127.0.0.1:8093/s/article/Content/index?classid=&keyword= Vulnerability parameter: keyword payload: %27andselectfromselect+ifasciisubstrdatabase,1,1%3E97,sleep1,0a//union/...
CVE-2024-51482
CVE-2024-51482 — ZoneMinder Time-Based Blind SQL Injection A proof-of-concept exploit for CVE-2024-51482 , an authenticated time-based blind SQL injection vulnerability in ZoneMinder v1.37. ≤ 1.37.64. The script extracts usernames and password hashes from the zm.Users table using binary search...
CVE-2024-1698-NotificationX-WordPress-Plugin-SQL-Injection-to-Admin-Credential-Extraction
CVE-2024-1698 – NotificationX WordPress Plugin SQL Injection Time‑Based Blind Unauthenticated Time‑Based Blind SQL Injection → Extract admin username & password hash from WordPress. 🧠 Vulnerability Overview NotificationX versions 2.8.2 and below suffer from improper input sanitization in the type...
CVE-2026-4060-PoC
CVE-2026-4060 — Geo Mashup ≤ 1.13.18 인증 없는 SQL 인젝션 PoC -blue 인증되지 않은 공격자가 Geo Mashup render-map 엔드포인트의 sort 파라미터를 통해 ORDER BY 절에 임의의 SQL을 주입할 수 있으며, 이를 통해 시간 기반 블라인드 방식으로 민감한 데이터베이스 정보를 추출할 수 있습니다. 목차 취약점 개요 테스트 환경 실행 방법 테스트 결과 완화 방안 탐지 공개 타임라인 참고 자료...
CVE-2025-4396
CVE-2025-4396 — Relevanssi SQL Injection Time-Based Blind Disclaimer: This repository is intended for authorized penetration testing, security research, and educational purposes only. Unauthorized access to computer systems is illegal and unethical. Overview A proof-of-concept exploit for a...
Geo Mashup <= 1.13.18 - SQL Injection
Geo Mashup WordPress plugin = 1.13.18 is vulnerable to time-based SQL injection via the sort parameter. The issue exists because the sort value is insufficiently sanitized in render-map.php/template tag code paths. id: CVE-2026-4060 info: name: Geo Mashup = 1.13.18 - SQL Injection author:...
phpMyFAQ <= 4.1.1 - SQL Injection
phpMyFAQ before 4.1.2 contains an unauthenticated SQL injection vulnerability in BuiltinCaptcha::garbageCollector and BuiltinCaptcha::saveCaptcha methods that interpolate unsanitized User-Agent headers into DELETE and INSERT queries. Unauthenticated attackers can exploit the public GET /api/captc...
Spam protection, AntiSpam, FireWall by CleanTalk < 5.153.4 - Unauthenticated Blind SQL Injection
It was possible to exploit an Unauthenticated Time-Based Blind SQL Injection vulnerability in the Spam protection, AntiSpam, FireWall by CleanTalk WordPress Plugin before 5.153.4. The updatelog function in lib/Cleantalk/ApbctWP/Firewall/SFW.php included a vulnerable query that could be injected v...
CVE-2025-45809-PoC
CVE-2025-45809 — /key/block을 통한 LiteLLM SQL 삽입시간 기반 블라인드 SQLi LiteLLM v1.65.4v1.81.0 이전 버전의 /key/block 및 /key/unblock 엔드포인트의 key 매개변수에 SQL 삽입 취약점 이 존재합니다. 공격자는 시간 기반 블라인드 삽입 기술을 활용하여 데이터베이스 내용을 탈취하고 서버 파일을 읽을 수 있습니다...
CVE-2023-31702
CVE-2023-31702 — eScan Management Console SQL Injection Authenticated Overview CVE-2023-31702 is an authenticated SQL Injection vulnerability discovered in MicroWorld Technologies eScan Management Console version 14.0.1400.2281. The vulnerability exists in the GetUserCurrentPwd endpoint, where th...
CVE-2026-54597
CVE-2026-54597 - ITFlow Time-Based Blind SQL Injection Severity: High Advisory: GHSA-m63v-j7fw-hq2h Affected: ITFlow agent/ajax.php — expires parameter Fixed in: Commit 63d8691 Author: iltosec Summary A time-based blind SQL injection vulnerability in ITFlow's share link generation handler. The...
CVE-2026-14762-PoC-Exploit
CVE-2026-14762 – Эксплуатация SQL-инъекции в Code‑Projects Hotel & Tourism Reservation 1.0 -orange -red Полнофункциональный, многопоточный эксплуатационный скрипт для слепой SQL-инъекции на основе времени для CVE‑2026‑14762. Нацелен на конечную точку /admin/rooms.php приложения Code‑Projects Hote...
CVE-2024-51482-PoC
CVE-2024-51482-PoC ZoneMinder v1.37. = 1.37.64에 대한 인증 기반 시간 기반 블라인드 SQL 인젝션 익스플로잇 개요 이것은 ZoneMinder의 이벤트 관리 기능에 존재하는 시간 기반 블라인드 SQL 인젝션 취약점인 CVE-2024-51482에 대한 개념 증명 익스플로잇입니다. 이 익스플로잇은 인증이 필요하며 조건부 SLEEP 쿼리를 사용하여 데이터베이스에서 데이터를 추출합니다. 기능 인증 기반 익스플로잇 - 자격 증명 또는 세션 쿠키로 로그인 길이 감지 - 추출 전에 이진 탐색으로 정확한...
CVE-2025-56380
CVE-2025-56380 — Time-based Blind SQL Injection in Frappe / ERPNext frappe.client.getvalue 📌 Summary A time-based blind SQL injection vulnerability was discovered in the frappe.client.getvalue API endpoint in Frappe Framework v15.72.4 and present in ERPNext v15.67.0 codebase. An authenticated use...
CVE-2025-45346
CVE-2025-45346 – Bacula-Web Time-Based SQL Injection PostgreSQL Version Extraction 📝 Overview Vulnerability Title : Time-Based Blind SQL Injection in Bacula-Web Product : Bacula-Web Versions Affected : Confirmed in versions supporting PostgreSQL backend CVE ID : CVE-2025-45346 Severity : High...
CVE-2025-5287
CVE-2025-5287 PoC Unauthenticated SQL Injection exploit for WordPress Likes and Dislikes Plugin ≤ 1.0.0 📖 Description This Python script is a proof-of-concept PoC exploit for CVE-2025-5287 , targeting a vulnerability in the WordPress Likes and Dislikes Plugin ≤ 1.0.0. The vulnerability allows...