PoC-CVE-2024-44349

PoC-CVE-2024-44349 漏洞发现并测试于 Anteeo WMS - v4.7.31 该漏洞允许威胁行为者在用户名参数中构造SQL命令，并泄露底层数据库中的数据。受影响版本的ANTEEO B2B WMS为v4.7.x至v4.7.34（不含）。 用法 1. git clone [email protected]:AndreaF17/PoC-CVE-2024-44349.git 2. cd PoC-CVE-2024-44349 3. python3 -m venv venv 4. source venv/bin/activate 5. pip3 install -r...

cve-2007-2447

CVE-2007-2447 Requisitos pysmb Información La vulnerabilidad CVE-2007-2447 afecta a Samba desde la versión 3.0.0 hasta la 3.0.25rc3. Permite a los atacantes ejecutar comandos de shell en el parámetro de nombre de usuario. Uso Abra un puerto de escucha de su elección, configure las variables en el...

CVE-2024-35511

PHPGurukul Men Salon Management System 2.0 Bienvenido al repositorio de PHPGurukul Men Salon Management System 2.0. Este proyecto tiene como objetivo proporcionar un sistema robusto para la gestión de salones masculinos. Vulnerabilidades de seguridad CVE-2024-35511 Descripción: Vulnerable a...

CVE-2021-42665

CVE-2021-42665 CVE-2021-42665 - 工程师在线门户系统中的SQL注入认证绕过漏洞。 技术描述： 在工程师在线门户系统的登录表单中存在一个SQL注入漏洞，攻击者可利用该漏洞绕过认证。 受影响组件 - 受影响页面 - login.php 受影响参数 - "username", "password" 利用步骤： 1. 导航至 http://localhost/niamunozmonitoringsystem/login.php 2. 在用户名或密码字段中插入有效载荷 3. 点击登录 概念验证（PoC） - 以下有效载荷将允许绕过工程师在线门户系统登录表单的认证机制 ...

CVE-2023-2594

CVE-2023-2594 https://vulners.com/cve/CVE-2023-2594 A vulnerability, which was classified as critical, was found in SourceCodester Food Ordering Management System 1.0. Affected is an unknown function of the component Registration. The manipulation of the argument username leads to sql injection. ...

CVE-2024-6043

CVE-2024-6043 CVE-2024-6043 CVE-2024-6043 概述 该Python工具利用CVE-2024-6043漏洞，该漏洞影响SourceCodester Best House Rental Management System 1.0。漏洞允许远程攻击者通过adminclass.php文件中的登录功能，针对username参数执行SQL注入。该工具自动化检测易受攻击的端点并注入payload以绕过认证的过程。 功能 - 自动路径检测：该工具检查目标服务器上是否存在易受攻击的adminclass.php文件。 -...

CVE-2025-7753

🚨 CVE-2025-7753 — SQL 注入 PoC 利用工具 作者: Byte Reaper Telegram: @ByteReaper0 CVE: CVE‑2025‑7753 漏洞类型: 未认证的基于时间的 SQL 注入 🔍 概述 在 在线预约系统 1.0 （Code‑Projects）中的 /admin/adddoctor.php 文件存在一个严重的 SQL 注入漏洞。username 参数未正确过滤，允许远程攻击者执行任意 SQL 查询（基于时间、基于错误、联合查询、布尔盲注）。 本仓库提供了 首个公开的 PoC ，使用 C 语言编写，利用 libcurl 进行 HTTP...

CVE-2025-8550

CVE-2025-8550 – atjiu pybbs XSS 漏洞利用 描述 本仓库托管了一个针对 CVE-2025-8550 的自动概念验证（PoC）漏洞利用工具，该漏洞是 atjiu pybbs （≤ v6.0.0）中的一个反射型跨站脚本（XSS）漏洞。它针对 /admin/topic/list 端点的 username 参数，该参数缺乏适当的输入过滤。 特性 20 多种载荷变体： script、SVG、iframe、object、onerror 处理器等。 自动 URL 编码： 通过 libcurl 的 curleasyescape 确保安全注入。 Cookie 窃取（可选）：...

CVE-2024-55099-Online-Nurse-Hiring-System-v1.0-SQL-Injection-Vulnerability-

CVE-2024-55099-Online-Nurse-Hiring-System-v1.0-Vulnerabilidad-de-Inyección-SQL Autor del exploit: ugurkarakoc Página del proveedor https://phpgurukul.com/online-nurse-hiring-system-using-php-and-mysql Enlace del software https://phpgurukul.com/?sdmprocessdownload=1&downloadid=17826 Resumen...

CVE-2023-7172

CVE-2023-7172 Resumen Este proyecto contiene una versión vulnerable de un Sistema de Gestión Hospitalaria HMS que es susceptible a Inyección SQL CVE-2023-7172. La Inyección SQL es una vulnerabilidad crítica de aplicaciones web que puede tener impactos graves en la seguridad y funcionalidad de un...

CVE-2021-39377

VULNERABILIDAD DE INYECCIÓN SQL EN OPENSIS 8.0 CVE-2021-39377 Existe una vulnerabilidad de inyección SQL en la versión 8.0 de openSIS cuando se usa MySQL MariaDB como base de datos de la aplicación. Un atacante malintencionado puede enviar comandos SQL a la base de datos MySQL MariaDB a través de...

WordPress Yo plugin 1.1-1.3.1 - Unauthenticated SQL Injection via username Parameter vulnerability

Unauthenticated SQL Injection via username Parameter vulnerability discovered by João Ramos Maciel in WordPress Plugin Yo versions 1.1-1.3.1...

CVE-2026-87963

The Yo WordPress plugin from 1.1 through 1.3.1 does not sanitize or parameterize the username request parameter before using it in a SQL query, and reads it before WordPress applies its request escaping, allowing unauthenticated attackers to perform SQL injection and read arbitrary database...

CVE-2026-87963 Yo 1.1 - 1.3.1 - Unauthenticated SQL Injection via username Parameter

The Yo WordPress plugin from 1.1 through 1.3.1 does not sanitize or parameterize the username request parameter before using it in a SQL query, and reads it before WordPress applies its request escaping, allowing unauthenticated attackers to perform SQL injection and read arbitrary database...

EUVD-2026-81385

The Yo WordPress plugin from 1.1 through 1.3.1 does not sanitize or parameterize the username request parameter before using it in a SQL query, and reads it before WordPress applies its request escaping, allowing unauthenticated attackers to perform SQL injection and read arbitrary database...

CVE-2026-87963 Yo 1.1 - 1.3.1 - Unauthenticated SQL Injection via username Parameter

The Yo WordPress plugin from 1.1 through 1.3.1 does not sanitize or parameterize the username request parameter before using it in a SQL query, and reads it before WordPress applies its request escaping, allowing unauthenticated attackers to perform SQL injection and read arbitrary database...

CVE-2026-87963

The Yo WordPress plugin (versions 1.1 through 1.3.1 ) is affected by an unauthenticated SQL injection vulnerability. The plugin does not sanitize or parameterize the username request parameter before using it in a SQL query, and reads it before WordPress applies its built-in request escaping. An ...

CVE-2026-87963: Improper Neutralization of Special Elements used in an SQL Command

The Yo WordPress plugin from 1.1 through 1.3.1 does not sanitize or parameterize the username request parameter before using it in a SQL query, and reads it before WordPress applies its request escaping, allowing unauthenticated attackers to perform SQL injection and read arbitrary database...

SQL Injection Vulnerability in Sales and Inventory System (CNVD-2026-37988)

Sales and Inventory System is a business resource planning system for sales and inventory management developed by itsourcecode. The Sales and Inventory System has a SQL injection vulnerability. This vulnerability stems from the improper handling of the Username parameter in the /pages/ustransac.p...

CVE-2026-86265

A vulnerability has been found in itsourcecode Sales and Inventory System 1.0. Affected by this vulnerability is an unknown functionality of the file /pages/ustransac.php. Such manipulation of the argument Username leads to sql injection. It is possible to launch the attack remotely. The exploit...