CVE-2025-11077

CVE-2025-11077 - SQL Injection Author: Byte Reaper Description This vulnerability is a Blind SQL Injection in the addcontent.php file of the Online Learning Management System CVE-2025-11077, allowing an attacker to extract database information by sending crafted POST requests. Requirements : Linu...

CVE-2025-32429

CVE-2025-32429 XWiki SQL Injection PoC Author: Byte Reaper Telegram: @ByteReaper0 CVE: CVE‑2025‑32429 Vulnerability: Blind SQL Injection in XWiki LiveData REST API Affected File: getdeleteddocuments.vm sort parameter Description : A blind SQL Injection vulnerability exists in XWiki Platform’s...

GLPI - Blind SQL Injection in History Log Filter (LogBleed)

GLPI versions before 10.0.26 and 11.0.8 are vulnerable to a blind SQL injection in the history log filter. The Log::convertFiltersValuesToSqlCriteria function splits the affectedfields filter into key:operator:value parts and DBmysqlIterator::analyseCrit does not quote OR, AND and NOT as column...

ClipBucket v5 <= 5.5.2 - Unauthenticated Blind SQL Injection

ClipBucket v5.5.2-187 and below contain a blind SQL injection caused by unsanitized objid parameter in /actions/ajax.php used in userexists function, letting attackers perform blind SQL injection remotely, exploit requires crafted POST request. id: CVE-2026-21875 info: name: ClipBucket v5 = 5.5.2...

Advance Product Search <= 1.4.4 - Unauthenticated Time-Based Blind SQL Injection

Advance Product Search 1.4.4 and earlier is vulnerable to unauthenticated time-based blind SQL injection. The plugin rebuilds the WordPress search SQL by hand and uses $wpdb-esclike which escapes LIKE wildcards but not single quotes, allowing injection through the ?s= parameter. id: CVE-2026-5607...

WordPress Core 6.9-7.0.1 - Pre-Auth Batch-Route Confusion

WordPress core versions 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1 are vulnerable to a pre-authentication route confusion issue in the REST API batch endpoint /?restroute=/batch/v1. A malformed nested batch request desynchronizes the batch router, allowing unauthenticated requests to reach...

Jms Blog - SQL Injection

The module Jms Blog jmsblog from Joommasters contains a Time Based SQL injection vulnerability. This module is for the PrestaShop e-commerce platform and mainly provided with joommasters PrestaShop themes id: CVE-2023-27034 info: name: Jms Blog - SQL Injection author: MaStErChO severity: critical...

Product Filter by WBW <= 3.4.6 - SQL Injection

WPFactory Product Filter by WBW woo-product-filter = 3.4.6 contains an SQL injection caused by improper neutralization of special elements in SQL commands, letting attackers perform blind SQL injection remotely, exploit requires crafted input. id: CVE-2026-112866 info: name: Product Filter by WBW...

The Events Calendar 6.15.12 - 6.16.2 - Unauthenticated Blind SQL Injection

The Events Calendar WordPress plugin versions 6.15.12 through 6.16.2 do not properly validate the order parameter of the experimental tec/v1 REST events endpoint, allowing unauthenticated attackers to run blind SQL queries and extract arbitrary database contents. id: CVE-2026-49772 info: name: Th...

Doctor Appointment System 1.0 - SQL Injection

Blind SQL injection in contactus.php in Doctor Appointment System 1.0 allows an unauthenticated attacker to insert malicious SQL queries via firstname parameter. id: CVE-2021-27320 info: name: Doctor Appointment System 1.0 - SQL Injection author: theamanrawat severity: high description: | Blind S...

CVE-2026-114189

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in WPVibes AnyWhere Elementor anywhere-elementor allows Blind SQL Injection.This issue affects AnyWhere Elementor: from n/a through 1.3.0...

EUVD-2026-119615

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in WPVibes AnyWhere Elementor anywhere-elementor allows Blind SQL Injection.This issue affects AnyWhere Elementor: from n/a through 1.3.0...

CVE-2026-114189

The WPVibes AnyWhere Elementor (anywhere-elementor) WordPress plugin is vulnerable to Blind SQL Injection due to the improper neutralization of special elements in SQL commands. This security flaw affects versions from n/a through 1.3.0 . An attacker can exploit this vulnerability to execute mali...

CVE-2026-114189 WordPress AnyWhere Elementor plugin <= 1.3.0 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in WPVibes AnyWhere Elementor anywhere-elementor allows Blind SQL Injection.This issue affects AnyWhere Elementor: from n/a through 1.3.0...

PT-2026-140021

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in WPVibes AnyWhere Elementor anywhere-elementor allows Blind SQL Injection.This issue affects AnyWhere Elementor: from n/a through 1.3.0...

CVE-2026-114189: WPVibes AnyWhere Elementor: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPVibes AnyWhere…

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in WPVibes AnyWhere Elementor anywhere-elementor allows Blind SQL Injection.This issue affects AnyWhere Elementor: from n/a through 1.3.0...

SQLbit

SQL Blind Injection Tool A tool for blind SQL injections that uses multithreaded bitwise comparisons to find values of cells in SQL-tables. Works with SQLite at least and supports cookies. It's able to: Search cell values by columns in a table Search characters count in a cells by columns in a...

Blinder

Blinder Blidner is a small python library to automate time-based blind SQL injection by using a pre defined queries as a functions to automate a rapid PoC development. Installation You can install Blinder using the following command: pip install blinder Or by downloading the source and importing ...

Blisqy

1. Blisqy Blisqy is a tool to aid Web Security researchers to find Time-based Blind SQL injection on HTTP Headers and also exploitation of the same vulnerability. The exploitation enables slow data siphon from a database currently supports MySQL/MariaDB only using bitwise operation on printable...

HBSQLI

HBSQLI: Automated Tester For Header Based Blind SQL Injection HBSQLI is an automated command-line tool for performing Header Based Blind SQL injection attacks on web applications. It automates the process of detecting Header Based Blind SQL injection vulnerabilities, making it easier for security...