cve-2024-37765

Description MachForm up to version 19 is affected by an authenticated Blind SQL injection in the user account settings page. SQL injection attacks consist in inserting SQL queries through the usage of an input data field from the client application. This kind of attack allows to obtain access to...

CVE-2024-51428-PoC

CVE-2024-51428 - ZoneMinder Blind SQL Injection PoC Python wrapper for sqlmap designed to exploit CVE-2024-51428 in ZoneMinder. This tool automates detection and exploitation of a Blind SQL Injection vulnerability while keeping the output clean and focused on useful data. The script hides sqlmap...

CVE-2026-63030-wp2r00t

wp2r00t - WordPress REST Batch Route-Confusion SQLi PoC A self-contained proof-of-concept for the unauthenticated blind SQL injection reachable through the WordPress REST batch endpoint /wp-json/batch/v1. It is an independent implementation built from the published vulnerability mechanics. Offici...

CVE-2026-57517

Control Web Panel ≤ 0.9.8.1224 — Blind SQL Injection to Remote Code Execution Port 2083 → userRes POST → INTO DUMPFILE → Port 2031 Webshell → cwpsvc 🔴 Vulnerability Overview CVE-2026-57517 is a critical pre-authentication blind SQL injection in Control Web Panel CWP versions ≤ 0.9.8.1224. The...

CVE-2026-36670

CVE-2026-36670 A time-based blind SQL injection exploit for the OpenSIPS Control Panel. This exploit abuses an authenticated sql injection vulnerability within the aliasmanagement.php module of opensips. The table GET parameter is improperly sanitized, allowing an attacker to inject a crafted...

CVE-2026-63030-CVE-2026-60137-wp2shell-poc

wp2shell — WordPress REST API Time-Based Blind SQLi → RCE Proof‑of‑Concept Description pocwptot.py is a proof‑of‑concept PoC to exploit a time‑based blind SQL injection vulnerability on the WordPress REST API batch endpoint, and perform an escalation chain up to Remote Code Execution RCE...

isr-sqlget

-- ISR - Infobyte Security Research -- | ISR-sqlget | www.infobytesec.com | ..:: DESCRIPTION ISR-sqlget: It's a blind SQL injection tool developed in Perl. It lets you get databases schemas and tables rows. Using a single GET/POST you can access quietly the database structure and using a single...

cve-2019-9053-py3

CVE-2019-9053 — CMS Made Simple SQLi Exploit Python 3 Disclaimer: This tool is intended for authorized penetration testing and educational purposes only. Running this against systems without explicit written permission is illegal. The author assumes no liability for misuse. Overview This is a...

CVE-2022-0439

CVE-2022-0439 CVE-2022-0439 - Email Subscribers & Newsletters 5.3.2 - Subscriber+ Blind SQL injection Must Have sqlmap installed & a valid username & password with subscriber+ Usage usage: CVE-2022-0439.py -h -w URL -u USERNAME -p PASSWORD options: -h, --help show this help message and exit -w UR...

bbqsql

BBQSQL A Blind SQL Injection Exploitation Tool Table Of Contents What is BBQSQL? Overview of Readme High Level Usage Install BBQSQL Options Query Syntax Overview HTTP Parameters Export Config Import Config Custom Hooks Found a Bug? Can I Help? What's Up with the Name? What is BBQSQL? Blind SQL...

CVE-2026-23921

CVE-2026-23921 — Zabbix Time-Based Blind SQL Injection Affected versions: Zabbix 50 THEN pgsleep3 ELSE pgsleep0 END-- Usage PostgreSQL backend d...

BSQLinjector

BSQLinjector BSQLinjector uses blind method to retrieve data from SQL databases. I recommend using "--test" switch to clearly see how configured payload looks like before sending it to an application. Options: --file Mandatory - File containing valid HTTP request and SQL injection point SQLINJECT...

CVE-2026-57517-CWP

CVE-2026-57517 CWP Exploit This repository contains a Go-based proof-of-concept tool for testing a known Control Web Panel CWP vulnerability scenario related to CVE-2026-57517. The implementation targets a blind SQL injection path and includes optional webshell deployment and command execution fl...

atutor-blind-sqli

ATutor v2.2.1 Blind SQL Injection Exploiting CVE-2016-2555 enumerating and dumping the underlying Database. Disclaimer All the information provided in this post is for educational purposes only. You shall not misuse the information to gain unauthorized access and/or write malicious programs. The...

CVE-2025-22953

CVE-2025-22953 – Epicor HCM Unauthenticated Blind SQL Injection Update – Patch Released by Epicor Epicor has officially released a patch addressing this vulnerability. All affected users are strongly advised to apply the update immediately. 🔗 Epicor Security Patch Announcement Summary An...

cve-2026-3180

CVE-2026-3180 - WordPress Contest Gallery 28.1.4 - Unauthenticated Blind SQL Injection Description A Blind SQL Injection vulnerability was discovered in the WordPress Contest Gallery plugin versions 28.1.4 and earlier. The issue occurs due to unsafe use of the cglmaili parameter, where the...

CVE-2026-112866

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in WPFactory Product Filter by WBW woo-product-filter allows Blind SQL Injection.This issue affects Product Filter by WBW: from n/a through 3.4.6...

CVE-2021-32789

CVE-2021-32789 Authenticated Blind SQL Injection. Wordpress woocommerce plugin versions = 2.5.0 Install git clone https://github.com/DonVorrin/CVE-2021-32789.git cd CVE-2021-32789 sudo pip install -r requirements.txt Exploit python3 exploit.py Enter URL: Example: http://exploit.cve/ Enter number:...

EUVD-2026-109250

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in WPFactory Product Filter by WBW woo-product-filter allows Blind SQL Injection.This issue affects Product Filter by WBW: from n/a through 3.4.6...

CVE-2026-112866 WordPress Product Filter by WBW plugin <= 3.4.6 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in WPFactory Product Filter by WBW woo-product-filter allows Blind SQL Injection.This issue affects Product Filter by WBW: from n/a through 3.4.6...