CVE-2023-48084-Revised

CVE-2023-48084 — updated PoC Repository: MettHK/CVE-2023-48084-Revised Updated version of Hamibubu/CVE-2023-48084 with multithreading, binary-search extraction, and CLI flags for database / table / column selection. Not the original repository. This is a derivative/improved PoC. Credit for the...

CVE-2024-36058

CVE-2024-36058 — Koha Library Software CVE ID: CVE-2024-36058 Product: Koha Library Software Vulnerability Type: Time-Based Blind SQL Injection CWE-89 CVSS Score: 8.1 High Authenticated Affected Versions: Below 22.05.22 Credits: Karolis Narvilas Description Koha is an open-source integrated libra...

XSS-Catcher

XSS Catcher A blind XSS detection and XSS data capture framework that runs on Flask, VueJS and PostgreSQL. XSS Catcher is an intuitive tool that automates blind Cross-Site Scripting XSS attacks and data gathering, including screenshots. It features a user-friendly payload generator for creating...

cve-2017-12945

CVE-2017-12945 Exploit for CVE-2017-12945 A remote authenticated blind OS command injection vulnerability exists in Mersive Solstice Pods - a wireless collaboration and presentation platform designed by Mersive Technologies Inc. - running versions of the firmware prior to 2.8.4, as...

CVE-2024-41651

Blind SSRF to RCE Exploit - PrestaShop 8.1.7 This document outlines a Blind SSRF to RCE exploit on a fresh PrestaShop 8.1.7 docker installation. Prerequisites Ensure you have at least an outdated module installed, for example: psfacetedsearch Download the original package: Download psfacetedsearc...

CVE-2026-49772

The Events Calendar SQL Injection CVE-2026-49772 PoC Description CVE-2026-49772 is an unauthenticated blind SQL injection in the WordPress plugin The Events Calendar. A broken REST parameter validator validatecallback returns a closure instead of validating lets the order parameter on the...

CVE-2023-42284

Disclaimer For educational purpose only! Details Proof of concept for CVE-2023-42284. Tyk Gateway is vulnerable to SQL injection. Fixed in 5.0.7 version. The URL parameter ‘apiversion’ of the "https:///api/errors/count/...?res=day&p=...&apiversion=&apiid=..."is vulnerable to Blind SQL injection...

CVE-2026-72708

SPIP before 4.4.18 is affected by an unauthenticated blind SQL injection in the public sitemap endpoint. The root cause lies in the MySQL escaper spip_mysql_cite() (in ecrire/req/mysql.php), which returns values unescaped when the target column is a date type and the input matches a word characte...

EUVD-2026-76154

SPIP before 4.4.18 contains an unauthenticated blind SQL injection vulnerability in the public sitemap endpoint where the MySQL escaper spipmysqlcite in ecrire/req/mysql.php returns values unescaped when the target column is a date type and the supplied value matches the pattern of a word charact...

CVE-2022-3590-WordPress-Vulnerability-Scanner

CVE-2022-3590 WordPress Vulnerability Scanner This Python script is designed to check whether a WordPress website is vulnerable to the CVE-2022-3590 vulnerability. The vulnerability exploits an unauthenticated blind Server-Side Request Forgery SSRF in the pingback feature of WordPress. Getting...

duct

Pown Duct Essential tool for finding blind injection attacks using DNS side-channels. Credits This tool is part of secapps.com open-source initiative. root@kitploit: / | / | /\ | \ / | \ \ | / | / /\ \ |/// \| || |/ https://secapps.com NB : This tool is taking advantage of http://requestbin.net...

CVE-2024-23746

CVE-2024-23746 Miro Desktop 0.8.18 on macOS allows Electron code injection. PoC signature and version: tool used to explore the vulnerability: https://github.com/r3ggi/electroniz3r verify if is vulnerable: inject a Blind Shell: References...

sqlmap

sqlmap sqlmap is an open source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers. It comes with a powerful detection engine, many niche features for the ultimate penetration tester, and a broad range of switche...

CVE-2018-8097-PoC

CVE-2018-8097 POC for CVE-2018-8097 This script exploits CVE-2018-8097 and can retrieve files and contents using a time based blind RCE method. Usage root@kitploit: python cve-2018-8097.py -h -u URL -c COMMAND -t TIME -id OBJECTID -d FILEPATH options: -h, --help show this help message and exit -u...

POC-S

POC-S: POC-T Strengthen Version POC-T Enhanced Edition Documentation for POC-T wiki is in the doc directory Preface: Currently Legal Disclaimer Using POC-S to attack targets without prior mutual consent is illegal. POC-S is intended for security testing purposes only. Features Compatible with POC...

CVE-2022-21661-Demo

This repository demonstrates a vulnerability in WordPress 5.8.2, in which missing sanitization in class-wp-tax-query.php can, in very specific situations, allow attackers to perform SQL injection. Note that successful exploitation requires developers to add vulnerable code to the WordPress...

CVE-2024-57430

CVE-2024-57430 An SQL injection vulnerability in the pjActionGetUser function of PHPJabbers Cinema Booking System v2.0 allows attackers to manipulate database queries via the column parameter. Exploiting this flaw can lead to unauthorized information disclosure, privilege escalation, or database...

Research_Successful_Errors

Successful Errors: New Code Injection and SSTI Techniques !NOTE This is the second version of the whitepaper based on the results I presented before releasing SSTImap version 1.3.1. Further improvements would be adapted for this format as version 1.2 of the research at a later date. Payloads...

CVE-2019-13633

CVE-2019-13633 Suggested description : Blinger.io v.1.0.2519 is vulnerable to Blind/Persistent XSS. Additional Information : Blinger.io - is a platform which used by global clients such as FxPro, Alfa Bank, OneTwoTrip, Ivi, KupiVIP Group, Belavia, Wargaming, Yandex, OZON, TCS Group Holding and...

CVE-2023-38890

CVE-2023-38890 Description Online Shopping Portal Project V3.1 allows remote attackers to execute arbitrary SQL commands/queries via the login form, leading to unauthorized access and potential data manipulation. This vulnerability arises due to insufficient validation of user-supplied input in t...