CVE-2026-27472-and-CVE-2026-27474

CVE-2026-27472 和 CVE-2026-27474（CVSS-B 5.3 中危 和 CVSS-B 4.8 中危） SPIP 4.4.8 联合功能中的盲 SSRF 及存储型 XSS 更多解释请访问我的网站 PoC 1. 以管理员身份登录。 2. 确保在 站点内容 配置中，站点引用与联合 设置为 管理网站目录。 3. 导航至某个栏目，然后点击 引用一个站点。 4. 在 联合 字段中，点击 联合 并输入目标 IP 和端口：tcp://127.0.0.1:22。 5. 保存。 6. 将响应时间与开放端口（tcp://127.0.0.1:80）进行对比。您也可以在被联合站点的页面上点击...

wraith

WRAITH — 浏览器钩子框架 一个面向红队、安全研究人员和教育工作者的现代化独立浏览器钩子框架——作为 BeEF 和盲 XSS 回调工具的洁净室继任者。 仅限授权安全测试、研究与教育用途。 WRAITH 是一款攻击性安全工具，用于演示和测试钓鱼 / 浏览器中间人 / 盲 XSS 攻击技术。仅可针对你拥有明确授权 进行测试的系统和人员使用。你需自行承担使用方式的责任。 为什么我们要构建它 在 Arcanum 的工作过程中，我们不断需要两种不同类型的工具，并希望它们能合二为一。 一方面是 BeEF —— 浏览器利用框架 —— 用于经典的 钩住浏览器，然后在其会话内部开展工作...

CVE-2024-51482-PoC

CVE-2024-51482-PoC Authenticated time-based blind SQL injection exploit for ZoneMinder v1.37. = 1.37.64 Overview This is a proof-of-concept exploit for CVE-2024-51482, a time-based blind SQL injection vulnerability in ZoneMinder's event management functionality. The exploit requires authenticatio...

atutor-blind-sqli

ATutor v2.2.1 盲 SQL 注入 利用 CVE-2016-2555 枚举并导出底层数据库。 免责声明 本文提供的所有信息仅供教育目的。 您不应滥用这些信息来获取未授权访问和/或编写恶意程序。 作者不对信息的滥用负责。...

CVE-2025-22953

CVE-2025-22953 – Epicor HCM Unauthenticated Blind SQL Injection Update – Patch Released by Epicor Epicor has officially released a patch addressing this vulnerability. All affected users are strongly advised to apply the update immediately. 🔗 Epicor Security Patch Announcement Summary An...

wp2shell

wp2shell WordPress REST batch route-confusion blind SQL injection — automated exploit chain. CVE-2026-63030 / CVE-2026-60137 | ---|--- Affected| WordPress 6.9.0 – 6.9.4 and 7.0.0 – 7.0.1 Fixed| WordPress 6.9.5 / 7.0.2 Sink| authornotin SQL via desync'd authorexclude parameter Auth required| None...

CVE-2026-26980

CVE-2026-26980 ★ CVE-2026-26980 PoC de inyección SQL en Content API de TryGhost Ghost CMS ★ https://github.com/user-attachments/assets/e7fab29e-8382-4ecc-986c-68852c28a32c Descripción general CVE-2026-26980 es una vulnerabilidad de inyección SQL no autenticada en la Content API de TryGhost Ghost...

CVE-2026-74251

Unauthenticated SQL Injection via Attribute Filter in Phoca Cart Phoca Cart ≤ 6.1.6 — Unauthenticated Attacker Extracts Full Database via Time-Based Blind Injection SUMMARY The a attribute and s specification GET array parameters on Phoca Cart's public shop items page are concatenated raw into SQ...

WP-Contest-Gallery-28.1.4-Exploit

⚠️ Under Testing This PoC is actively being tested and refined. Features may change between releases. CVE-2026-3180 WordPress Contest Gallery — Unauthenticated Blind SQL Injection Proof-of-concept assessment tool for CVE-2026-3180 Author: Sudeepa Wanigarathna · Original discovery: cardosource...

CVE-2026-63030-wp2r00t

wp2r00t - WordPress REST Batch Route-Confusion SQLi PoC A self-contained proof-of-concept for the unauthenticated blind SQL injection reachable through the WordPress REST batch endpoint /wp-json/batch/v1. It is an independent implementation built from the published vulnerability mechanics. Offici...

CVE-2026-28576-poc

CVE-2026-28576：Android 通讯录提供程序中的 SQL 注入 选中一个联系人，泄露全部联系人：一个 targetSdk 兼容性开关将单联系人选择器授权变成完整的通讯录数据库泄露。 Android 17 通过 setStrictColumns / setStrictGrammar 强化了通讯录提供程序以抵御 SQL 注入——但该强化措施被置于一个受 targetSdk 限制的兼容性变更之后（ENFORCESTRICTSQLCHECKS，id 484953293，enableAfterTargetSdk="36"）。任何以 SDK 36...

CVE-2022-25765

CVE-2022-25765 PoC for Blind RCE for CVE-2022-25765 Tested in HTB - Precious Machine...

nosqli-flintcms

nosqli-flintcms Blind noSQL injection case study lab based on CVE-2018-3783 privilege escalation on flintcms 1.1.9. The vulnerability was originally discovered by Benoit Côté-Jodoin. You can read original report on HackerOne. Prerequisites root@kitploit: docker-compose Limitation : We removed...

CVE-2022-0739

CVE-2022-0739 Python PoC Exploit for CVE-2022-0739 Features Database Metadata Lookup Wordpress User Credential Dump Arbitrary Blind Query Injection 💉 Usage root@kitploit: usage: cve-2022-0739 -h -u URL -e EXEC options: -h, --help show this help message and exit -u URL, --url URL URL of the page...

CVE-2026-63030

CVE-2026-63030: wp2shell WordPress Batch API Desynchronization SQL Injection Exploit Proof of Concept tool for extracting users and password hashes via the CVE-2026-63030 wp2shell vulnerability. Vulnerability Information CVE : CVE-2026-63030 wp2shell Companion CVE : CVE-2026-60137 Type : Pre-Auth...

CVE-2019-7616

CVE-2019-7616 POC for CVE-2019-7616 / ESA-2019-09 - Blind SSRF This just a POC not a tool...

sqlpad-rce-exploit-CVE-2022-0944

SQLPad RCE Exploit This repository contains an exploit script for CVE-2022-0944 in SQLPad, a vulnerability that allows for Remote Code Execution RCE via the /api/test-connection endpoint. Overview The provided script exploit.py demonstrates how to exploit the RCE vulnerability in SQLPad. The scri...

XSSFire

XSSFire A standalone Blind XSS Script. How it works: The script is a combination between PHP and JavaScript, it captures the data using JS and send it to the script itself, then it generates report files and deliver them through telegram. Requirements: 1. Web Server running on Linux with a domain...

CVE-2021-22911

CVE-2021-22911 预认证盲注NoSQL注入导致Rocket Chat 3.12.1远程代码执行 getPasswordPolicy方法容易受到NoSQL注入攻击，且不需要身份验证/授权。它可以通过泄露密码重置令牌来接管账户。接管管理员账户会导致远程代码执行。 解释 1. 劫持用户账户（未经身份验证） 在getPasswordPolicy 端点的密码重置token 参数中存在NoSQL注入，该参数接受JSON对象，允许我们使用$regex运算符。我们利用它来执行盲注NoSQL注入以获取重置令牌。 2. 权限提升至管理员（已认证）...

CVE-2026-42647-Lab

CVE-2026-42647 - JoomSport Unauthenticated Time-Based Blind SQL Injection via sortf Executive Summary This repository contains a local Docker lab for reproducing and validating CVE-2026-42647, an unauthenticated SQL injection vulnerability affecting the WordPress plugin JoomSport - for Sports: Te...