CVE-2022-37209

CVE-2022-37209 CVE-2022-37209 POC Suggested description JFinal CMS 5.1.0 is vulnerable to SQL Injection. These interfaces do not use the same component, nor do they have filters, but each uses its own SQL concatenation method, resulting in SQL injection. Additional Information...

CVE-2022-37210

CVE-2022-37210 CVE-2022-37210 POC Suggested description JFinal CMS 5.1.0 is affected by: SQL Injection. These interfaces do not use the same component, nor do they have filters, but each uses its own SQL concatenation method, resulting in SQL injection. Additional Information...

pharmacy-sqli-CVE-2026-7392

Pharmacy Sales and Inventory System 1.0 - CVE-2026-7392 SQL Injection SourceCodester Pharmacy Sales and Inventory System V1.0 pure PHP/MySQL version CVE : CVE-2026-7392 Endpoint : /ajax.php?action=deletesupplier id parameter Type : SQL Injection CWE-89 CVSS 3.1 : 6.3 Medium Author : oretnom23...

CVE-2022-37201

CVE-2022-37201 CVE-2022-37201 POC POC First of all you should install sqlmap you need set target domain or IP your cookie the run the shell sqlmap -u http://targetDomainOrIP/jfinalcms/jfinalcms/admin/contact/list --thread 8 --batch --smart --random-agent --data "...

CVE-2020-12112

CVE-2020-12112 🚨 BigBlueButton versions lower than 2.2.4 have a LFI vulnerability allowing access to sensitive files. Story 📜 During a distance learning course on a BigBlueButton instance a student in my class shared my teacher's slide presentation link and I noticed that the file name was includ...

CVE-2025-63572

Description A SQL injection vulnerability was discovered in the endpoint responsible for searching for platform clients Zentrajuris v.1.0. User input sent to the search parameter is concatenated directly into a SQL query without proper sanitization/parameterization, allowing the attacker to...

CVE-2022-37203

CVE-2022-37203 CVE-2022-37203 POC Additional Information https://github.com/AgainstTheLight/someEXPofjfinalcms/blob/main/jfinalcms/sql3.md Vulnerability Type SQL Injection Vendor of Product the development group Affected Product Code Base https://github.com/jflyfox/jfinalcms - JFinal CMS 5.1.0...

CVE-2021-21017

CVE-2021-21017 Not another Adobe Reader Byte Order Mark bug : IA32 plugin, ver. 2020.013.20074. char cdecl FUN2581894cchar baseurl,LPCSTR relurl ............................................................ ............................................................ if baseurl != char 0x0 && relu...

net-creds

Thoroughly sniff passwords and hashes from an interface or pcap file. Concatenates fragmented packets and does not rely on ports for service identification. Screenshots --- Sniffs URLs visited POST loads sent HTTP form logins/passwords HTTP basic auth logins/passwords HTTP searches FTP...

pfsense-limiter-number

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · pfsense-limiter-number pfsense-limiter-number Class: RCE Reach: Remote pfSense CE 2.9.0-DEVELOPMENT 9363ac5 - pfsense.org Traffic Shaper Limiters emit a hidden number field on edit. Create overwrites that number with...

CVE-2026-1207

CVE-2026-1207 Django GIS RasterField SQL Injection Vulnerability Reproduction Vulnerability Overview Vulnerability Type : SQL Injection Affected Component : django.contrib.gis RasterField When querying with Django GIS's RasterField, the band parameter is directly concatenated into the SQL...

CVE-2024-44541

CVE-2024-44541: SQL Injection Vulnerability in Inventio Lite v4 Description Inventio Lite v4 is vulnerable to SQL Injection SQLi in the /action=processlogin endpoint. This vulnerability allows attackers to inject arbitrary SQL queries via the username parameter in POST requests, potentially leadi...

XSS-Bypass-Filters

XSS-Bypass-Filters Redirection document.location= document'location'= window.location= this"window""location"= document.location.href= location.href= location= window.location.assign window'location''href'= document.location.replace window.open"link", "blank"; Link //google.com/?=a...

CVE-2026-28672

CVE-2026-28672 — Apache Ranger UnixUserGroupBuilder OS command injection Runnable proof-of-concept reproducer for the OS command injection in Apache Ranger's user-sync unixusersync module. While enumerating the groups of each synced user, UnixUserGroupBuilder runs the id command through a shell,...

CVE-2022-37204

CVE-2022-37204 CVE-2022-37204 POC Suggested description RESERVED JFinal CMS 5.1.0 is vulnerable to SQL Injection. Additional Information https://github.com/AgainstTheLight/someEXPofjfinalcms/blob/main/jfinalcms/sql7.md Vulnerability Type SQL Injection Vendor of Product the development group...

CVE-2021-21017

CVE-2021-21017 Not another Adobe Reader Byte Order Mark bug : IA32 plugin, ver. 2020.013.20074. char cdecl FUN2581894cchar baseurl,LPCSTR relurl ............................................................ ............................................................ if baseurl != char 0x0 && relu...

CVE-2022-37205

CVE-2022-37205 CVE-2022-37205 POC Suggested description RESERVED JFinal CMS 5.1.0 is affected by: SQL Injection. These interfaces do not use the same component, nor do they have filters, but each uses its own SQL concatenation method, resulting in SQL injection. Additional Information...

subgen

Subgen - a subdomain concating-utility with some smarts If you've come to the realisation that you'd like to split up your DNS enumeration methodology by generating combinations and/or pulling passive data from other sources, then subgen is the sorter & concator you're probably looking for...

CVE-2026-48710

CVE-2026-48710 Principle: Starlette is an open-source, lightweight Python ASGI framework. The root cause is that when processing URL data structures, Starlette trusts the host sent by the client and directly concatenates it into the url variable for subsequent authentication handling. The raw URL...

discuz-ml-rce

discuz-ml-rce Affected systems and versions: Discuz!ML V3.2-3.4 Discuz!x V3.2-3.4 Vulnerability cause: The Discuz!ML system does not filter the language parameter content received by l in the cookie, leading to string concatenation, thereby executing PHP code. The cookie field will contain an...