CVE-2024-1071

CVE-2024-1071 CVE-2024-1071 Ultimate Member Unauthorized Database Access / SQLi PoC is now published. It was created for educational/research purposes only! Use it at your own risk!...

kviklet

Kviklet Kviklet.dev | Release Notes | Discord Secure access to production environments without impairing developer productivity. Kviklet pronounced Quick-let embraces the Four-Eyes Principle and a high level of configurability to allow a Pull Request-like Review and Approval flow for individual S...

CVE-2024-32640-SQLI-MuraCMS

Muraider - Automating the detection & Exploitation of CVE-2024-32640 \ SQLi in Mura/Masa CMS Usage Detection: python3 CVE-2024-32640.py --url https://target.com/ Ghauri Exploitation Pass '-g' or '--ghauri' as argument: Parse in any arguments that you wish to use with Ghauri, following their...

CVE-2022-0739

CVE-2022-0739 Proof-of-Concept exploit SQLI BookingPress before 1.0.11 Usage Supply the URL to where the Booking Press plugin is in use on the application. bash exploit.sh '' e.g. Hashes are redacted in this demo root@kitploit: ┌──user@user-/ └─$ bash sqliexploit.sh 'http://localhost/calendar/' /...

CVE-2024-1071

CVE-2024-1071 Ultimate Member Unauthorized Database Access / SQLi PoC is now published. It was created for educational/research purposes only! Use it at your own risk!...

CVE-2024-1301---Badgermeter-moni-tool-SQL-Injection

CVE-2024-1301 --- Badgermeter moni tool - SQL Injection https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-badger-meters-monitool CVE-2024-1301: 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | CWE-89. Software link : https://www.s-can.at/en/product/monitool/...

KiviCare Clinic & Patient Management System (EHR) <= 3.6.4 - SQL Injection

The KiviCare Clinic & Patient Management System EHR plugin for WordPress is vulnerable to SQL Injection via the 'visittypeserviceid' parameter of the taxcalculateddata AJAX action in all versions up to, and including, 3.6.4 due to insufficient escaping on the user supplied parameter and lack of...

Slimstat Analytics < 4.9.3.3 Subscriber - SQL Injection

The Slimstat Analytics WordPress plugin before 4.9.3.3 does not prevent subscribers from rendering shortcodes that concatenates attributes directly into an SQL query. id: CVE-2023-0630 info: name: Slimstat Analytics 4.9.3.3 Subscriber - SQL Injection author: DhiyaneshDK severity: high description...

MOVEit Transfer - SQL Injection

In Progress MOVEit Transfer before 2021.0.8 13.0.8, 2021.1.6 13.1.6, 2022.0.6 14.0.6, 2022.1.7 14.1.7, and 2023.0.3 15.0.3, a SQL injection vulnerability has been identified in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain unauthorized access to MOVEit...

Kaseya VSA 2017 ConnectWise ManagedITSync - Remote Code Execution

ConnectWise ManagedITSync integration through 2017 for Kaseya VSA is vulnerable to unauthenticated remote commands that allow full direct access to the Kaseya VSA database. If the ManagedIT.asmx page is available via the Kaseya VSA web interface, anyone with access to the page is able to run...

WordPress Secure Copy Content Protection and Content Locking <2.8.2 - SQL Injection

WordPress Secure Copy Content Protection and Content Locking plugin before 2.8.2 contains a SQL injection vulnerability. The plugin does not escape the sccpid parameter of the ayssccpresultsexportfile AJAX action, available to both unauthenticated and authenticated users, before using it in a SQL...

CVE-2024-42327

Write-up CVE-2024-42327 Zabbix Vulnerability Target: 10.129.231.176 Information: I know my target is a Zabbix server. I received a default user account to log into Zabbix: user matthew passwd 96qzn0h2e1k3. This account is a default user, without additional groups or privileges. As usual, we start...

CVE-2021-36396-Moodle-Time-Based-SQLi-Exploit

Exploit CVE-2021-36396 Descripción Este repositorio contiene un exploit basado en Python dirigido a CVE-2021-36393, una vulnerabilidad grave encontrada en la función de cursos recientes de Moodle. El fallo reside en el parámetro 'sort', permitiendo ataques de inyección SQL que pueden conducir a u...

CVE-2021-36393

CVE-2021-36393 Inyección SQL ciega basada en errores con enfoque de desplazamiento de bits para Moodle 3.10.4. Permite a un atacante realizar consultas arbitrarias a la base de datos. Por ejemplo, se puede robar: las respuestas de los exámenes de la base de datos Modifica el archivo script.js y...

CVE-2026-0075

CVE-2026-0075 ContactsProvider Research PoC A controlled-lab Android research prototype for evaluating the observable behavior associated with CVE-2026-0075 in ContactsProvider2. Overview CVE-2026-0075 is an Android local elevation-of-privilege issue in ContactsProvider2. The public advisory...

CVE-langgraph

cve-id ⚡ Simple Usage Use this project only in safe and authorized environments such as: Local virtual machines Docker containers Isolated lab setups Authorized penetration testing environments Example setup: root@kitploit: git clone cd Project use python follow below Create a virtual environment...

CVE-2024-55099-Online-Nurse-Hiring-System-v1.0-SQL-Injection-Vulnerability-

CVE-2024-55099-Online-Nurse-Hiring-System-v1.0-Vulnerabilidad-de-Inyección-SQL Autor del exploit: ugurkarakoc Página del proveedor https://phpgurukul.com/online-nurse-hiring-system-using-php-and-mysql Enlace del software https://phpgurukul.com/?sdmprocessdownload=1&downloadid=17826 Resumen...

CVE-2025-60736

CVE-2025-60736: SQL Injection Vulnerability in Online Medicine Guide Executive Summary This document outlines a critical SQL injection vulnerability discovered in the Online Medicine Guide web application. The vulnerability allows unauthorized database access and poses significant security risks ...

CVE-2021-43798

CVE-2021-43798 A batch verification script written in Golang, with 48 built-in verifications Too many people write it in Python, so I'm trying to learn Golang Usage Save the URL addresses as url.txt, then run go run CVE-2021-43798.go in the current directory. Vulnerable addresses will be saved to...

CVE-2026-79570

mfish-nocode-pro v1.0.0 was discovered to contain a SQL injection vulnerability in the tableName parameter at /sys/dbConnect/data. This vulnerability allows attackers to access sensitive database information via a crafted SQL statement...