CVE-2026-121536

The WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps plugin for WordPress is vulnerable to a generic SQL Injection in all versions up to and including 5.5.90 . The root cause is insufficient escaping of the 'engine' parameter and a lack of sufficient preparation on the ex...

CVE-2022-24707

PoC for CVE-2022-24707 SQL Injection Vulnerability on Puncher plugin. A POST request can be crafted to exploit SQL Injection and leak database contents. This is tested on Anuko Time Tracker 1.20.0.5640. python3 exploit.py --help usage: exploit.py -h --username USERNAME --password PASSWORD --host...

hacker-scripts

English | 简体中文 Hacker Scripts Based on a true story : xxx: OK, so, our build engineer has left for another company. The dude was literally living inside the terminal. You know, that type of a guy who loves Vim, creates diagrams in Dot and writes wiki-posts in Markdown... If something - anything -...

ctftools

CTF-Tool Database Twitter: @hydr0nium Dependencies: sudo apt install python2 Installation: git clone https://github.com/white-hood/ctftools.git cp .ctftools cd /bin ln -s ctftools /path/to/ctftools.py Usage: ./ctftools | normal use ./ctftools --remove | remove tool from database ./ctftools --add ...

CVE-2022-0739

CVE-2022-0739 Proof-of-Concept exploit SQLI BookingPress before 1.0.11 Usage Supply the URL to where the Booking Press plugin is in use on the application. bash exploit.sh '' e.g. Hashes are redacted in this demo ┌──user@user-/ └─$ bash sqliexploit.sh 'http://localhost/calendar/' / / / / \ / / /...

Joomla-Scanner

Joomla Scanner Joomla Unauthorized Access Vulnerability CVE-2023-23752 made with python Usage Display Result.txt URL | Database Name | Username | Password | Host Disclaimer Alat ini hanya untuk edukasi, dilarang memperjual beli kan dan menyalahgunakan...

qsreplace

qsreplace Accept URLs on stdin, replace all query string values with a user-supplied value, only output each combination of query string parameters once per host and path. Usage Example input file: ▶ cat urls.txt https://example.com/path?one=1&two=2 https://example.com/path?two=2&one=1...

CVE-2026-17411

The IBM API Connect software versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are affected by multiple vulnerabilities. These flaws stem from a SQL injection issue where user input is not properly neutralized before being used in database queries. An authenticated attacker could ...

EUVD-2026-118791

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow an authenticated attacker to view, add, modify, or delete information in the back-end database due to SQL injection. Input is not properly neutralized before it is used in database queries...

LetsMapYourNetwork

Omniscient - Let’s Map Your Network v2.0 Table of Contents 1. WHAT IT IS 2. WHY IT IS 3. WHERE TO USE IT 4. Presentations 5. Key Features 6. Installation Guidelines 7. HOW TO USE IT 8. Understand Node 9. Contributer 10. LMYN In Action 11. Roadmap 12. Contact Information WHAT IT IS It is utmost...

JCS

JCS Joomla Component Scanner made for penetration testing purpose on Joomla CMS JCS can help you with the latest component vulnerablities and exploits. Database can update from several resources and a Crawler has been implemented to find components and component's link. This version supports...

cve-exploit

CVE-EXPLOIT Use this software only for legal purposes. I am in no way responsible for your actions. Use python 3.11.2 Made by Edu0x01 DESCRIPTION cve-exploit is a hub for finding CVEs and exploits. It is based on the official NIST, ExploitDB and Github databases. The tool makes it quick and easy ...

cve-collector

CVE-Collector Simple Latest CVE Collector Written in Python There are various methods for collecting the latest CVE Common Vulnerabilities and Exposures information. This code was created to provide guidance on how to collect, what information to include, and how to code when creating a CVE...

CVE-2024-49681

CVE-2024-49681 WP Sessions Time Monitoring Full Automatic = 1.0.9 - Unauthenticated SQL Injection Description: The WP Sessions Time Monitoring Full Automatic plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 1.0.9 due to insufficient escaping on the user suppli...

teams_dump

PoC for dumping and decrypting cookies in the latest version of Microsoft Teams extract.py just dumps without arguments extract.exe is just extract.py packed into an exe teamsdump.py List values in the database python.exe .\teamsdump.py teams --list Table: meta Columns in meta: key, value...

bbqsql

BBQSQL A Blind SQL Injection Exploitation Tool Table Of Contents What is BBQSQL? Overview of Readme High Level Usage Install BBQSQL Options Query Syntax Overview HTTP Parameters Export Config Import Config Custom Hooks Found a Bug? Can I Help? What's Up with the Name? What is BBQSQL? Blind SQL...

CVE-2023-49954.github.io

SQL Injection in 3CX CRM Integration For the CRM integration, 3CX ships templates for connecting to various databases. In these templates, placeholders FirstName,SearchText,Email are used to populate the queries. User input is not sanitized and thus enables SQL injections. Affected Versions no...

jackdaw

jackdaw gather gather gather What is this? Jackdaw is here to collect all information in your domain, store it in a SQL database and show you nice graphs on how your domain objects interact with each-other an how a potential attacker may exploit these interactions. It also comes with a handy...

OWASP-WSTG-Rag

OWASP WSTG RAG A Retrieval-Augmented Generation RAG system that indexes the OWASP Web Security Testing Guide WSTG into a vector database, providing instant access to security testing methodologies via REST API and MCP Model Context Protocol for Claude Code integration. Features Complete WSTG...

pike-agent

Pike Agent pike-agent records and analyzes how programs behave on Linux. It traces a program's activity, indexes it into a database, and lets you chat with an LLM agent about it in a TUI. Example of prompts: Crash diagnosis: This program crashed with a bus error. What happened? Race condition...