legba

legba Join the project community on our server! Legba is a multiprotocol credentials bruteforcer / password sprayer and enumerator built with Rust and the Tokio asynchronous runtime in order to achieve better performances and stability while consuming less resources than similar tools. Key Featur...

sqlmap

sqlmap sqlmap is an open source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers. It comes with a powerful detection engine, many niche features for the ultimate penetration tester, and a broad range of switche...

msdat

Quentin HARDY --- [email protected] [email protected] MSDAT MSDAT M icros oft SQL D atabase A ttacking T ool is an open source penetration testing tool that tests the security of Microsoft SQL Databases remotely. Usage examples of MSDAT: You have a Microsoft database listening remotely...

mssqlproxy

mssqlproxy mssqlproxy is a toolkit aimed to perform lateral movement in restricted environments through a compromised Microsoft SQL Server via socket reuse. The client requires impacket and sysadmin privileges on the SQL server. Please read this article carefully before continuing. It consists of...

MSSQLand

✈️ MSSQLand Land gracefully in your target Microsoft SQL Server MS SQL DBMS, as if arriving on a business-class flight with a champagne glass in hand. 🥂 MSSQLand is a C Microsoft SQL Server MSSQL / MS SQL post-exploitation tool built for red team operators. Designed to run inside the target...

CVE-2026-18782-TREX-MES-Uygulamalarinda-SQL-Zafiyeti

TREX-MES-Uygulamalarında-SQLi-Zafiyeti CVE-2026-18782 Genel Bakış TREX MES, üretim sahasından veri toplamak ve yönetmek için kullanılan ticari bir Üretim Yürütme Sistemi MES / Endüstri 4.0 platformudur. Uygulamanın web API'si, istemciden gelen sql parametresi doğrudan arka uçtaki Microsoft SQL...

CVE-2025-24999

CVE-2025-24999 proof of concept for CVE-2025-24999 https://databasesecurityninja.wordpress.com/2026/04/02/microsoft-sql-server-privilege-elevation-through-msdatabasemanager-role-cve-2025-24999/...

CVE-2019-1068

CVE-2019-1068 Root cause analysis and PoC for a Microsoft SQL Server Stack Overflow Vulnerability by reversing “svl.dll”. Links to our work: 1. Ataberk's Blog 2. Fatih's Blog 3. Cem's Blog https://msrc.microsoft.com/update-guide/vulnerability/CVE-2019-1068...

CVE-2008-5416

CVE-2008-5416 Microsoft SQL Server spreplwritetovarbin Memory Corruption via SQL Injection A heap-based buffer overflow can occur when calling the undocumented "spreplwritetovarbin" extended stored procedure. This vulnerability affects all versions of Microsoft SQL Server 2000 and 2005, Windows...

EUVD-2026-101723

n8n before 2.41.4 and 2.42.x before 2.42.1 contains an SQL injection vulnerability in version 1 of the Microsoft SQL node, which substitutes Query field expression values directly into SQL text without parameterisation. When a workflow binds untrusted input such as webhook fields to the Query...

CVE-2026-110840

n8n before 2.41.4 and 2.42.x before 2.42.1 contains an SQL injection vulnerability in version 1 of the Microsoft SQL node, which substitutes Query field expression values directly into SQL text without parameterisation. When a workflow binds untrusted input such as webhook fields to the Query...

CVE-2026-110840

The n8n automation tool (versions before 2.41.4 and 2.42.x before 2.42.1 ) is vulnerable to an SQL injection in version 1 of the Microsoft SQL node . The root cause is the direct substitution of Query field expression values into SQL text without proper parameterisation . If a workflow binds untr...

CVE-2026-110840 n8n before 2.41.4 and 2.42.1 SQL Injection via Microsoft SQL Node Query Field

n8n before 2.41.4 and 2.42.x before 2.42.1 contains an SQL injection vulnerability in version 1 of the Microsoft SQL node, which substitutes Query field expression values directly into SQL text without parameterisation. When a workflow binds untrusted input such as webhook fields to the Query...

CVE-2026-110840 n8n before 2.41.4 and 2.42.1 SQL Injection via Microsoft SQL Node Query Field

n8n before 2.41.4 and 2.42.x before 2.42.1 contains an SQL injection vulnerability in version 1 of the Microsoft SQL node, which substitutes Query field expression values directly into SQL text without parameterisation. When a workflow binds untrusted input such as webhook fields to the Query...

CVE-2026-108065

SQL Injection CWE-89 in the SOAP GetUser method of the /preapproval.asmx endpoint in Channel Software WebAlliance eCommerce VERSION — missing allows an unauthenticated remote attacker to read, write, and potentially execute commands on the backend Microsoft SQL Server via a crafted sUserID...

CVE-2026-108065 Unauthenticated SQL Injection in Channel Software WebAlliance eCommerce

SQL Injection CWE-89 in the SOAP GetUser method of the /preapproval.asmx endpoint in Channel Software WebAlliance eCommerce VERSION — missing allows an unauthenticated remote attacker to read, write, and potentially execute commands on the backend Microsoft SQL Server via a crafted sUserID...

CVE-2026-108065

Channel Software WebAlliance eCommerce is vulnerable to an unauthenticated SQL Injection (CWE-89) within the SOAP GetUser method of the /preapproval.asmx endpoint. An attacker can exploit this by providing a crafted sUserID parameter containing a single quote and a stacked SQL query. This vulnera...

EUVD-2026-101025

SQL Injection CWE-89 in the SOAP GetUser method of the /preapproval.asmx endpoint in Channel Software WebAlliance eCommerce VERSION — missing allows an unauthenticated remote attacker to read, write, and potentially execute commands on the backend Microsoft SQL Server via a crafted sUserID...

Security Updates for Microsoft SQL Server (October 2026)

The Microsoft SQL Server installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities: - Deserialization of untrusted data in SQL Server allows an authorized attacker to execute code over a network. CVE-2026-65674 - Heap-based buffer overflow...

Security Updates for Microsoft SQL Server (October 2026)

The Microsoft SQL Server installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities: - Deserialization of untrusted data in SQL Server allows an authorized attacker to execute code over a network. CVE-2026-65674 - Heap-based buffer overflow...