1456 matches found
CVE-2019-1068
CVE-2019-1068 Root cause analysis and PoC for a Microsoft SQL Server Stack Overflow Vulnerability by reversing “svl.dll”. Links to our work: 1. Ataberk's Blog 2. Fatih's Blog 3. Cem's Blog https://msrc.microsoft.com/update-guide/vulnerability/CVE-2019-1068...
mssqlproxy
mssqlproxy mssqlproxy is a toolkit aimed to perform lateral movement in restricted environments through a compromised Microsoft SQL Server via socket reuse. The client requires impacket and sysadmin privileges on the SQL server. Please read this article carefully before continuing. It consists of...
legba
legba Join the project community on our server! Legba is a multiprotocol credentials bruteforcer / password sprayer and enumerator built with Rust and the Tokio asynchronous runtime in order to achieve better performances and stability while consuming less resources than similar tools. Key Featur...
sqlmap
sqlmap sqlmap is an open source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers. It comes with a powerful detection engine, many niche features for the ultimate penetration tester, and a broad range of switche...
msdat
Quentin HARDY --- [email protected] [email protected] MSDAT MSDAT M icros oft SQL D atabase A ttacking T ool is an open source penetration testing tool that tests the security of Microsoft SQL Databases remotely. Usage examples of MSDAT: You have a Microsoft database listening remotely...
cve-2024-50330-ivanti_epm_sqli_reproduction
CVE-2024-50330: Ivanti Endpoint Manager EPM SQL Injection to RCE Overview CVE-2024-50330 is a critical pre-authentication SQL injection vulnerability in Ivanti Endpoint Manager EPM that allows a remote unauthenticated attacker to achieve remote code execution on the target server. The vulnerabili...
MSSQLand
✈️ MSSQLand Aterrice con elegancia en su DBMS Microsoft SQL Server MS SQL objetivo, como si llegara en un vuelo de clase business con una copa de champán en la mano. 🥂 MSSQLand es una herramienta de post-explotación para Microsoft SQL Server MSSQL / MS SQL en C diseñada para operadores de equipos...
CVE-2008-5416
CVE-2008-5416 Microsoft SQL Server spreplwritetovarbin Memory Corruption via SQL Injection A heap-based buffer overflow can occur when calling the undocumented "spreplwritetovarbin" extended stored procedure. This vulnerability affects all versions of Microsoft SQL Server 2000 and 2005, Windows...
msdat
Quentin HARDY --- [email protected] [email protected] MSDAT MSDAT M icros oft SQL D atabase A ttacking T ool es una herramienta de pruebas de penetración de código abierto que prueba la seguridad de las bases de datos Microsoft SQL de forma remota. Ejemplos de uso de MSDAT: Tiene una ba...
CVE-2025-24999
CVE-2025-24999 Proof of Concept für CVE-2025-24999 https://databasesecurityninja.wordpress.com/2026/04/02/microsoft-sql-server-privilege-elevation-through-msdatabasemanager-role-cve-2025-24999/...
Microsoft SQL Server Remote Code Execution Vulnerability
Microsoft SQL Server contains a remote code execution vulnerability that could allow an attacker to execute code in the context of the SQL Server Database Engine service account...
EUVD-2024-55719
Hongjing e-HR contains an unauthenticated SQL injection vulnerability in the getSdutyTree servlet endpoint that allows remote unauthenticated attackers to access protected resources by supplying a path traversal sequence in the request URI to bypass the oauthservlet authentication filter. Attacke...
VulnCheck KEV: CVE-2024-58374
Hongjing e-HR contains an unauthenticated SQL injection vulnerability in the getSdutyTree servlet endpoint that allows remote unauthenticated attackers to access protected resources by supplying a path traversal sequence in the request URI to bypass the oauthservlet authentication filter. Attacke...
CVE-2022-50997 Weaver E-cology 8.0 / 9.0 SQL Injection via HrmCareerApplyPerView.jsp
Weaver Fanwei E-cology 8.0 and 9.0 contains a SQL injection vulnerability in the HrmCareerApplyPerView.jsp endpoint that allows unauthenticated remote attackers to extract arbitrary data from the backend database by manipulating the id GET parameter. Attackers can send a single crafted GET reques...
CVE-2022-50997 Weaver E-cology 8.0 / 9.0 SQL Injection via HrmCareerApplyPerView.jsp
Weaver Fanwei E-cology 8.0 and 9.0 contains a SQL injection vulnerability in the HrmCareerApplyPerView.jsp endpoint that allows unauthenticated remote attackers to extract arbitrary data from the backend database by manipulating the id GET parameter. Attackers can send a single crafted GET reques...
CVE-2022-50997
The CVE-2022-50997 entry concerns Weaver (Fanwei) E-cology 8.0 and 9.0, where a SQL injection vulnerability exists in the HrmCareerApplyPerView.jsp endpoint. An unauthenticated attacker can manipulate the id parameter (via a crafted GET request) to perform UNION-based injections against a Microso...
PT-2026-70788
Weaver Fanwei E-cology 8.0 and 9.0 contains a SQL injection vulnerability in the HrmCareerApplyPerView.jsp endpoint that allows unauthenticated remote attackers to extract arbitrary data from the backend database by manipulating the id GET parameter. Attackers can send a single crafted GET reques...
VulnCheck KEV: CVE-2022-50997
Weaver Fanwei E-cology 8.0 and 9.0 contains a SQL injection vulnerability in the HrmCareerApplyPerView.jsp endpoint that allows unauthenticated remote attackers to extract arbitrary data from the backend database by manipulating the id GET parameter. Attackers can send a single crafted GET reques...
KLA91211 ACE vulnerability in Microsoft SQL Server
Arbitrary code execution vulnerability was found in Microsoft SQL Server. Malicious users can exploit this vulnerability to execute arbitrary code. Original advisories CVE-2026-65811 Exploitation Related products Microsoft-Power-BI CVE list CVE-2026-65811 critical KB list Solution Install necessa...