sqlmap

sqlmap sqlmap is an open source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers. It comes with a powerful detection engine, many niche features for the ultimate penetration tester, and a broad range of switche...

mssqlproxy

mssqlproxy mssqlproxy is a toolkit aimed to perform lateral movement in restricted environments through a compromised Microsoft SQL Server via socket reuse. The client requires impacket and sysadmin privileges on the SQL server. Please read this article carefully before continuing. It consists of...

msdat

Quentin HARDY --- [email protected] [email protected] MSDAT MSDAT M icros oft SQL D atabase A ttacking T ool è uno strumento di penetration test open source che testa la sicurezza dei database Microsoft SQL da remoto. Esempi di utilizzo di MSDAT: Hai un database Microsoft in ascolto in...

CVE-2008-5416

CVE-2008-5416 Microsoft SQL Server spreplwritetovarbin Speicherverfälschung durch SQL-Injection Ein heap-basierter Pufferüberlauf kann auftreten, wenn die undokumentierte erweiterte gespeicherte Prozedur "spreplwritetovarbin" aufgerufen wird. Diese Sicherheitsanfälligkeit betrifft alle Versionen...

cve-2024-50330-ivanti_epm_sqli_reproduction

CVE-2024-50330: Ivanti Endpoint Manager EPM – Iniezione SQL a Esecuzione di Codice Remoto Panoramica CVE-2024-50330 è una vulnerabilità di iniezione SQL critica pre-autenticazione in Ivanti Endpoint Manager EPM che consente a un attaccante remoto non autenticato di ottenere esecuzione di codice...

CVE-2025-24999

CVE-2025-24999 Proof of Concept für CVE-2025-24999 https://databasesecurityninja.wordpress.com/2026/04/02/microsoft-sql-server-privilege-elevation-through-msdatabasemanager-role-cve-2025-24999/...

MSSQLand

✈️ MSSQLand Atterra con eleganza nel tuo database Microsoft SQL Server MS SQL di destinazione, come se arrivassi su un volo business class con un calice di champagne in mano. 🥂 MSSQLand è uno strumento di post-sfruttamento per Microsoft SQL Server MSSQL / MS SQL scritto in C, progettato per...

Microsoft SQL Server Remote Code Execution Vulnerability

Microsoft SQL Server contains a remote code execution vulnerability that could allow an attacker to execute code in the context of the SQL Server Database Engine service account...

CVE-2019-1068

CVE-2019-1068 Ursachenanalyse und PoC für eine Microsoft SQL Server Stack-Overflow-Sicherheitslücke durch Reverse Engineering von „svl.dll“. Links zu unserer Arbeit: 1. Ataberk's Blog 2. Fatih's Blog 3. Cem's Blog https://msrc.microsoft.com/update-guide/vulnerability/CVE-2019-1068...

EUVD-2024-55719

Hongjing e-HR contains an unauthenticated SQL injection vulnerability in the getSdutyTree servlet endpoint that allows remote unauthenticated attackers to access protected resources by supplying a path traversal sequence in the request URI to bypass the oauthservlet authentication filter. Attacke...

VulnCheck KEV: CVE-2024-58374

Hongjing e-HR contains an unauthenticated SQL injection vulnerability in the getSdutyTree servlet endpoint that allows remote unauthenticated attackers to access protected resources by supplying a path traversal sequence in the request URI to bypass the oauthservlet authentication filter. Attacke...

CVE-2022-50997 Weaver E-cology 8.0 / 9.0 SQL Injection via HrmCareerApplyPerView.jsp

Weaver Fanwei E-cology 8.0 and 9.0 contains a SQL injection vulnerability in the HrmCareerApplyPerView.jsp endpoint that allows unauthenticated remote attackers to extract arbitrary data from the backend database by manipulating the id GET parameter. Attackers can send a single crafted GET reques...

CVE-2022-50997 Weaver E-cology 8.0 / 9.0 SQL Injection via HrmCareerApplyPerView.jsp

Weaver Fanwei E-cology 8.0 and 9.0 contains a SQL injection vulnerability in the HrmCareerApplyPerView.jsp endpoint that allows unauthenticated remote attackers to extract arbitrary data from the backend database by manipulating the id GET parameter. Attackers can send a single crafted GET reques...

CVE-2022-50997

The CVE-2022-50997 entry concerns Weaver (Fanwei) E-cology 8.0 and 9.0, where a SQL injection vulnerability exists in the HrmCareerApplyPerView.jsp endpoint. An unauthenticated attacker can manipulate the id parameter (via a crafted GET request) to perform UNION-based injections against a Microso...

PT-2026-70788

Weaver Fanwei E-cology 8.0 and 9.0 contains a SQL injection vulnerability in the HrmCareerApplyPerView.jsp endpoint that allows unauthenticated remote attackers to extract arbitrary data from the backend database by manipulating the id GET parameter. Attackers can send a single crafted GET reques...

KLA91211 ACE vulnerability in Microsoft SQL Server

Arbitrary code execution vulnerability was found in Microsoft SQL Server. Malicious users can exploit this vulnerability to execute arbitrary code. Original advisories CVE-2026-65811 Exploitation Related products Microsoft-Power-BI CVE list CVE-2026-65811 critical KB list Solution Install necessa...

VulnCheck KEV: CVE-2022-50997

Weaver Fanwei E-cology 8.0 and 9.0 contains a SQL injection vulnerability in the HrmCareerApplyPerView.jsp endpoint that allows unauthenticated remote attackers to extract arbitrary data from the backend database by manipulating the id GET parameter. Attackers can send a single crafted GET reques...

CVE-2026-54116 Microsoft SQL Server Information Disclosure Vulnerability

...

CVE-2026-50468

CVE-2026-50468 affects Microsoft SQL Server. It is a buffer over-read that allows an authorized attacker to disclose information over the network. The published advisories indicate an impact of accessing sensitive data with a network attack vector and low privileges required; CVSS 3.1 base score ...

CVE-2026-54116

CVE-2026-54116 impacts Microsoft SQL Server components via a type-confusion flaw that could allow an authenticated, low-privilege attacker to disclose information over the network. The CVSSv3.1 base score is 6.5 (Medium); impact is confined to confidentiality. Affected products are SQL Server (pe...