second-order

Second Order Escanea aplicaciones web para la toma de control de subdominios de segundo orden rastreando la aplicación y recolectando URLs y otros datos que coincidan con ciertas reglas o respondan de cierta manera. Instalación Desde binario Descarga un binario precompilado desde la página de...

CVE-2024-23108

CVE-2024-23108 POC Proof of concept exploit to blindly execute commands as root on vulnerable FortiSIEM appliances. I just quickly added the option to supply a list and added some coloring. The orginal and all the cred goes to horizon3 see blog post below Blog Post Root cause and indicators of...

CVE-2018-6376

CVE-2018-6376 Joomla!, Inyección SQL de Segundo Orden Iniciar Joomla! root@kitploit: $ docker-compose up -d Acceder a localhost a través del navegador http://localhost:10080...

CVE-2023-38891

CVE-2023-38891 Vulnerabilidad de inyección SQL autenticada en VTiger Open Source CRM v7.5 Descubierto por: Jacob Elliott 13/07/23 Resumen En el módulo de Informes de VTiger CRM v7.5.0, la verificación de los campos seleccionados para el informe es insuficiente; estos campos se almacenan y luego s...

second-order

Second Order Scans web applications for second-order subdomain takeover by crawling the app, and collecting URLs and other data that match certain rules, or respond in a certain way. Installation From binary Download a prebuilt binary from the releases page and unzip it. From source Go version 1....

CVE-2026-0603

CVE-2026-0603 Inyección en Hibernate ORM / Inyección SQL de Segundo Orden ★ CVE-2026-0603 PoC de Inyección SQL en Hibernate ★ https://github.com/user-attachments/assets/2e7c3a89-e26f-48cd-af0b-8b82d32ce71f Descripción general CVE-2026-0603 es una vulnerabilidad de Inyección SQL de Segundo Orden e...

CVE-2026-27470

⚠️ YASAL UYARI / LEGAL DISCLAIMER Bu araç yalnızca eğitim amaçlı ve yazılı izin alınmış güvenlik testleri için geliştirilmiştir. Sahip olmadığınız veya test etmek için açık yazılı izniniz olmayan sistemlere karşı kullanılması yasadışıdır. Yetkisiz erişim, birçok ülkede ağır cezai yaptırımlara...

CVE-2026-27470-POC

CVE-2026-27470 — ZoneMinder Second-Order SQL Injection PoC Author:d3vn0mi | CVSS 8.8 | Authenticated | Events Permission Required Overview CVE-2026-27470 is a second-order SQL injection vulnerability in ZoneMinder's web/ajax/status.php — specifically the getNearEvents function...

CVE-2026-19944

The WP Crowdfunding plugin for WordPress is vulnerable to generic SQL Injection via 'wpneoreward' Post Meta in all versions up to, and including, 2.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible...

EUVD-2026-74607

The WP Crowdfunding plugin for WordPress is vulnerable to generic SQL Injection via 'wpneoreward' Post Meta in all versions up to, and including, 2.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible...

CVE-2026-19944

WP Crowdfunding for WordPress (versions up to and including 2.2.1 ) contains a second-order SQL injection in the wpneo_reward Post Meta field, caused by insufficient escaping and lack of prepared statements. An authenticated attacker with Shop Manager or higher privileges can inject a malicious p...

CVE-2026-19944 WP Crowdfunding <= 2.2.1 - Authenticated (Shop Manager+) SQL Injection via 'wpneo_reward' Post Meta

The WP Crowdfunding plugin for WordPress is vulnerable to generic SQL Injection via 'wpneoreward' Post Meta in all versions up to, and including, 2.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible...

EverShop-Lab-CVE-2026-25993

CVE-2026-25993 — EverShop Second-Order SQL Injection Lab Prerequisites Docker Engine 24+ with Docker Compose v2+ 2 GB free RAM Deploy root@kitploit: cd EverShop-Lab/ docker compose up Wait 2 minutes for first build clones EverShop v2.1.0, compiles, runs migrations, seeds data. App will be availab...

POC-AIOWPM-CVE-2026-19949

CVE-2026-19949 — Documented, reproducible-in-Docker proof of concept Unauthenticated second-order SQL injection in All-in-One WP Migration and Backup WordPress that escalates to leaking the ai1wmsecretkey and, with it, to remote code execution RCE. Read this in: English · Español...

CVE-2025-68999-POC

CVE-2025-68999 Happy Addons for Elementor prepare, but then drops $entry-metakey straight into the SQL string without escaping: root@kitploit: $records = " $duplicatedpostid, '$entry-metakey', '$value' "; // ... $wpdb-query $query ; Because metakey comes from the database, the code treats it as...

CVE-2025-68999-POC

CVE-2025-68999 Happy Addons for Elementor = 3.20.4 — Authenticated Contributor+ Second-Order SQL Injection...

CVE-2026-52771 YesWiki: Second-Order SQL Injection in Page Delete API via Unescaped Page Tag (`ApiController::deletePage`)

YesWiki is a wiki system written in PHP. From version 4.2.0 to before version 4.6.6, ApiController::deletePage interpolates a page tag retrieved from the database into a DELETE FROM …links WHERE totag = '$tag' query without escaping. The page tag is attacker-controlled — the POST /api/pages/tag A...

CVE-2026-52771

YesWiki (PHP wiki system) versions 4.2.0 through 4.6.5 are affected by a second-order SQL injection in ApiController::deletePage(). A page tag containing a single quote is stored intact during insertion (the INSERT escapes it for SQL, but the raw byte persists), then read back unescaped into DELE...

CVE-2026-52771 YesWiki: Second-Order SQL Injection in Page Delete API via Unescaped Page Tag (`ApiController::deletePage`)

YesWiki is a wiki system written in PHP. From version 4.2.0 to before version 4.6.6, ApiController::deletePage interpolates a page tag retrieved from the database into a DELETE FROM …links WHERE totag = '$tag' query without escaping. The page tag is attacker-controlled — the POST /api/pages/tag A...

GHSA-X67C-8PWR-M8G3 SiYuan: Second-order SSTI to arbitrary SQL via attribute-view template column (queryBlocks): malicious imported package executes SQL on victim kernel

CVE: This vulnerability corresponds to CVE-2026-72807. Summary Attribute-view AV template columns are live-evaluated on every render and expose the queryBlocks template function, which runs raw SQL on the read-write database handle SelectBlocksRawStmt, using ?→argument string substitution rather...