EUVD-2026-124254

An improper neutralization of special elements used in an SQL command vulnerability in the Auth API in Synology DiskStation Manager DSM before 7.2.1-69057-13, 7.2.2-72806-10, 7.3.2-86009-5, and 7.4.1-90080-1 allows remote attackers to read or write arbitrary files and conduct denial-of-service...

EUVD-2026-124185

An improper neutralization of special elements used in an SQL command vulnerability in the User API in Synology DiskStation Manager DSM before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote attackers with control over a compromised LDAP or Active Directory server to read or write arbitrary files a...

CVE-2026-124815

The Clockinator Lite WordPress plugin (versions before 1.1.0 ) is vulnerable to unauthenticated SQL injection . The root cause is the lack of access restrictions on specific record deletion actions combined with the use of unvalidated and unescaped user-supplied table names in SQL queries. This a...

CVE-2026-124647

The TI WooCommerce Wishlist WordPress plugin, versions prior to 2.0.7 , is vulnerable to SQL injection due to insufficient sanitization and escaping of user input. Specifically, the tinv_wishlistkey cookie is processed in a front-end endpoint SQL statement without proper security controls. This f...

CVE-2026-118421

The WP Directory Kit WordPress plugin version prior to 1.6.3 is vulnerable to SQL injection . The flaw exists because the plugin fails to properly sanitize and escape a parameter used to order results on an admin screen. Specifically, the plugin relies on a keyword deny-list where the replacement...

DSSS

Damn Small SQLi Scanner Damn Small SQLi Scanner DSSS is a fully functional SQL injection vulnerability scanner supporting GET and POST parameters written in under 100 lines of code. As of optional settings it supports HTTP proxy together with HTTP header values User-Agent, Referer and Cookie...

SQLiDetector

SQLiDetector Simple python script supported with BurpBouty profile that helps you to detect SQL injection "Error based" by sending multiple requests with 14 payloads and checking for 152 regex patterns for different databases. +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+- | S|Q|L|i...

Blisqy

1. Blisqy Blisqy is a tool to aid Web Security researchers to find Time-based Blind SQL injection on HTTP Headers and also exploitation of the same vulnerability. The exploitation enables slow data siphon from a database currently supports MySQL/MariaDB only using bitwise operation on printable...

Scanner-and-Patcher

Scanner and Patcher Overview: The Scanner and Patcher project is built as part of the AlphaSecure framework, which has been presented and published at ACM IC3 2024 under the title AlphaSecure: A State-of-the-Art Framework for Web Application Vulnerabilities Detection and Patch Recommendation Usin...

Jeeves

Jeeves Usage • Installation Jeeves is made for looking to Time-Based Blind SQLInjection through recon. Contents: Installation Usage Adding Headers Using Proxy Making Post Request Multiple ways of usage - Installation & Requirements: Installing Jeeves 💀 $ go install...

brutemap

Brutemap .. image:: https://brutemap-dev.github.io/static/brutemap-logo.jpg :target: https://brutemap-dev.github.io :alt: Brutemap Logo |Build Status| |Python| |License| .. |Build Status| image:: https://travis-ci.org/brutemap-dev/brutemap.svg?branch=master :target:...

CVE-2026-81584

An improper neutralization of special elements used in an SQL command vulnerability in the User API in Synology DiskStation Manager DSM before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote attackers with control over a compromised LDAP or Active Directory server to read or write arbitrary files a...

CVE-2026-76954

An improper neutralization of special elements used in an SQL command vulnerability in the Auth API in Synology DiskStation Manager DSM before 7.2.1-69057-13, 7.2.2-72806-10, 7.3.2-86009-5, and 7.4.1-90080-1 allows remote attackers to read or write arbitrary files and conduct denial-of-service...

teler-waf

teler-waf teler-waf is a comprehensive security solution for Go-based web applications. It acts as an HTTP middleware, providing an easy-to-use interface for integrating IDS functionality with teler IDS into existing Go applications. By using teler-waf, you can help protect against a variety of...

sqlmc

SQLMC - SQL Injection Massive Checker Demo Information This tool is for educational purpose only, usage of SQLMC for attacking targets without prior mutual consent is illegal. Developers assume no liability and are not responsible for any misuse or damage cause by this program. Overview SQLMC SQL...

WAF-A-MoLE

WAF-A-MoLE A guided mutation-based fuzzer for ML-based Web Application Firewalls, inspired by AFL and based on the FuzzingBook by Andreas Zeller et al. Given an input SQL injection query, it tries to produce a semantic invariant query that is able to bypass the target WAF. You can use this tool f...

CVE-2026-76954

An improper neutralization of special elements used in an SQL command vulnerability in the Auth API in Synology DiskStation Manager DSM before 7.2.1-69057-13, 7.2.2-72806-10, 7.3.2-86009-5, and 7.4.1-90080-1 allows remote attackers to read or write arbitrary files and conduct denial-of-service...

CVE-2026-76954

A critical improper neutralization of special elements used in an SQL command vulnerability exists in the Auth API of Synology DiskStation Manager (DSM) . The flaw affects versions before 7.2.1-69057-13, 7.2.2-72806-10, 7.3.2-86009-5, and 7.4.1-90080-1. Remote attackers can exploit this to read o...

CVE-2026-81584

Synology DiskStation Manager (DSM) versions before 7.3.2-86009-5 and 7.4.1-90080-1 are vulnerable to an improper neutralization of special elements used in an SQL command within the User API . This flaw allows remote attackers, who possess control over a compromised LDAP or Active Directory serve...

CVE-2026-81584

An improper neutralization of special elements used in an SQL command vulnerability in the User API in Synology DiskStation Manager DSM before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote attackers with control over a compromised LDAP or Active Directory server to read or write arbitrary files a...