Astra

Astra Las pruebas de penetración de API REST son complejas debido a los cambios continuos en las API existentes y las API recién agregadas. Astra puede ser utilizado por ingenieros de seguridad o desarrolladores como parte integral de su proceso, permitiéndoles detectar y corregir vulnerabilidade...

exploits-rconfig

exploits Tres exploits para rconfig = 3.9.4 : CVE-2019-19509 : authenticated RCE CVE-2019-19585 : Local Privilege Escalation root CVE-2020-10220 : unauthenticated SQLi rconfigrootRCEunauth.py : chaining the three CVEs above to get root reverse shell without authentication...

Complete-google-dorks

Complete-google-sql-dorks news/news.php?id= -site:php.net -"The PHP Group" inurl:source inurl:url ext:pHp !Host=. intext:encUserPassword= ext:pcf ?action= ?cat= ?id= ?intitle:index.of? mp3 artist-name-here ?intitle:index.of? mp3 name ?page= ?pagerequested= ?pid= " -FrontPage-" ext:pwd inurl:servi...

CVE-2025-56380

CVE-2025-56380 — Inyección SQL ciega basada en tiempo en Frappe / ERPNext frappe.client.getvalue 📌 Resumen Se descubrió una vulnerabilidad de inyección SQL ciega basada en tiempo en el endpoint de API frappe.client.getvalue en Frappe Framework v15.72.4 y presente en el código de ERPNext v15.67.0...

CVE-2024-3922-Poc

CVE-2024-3922-Poc Dokan Pro Cache-Control: max-age=0 Upgrade-Insecure-Requests: 1 Origin: http://192.168.110.184:8080 User-Agent: Mozilla/5.0 Windows NT 10.0; Win64; x64 AppleWebKit/537.36 KHTML, like Gecko Chrome/126.0.0.0 Safari/537.36 Accept:...

drupal-cve-2026-9082-checker

DRUPAL CVE-2026-9082 COMPROBADOR Drupal CVE-2026-9082 Comprobador de Inyección SQL Ciega Instalación git clone https://github.com/N45HT/drupal-cve-2026-9082-checker.git cd drupal-cve-2026-9082-checker pip install -r requirements.txt Referencias https://vulners.com/cve/CVE-2026-9082...

CMS-Made-Simple-2.2.10---SQL-Injection

CMS-Made-Simple-2.2.10---SQL-Injection Google Dorks for detecting CMS Made Simple 2.2.10 SQL Injection CVE-2019-9053. Built for security auditing and patch verification...

CVE-2025-67261

CVE-2025-67261 - Content-based blind SQL injection on Abacre Retail Point of Sale 14.0.0.396 Abacre Retail Point of Sale 14.0.0.396 is vulnerable to content-based blind SQL injection. The vulnerability exists in the Search function of the Orders page. The "Search" function under the "Orders" page...

rails-cve-2012-5664-test

Rails CVE-2012-5664 vulnerability demo This demonstration application shows how the Rails CVE-2013-5664 vulnerability works. More information: http://blog.phusion.nl/2013/01/03/rails-sql-injection-vulnerability-hold-your-horses-here-are-the-facts...

django-cve-2025-64459

Django CVE-2025-64459 This application demonstrates CVE-2025-64459 affecting multiple Django versions. This vulnerability has been patched in newer releases of Django. SQL Injection SQL Injection is when user-provided input is treated as part of a SQL query, allowing an attacker to change how the...

CVE-2025-24799

Escáner SQLi CVE-2025-24799 Un escáner rápido de vulnerabilidades de inyección SQL creado con Python. Utiliza detección de SQLi basada en tiempo con multihilo y salida colorida, diseñado para probar vulnerabilidades CVE-2025-24799. Características Escanea URL individuales o listas desde archivos...

CVE-2025-2011

CVE-2025-2011 PoC By: X3RX3S But Proudly ripped by Ash Wesker that GPT'd my code with his banner ; see here --- https://github.com/Ashwesker/Blackash-CVE-2025-2011 You can even see my handle in 'his' code --' Purpose: A proof-of-concept tool to test for an SQL injection vulnerability CVE-2025-201...

spip-exploits

Casse-Spip CVE-2026-72708, CVE-2026-72709, CVE-2026-72710 From an Unauthenticated SQL Injection to Remote Code Execution Exploit for CVE-2026-72708, CVE-2026-72709 and CVE-2026-72710 discovered by Franck Chevalier Wayko For a complete technical deep dive, read the full article on Lexfo's blog...

CVE-2025-22652

CVE-2025-22652 1️⃣ Tipo de componente Plugin de WordPress 2️⃣ Detalles del componente Nombre del componente Payment Forms for Paystack Versión vulnerable = 4.0.1 Slug del componente payment-forms-for-paystack Enlace del componente https://wordpress.org/plugins/payment-forms-for-paystack/ 3️⃣ OWASP...

reversemap

reversemap Analiza intentos de inyección SQL en registros de servidor web El programa puede ejecutarse en modo batch o en modo interactivo. En modo batch, el programa aceptará registros del servidor web Apache y desofuscará las URLs solicitadas de los registros. En modo interactivo, el programa...

CVE-2023-39361

CVE-2023-39361 Inyección SQL no autenticada en Cacti v1.2.24 Resumen Cacti es una herramienta de monitoreo operativo de código abierto escrita en PHP, MySQL/MariaDB, que proporciona una interfaz amigable. La vulnerabilidad fue descubierta en 2023 y afecta a todas las versiones anteriores a la...

PrestaShop SmartBlog <4.0.6 - SQL Injection

PrestaShop SmartBlog by SmartDataSoft 4.0.6 is vulnerable to a SQL injection vulnerability in the blog archive functionality. id: CVE-2021-37538 info: name: PrestaShop SmartBlog 4.0.6 - SQL Injection author: whoever severity: critical description: PrestaShop SmartBlog by SmartDataSoft 4.0.6 is...

IPeakCMS 3.5 - SQL Injection

ipeak Infosystems ibexwebCMS 3.5 contains an unauthenticated Boolean-based SQL injection caused by unsanitized 'id' parameter in /cms/print.php, letting attackers execute arbitrary SQL commands, exploit requires no authentication. id: CVE-2021-3018 info: name: IPeakCMS 3.5 - SQL Injection author:...

Slider & Popup Builder by Depicter <= 3.6.1 - Unauthenticated SQL Injection

The Slider & Popup Builder by Depicter plugin for WordPress is vulnerable to generic SQL Injection via the ‘s' parameter in all versions up to, and including, 3.6.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.This makes ...

WordPress Loginizer < 1.6.4 – Unauthenticated SQL Injection via `log` Parameter

The Loginizer plugin before 1.6.4 for WordPress allows SQL injection with resultant XSS, related to loginizerloginfailed and lzvalidip. id: CVE-2020-27615 info: name: WordPress Loginizer 1.6.4 – Unauthenticated SQL Injection via log Parameter author: intelligent-ears severity: critical descriptio...