WordPress WP Directory Kit plugin <= 1.5.4 - Authenticated (Custom+) SQL Injection vulnerability

Authenticated Custom+ SQL Injection vulnerability discovered by zickzick2 in WordPress Plugin WP Directory Kit versions = 1.5.4...

CVE-2026-102616

A vulnerability was detected in risesoft-y9 WorkFlow-Engine up to 9.6.10. Impacted is the function getByIdAndYear of the file CustomHistoricProcessServiceImpl.java of the component OAuth2 Resource Filter. Performing a manipulation of the argument year/processInstanceId results in sql injection...

SQLbit

SQL Blind Injection Tool A tool for blind SQL injections that uses multithreaded bitwise comparisons to find values of cells in SQL-tables. Works with SQLite at least and supports cookies. It's able to: Search cell values by columns in a table Search characters count in a cells by columns in a...

brutemap

Brutemap .. image:: https://brutemap-dev.github.io/static/brutemap-logo.jpg :target: https://brutemap-dev.github.io :alt: Brutemap Logo |Build Status| |Python| |License| .. |Build Status| image:: https://travis-ci.org/brutemap-dev/brutemap.svg?branch=master :target:...

andor

andor Blind SQL Injection Tool with Golang Usage Download andor.go and go to the folder where the file andor.go located. And type this to command prompt: go run andor.go --url "http://deneme.com/index.php?id=1" Note: Get parameter value must be correct, otherwise it will not work...

Pybelt

NOTE: This project is no longer updated, this will be the last push to this project, if you would like more info, feel free to ping me on Twitter: @staysalty Pybelt Pybelt is an open source hackers tool belt complete with: A port scanner SQL injection scanner Dork checker Hash cracker Hash type...

CVE-2026-102616 risesoft-y9 WorkFlow-Engine OAuth2 Resource Filter CustomHistoricProcessServiceImpl.java getByIdAndYear sql injection

A vulnerability was detected in risesoft-y9 WorkFlow-Engine up to 9.6.10. Impacted is the function getByIdAndYear of the file CustomHistoricProcessServiceImpl.java of the component OAuth2 Resource Filter. Performing a manipulation of the argument year/processInstanceId results in sql injection...

CVE-2026-102616

A SQL injection vulnerability exists in risesoft-y9 WorkFlow-Engine up to version 9.6.10 . The flaw is located within the getByIdAndYear function of the CustomHistoricProcessServiceImpl.java file in the OAuth2 Resource Filter component. By manipulating the year/processInstanceId arguments, an att...

EUVD-2026-89335

A vulnerability was detected in risesoft-y9 WorkFlow-Engine up to 9.6.10. Impacted is the function getByIdAndYear of the file CustomHistoricProcessServiceImpl.java of the component OAuth2 Resource Filter. Performing a manipulation of the argument year/processInstanceId results in sql injection...

CVE-2026-102616 risesoft-y9 WorkFlow-Engine OAuth2 Resource Filter CustomHistoricProcessServiceImpl.java getByIdAndYear sql injection

A vulnerability was detected in risesoft-y9 WorkFlow-Engine up to 9.6.10. Impacted is the function getByIdAndYear of the file CustomHistoricProcessServiceImpl.java of the component OAuth2 Resource Filter. Performing a manipulation of the argument year/processInstanceId results in sql injection...

CVE-2025-1094-PoC-Postgre-SQLi

CVE-2025-1094 分析与模拟环境搭建 本详细分析于2025年3月14日进行，探讨了CVE-2025-1094（一个假设的高危PostgreSQL SQL注入漏洞），基于提供的模拟环境搭建和概念验证（PoC）执行。分析涵盖了漏洞介绍、根本原因、文件贡献、PoC步骤及缓解措施，并整合了模拟过程中的所有复杂细节。 漏洞介绍 CVE-2025-1094被描述为PostgreSQL中的一个严重SQL注入漏洞，影响17.3、16.7、15.11、14.16和13.19之前的版本，CVSS...

CVE-2025-57819-exploit

CVE-2025-57819 — FreePBX Pre-Auth SQLi to RCE An all-in-one exploit for CVE-2025-57819 , an unauthenticated SQL injection in FreePBX's endpoint module that leads to remote code execution via cron job injection. CVSS : 9.8 Critical — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CISA KEV : Added...

CVE-2024-27956-RCE

CVE-2024-27956-RCE Un PoC para CVE-2024-27956, una inyección SQL en el plugin ValvePress Automatic. Este PoC explota la vulnerabilidad creando un usuario en el objetivo y otorgándole derechos de Administrador. Ser administrador en WordPress puede llevar a la Ejecución Remota de Código. Uso git...

CVE-2023-50071

CVE-2023-50071 Customer Support System 1.0 - Múltiples vulnerabilidades de inyección SQL - savedepartment Descripción : Múltiples vulnerabilidades de inyección SQL en /customersupport/ajax.php?action=savedepartment en Customer Support System 1.0 permiten a atacantes autenticados ejecutar comandos...

HUNT

Extensiones de Proxy de HUNT Suite ¿Qué es HUNT Suite? HUNT Suite es una colección de extensiones para Burp Suite Pro/Free y OWASP ZAP. Identifica parámetros comunes vulnerables a ciertas clases de vulnerabilidad Burp Suite Pro y OWASP ZAP. Organiza metodologías de prueba Burp Suite Pro y Free...

CVE-2019-9053-CMS46635-python3

CVE-2019-2019-9053--CMS46635 CMS Made Simple 2.2.10 - Inyección SQL python3...

CVE-2022-31061

CVE-2022-31061 GLPI CVE-2022-31061 的 PoC 针对 GLPI = 9.3.0 且 10.0.2 的 Proof of Concept – 登录页面上的未授权 SQL 注入 法律免责声明： 未经双方同意使用此脚本攻击目标是违法的。 最终用户有责任遵守其所在地的所有适用法律。 开发者不承担任何责任，也不对因使用本程序而导致的任何误用或损害负责。 背景： 公开披露：https://github.com/glpi-project/glpi/security/advisories/GHSA-w2gc-v2gm-q7wq 于 2022-06-28...

CVE-2022-24124

Preface Casdoor is a centralized single sign-on SSO authentication platform based on OAuth 2.0/OIDC ID CVE ID: CVE-2022-24124 CNPD ID: CNPD-202201-7304 Affected Versions Severity: High 7.5 HIGH POC/EXP: Publicly available Casdoor POC:...

CVE-2024-6670

CVE-2024-6670 Progress Software WhatsUp Gold HasErrors SQL注入认证绕过漏洞 CVE-2024-6670 的PoC 该漏洞的根本原因分析可在我博客中找到： https://summoning.team/blog/progress-whatsup-gold-sqli-cve-2024-6670/ 使用方法 python CVE-2024-6670.py --newpassword Pwned --target-url https://192.168.201.150 | | | | | | | | | | | | \ | | | \ |...

proftpd-CVE-2026-42167-poc

POCs de Vulnerabilidad en ProFTPD Demostraciones de prueba de concepto para CVE-2026-42167, una vulnerabilidad de inyección SQL en el pipeline de registro modsql de ProFTPD que permite a un atacante no autenticado ejecutar SQL arbitrario — e inyectar usuarios puerta trasera en la base de datos de...