CVE-2024-22120-RCE-with-gopher

Usage python exploit.py --ip --sid --hostid --phpsessid --falsetime --truetime Summary This exploit was created to exploit an XXE XML External Entity. Through it, I read the backend code of the web service and found an endpoint where I could use gopher to make internal requests on Zabbix version...

CVE-2023-34362

CVE-2023-34362 POC for CVE-2023-34362 affecting MOVEit Transfer Technical Analysis A technical root cause analysis of the vulnerability can be found on our blog: https://www.horizon3.ai/moveit-transfer-cve-2023-34362-deep-dive-and-indicators-of-compromise/ Summary This POC abuses an SQL injection...

CVE-2025-57819_FreePBX-PoC

FreePBX SQL Injection Checker 🔍 Safe, read-only SQLi detector for FreePBX’s /admin/ajax.php focused on template, model, and brand parameters. 🛡️ Uses error-based , boolean-based , and time-based techniques to flag potential injection without modifying the database. ✍️ Per-parameter verdicts + clean...

CVE_2022_3141

CVE-2022-3141: SQL Injection in ACS EDU 3rd Generation This repository contains a detailed security analysis and report for the vulnerability identified as CVE-2022-3141, affecting the ACS EDU 3rd Generation smart-card system. Vulnerability Overview CVE ID : CVE-2022-3141 Product : ACS EDU 3rd...

CVE-2025-7558-PoC

CVE-2025-7558-PoC Summary A vulnerability labeled as critical has been found in code-projects Voting System 1.0. The affected element is an unknown function of the file /admin/positionsadd.php. Such manipulation of the argument Description leads to sql injection. This vulnerability is documented ...

CVE-2025-6970

CVE-2025-6970 Events Manager = 7.0.3 - Unauthenticated SQL Injection via orderby Parameter Description The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to time-based SQL Injection via the ‘orderby’ parameter in all versions up to, and including, 7.0.3...

CVE

CVE's Table CVE Number| Type| Company/Product| Description| Article Link| Repository Link ---|---|---|---|---|--- CVE-2026-9680| SQLi| Alibaba RDS MCP Servers| TBA| TBA| TBA CVE-2026-50335| LPE| Windows July 2026| TBA| TBA| TBA GHSA-73cv-556c-w3g6| SQLi| Apache Pinot MCP 3.1.0| Missing sanitizati...

CVE-2023-51801

CVE-2023-51801 Simple Student Attendance System v.1.0 - Multiple SQL injection vulnerabilities - studentform.php and classform.php Description :Simple Student Attendance System v.1.0 is prone to multiple SQL injection vulnerabilities that can be exploited by authenticated attackers. These...

CVE-2020-7471-Django

CVE-2020-7471-PoC Django PoC for the SQL injection vulnerability in PostgreSQL with Django, found in Django 1.11 before 1.11.28, 2.2 before 2.2.10, and 3.0 before 3.0.3 The class django.contrib.postgres.aggregates.StringAgg for using the PostgreSQL STRINGAGG function had a SQL injection...

CVE-2024-35469

CVE-2024-35469 Submitter: Kha Do Human Resource Management System 1.0 Vulnerability SQL injection Description SQL injection vulnerability in /hrm/user/ in SourceCodester Human Resource Management System 1.0 allow attackers to execute arbitrary SQL commands via the password parameters. Affected...

CVE-2025-28346

Vulnerability Type SQL Injection Description A Time-Based Blind SQL Injection vulnerability was discovered in Ticket-Booking-App - 1.0 that allows an attacker to execute arbitrary SQL queries on the underlying database. The vulnerable parameter does not properly sanitize user-supplied input,...

oracle-xxe-sqli

oracle-xxe-sqli Automated Oracle CVE-2014-6577 exploitation via SQLi Usage: oracle-xxe-sqli.py -h -i IP -p PORT --disable-server --custom-headers CUSTOMHEADERS -f PAYLOADFILE url Options positional arguments: url URL to inject. Use as the injection marker, just once. optional arguments: -h, --hel...

AWE

AWE: Adaptive Agents for Dynamic Web Penetration Testing Akshat Singh Jaswal · Ashish Baghel Accepted at NDSS LAST-X 2026 Abstract Modern web applications are increasingly produced through AI-assisted development and rapid no-code deployment pipelines, widening the gap between accelerating softwa...

CVE-2025-25964

CVE-2025-25964: SQL Injection in School Information Management System v1.0 Introduction In today's digital landscape, SQL Injection SQLi remains one of the most common and dangerous vulnerabilities found in web applications. This blog post discusses a critical SQL Injection vulnerability...

google-dorks-bug-bounty

Google Dorks for Bug Bounty A list of Google Dorks for Bug Bounty, Web Application Security, and Pentesting Live Tool Broad domain search w/ negative search site:example.com -www -shop -share -ir -mfa PHP extension w/ parameters site:example.com ext:php inurl:? API Endpoints site:example.com...

jackdaw

jackdaw gather gather gather What is this? Jackdaw is here to collect all information in your domain, store it in a SQL database and show you nice graphs on how your domain objects interact with each-other an how a potential attacker may exploit these interactions. It also comes with a handy...

CVE-2025-67644-LangGraph-3.0.1-SQLite-Checkpoint-SQL-Injection

CVE-2025-67644 PoC – LangGraph SQLite Checkpoint SQL Injection CVE-2025-67644 is a SQL Injection vulnerability CWE-89 in the langgraph-checkpoint-sqlite package part of LangGraph / LangChain ecosystem. It allows an attacker to inject arbitrary SQL via unsanitized metadata filter keys passed to th...

Optiva-Framework

Optiva-Framework 🕵️ Web Application Scanner 💉 Author : Joker-Security dev-labs ✔️ Description : You can use this Framework on your website to check the security of your website by finding the vulnerability in your website or you can use this tool to Get admin panel search SQL injection by dork As...

CVE-2025-52399-SQLi-Institute-of-Current-Students

CVE-2025-52399 - SQL Injection in Institute of Current Students Summary The loginlinkfaculty endpoint in the Institute-of-Current-Students application is vulnerable to SQL Injection via the fid POST parameter. The parameter is not properly sanitized before being used in a SQL query, allowing remo...

CVE-2024-9264

🚨 CVE-2024-9264 - Grafana SQL injection leading to Remote Code Execution RCE and file Read Exploit tool for CVE-2024-9264, a critical vulnerability in Grafana allow authenticated attcker to execute sql query leading to RCE 🛡️ This tool is strictly for educational purposes and authorized penetratio...