283350 matches found
CMS-made-simple-sqli-python3
CMS-made-simple-sqli-python3 CMS Made Simple 2.2.10 - SQL Injection rewritten for python3, CVE-2019-9053 I found it problematic to run this exploit on kali linux, since python2 doesn't have termcolor, so with very few brackets I made it working with python3. All credit goes to:...
cve-2026-3180
CVE-2026-3180 - WordPress Contest Gallery 28.1.4 - Unauthenticated Blind SQL Injection Description A Blind SQL Injection vulnerability was discovered in the WordPress Contest Gallery plugin versions 28.1.4 and earlier. The issue occurs due to unsafe use of the cglmaili parameter, where the...
CVE-2023-1454
CVE-2023-1454 CVE-2023-1454 Vulnerability Detection Script This article is for reference only. Do not use the technical materials and tools in this article to intrude into any computer system without authorization. The direct or indirect consequences and losses caused by the information provided ...
CVE-2024-49681
CVE-2024-49681 WP Sessions Time Monitoring Full Automatic = 1.0.9 - Unauthenticated SQL Injection Description: The WP Sessions Time Monitoring Full Automatic plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 1.0.9 due to insufficient escaping on the user suppli...
CVE-2020-14295
CVE-2020-14295 CVE-2020-14295 proof of concept. The original post can be found at exploit-db. Install requirements python3 -m pip install -r requirements.txt Usage $ python3 cactisqlirce.py --help usage: cactisqlirce.py -h -t -u -p --lhost --lport Cacti 1.2.12 - SQL Injection / Remote Code...
freepbx-endpoint-sqli-rce
CVE-2025-57819 β FreePBX Endpoint Module SQL Injection β Remote Code Execution Summary FreePBX is the open-source web GUI for Asterisk PBX, widely deployed in enterprise telephony environments. The Endpoint Manager module exposes an AJAX handler at /admin/ajax.php that accepts a brand parameter a...
CVE-2026-49079
CVE-2026-49079 CVE-2026-49079 JetSearch SQL Injection Exploit...
CVE-2026-8054
1. Vulnerability Overview CVE-2026-8054 is a high-severity pre-authentication SQL injection vulnerability Pre-auth SQL Injection in the dotCMS Core Publish Audit API. The vulnerability is officially tracked as Security Incident SI-75 and was formally disclosed at the end of May 2026. Since...
CVE-2026-5076
β οΈ CVE-2026-5076 ARMember Premium = 7.3.1 Insecure Password Reset Mechanism β Full Admin Account Takeover Plaintext Password Reset Keys Stored in Database + SQL Injection = Complete Admin Takeover π Vulnerability Information Item| Detail ---|--- CVE ID| CVE-2026-5076 Plugin| ARMember β Membership...
exploit-cve-2023-36808
CVE-2023-36808 - GLPI Unauthenticated SQL Injection Vulnerability GLPI versions field is injected directly into a SQL query without sanitisation: SELECT id FROM glpiagents WHERE deviceid = '' No authentication is required. The vulnerability allows full database read access via blind SQL injection...
CVE-2026-54597
CVE-2026-54597 - ITFlow Time-Based Blind SQL Injection Severity: High Advisory: GHSA-m63v-j7fw-hq2h Affected: ITFlow agent/ajax.php β expires parameter Fixed in: Commit 63d8691 Author: iltosec Summary A time-based blind SQL injection vulnerability in ITFlow's share link generation handler. The...
CVE-2025-13673
CVE-2025-13673 β Tutor LMS SQL Injection Lab Unauthenticated SQL Injection in Tutor LMS WordPress plugin = 3.9.6 via the couponcode parameter. Quick Start 1. Clone and start the lab git clone https://github.com/dinosn/CVE-2025-13673.git cd CVE-2025-13673 ./setup.sh Deploys WordPress + Tutor LMS...
WordPress Appointment Booking Plugin β LatePoint | Calendar & Scheduling for WordPress plugin <= 5.7.2 - Unauthenticated SQL Injection vulnerability
Unauthenticated SQL Injection vulnerability discovered by zickzick2 in WordPress Plugin LatePoint versions = 5.7.2...
CVE-2021-42667
CVE-2021-42667 CVE-2021-42667 - SQL Injection vulnerability in the Online event booking and reservation system version 2.3.0. Technical description: An SQL Injection vulnerability exists in the Event management software version 2.3.0. An attacker can leverage the vulnerable "id" parameter in the...
WordPress WP Directory Kit plugin <= 1.5.9 - Authenticated (Subscriber+) SQL Injection vulnerability
Authenticated Subscriber+ SQL Injection vulnerability discovered by TarcΓsio Luchesi De Almeida Silva Poystick in WordPress Plugin WP Directory Kit versions = 1.5.9...
CVE-2025-7606
CVE-2025-7606 code-projects AVL Rooms Project V1.0/city.php SQL injection NAME OF AFFECTED PRODUCTS AVL Rooms Vendor Homepage https://code-projects.org/avl-rooms-in-php-css-javascript-and-mysql-free-download/ submitter dazhi Vulnerable File /city.php VERSIONS V1.0 Software Link...
CVE-2016-2555
CVE-2016-2555 Exploit This exploit targets a SQL Injection vulnerability and an authentication weakness vulnerability in ATutor 2.2.1. By exploiting these vulnerabilities, the attacker can upload malicious code to achieve Remote Code Execution RCE on the vulnerable server. Usage $ python3...
mirth-connect-security-poc
NextGen Connect 4.5.2 vulnerability PoCs Working proof-of-concept exploits for three network-reachable vulnerabilities in NextGen Connect Mirth Connect 4.5.2. The harnesses run the official container image, create only the channel configuration needed by the finding, execute the attack from a...
WordPress WP Booking System β Booking Calendar plugin <= 2.1.0.1 - Authenticated (Subscriber+) SQL Injection vulnerability
Authenticated Subscriber+ SQL Injection vulnerability discovered by Spy0x7 in WordPress Plugin WP Booking System versions = 2.1.0.1...
CVE-2025-5781
FreePBX CVE-2025-57819 Exploit Description This script exploits a vulnerability in FreePBX versions prior to 16.0.26.0 CVE-2025-57819, allowing remote attackers to execute arbitrary PHP code via a SQL injection flaw in the AJAX API endpoint. The exploit creates both a webshell and an auto-trigger...