CVE

CVE's Table CVE Number| Type| Company/Product| Description| Article Link| Repository Link ---|---|---|---|---|--- CVE-2026-9680| SQLi| Alibaba RDS MCP Servers| TBA| TBA| TBA CVE-2026-50335| LPE| Windows July 2026| TBA| TBA| TBA GHSA-73cv-556c-w3g6| SQLi| Apache Pinot MCP 3.1.0| Missing sanitizati...

CVE-2023-51801

CVE-2023-51801 Simple Student Attendance System v.1.0 - Multiple SQL injection vulnerabilities - studentform.php and classform.php Description :Simple Student Attendance System v.1.0 is prone to multiple SQL injection vulnerabilities that can be exploited by authenticated attackers. These...

CVE-2020-7471-Django

CVE-2020-7471-PoC Django PoC for the SQL injection vulnerability in PostgreSQL with Django, found in Django 1.11 before 1.11.28, 2.2 before 2.2.10, and 3.0 before 3.0.3 The class django.contrib.postgres.aggregates.StringAgg for using the PostgreSQL STRINGAGG function had a SQL injection...

slowql

SlowQL The fastest offline SQL static analyzer. Built in Rust for zero false positives. Catch SQL injection, performance regressions, missing indexes, unbounded queries, compliance violations, and 282+ more issues before they reach production. No database connection required. What SlowQL Does...

CVE-2024-35469

CVE-2024-35469 Submitter: Kha Do Human Resource Management System 1.0 Vulnerability SQL injection Description SQL injection vulnerability in /hrm/user/ in SourceCodester Human Resource Management System 1.0 allow attackers to execute arbitrary SQL commands via the password parameters. Affected...

CVE-2025-28346

Vulnerability Type SQL Injection Description A Time-Based Blind SQL Injection vulnerability was discovered in Ticket-Booking-App - 1.0 that allows an attacker to execute arbitrary SQL queries on the underlying database. The vulnerable parameter does not properly sanitize user-supplied input,...

sqlmap

sqlmap sqlmap is an open source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers. It comes with a powerful detection engine, many niche features for the ultimate penetration tester, and a broad range of switche...

oracle-xxe-sqli

oracle-xxe-sqli Automated Oracle CVE-2014-6577 exploitation via SQLi Usage: oracle-xxe-sqli.py -h -i IP -p PORT --disable-server --custom-headers CUSTOMHEADERS -f PAYLOADFILE url Options positional arguments: url URL to inject. Use as the injection marker, just once. optional arguments: -h, --hel...

AWE

AWE: Adaptive Agents for Dynamic Web Penetration Testing Akshat Singh Jaswal · Ashish Baghel Accepted at NDSS LAST-X 2026 Abstract Modern web applications are increasingly produced through AI-assisted development and rapid no-code deployment pipelines, widening the gap between accelerating softwa...

CVE-2025-25964

CVE-2025-25964: SQL Injection in School Information Management System v1.0 Introduction In today's digital landscape, SQL Injection SQLi remains one of the most common and dangerous vulnerabilities found in web applications. This blog post discusses a critical SQL Injection vulnerability...

google-dorks-bug-bounty

Google Dorks for Bug Bounty A list of Google Dorks for Bug Bounty, Web Application Security, and Pentesting Live Tool Broad domain search w/ negative search site:example.com -www -shop -share -ir -mfa PHP extension w/ parameters site:example.com ext:php inurl:? API Endpoints site:example.com...

jackdaw

jackdaw gather gather gather What is this? Jackdaw is here to collect all information in your domain, store it in a SQL database and show you nice graphs on how your domain objects interact with each-other an how a potential attacker may exploit these interactions. It also comes with a handy...

CVE-2025-67644-LangGraph-3.0.1-SQLite-Checkpoint-SQL-Injection

CVE-2025-67644 PoC – LangGraph SQLite Checkpoint SQL Injection CVE-2025-67644 is a SQL Injection vulnerability CWE-89 in the langgraph-checkpoint-sqlite package part of LangGraph / LangChain ecosystem. It allows an attacker to inject arbitrary SQL via unsanitized metadata filter keys passed to th...

Optiva-Framework

Optiva-Framework 🕵️ Web Application Scanner 💉 Author : Joker-Security dev-labs ✔️ Description : You can use this Framework on your website to check the security of your website by finding the vulnerability in your website or you can use this tool to Get admin panel search SQL injection by dork As...

CVE-2025-52399-SQLi-Institute-of-Current-Students

CVE-2025-52399 - SQL Injection in Institute of Current Students Summary The loginlinkfaculty endpoint in the Institute-of-Current-Students application is vulnerable to SQL Injection via the fid POST parameter. The parameter is not properly sanitized before being used in a SQL query, allowing remo...

CVE-2024-9264

🚨 CVE-2024-9264 - Grafana SQL injection leading to Remote Code Execution RCE and file Read Exploit tool for CVE-2024-9264, a critical vulnerability in Grafana allow authenticated attcker to execute sql query leading to RCE 🛡️ This tool is strictly for educational purposes and authorized penetratio...

mssqlproxy

mssqlproxy mssqlproxy is a toolkit aimed to perform lateral movement in restricted environments through a compromised Microsoft SQL Server via socket reuse. The client requires impacket and sysadmin privileges on the SQL server. Please read this article carefully before continuing. It consists of...

CVE-2022-40347_Intern-Record-System-phone-V1.0-SQL-Injection-Vulnerability-Unauthenticated

CVE-2022-40347: Intern Record System - 'phone', 'email', 'deptType' and 'name' SQL Injection Unauthenticated Exploit Title: Intern Record System - 'phone', 'email', 'deptType' and 'name' SQL Injection Unauthenticated Date: 2022-06-09 Exploit Author: Hamdi Sevben Vendor Homepage:...

CVE-2024-39304

Description This script is a PoC for CVE-2024-39304, where a SQLi is possible due to a lack of sanitization in the ChurchCRM project. Usage python3 CVE-2024-39304.py -u -p -b -v Example: python3 CVE-2024-39304.py -u FirstLast -p Password123 -b http://localhost/churchcrm -v Links...

CVE-2024-42327

CVE-2024-42327: Zabbix Privilege Escalation - RCE Description This Proof-of-Concept POC can be used to exploit CVE-2024-42327 to leak the admin API authentication token and create an item to achieve a reverse shell on a Zabbix server 6.0.32rc1, 6.4.17rc1, 7.0.1rc1 A non-admin user account on the...