CVE-2024-24142

CVE-2024-24142: School-Task-Manager-System-SQL-Injection-2 Proof of ConceptPoC : https://github.com/BurakSevben/CVEs/blob/main/School-Task-Manager-System/CVE-2024-24142.md Proof of ConceptPoC : https://github.com/BurakSevben/CVE-2024-24142/blob/main/CVE-2024-24142.md...

CVE-2024-46532

CVE number: CVE-2024-46532 vendor: Shanghai Dingxiang Information Technology Co., Ltd.https://www.kancloud.cn/ product: Internet Medical System Medical Outpatient OpenHIS version: V1.0 affected component: https://github.com/1638824607/OpenHIS?tab=readme-ov-file Reproduction of SQL Injection...

freepbx-endpoint-sqli-rce

CVE-2025-57819 — FreePBX Endpoint Module SQL Injection → Remote Code Execution Summary FreePBX is the open-source web GUI for Asterisk PBX, widely deployed in enterprise telephony environments. The Endpoint Manager module exposes an AJAX handler at /admin/ajax.php that accepts a brand parameter a...

Simple_CMS_SQLi

This repository does not have a README...

CVE-2026-26980

CVE-2026-26980 — 👻 Ghost CMS Unauthenticated SQLi via Content API A SQL injection vulnerability existed in Ghost's Content API that allowed unauthenticated attackers to read arbitrary data from the database. | ---|--- CVE| CVE-2026-26980 CVSS| 9.4 Critical Affected| Ghost = 3.24.0, = 6.19.0 Fixed...

wp2shell-lab

wp2shell-lab Educational PoC and lab for CVE-2026-63030 + CVE-2026-60137 : pre-authentication SQL injection in WordPress core via REST batch-route confusion. Discovered by Adam Kues Searchlight Cyber / Assetnote. Fixed in WordPress 6.9.5 / 7.0.2. Quick start bring up the vulnerable lab cd docker ...

TarantuBench

TarantuBench v1 A benchmark for evaluating AI agents on web security challenges, generated by the TarantuLabs engine. What is this? TarantuBench is a collection of 100 vulnerable web applications, each containing a hidden flag TARANTU.... An agent's job is to find and extract the flag by...

cmsms-sqli

CMS Made Simple = 2.2.9 SQL Injection CVE-2019-9053 - Python3 Exploit Pure Python3 port of the original Exploit-DB 46635 by Daniele Scanu. Time-based blind SQLi to dump admin credentials from vulnerable CMS Made Simple installations. 🎯 Features: ✅ No external dependencies only requests ✅ Python...

cve-2023-27372

education purpose only!!!!!...

CVE-2021-41511

CVE-2021-41511 Exploit Title: Lodging Reservation Management System 1.0 - SQL Injection / Authentication Bypass Exploit Author: Nitin Sharmavidvansh Vendor Homepage: https://www.sourcecodester.com/php/14883/lodging-reservation-management-system-php-free-source-code.html Software Link:...

EXPLOITING-CVE-2024-27956

Python script that exploits CVE-2024-27956, a vulnerability in Wordpress that allows SQL Injection leading to Remote Code Execution...

CVE-2020-13996

Exploit Title: Joomla J2 Store 3.3.11 - 'filterorderDir' SQL Injection Authenticated Date: 2020-04-17 Exploit Author: Mehmet Kelepçe / Gais Cyber Security Vendor Homepage: https://www.j2store.org/ Software Link: https://www.j2store.org/download.html Reference:...

CVE-2024-50972

CVE-2024-50972 Description A SQL injection vulnerability in printtool.php of Itsourcecode Construction Management System 1.0 allows remote attackers to execute arbitrary SQL commands via the borrowid parameter. Vulnerability Type SQL Injection Vendor of Product Itsourcecode Affected Product Code...

FreePBX-CVE-2025-57819-RCE

FreePBX 16 — Unauthenticated SQLi to RCE Proof-of-concept exploit chaining two FreePBX vulnerabilities to go from zero access to remote code execution on FreePBX 16. CVE| Component| Impact ---|---|--- CVE-2025-57819| Endpoint module loader brand parameter| Unauthenticated stacked SQL injection...

cve-2021-29442-Nacos-Derby-rce-exp

Introduction Nacos Derby command execution vulnerability exploitation script, by default uses User-Agent bypass to exploit the vulnerability Nacos is an open-source platform for service registration, discovery, and configuration management. In its early versions ≤2.4.0-BETA, Nacos integrates Apac...

wp2shell

wp2shell by: ek0ms savi0r Unauthenticated Remote Code Execution for WordPress Core POC CVE-2026-63030 + CVE-2026-60137 wp2shell exploit for a critical vulnerability chain in WordPress core. It chains a REST API batch route confusion bug with an SQL injection in WPQuery to achieve unauthenticated...

CVE-2022-37202

CVE-2022-37202 CVE-2022-37202 POC Suggested description JFinal CMS 5.1.0 is vulnerable to SQL Injection. Vulnerability Type SQL Injection Vendor of Product the development group Affected Product Code Base https://github.com/jflyfox/jfinalcms - JFinal CMS 5.1.0 Affected Component These interfaces...

CVE-2026-72898

🔴 CVE-2026-72898 - Unauthenticated SQL Injection Metabase — Unauthenticated SQL Injection → Full Administrator Takeover 📌 Overview CVE-2026-72898 is a maximum-severity CVSS 10.0 unauthenticated SQL injection vulnerability in Metabase that allows a remote attacker to inject arbitrary SQL into the...

CVE-2026-5076

☠️ CVE-2026-5076 ARMember Premium = 7.3.1 Insecure Password Reset Mechanism → Full Admin Account Takeover Plaintext Password Reset Keys Stored in Database + SQL Injection = Complete Admin Takeover 📋 Vulnerability Information Item| Detail ---|--- CVE ID| CVE-2026-5076 Plugin| ARMember – Membership...

CVE-2022-37207

CVE-2022-37207 CVE-2022-37207 POC Suggested description JFinal CMS 5.1.0 is affected by: SQL Injection. These interfaces do not use the same component, nor do they have filters, but each uses its own SQL concatenation method, resulting in SQL injection Additional Information...