cve-2025-25257

CVE-2025-25257 - Experimentation Environment Experiment Architecture the environment simulates vulnerable FortiWeb components Vulnerable endpoint: /api/system/fabric/config Injection vector: HTTP Header Authorization: Bearer Mechanism: Direct SQL concatenation Python f-string Authentication: None...

SafeLine

SafeLine - Make your web apps secure 🏠 Website | 📖 Docs | 🔍 Live Demo | 🙋‍♂️ Discord | 中文版 👋 INTRODUCTION SafeLine is a self-hosted WAFWeb Application Firewall to protect your web apps from attacks and exploits. A web application firewall helps protect web apps by filtering and monitoring HTTP...

CVE-2026-114255

A security flaw exists in the User Account Management component of oretnom23 file-management-system-php (up to commit 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4). The vulnerability is located in the save_user function within the admin_class.php file, where improper handling of the name/username/pas...

CVE-2026-114255 oretnom23 file-management-system-php User Account Management admin_class.php save_user sql injection

A security flaw has been discovered in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. This impacts the function saveuser of the file adminclass.php of the component User Account Management. The manipulation of the argument name/username/password/type/id resul...

EUVD-2026-107325

A security flaw has been discovered in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. This impacts the function saveuser of the file adminclass.php of the component User Account Management. The manipulation of the argument name/username/password/type/id resul...

commend_sqli

CVE-2023-XXXXX Suggested description G8-VOIPREC Commend VoIPRec web interface is vulnerable to time-base blind SQL injections in "Code" parameter on login page. Additional Information PoC: POST /cgi-bin/SecComRecX.cgi HTTP/1.1 Host: 192.168.88.10 User-Agent: Mozilla/5.0 X11; Linux x8664; rv:109.0...

CVE-2026-114251

A vulnerability has been found in itsourcecode Sales-and-Inventory-System up to 0a3c45a78aaff3601b8cf9ce8ba82ff5c345caac. Impacted is an unknown function of the file /pages/custdel.php. Such manipulation of the argument ID leads to sql injection. The attack can be launched remotely. The exploit h...

CVE-2026-114252

A vulnerability was found in itsourcecode Sales-and-Inventory-System up to 0a3c45a78aaff3601b8cf9ce8ba82ff5c345caac. The affected element is an unknown function of the file /pages/custsearchfrm.php. Performing a manipulation of the argument ID results in sql injection. The attack may be initiated...

CVE-2026-111852

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in WPdreams Ajax Search Lite ajax-search-lite allows Blind SQL Injection.This issue affects Ajax Search Lite: from n/a through 4.14.6...

CVE-2026-114250

A flaw has been found in itsourcecode Sales-and-Inventory-System up to 0a3c45a78aaff3601b8cf9ce8ba82ff5c345caac. This issue affects some unknown processing of the file /pages/custedit.php. This manipulation of the argument ID causes sql injection. The attack can be initiated remotely. The exploit...

CVE-2026-114254

A SQL injection vulnerability exists in the Login function of the admin_class.php file within oretnom23 file-management-system-php (up to commit 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4). An attacker can manipulate the username or password arguments to execute arbitrary SQL commands. Remote explo...

CVE-2026-114254 oretnom23 file-management-system-php admin_class.php login sql injection

A vulnerability was identified in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. This affects the function Login of the file adminclass.php. The manipulation of the argument username/password leads to sql injection. Remote exploitation of the attack is...

EUVD-2026-107323

A vulnerability was identified in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. This affects the function Login of the file adminclass.php. The manipulation of the argument username/password leads to sql injection. Remote exploitation of the attack is...

loxs-optimized

loxs-optimized Project from https://github.com/coffinxp/loxs CSP-Bypass-xss.txt Note: It mainly bypasses the CSP payload 2024-11-06 Add CSP-Bypass-xss.txt to xss.txt 2024-11-07 Removing interfering information Only the vulnerable information is displayed 2024-11-11 Solves the problem that the...

Exploits

Exploits Real world and CTFs exploit POCs. Real World CVE| Short description| Exploit ---|---|--- CVE-2017-5343| Wordpress SQL Injection| POC CVE-2018-8880| Unauthenticated Lutron Quantum Bacnet v2 network info exfiltration| POC CVE-2018-11629| Default and unremovable credentials in Homeworks QS...

CVE-2026-114252

A SQL injection vulnerability exists in the itsourcecode Sales-and-Inventory-System (up to commit 0a3c45a78aaff3601b8cf9ce8ba82ff5c345caac) within an unknown function of the /pages/cust_searchfrm.php file. An attacker can initiate a remote attack by manipulating the ID argument to execute unautho...

CVE-2026-114252 itsourcecode Sales-and-Inventory-System cust_searchfrm.php sql injection

A vulnerability was found in itsourcecode Sales-and-Inventory-System up to 0a3c45a78aaff3601b8cf9ce8ba82ff5c345caac. The affected element is an unknown function of the file /pages/custsearchfrm.php. Performing a manipulation of the argument ID results in sql injection. The attack may be initiated...

EUVD-2026-107287

A vulnerability was found in itsourcecode Sales-and-Inventory-System up to 0a3c45a78aaff3601b8cf9ce8ba82ff5c345caac. The affected element is an unknown function of the file /pages/custsearchfrm.php. Performing a manipulation of the argument ID results in sql injection. The attack may be initiated...

exploits

exploits Published PoCs can be found at exploitdb.com Patient Appointment Scheduler System v1.0: Inbit Messenger v4.6.0:...

CVE-2023-24203-and-CVE-2023-24204

CVE-2023-24203-and-CVE-2023-24204 Introduction In the ever-evolving landscape of cybersecurity, web applications remain a prime target for attackers seeking to exploit vulnerabilities. Recently, two critical vulnerabilities were discovered in the SourceCodester Simple Customer Relationship...