BinGoo

,--="=--, / ." .-. "./ / ,/ : : /\ \ | /o\ :: /o\ | / -'| :=" "=: | \ / .-"-. \ | / .-"-. .--- --| /,.-'-.,\ |-- ---. /-===- / | / | | | | | | ' | | / \ / | | | | | | | | | | | | | || |/| || | || / / '-----v1--------------By-Hood3dRob1n----' Welcome to the BinGoo README file! This should give you...

w3af

w3af - Web Application Attack and Audit Framework w3af is an open source web application security scanner which helps developers and penetration testers identify and exploit vulnerabilities in their web applications. The scanner is able to identify 200+ vulnerabilities, including Cross-Site...

CVE-2025-25257

CVE-2025-25257 CVE‑2025‑25257 is a critical pre-authentication SQL injection vulnerability affecting Fortinet FortiWeb’s Fabric Connector component. It impacts FortiWeb versions: 7.6.0–7.6.3 7.4.0–7.4.7 7.2.0–7.2.10 ≤ 7.0.10 Technical Details The issue resides in the getfabricuserbytoken function...

TarantuBench

TarantuBench v1 A benchmark for evaluating AI agents on web security challenges, generated by the TarantuLabs engine. What is this? TarantuBench is a collection of 100 vulnerable web applications, each containing a hidden flag TARANTU.... An agent's job is to find and extract the flag by...

TraditionalJay

TraditionalJay Intentionally vulnerable classic / traditional shop for security workshops — Java on a VM EC2, Azure VM, or GCP Compute Engine, not containers. Primary story: Critical VM Compromise — SQL injection → Log4Shell CVE-2021-44228 → reverse shell to external C2. !CAUTION Do not deploy to...

CVE-2026-93300

CVE-2026-93300 — EventON - Subscriber ≤ 1.4.5 Unauthenticated SQLi PoC Python proof-of-concept for CVE-2026-93300 : unauthenticated SQL injection via the email parameter in the EventON - Subscriber WordPress plugin Wordfence, CVSS 7.5 High. | ---|--- CVE| CVE-2026-93300 Plugin| EventON - Subscrib...

EUVD-2026-125822

A flaw has been found in projectworlds Visitor Management System 1.0. This vulnerability affects the function mysqliquery of the file actionpage.php. This manipulation of the argument purpose causes sql injection. It is possible to initiate the attack remotely. The exploit has been published and...

CVE-2026-57517-CWP

CVE-2026-57517 CWP Exploit This repository contains a Go-based proof-of-concept tool for testing a known Control Web Panel CWP vulnerability scenario related to CVE-2026-57517. The implementation targets a blind SQL injection path and includes optional webshell deployment and command execution fl...

wp2shell

wp2shell — WordPress Core Pre-Auth RCE CVE-2026-63030 Batch Route Confusion, CVSS 7.5 + CVE-2026-60137 SQL Injection, CVSS 9.1 A pre-authentication remote code execution chain in WordPress Core that requires no plugins, no special configuration, and works on default installs. Affected Versions...

CVE-2025-68400

CVE-2025-68400: ChurchCRM vulnerable to time-based blind SQL Injection in ConfirmReportEmail.php Overview Field| Details ---|--- CVE ID| CVE-2025-68400 Severity| CRITICAL Advisory| View Advisory Discovered by| Lukasz Rybak Affected Products ChurchCRM/CRM Details Summary A critical SQL Injection...

jsql-injection

Description jSQL Injection is a lightweight application used to find database information from a server. It's free , open source and cross-platform for Windows, Linux and Mac, and it works with Java from version 21 to 25. jSQL Injection is also part of the official penetration testing distributio...

CVE-2026-88854

CVE-2026-88854 — OrdaSoft Joomla Gallery SQL Injection Python 3 PoC scanner/exploit for CVE-2026-88854 in OrdaSoft OS Responsive Image Gallery for Joomla. | ---|--- Component| comosgallery, comosgallerylight Affected| 1.0.0 – 6.2.6 Fixed in| 6.2.7+ CVSS 4.0| 9.3 Critical Auth| None public...

WebGoat.NET

Webgoat.NET Source Code: https://github.com/jerryhoff/WebGoat.NET Download zip: https://github.com/jerryhoff/WebGoat.NET/zipball/master This web application is a learning platform that attempts to teach about common web security flaws. It contains generic security flaws that apply to most web...

ghauri

Like Ghauri, consider supporting the developer Ghauri An advanced cross-platform tool that automates the process of detecting and exploiting SQL injection security flaws. Requirements Python 3 Python pip3 Installation cd to ghauri directory. install requirements: python3 -m pip install --upgrade ...

VulnLab

VulnLab A web vulnerability lab project developed by Yavuzlar. Logo Vulnerabilities SQL Injection Cross Site Scripting XSS Command Injection Insecure Direct Object References IDOR Cross Site Request Forgery CSRF XML External Entity XXE Insecure Deserialization File Upload File Inclusion Broken...

Tiredful-API

What is Tiredful API? Tiredful API is intentionally designed broken app. The aim of this web app is to teach developers, QA or security professionals about flaws present in webservices REST API due to insecure coding practice. Who can use Tiredful API? Web developers Web Pentesters Security...

CVE-2023-20110

CVE-2023-20110 PoC script for CVE-2023-20110 - Cisco Smart Software Manager On-Prem SQL Injection Vulnerability Usage 1. Update IP address and admin cookies in script, 2. Run the script with the following command: python3 exploit.py...

sqlmap-ai

SQLMap AI Assistant An AI-powered wrapper around SQLMap that makes SQL injection testing more accessible and automated. Features Core Features AI-Assisted Testing - Intelligent vulnerability analysis and recommendations Adaptive Testing - Step-by-step testing that adapts to target responses...

CVE-2026-57517

Control Web Panel ≤ 0.9.8.1224 — Blind SQL Injection to Remote Code Execution Port 2083 → userRes POST → INTO DUMPFILE → Port 2031 Webshell → cwpsvc 🔴 Vulnerability Overview CVE-2026-57517 is a critical pre-authentication blind SQL injection in Control Web Panel CWP versions ≤ 0.9.8.1224. The...

WordPresShell

WordPresShell Pre-auth RCE PoC for CVE-2026-63030 + CVE-2026-60137 WordPress core. REST /batch/v1 route confusion → WPQuery authornotin SQLi → unauthenticated admin creation → webshell. Single file, Python stdlib only. Vulnerability: Adam Kues Searchlight Cyber. Affected: 6.9.0–6.9.4, 7.0.0–7.0.1...