CVE-2026-63030

CVE-2026-63030: wp2shell استغلال حقن SQL أعمى عبر فك تزامن واجهة برمجة التطبيقات بالجملة في ووردبريس أداة إثبات المفهوم لاستخراج المستخدمين وهاشات كلمات المرور عبر الثغرة CVE-2026-63030 wp2shell. معلومات الثغرة CVE : CVE-2026-63030 wp2shell CVE مرافقة : CVE-2026-60137 النوع : حقن SQL أعمى بدون...

CVE-2020-35545

CVE-2020-35545 Spotweb 1.4.9 - 'search' SQL Injection...

CVE-2020-24913-PoC

CVE-2020-24913-PoC Un PoC para CVE-2020-24913, una vulnerabilidad de inyección SQL en qcubed todas las versiones incluida la 3.1.1 en profile.php a través del parámetro strQuery permite a un atacante no autenticado acceder a la base de datos inyectando código SQL mediante una solicitud POST...

CVE-2023-3047

Telegram : @ghostmans3c o @Chrome2024 Donar BTC : 17L22i227Keet23QCNaeCyrQ6xfiTQpQJ5 PoC Cómo Explotar CVE-2023-3047 Descripción Vulnerabilidad de neutralización inadecuada de elementos especiales usados en un comando SQL 'Inyección SQL' en TMT Lockcell permite la inyección SQL. Este problema...

CVE-2022-28171-POC

CVE-2022-28171-POC I originally published this on ExploitDB, which you can find at https://www.exploit-db.com/exploits/51607 Hikvision Hybrid SAN Ds-a71024 Firmware - Multiple Remote Code Execution Date: 16 July 2023 Exploit Author: Thurein Soe CVE : CVE-2022-28171 Reference Link:...

CVE-2026-60137-WordPress-Core-SQL-Injection-PoC

CVE-2026-60137 — WordPress Core SQL Injection PoC Non-destructive proof-of-concept and verification harness for CVE-2026-60137 , a blind SQL injection in WordPress core WPQuery::authornotin, reachable via the REST API's authorexclude parameter. Root Cause WPQuery::getposts builds SQL by...

CVE-2026-63030-WP2Shell

CVE-2026-63030 | WP2Shell xpl0ited by gr1tx WP2Shell is a Python-based Proof-of-Concept PoC for CVE-2026-63030. It performs time-based vulnerability verification against the WordPress Batch API and generates detailed HTML and JSON reports. The project is intended for authorized security...

WP2Shell

WP2Shell - CVE-2026-63030 / CVE-2026-60137 WordPress REST API Batch SQL Injection to RCE Full discovery and exploitation tool for WordPress REST API Batch endpoint vulnerability. This tool exploits a critical SQL injection vulnerability in the WordPress REST API /wp-json/batch/v1 endpoint, allowi...

CVE-2021-41648

CVE-2021-41648 CVE-2021-41648 SQL Injection in online-shopping-system The online-shopping-system is vulnerable to un-authenticated error/boolean-based blind & error based SQL Injection attacks. The proId parameter on the /action.php page does not sanitize the user input, an attacker can extract...

CVE-2023-49548

CVE-2023-49548 Customer Support System 1.0 - SQL Injection Vulnerability in the "lastname" Parameter During "saveuser" Operation Description : A SQL Injection vulnerability exists in version 1 of the Customer Support System. A malicious attacker can issue SQL commands to the MySQL database when...

watchTowr-vs-FreePBX-CVE-2025-57819

CVE-2025-57819 FreePBX Pre-Auth RCE FreePBX Pre-Auth RCE 1day Detection Artifact Generator Tool Detection in Action Detection Artifact Generator attempts to upload the php script or adds a new user if the upload fails. $ python3 watchTowr-vs-FreePBX-CVE-2025-57819.py -H http://freepbx.lab.local /...

CVE-2024-34220

Human Resource Management System Project in PHP and MySQL Free Source Code Submitter: Kha Do Vender: SourceCodester AFFECTED AND/OR FIXED VERSION Vulnerable File applyleave.php PROBLEM TYPE Vulnerability Type SQL Injection Impact The attackers can exploit this vulnerability to gain database...

AOSP-DownloadProviderDbDumper

AOSP-DownloadProviderDbDumper PoC Exploiting SQL Injection in Android's Download Provider CVE-2018-9493 Security Advisory https://ioactive.com/wp-content/uploads/2019/04/IOActive-Security-Advisory-Androids-Download-Provider-SQL-Injection-CVE-2018-9493.pdf More Information...

CVE-2024-34226

Sistema de Gestión de Visitantes 1.0 Remitente: Kha Do Vulnerabilidad Inyección SQL Descripción Vulnerabilidad de inyección SQL en /php-sqlite-vms/?page=managevisitor&id=1 en SourceCodester Visitor Management System 1.0 permite a los atacantes ejecutar comandos SQL arbitrarios a través del...

CVE-2024-27956

Wordpress SQLI-2-RCE Exploit Este script de Python explota CVE-2024-27956, una vulnerabilidad en Wordpress que permite inyección SQL que lleva a ejecución remota de código RCE. Características Explotación multi-hilo: Utiliza hilos concurrentes para explotar múltiples instancias de Wordpress...

CVE-2022-24124

POC for CVE-2022-24124 Exploit Code for CVE-2022-24124 aka Casdoor SQL Injection Exploit Links: ExploitDB-50792 PacketStormSecurity Expected outcome: Dump SQL database version on host running Casdoor 1.13.1 Intended only for educational and testing in corporate environments. Exploit Usage...

FortiWeb-CVE-2025-52970-Authentication-Bypass

🚨 FortiWeb Authentication Bypass → Remote Code Execution 📌 Overview This repository demonstrates an authentication bypass in FortiWeb that can be chained to achieve Remote Code Execution RCE. The exploit leverages a vulnerable endpoint to inject SQL payloads, upload a webshell, and execute comman...

Cisco-UCM-SQLi-Scripts

Scripts de CVE-2019-15972 Cisco UCM SQLi Scripts que se pueden usar para explotar CVE-2019-15972, un problema de SQLi autenticado en Cisco Unified Call Manager UCM. Enumerar tablas - enumera todas las tablas en la base de datos subyacente y coloca los nombres de las tablas en un archivo de texto...

wp2shell

CVE-2026-63030 + CVE-2026-60137 - "wp2shell": RCE غير مصادق عليه في نواة ووردبريس ارتباك مسار REST API CVE-2026-63030 متسلسل مع حقن SQL فيWPQuery authornotin CVE-2026-60137 → تنفيذ كود عن بُعد بدون مصادقة مسبقة على تثبيت ووردبريس افتراضي. مكتشف من قبل Adam Kues Assetnote / Searchlight Cyber، تم...

wordpress-CVE-2022-21661

wordpress-CVE-2022-21661 version5.8.3 ruta: http://your target/wp-admin/admin-ajax.php El tipo de inyección es fuera de banda, debes especificar tu propio dnslog y reemplazar ceye.io DATOS POST: "taxquery":"field":"termtaxonomyid","terms":"1 and ifselect loadfileconcat'\',select...