CVE-2023-25157-GeoServer-SQLi-Lab

GeoServer & GeoTools SQL注入 CVE-2023-25157 & CVE-2023-25158 — 漏洞实验环境与PoC报告 漏洞实验环境（Vulnerable Lab）以及针对 GeoServer CVE-2023-25157 和 GeoTools CVE-2023-25158 库的 SQL注入（基于错误） 漏洞的详细利用分析报告。 详细分析与利用报告 请查看官方报告中的完整分析文档及每层的PoC截图： 👉 查看详细利用报告 REPORT.md （报告内容包括：CQL解析器与SQL转换器层的错误原理、OGC XML...

day05-grafana-sqlexpr-lab

第5天 – Grafana SQL表达式 → DuckDB本地文件包含CVE-2024-9264 TL;DR: 在受影响的Grafana 11.x版本中，已登录的查看者可以使用SQL表达式 。Grafana将表达式转发给服务器上的DuckDB 。利用readtext/readblob，可以读取本地文件本地文件包含。我们在/opt/flag.txt放置一个标志文件。 构建 → 运行 docker build -t day5-grafana . docker rm -f day5 2/dev/null || true docker run -d --name day5 -p 3000:300...

CVE-2026-4889

SQL injection SQLi vulnerability in the eLoanApp application, specifically in the POST parameter 'logina' of the user process endpoint '/ajax/users.php?op=verify'. The parameter is vulnerable to boolean-based and time-based SQL injection. Successfully exploiting this vulnerability would allow an...

CVE-2026-42416

Subscriber SQL Injection in UDesign Core = 4.15.0 versions...

CVE-2026-42415

Unauthenticated SQL Injection in Porto Theme - Functionality = 3.9.3 versions...

CVE-2026-42414

Subscriber SQL Injection in ListingPro = 2.9.12 versions...

CVE-2026-42417

Unauthenticated SQL Injection in ARMember Premium = 7.8 versions...

CVE-2026-41555

Unauthenticated SQL Injection in Newsletter Subscription Form – User Subscriptions Form, Capture Email = 1.5.9 versions...

CVE-2026-39795

Unauthenticated SQL Injection in SendPress Newsletters = 1.26.1.20 versions...

CVE-2026-39785

Unauthenticated SQL Injection in Gmedia Photo Gallery = 1.25.1 versions...

CVE-2026-39771

Subscriber SQL Injection in Buddyboss Platform = 3.1.0 versions...

CVE-2026-39764

Unauthenticated SQL Injection in Radius Booking — Booking Calendar for Appointments & Services = 1.0.19 versions...

CVE-2026-39747

Subscriber SQL Injection in Woffice = 5.4.35 versions...

CVE-2026-39746

Unauthenticated SQL Injection in Booknetic = 4.8.5 versions...

CVE-2026-32581

Subscriber SQL Injection in Mooberry Book Manager 4.16.2 versions...

CVE-2026-32580

Unauthenticated SQL Injection in WooCommerce Lottery = 2.2.9 versions...

CVE-2026-32557

Unauthenticated SQL Injection in WooCommerce Appointments = 5.3.2 versions...

CVE-2026-25434

Subscriber SQL Injection in WP2LEADS = 3.5.7 versions...

CVE-2026-105317

Subscriber SQL Injection in Paid Member Subscriptions = 3.1.1 versions...

CVE-2025-70149-SQL-Injection

CVE-2025-70149 — SQL注入研究项目 概述 安全研究项目，演示了CodeAstro Membership Management System v1.0中一个严重SQL注入漏洞（CVSS 9.8/10）CVE-2025-70149的利用与缓解措施。 CVE详情 字段| 值 ---|--- CVE ID| CVE-2025-70149 CVSS 评分| 9.8 严重 类型| SQL注入（CWE-89） 是否需要认证| 否 实验环境搭建 攻击机：Kali Linux 192.168.63.5 目标机：Windows 10 + XAMPP 192.168.63.6 工具：sqlm...