CVE-2024-10400

CVE-2024-10400 The Tutor LMS plugin for WordPress is vulnerable to SQL Injection via the 'ratingfilter' parameter in all versions up to, and including, 2.7.6 versions Note : The exploit uses a time-based blind SQL injection check with a 5-second delay threshold. If the response time exceeds 5...

CVE-2025-32429

CVE-2025-32429 – SQL Injection in PHP PDO Prepared Statements This repository contains a proof-of-concept exploit for CVE-2025-32429 , a vulnerability affecting PHP PDO prepared statements when emulation is enabled. 📄 References Original research by Assetnote:...

CVE-2022-39066

CVE-2022-39066 Firmware details: wainnerversion: BDPOSTEMF286RMODULEV1.0.0B12 crversion: CRITPOSTEMF286RV1.0.0B10 Prerequisites requests pip install requests SQL injection The vulnerability is a SQL injection present in the handler PHONEBLOCKADD in the webserver goahead binary. Possible exploits:...

CVE-2019-9053-POC

CMS Made Simple ⚠️ Disclaimer: This script is for educational and authorized testing purposes only. Do not use it on systems you do not own or have explicit permission to test. The author and contributors are not responsible for any misuse or damage caused by this tool. 🎯 What is this? This is a...

pharmacy-sqli-CVE-2026-7392

Pharmacy Sales and Inventory System 1.0 - CVE-2026-7392 SQL Injection SourceCodester Pharmacy Sales and Inventory System V1.0 pure PHP/MySQL version CVE : CVE-2026-7392 Endpoint : /ajax.php?action=deletesupplier id parameter Type : SQL Injection CWE-89 CVSS 3.1 : 6.3 Medium Author : oretnom23...

joomla-cve-2018-6396

Joomla-CVE-2018-6396 Joomla! Component Google Map Landkarten PoC cve-2018-6396...

Astra

Astra REST API penetration testing is complex due to continuous changes in existing APIs and newly added APIs. Astra can be used by security engineers or developers as an integral part of their process, so they can detect and patch vulnerabilities early during development cycle. Astra can...

CVE-2008-6970

DESCRIPTION Exploits PHP parameter input validation flaw and blindly brute force stored MD5 SQL hash for given user ID. FILE CVE-2008-6970.sh - Shell code program. SOURCE https://github.com/KyomaHooin/CVE-2008-6970...

wp2shell-poc

wp2shell 💙 Support the Project If you appreciate my work, consider supporting the project via USDT TRC20: TQBA72kakjCZLnJt8fJYcD7dyQCEpzNtVN WordPress Core Pre-Authentication RCE Chain wp2shell is a security research Proof-of-Concept demonstrating a pre-authentication vulnerability chain in...

CVE-2026-26980-PoC

CVE-2026-26980 — Ghost CMS Content API Blind SQL Injection Affected: Ghost 3.24.0 – 6.19.0 Fixed in: Ghost 6.19.1 Auth required: None — Content API key is public Impact: Unauthenticated read of the entire database credentials, API keys Vulnerability slug-filter-order.js interpolates user-supplied...

VulnLab

VulnLab A web vulnerability lab project developed by Yavuzlar. Logo Vulnerabilities SQL Injection Cross Site Scripting XSS Command Injection Insecure Direct Object References IDOR Cross Site Request Forgery CSRF XML External Entity XXE Insecure Deserialization File Upload File Inclusion Broken...

CVE-2025-58788

SINK: The searchProducts function does not validate input, leading to a SQL Injection vulnerability in the $term variable. The dropdownDataSearch function with $type= 'product' allows to control the $term variable while calling the searchProducts function. POC:...

CVE-2025-26198

🛡️ CVE Disclosure: CVE-2025-26198 — SQL Injection in CloudClassroom-PHP-Project Disclosure Date: 18 June 2025 CVE ID: CVE-2025-26198 Severity: CRITICAL CVSS 9.8 🧩 Summary A critical SQL Injection vulnerability exists in CloudClassroom-PHP-Project v1.0, specifically within the loginlinkadmin.php...

joomla.3.7.0exploit

CVE-2017-8917 Joomla SQLi PoC This repository contains a simple, CTF-friendly proof of concept PoC for the Joomla comfields SQL injection vulnerability CVE-2017-8917. The goal is to keep the workflow lightweight while still showing the full exploitation flow: detection, enumeration, and data...

poc-CVE-2019-9053

PoC CVE-2019-9053 - CMS Made Simple SQL Injection Educational PoC in Python 3 for CVE-2019-9053, a time-based blind SQL Injection vulnerability in CMS Made Simple = 2.2.9. This version has been modified for use in CTF/lab environments. It includes pre-configured prefixes to reduce extraction time...

CVE-2021-32099

CVE-2021-32099 PoC This repository provides a Proof of Concept PoC exploit for the CVE-2021-32099 vulnerability, affecting Pandora FMS 742. The exploit shows how an unauthenticated attacker can leverage a SQL injection vulnerability to escalate an unprivileged session to an administrator-level...

RedTeamBrasil-CVE-2025-64459

connector-sqli Automated SQL Injection exploitation in Django's ORM Q-object connector · CVE-2025-64459 🎥 RedTeam Brasil channel — offensive security, hands-on, in Portuguese. ██████╗ ████████╗██████╗ connector-sqli ██╔══██╗╚══██╔══╝██╔══██╗ Django Q connector SQLi ██████╔╝ ██║ ██████╔╝...

nginx_log_check

nginxlogcheck Nginx log security analysis script Features Top 20 address statistics SQL injection analysis Scanner alert analysis Vulnerability exploitation detection Sensitive path access File inclusion attack Webshell Find Top 20 URLs by response length Find rare script file access Find 302...

CVE-2025-61455

🛡️ CVE Disclosure: CVE-2025-61455 — SQL Injection in E-commerce Project Disclosure Date: 14 October 2025 CVE ID: CVE-2025-61455 Severity: CRITICAL CVSS 9.8 🧩 Summary A critical SQL Injection vulnerability exists in E-commerce Project v1.0, specifically within the signup.inc.php endpoint. The...

CVE-2024-55982

CVE-2024-55982 Share Buttons – Social Media = 1.0.2 - Unauthenticated SQL Injection Description The Share Buttons – Social Media plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 1.0.2 due to insufficient escaping on the user supplied parameter and lack of...