CVE-2020-15394-PoC

CVE-2020-15394 DBMS: MSSQL TRUE condition in sql query POST /AppManager/json/ApmAdminServices/checkResourceID HTTP/1.1 Host: redacted.com Content-Type: application/x-www-form-urlencoded Content-Length: 67 resourceIds=1+AND+SELECT+CASE+WHEN+1=1+THEN+1+ELSE+1/0+END=1-- HTTP/1.1 200 Set-Cookie:...

CVE-2023-51801

CVE-2023-51801 Simple Student Attendance System v.1.0 - Multiple SQL injection vulnerabilities - studentform.php and classform.php Description :Simple Student Attendance System v.1.0 is prone to multiple SQL injection vulnerabilities that can be exploited by authenticated attackers. These...

CVE-2024-27956

CVE-2024-27956 Note Build wordpress: docker-compose -f stack.yml up Install plugin: 1. WordPress dashboard, choose Plugins Add New 2. Click Upload Plugin 3. Choose File - wp-automatic.zip - Install Now 4. After the installation is complete, click Activate Plugin Exploit...

cve-2020-9006

CVE-2020-9006: Wordpress Popup-Builder Plugin Exploit Usage: Create and upload payload Also see: php create-serialized-payload.php -h $ php create-serialized-payload.php | curl -F 'sprunge=-' http://sprunge.us http://sprunge.us/XXXXXX Run exploit $ nmap --script ./cve-2020-9006 --script-args...

CVE-2026-24031

CVE-2026-24031: Dovecot SQL authentication bypass authentication + user enumeration This repository contains a proof-of-concept authentication-bypass exploit for CVE-2026-24031 , a SQL injection in Dovecot's SQL-based authentication introduced as a regression in Dovecot 2.4.0 / 3.1.0. In the test...

FreePBX-SQLi-Exploit-Privilege-escalation

FreePBX: From Unauthenticated SQL Injection to Root Shell CVE-2025-57819 • FreePBX 16.0.40.7 • HTB Connected 📋 Executive Summary This walkthrough documents the complete compromise of the HTB machine Connected. The attack chain begins with an unauthenticated SQL injection vulnerability in FreePBX,...

CVE-2025-58780

CVE-2025-58780 Vulnerability Disclosure: SQL Injection in ScienceLogic Overview This document outlines a responsibly disclosed SQL injection vulnerability found in ScienceLogic's web platform. The vulnerability has been reported to the project maintainers in accordance with responsible disclosure...

CVE-2025-57819

CVE-2025-57819 - FreePBX 16 Endpoint Manager unauthenticated SQL injection to RCE Unauthenticated stacked SQL injection in the FreePBX Endpoint Manager module admin/ajax.php, brand parameter, CVE-2025-57819, affecting FreePBX framework --vhost --root --cmd How it works 1. Confirm the SQL injectio...

CVE-2025-6970

CVE-2025-6970 Events Manager = 7.0.3 - Unauthenticated SQL Injection via orderby Parameter Description The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to time-based SQL Injection via the ‘orderby’ parameter in all versions up to, and including, 7.0.3...

CVE-2025-24587

CVE-2025-24587 1️⃣ Component type WordPress plugin 2️⃣ Component details Component name Email Subscription Popup Vulnerable version = 1.2.23 Component slug email-subscribe Component link https://wordpress.org/plugins/email-subscribe/ 3️⃣ OWASP 2017: TOP 10 Vulnerability class A3: Injection...

CVE-2024-32369

CVE-2024-32369 Description: SQL Injection vulnerability in HSC Cybersecurity HSC Mailinspector v.5.2.17-3 allows a remote attacker to obtain sensitive information via a crafted payload to the start and limit parameter in the mliWhiteList.php component. Versions: Discovered in HSC Mailinspector...

CVE-2024-55270

Student Management System 1.0 CVE-2024-55270 Overview The Student Management System SMS is a web application developed using PHP and MySQL for managing student information. This repository contains the source code and details of the system, along with a security vulnerability report. Auditor:...

CVE-2024-3495-Poc

CVE-2024-3495-Poc CVE-2024-3495 Country State City Dropdown CF7 Accept-Encoding: gzip, deflate Accept: / Accept-Language: en-US;q=0.9,en;q=0.8 User-Agent: Mozilla/5.0 Windows NT 10.0; Win64; x64 AppleWebKit/537.36 KHTML, like Gecko...

Microfinance-Management-System-V1.0-SQL-Injection-Vulnerability-Unauthenticated

Microfinance Management System V1.0 SQL Injection Vulnerability Unauthenticated 1. Description: Microfinance Management System allows SQL Injection via parameter 'customernumber' in /mims/updatecustomer.php. Exploiting this issue could allow an attacker to compromise the application, access or...

CVE-2016-10204_Webshell

CVE-2016-10204Webshell A bash script demonstrating the manual exploitation of CVE-2016-10204 against a target endpoint, leading to upload of a php webshell. Currently, the webshell variable is set for a MySQL payload. This can be replaced with whatever backend you need to target. More information...

CVE-2026-72550-poc

CVE-2026-72550 — Friendica Unauthenticated SQL Injection Unauthenticated stacked-query SQL injection in the photos endpoint in Friendica allows any visitor to run arbitrary SQL. Field| Value ---|--- CVE ID| CVE-2026-72550 Product| Friendica self-hosted federated social network Affected| =...

CVE-2024-57521-RuoYi-SQLi

🛡️ CVE-2024-57521 RuoYi-Vue Post-Authentication SQL Injection Vulnerability Audit Notes Figure 1: CVE-2024-57521 SQL Injection Vulnerability Data Flow Audit Diagram 0. Project Statement This repository is intended for security research and educational purposes only. Do not use the techniques in...

CVE-2021-24959

CVE-2021-24959 Description The WP Email Users WordPress plugin through 1.7.6 does not escape the dataraw parameter in the weuselectedusers1 AJAX action, available to any authenticated users, allowing them to perform SQL injection attacks. CVE CVE-2021-24959 CVSS 8.8 High Publicly Published Januar...

CVE-2024-27956

Wordpress SQLI-2-RCE Exploit This Python script exploits CVE-2024-27956, a vulnerability in Wordpress that allows for SQL Injection leading to Remote Code Execution RCE. Features Multi-threaded Exploitation: Utilizes concurrent threads to exploit multiple Wordpress instances simultaneously. Dynam...

AOSP-DownloadProviderDbDumper

AOSP-DownloadProviderDbDumper PoC Exploiting SQL Injection in Android's Download Provider CVE-2018-9493 Security Advisory https://ioactive.com/wp-content/uploads/2019/04/IOActive-Security-Advisory-Androids-Download-Provider-SQL-Injection-CVE-2018-9493.pdf More Information...