873 matches found
CVE-2026-108107 PHPNuxBill through 2025.3.20 Unauthenticated SQL Injection via radius.php
PHPNuxBill through 2025.3.20 contains an unauthenticated SQL injection vulnerability in the radius.php FreeRADIUS REST endpoint that interpolates request parameters into whereRaw queries. Attackers can send crafted username, macAddr or nasid parameters to the accounting or authenticate actions to...
CVE-2019-9053
CVE 2019-9053 Detail Description This code is an implementation of a Time-Based Blind SQL Injection attack in Python 3. The attack is designed to exploit a SQL injection vulnerability in a Content Management System CMS Made Simple 2.2.8 through an HTTP request. Exploit Use: exploit.py -u...
sqlmap
sqlmap sqlmap is an open source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers. It comes with a powerful detection engine, many niche features for the ultimate penetration tester, and a broad range of switche...
CVE-2025-56380
CVE-2025-56380 — Time-based Blind SQL Injection in Frappe / ERPNext frappe.client.getvalue 📌 Summary A time-based blind SQL injection vulnerability was discovered in the frappe.client.getvalue API endpoint in Frappe Framework v15.72.4 and present in ERPNext v15.67.0 codebase. An authenticated use...
Jeeves
Jeeves Usage • Installation Jeeves is made for looking to Time-Based Blind SQLInjection through recon. Contents: Installation Usage Adding Headers Using Proxy Making Post Request Multiple ways of usage - Installation & Requirements: Installing Jeeves 💀 $ go install...
CVE-2024-55981
CVE-2024-55981 Nabz Image Gallery = v1.00 - Unauthenticated SQL Injection Description The Nabz Image Gallery plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, v1.00 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation o...
WordPress-NotificationX-CVE-2024-1698
Set-up docker-compose up --build Clean up docker-compose down Testing Measure-Command curl.exe http://localhost/wp-json/notificationx/v1/analytics -Method Post -Body 'nxid=1337&type=clicks=IFASCIISUBSTRINGselect userpass from wpusers where id=1,1,1=36,SLEEP10,null-- -'...
Spam protection, AntiSpam, FireWall by CleanTalk < 5.153.4 - Unauthenticated Blind SQL Injection
It was possible to exploit an Unauthenticated Time-Based Blind SQL Injection vulnerability in the Spam protection, AntiSpam, FireWall by CleanTalk WordPress Plugin before 5.153.4. The updatelog function in lib/Cleantalk/ApbctWP/Firewall/SFW.php included a vulnerable query that could be injected v...
Geo Mashup <= 1.13.18 - SQL Injection
Geo Mashup WordPress plugin = 1.13.18 is vulnerable to time-based SQL injection via the sort parameter. The issue exists because the sort value is insufficiently sanitized in render-map.php/template tag code paths. id: CVE-2026-4060 info: name: Geo Mashup = 1.13.18 - SQL Injection author:...
phpMyFAQ <= 4.1.1 - SQL Injection
phpMyFAQ before 4.1.2 contains an unauthenticated SQL injection vulnerability in BuiltinCaptcha::garbageCollector and BuiltinCaptcha::saveCaptcha methods that interpolate unsanitized User-Agent headers into DELETE and INSERT queries. Unauthenticated attackers can exploit the public GET /api/captc...
CVE-2025-28346
Vulnerability Type SQL Injection Description A Time-Based Blind SQL Injection vulnerability was discovered in Ticket-Booking-App - 1.0 that allows an attacker to execute arbitrary SQL queries on the underlying database. The vulnerable parameter does not properly sanitize user-supplied input,...
CVE-2024-37843-POC
CVE-2024-37843-POC POC for CVE-2024-37843. Craft CMS time-based blind SQLi Details available in blog POC curl -X POST '/api/' -H 'Content-Type:application/json' -d '"query":"query IntrospectionQuery assetsorderBy: "assets.volumeId -- \\ \n \n LIMIT 5 AS subquery\nINNER JOIN assets assets ON...
CVE-2024-37791
CVE-2024-37791 CVE-2024-37791 Project address: Preparatory work: Log in to the backend - get cookie Vulnerability URL: http://127.0.0.1:8093/s/article/Content/index?classid=&keyword= Vulnerability parameter: keyword payload: %27andselectfromselect+ifasciisubstrdatabase,1,1%3E97,sleep1,0a//union/...
CVE-2026-24417
CVE-2026-24417: OpenSTAManager has a Time-Based Blind SQL Injection with Amplified Denial of Service Overview Field| Details ---|--- CVE ID| CVE-2026-24417 Severity| HIGH Advisory| View Advisory Discovered by| Lukasz Rybak Affected Products devcode-it/openstamanager versions: 2.9.8 CWE...
CVE-2026-24416
CVE-2026-24416: OpenSTAManager has a Time-Based Blind SQL Injection in Article Pricing Module Overview Field| Details ---|--- CVE ID| CVE-2026-24416 Severity| HIGH Advisory| View Advisory Discovered by| Lukasz Rybak Affected Products devcode-it/openstamanager versions: = 2.9.8 CWE Classification...
Exploit-CVE-2023-6063-PoC-Vuln
CVE-2023-6063 — WP Fastest Cache SQL Injection PoC -red Proof of Concept PoC for CVE-2023-6063 , an unauthenticated, time-based blind SQL injection vulnerability affecting WP Fastest Cache ≤ 1.2.2. The vulnerability can be triggered through the wordpressloggedin cookie and may allow an attacker t...
CVE-2024-35584
CVE-2024-35584 OpenSIS Authenticated SQL Injection Description There exists a SQL injection vulnerability in Ajax.php, ForWindow.php, ForExport.php, Modules.php, functions/HackingLogFnc.php. This finding affects OpenSis Community Edition 9.1 to 8.0 and possibly versions below. Proof of Concept In...
CVE-2025-24799
CVE-2025-24799 Auto Exploit ⚡ Overview CVE-2025-24799 is a proof-of-concept PoC exploit targeting GLPI. This exploit demonstrates unauthenticated SQL Injection time-based blind to extract user credentials. Disclaimer: This PoC is for educational purposes only. Do not use on systems without...
commend_sqli
CVE-2023-XXXXX Descripción sugerida La interfaz web de G8-VOIPREC Commend VoIPRec es vulnerable a inyecciones SQL ciegas basadas en tiempo en el parámetro "Code" de la página de inicio de sesión. Información adicional PoC: POST /cgi-bin/SecComRecX.cgi HTTP/1.1 Host: 192.168.88.10 User-Agent:...