ghauri

Like Ghauri, consider supporting the developer Ghauri An advanced cross-platform tool that automates the process of detecting and exploiting SQL injection security flaws. Requirements Python 3 Python pip3 Installation cd to ghauri directory. install requirements: python3 -m pip install --upgrade ...

CVE-2022-31061

CVE-2022-31061 GLPI CVE-2022-31061 的 PoC 针对 GLPI = 9.3.0 且 10.0.2 的 Proof of Concept – 登录页面上的未授权 SQL 注入 法律免责声明： 未经双方同意使用此脚本攻击目标是违法的。 最终用户有责任遵守其所在地的所有适用法律。 开发者不承担任何责任，也不对因使用本程序而导致的任何误用或损害负责。 背景： 公开披露：https://github.com/glpi-project/glpi/security/advisories/GHSA-w2gc-v2gm-q7wq 于 2022-06-28...

CVE-2024-51482-ZoneMinder-CCTV-HTB-Reliable-EXP

README Hackthebox 机器：CCTV 应用程序：ZoneMinder 描述 对同一字符执行多次基于时间的盲注，并选择出现最频繁的结果，可显著减少错误并提高可靠性，尽管这非常耗时。...

CVE-2019-10708

Scms - SQL Injection exploit.py是對於CVE-2019-10708漏洞的PoC，實現multiprocessing進行注入，取得資料庫名稱與後台管理員帳密建議是20190401前的版本 Usage 測試是否可注入 python3 exploit.py http:localhost/js/scms.php --test sleep時間為60秒與取得資料庫 python3 exploit.py http:localhost/js/scms.php -s 60 --db 取得Alogin與Apwd python3 exploit.py...

CVE-2026-63030-CVE-2026-60137-wp2shell-poc

wp2shell — WordPress REST API 时间盲SQL注入 → RCE 概念验证 描述 pocwptot.py 是一个概念验证（PoC），用于利用 WordPress REST API 批量端点上的时间盲SQL注入漏洞，并通过链式升级实现远程代码执行（RCE）。 被测试的漏洞： CVE-2026-63030 CVE-2026-60137 重要警告 仅将此工具用于您拥有或拥有明确书面许可进行测试的系统。滥用可能导致非法和破坏性后果。 作者：GhostGTR666 github.com/gagaltotal PoC 版本：1.0.0 要求 Python 3.8+（推荐）...

TimeInjector

TimeInjector Time injector is a CVE-2018-14714 exploitation script in bash To tell if the target is vulnerable, the script works by first checking if the target is accessible and if it can establish a login session. After that, it checks for the existence of specific pages and performs a time-bas...

CVE-2026-96673

Versions of Photoview prior to 2.4.0 are vulnerable to an SQL injection flaw within the album download route. The root cause is the improper handling of the album_id path segment, which allows unauthenticated attackers to inject crafted SQL expressions. Successful exploitation enables attackers t...

CVE-2026-96673 Photoview through 2.4.0 SQL Injection via album download route

Photoview through 2.4.0 contains an SQL injection vulnerability in the album download route that allows unauthenticated attackers to inject SQL by manipulating the albumid path segment. Attackers can supply crafted SQL expressions in the albumid parameter to extract arbitrary data from the databa...

EUVD-2026-85345

Photoview through 2.4.0 contains an SQL injection vulnerability in the album download route that allows unauthenticated attackers to inject SQL by manipulating the albumid path segment. Attackers can supply crafted SQL expressions in the albumid parameter to extract arbitrary data from the databa...

CVE-2026-96673: Improper Neutralization of Special Elements used in an SQL Command

Photoview through 2.4.0 contains an SQL injection vulnerability in the album download route that allows unauthenticated attackers to inject SQL by manipulating the albumid path segment. Attackers can supply crafted SQL expressions in the albumid parameter to extract arbitrary data from the databa...

Astra Linux – Vulnerability in Zabbix

The Zabbix server can execute commands for configured scripts. After the command is executed, an audit entry is added to the “Audit Log”. Since the “clientip” field is not sanitized, it is possible to inject SQL code into the “clientip” field, resulting in time-based blind SQL injection attacks...

CVE-2026-72608 Koha Community Koha - Stored SQL Injection via Patron Card Layout image_name

A stored SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the tools = labelcreator permission to execute arbitrary SQL via the imagename field of a patron card layout. The imagename value is stored verbatim in the layout XML an...

CVE-2026-71287

Cacti's sanitizesqlcolumn lib/functions.php sanitizes user-supplied ORDER BY column names using the regex . Because this allowlist retains letters, digits, underscore, parentheses, and dot intended to support expressions like COUNTid and table.column, a payload such as passes through completely...

CVE-2026-71288 Koha SQL Injection via order_by and {order}_ovalue Parameters in guided_reports.pl

Koha's guided report builder reports/guidedreports.pl reads the CGI parameter and, for each value, a dynamically-named parameter, and concatenates both directly into an SQL ORDER BY clause with no allowlist or validation. Since ORDER BY columns cannot be bound via prepared-statement placeholders,...

CVE-2026-71287

Cacti CVE-2026-71287 involves a flaw in sanitize_sql_column() in lib/functions.php. The function filters ORDER BY column names with preg_replace('/[^a-zA-Z0-9_().]/', '', $column), which leaves letters, digits, underscore, parentheses, and dot. This allows payloads like SLEEP(5) to pass unmodifie...

CVE-2026-15360 Ajax Load More < 8.0.1 - Unauthenticated SQL Injection via custom_args

The Ajax Load More WordPress plugin before 8.0.1 does not properly sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated attackers to perform time-based blind SQL injection and extract sensitive data from the database...

📄 LiteLLM 1.83.6 Blind SQL Injection

A proof of concept exploit for a pre-authentication blind SQL injection vulnerability in LiteLLM version 1.83.6. The vulnerability affects LiteLLM proxy versions 1.81.16 through 1.83.6 and occurs because the virtual-key lookup interpolates an unauthenticated bearer token directly into a PostgreSQ...

CVE-2026-15018

The Database Collation Fix plugin for WordPress is vulnerable to time-based SQL Injection via the 'force-collation-algorithm' parameter in all versions up to, and including, 1.2.10 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

CVE-2026-15018 Database Collation Fix <= 1.2.10 - Unauthenticated SQL Injection via 'force-collation-algorithm' Parameter

The Database Collation Fix plugin for WordPress is vulnerable to time-based SQL Injection via the 'force-collation-algorithm' parameter in all versions up to, and including, 1.2.10 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

PT-2026-65700

A pre-authentication blind SQL injection vulnerability in Koollab LMS allowed an unauthenticated attacker to use a time-based SQL oracle via the SSO OAuth endpoint to read sensitive database contents, including personally identifiable information, credentials, and valid JWT tokens that may enable...