CVE-2026-96512

abraxaslabs.tech · github.com/abraxas · @abraxasnull · CVE-2026-96512 CVE-2026-96512 sudo 1.9.13p3 Debian bookworm — Sudo Project A flaw was found in sudo. When sudoers rules use NOTBEFORE or NOTAFTER time-based access restrictions with timestamps that omit the trailing Z timezone indicator, the...

EUVD-2026-91934

The WP 2FA WordPress plugin before 4.1.0 does not invalidate a time-based one-time passcode once it has been used, allowing an attacker who knows an account's password and has observed a valid code within its validity window to replay it and bypass two-factor authentication, including on...

ScanQLi

ScanQLi ScanQLi es un escáner simple de inyección SQL con algunas características adicionales. Esta herramienta no puede explotar la SQLi, solo las detecta. Probado en Debian 9 Características Clásico Ciego Basado en tiempo GBK próximamente Escaneo recursivo sigue todos los hrefs del sitio web...

msmailprobe

msmailprobe Office 365 and Exchange Enumeration It is widely known that OWA Outlook Webapp is vulnerable to time-based user enumeration attacks. This tool leverages all known, and even some lesser-known services exposed by default Exchange installations to enumerate users. It also targets Office...

msmailprobe

msmailprobe Enumeración de Office 365 y Exchange Es ampliamente conocido que OWA Outlook Webapp es vulnerable a ataques de enumeración de usuarios basados en tiempo. Esta herramienta aprovecha todos los servicios conocidos, e incluso algunos menos conocidos, expuestos por instalaciones...

CVE-2021-36396-Moodle-Time-Based-SQLi-Exploit

CVE-2021-36396 Exploit Description This repository holds a Python-based exploit targeting CVE-2021-36393, a severe vulnerability found within Moodle's recent courses feature. The flaw resides in the 'sort' parameter, enabling SQL injection attacks that can lead to unauthorized database access...

ghauri

Like Ghauri, consider supporting the developer Ghauri An advanced cross-platform tool that automates the process of detecting and exploiting SQL injection security flaws. Requirements Python 3 Python pip3 Installation cd to ghauri directory. install requirements: python3 -m pip install --upgrade ...

Blinder

Blinder Blidner es una pequeña biblioteca de Python para automatizar la inyección SQL ciega basada en tiempo mediante el uso de consultas predefinidas como funciones para automatizar el desarrollo rápido de PoC. Instalación Puedes instalar Blinder usando el siguiente comando: pip install blinder ...

CVE-2025-32429-Checker

CVE-2025-32429 Vulnerability Checker A Python-based vulnerability scanner for detecting CVE-2025-32429 SQL injection vulnerability in XWiki platforms. Features Single Target Scanning : Check individual targets with -t option Bulk Scanning : Scan multiple targets from a file with -l option WAF...

CVE-2026-94539

The SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent plugin for WordPress is vulnerable to time-based SQL Injection via the 'sortby' parameter in all versions up to, and including, 3.5.3 due to insufficient escaping on the user supplied parameter and lack of sufficient...

EUVD-2026-91879

The SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent plugin for WordPress is vulnerable to time-based SQL Injection via the 'sortby' parameter in all versions up to, and including, 3.5.3 due to insufficient escaping on the user supplied parameter and lack of sufficient...

sqlmap

sqlmap sqlmap is an open source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers. It comes with a powerful detection engine, many niche features for the ultimate penetration tester, and a broad range of switche...

CVE-2025-24799

CVE-2025-24799 SQLi Scanner A fast SQL injection vulnerability scanner built with Python. Uses time-based SQLi detection with multithreading and colorful output, designed for testing CVE-2025-24799 vulnerabilities. Features Scans single URLs or lists from files Shows vulnerable URLs live as they'...

CVE-2024-37843-POC

CVE-2024-37843-POC POC for CVE-2024-37843. Craft CMS time-based blind SQLi Details available in blog POC curl -X POST '/api/' -H 'Content-Type:application/json' -d '"query":"query IntrospectionQuery assetsorderBy: "assets.volumeId -- \\ \n \n LIMIT 5 AS subquery\nINNER JOIN assets assets ON...

CVE-2022-31061

CVE-2022-31061 PoC for GLPI CVE-2022-31061 A Proof of Concept for GLPI = 9.3.0 and 10.0.2 - Unauthenticated SQL injection on login page Legal disclaimer : Use of this script for attacking à target without mutual consent is illegal. It's is the end user responsibility to obey all applicables laws...

CVE-2018-8097-PoC

CVE-2018-8097 POC for CVE-2018-8097 This script exploits CVE-2018-8097 and can retrieve files and contents using a time based blind RCE method. Usage python cve-2018-8097.py -h -u URL -c COMMAND -t TIME -id OBJECTID -d FILEPATH options: -h, --help show this help message and exit -u, --url URL...

CVE-2025-50867

Existe una vulnerabilidad de inyección SQL en el endpoint takeassessment2.php de CloudClassroom-PHP-Project 1.0, donde el parámetro POST Q5 se inserta directamente en sentencias SQL sin desinfección. Tipo de Vulnerabilidad : Inyección SQL Proveedor del Producto :...

Jeeves

Jeeves Uso • Instalación Jeeves está hecho para buscar Inyecciones SQL Ciegas Basadas en Tiempo durante el reconocimiento. Contenido: Instalación Uso Agregar Cabeceras Usar Proxy Hacer Petición POST Múltiples formas de uso - Instalación y Requisitos: Instalando Jeeves 💀 $ go install...

CVE-2025-56380

CVE-2025-56380 — Time-based Blind SQL Injection in Frappe / ERPNext frappe.client.getvalue 📌 Summary A time-based blind SQL injection vulnerability was discovered in the frappe.client.getvalue API endpoint in Frappe Framework v15.72.4 and present in ERPNext v15.67.0 codebase. An authenticated use...

CVE-2024-6028-Poc

CVE-2024-6028-Poc CVE-2024-6028 Quiz Maker method getquestionscategories image image image Poc POST /wp-admin/admin-ajax.php HTTP/1.1 Host: Accept-Encoding: gzip, deflate Accept: / Accept-Language: en-US;q=0.9,en;q=0.8 User-Agent: Mozilla/5.0 Windows NT 10.0; Win64; x64 AppleWebKit/537.36 KHTML,...