CVE-2025-68400

CVE-2025-68400: ChurchCRM vulnerable to time-based blind SQL Injection in ConfirmReportEmail.php Overview Field| Details ---|--- CVE ID| CVE-2025-68400 Severity| CRITICAL Advisory| View Advisory Discovered by| Lukasz Rybak Affected Products ChurchCRM/CRM Details Summary A critical SQL Injection...

cmsms-sqli

CMS Made Simple = 2.2.9 SQL Injection CVE-2019-9053 - Python3 Exploit Pure Python3 port of the original Exploit-DB 46635 by Daniele Scanu. Time-based blind SQLi to dump admin credentials from vulnerable CMS Made Simple installations. 🎯 Features: ✅ No external dependencies only requests ✅ Python...

CVE-2026-54597

CVE-2026-54597 - ITFlow Time-Based Blind SQL Injection Severity: High Advisory: GHSA-m63v-j7fw-hq2h Affected: ITFlow agent/ajax.php — expires parameter Fixed in: Commit 63d8691 Author: iltosec Summary A time-based blind SQL injection vulnerability in ITFlow's share link generation handler. The...

sqlmap

sqlmap sqlmap is an open source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers. It comes with a powerful detection engine, many niche features for the ultimate penetration tester, and a broad range of switche...

CVE-2025-28346

Vulnerability Type SQL Injection Description A Time-Based Blind SQL Injection vulnerability was discovered in Ticket-Booking-App - 1.0 that allows an attacker to execute arbitrary SQL queries on the underlying database. The vulnerable parameter does not properly sanitize user-supplied input,...

CVE-2019-9053-POC

CMS Made Simple ⚠️ Disclaimer: This script is for educational and authorized testing purposes only. Do not use it on systems you do not own or have explicit permission to test. The author and contributors are not responsible for any misuse or damage caused by this tool. 🎯 What is this? This is a...

commend_sqli

CVE-2023-XXXXX Suggested description G8-VOIPREC Commend VoIPRec web interface is vulnerable to time-base blind SQL injections in "Code" parameter on login page. Additional Information PoC: POST /cgi-bin/SecComRecX.cgi HTTP/1.1 Host: 192.168.88.10 User-Agent: Mozilla/5.0 X11; Linux x8664; rv:109.0...

CVE-2024-51482

CVE-2024-51482 — ZoneMinder Time-Based Blind SQL Injection A proof-of-concept exploit for CVE-2024-51482 , an authenticated time-based blind SQL injection vulnerability in ZoneMinder v1.37. ≤ 1.37.64. The script extracts usernames and password hashes from the zm.Users table using binary search...

CVE-2024-51482-PoC

CVE-2024-51482-PoC Authenticated time-based blind SQL injection exploit for ZoneMinder v1.37. = 1.37.64 Overview This is a proof-of-concept exploit for CVE-2024-51482, a time-based blind SQL injection vulnerability in ZoneMinder's event management functionality. The exploit requires authenticatio...

WordPress-NotificationX-CVE-2024-1698

Set-up docker-compose up --build Clean up docker-compose down Testing Measure-Command curl.exe http://localhost/wp-json/notificationx/v1/analytics -Method Post -Body 'nxid=1337&type=clicks=IFASCIISUBSTRINGselect userpass from wpusers where id=1,1,1=36,SLEEP10,null-- -'...

CVE-2019-9053

CMS Made Simple Extracts data character by character by checking response delays. Extracts: Salt cmssiteprefs table Admin username cmsusers Admin email cmsusers Admin password hash cmsu...

CVE-2025-50383

CVE-2025-50383 Description A low-privileged authenticated user can exploit this vulnerability by sending a crafted HTTP POST request with a malicious orderby parameter e.g., orderby=IF1=1,SLEEP5,1. This can trigger time-based blind SQL injection, resulting in unauthorized SQL execution on the...

CVE-2023-31702

CVE-2023-31702 — eScan Management Console SQL Injection Authenticated Overview CVE-2023-31702 is an authenticated SQL Injection vulnerability discovered in MicroWorld Technologies eScan Management Console version 14.0.1400.2281. The vulnerability exists in the GetUserCurrentPwd endpoint, where th...

CVE-2024-51482-POC

ZoneMinder Authenticated Time Based SQLi POC - CVE-2024-51482 ⚠️ For educational and authorized security research only. Running this tool against systems you do not own or lack written permission to test is illegal. Table of Contents ZoneMinder Authenticated Time Based SQLi POC - CVE-2024-51482...

CVE-2022-45808

CVE-2022-45808 LearnPress Plugin = 5.0.1...

Jeeves

Jeeves Usage • Installation Jeeves is made for looking to Time-Based Blind SQLInjection through recon. Contents: Installation Usage Adding Headers Using Proxy Making Post Request Multiple ways of usage - Installation & Requirements: Installing Jeeves 💀 $ go install...

CVE-2026-4060-PoC

CVE-2026-4060 — Geo Mashup ≤ 1.13.18 Unauthenticated SQL Injection PoC -blue Unauthenticated attackers can inject arbitrary SQL into the ORDER BY clause via the sort parameter of the Geo Mashup render-map endpoint, enabling time-based blind extraction of sensitive database information. Table of...

Quotes llama <= 3.1.5 - SQL Injection

Quotes llama 3.1.5 and earlier contains a time-based blind SQL injection vulnerability caused by improper control of a SQL identifier. The selectsearch AJAX handler registered for guests via wpajaxnoprivselectsearch reads the attacker-controlled 'sc' parameter from $POST and substitutes it into t...

Advance Product Search <= 1.4.4 - Unauthenticated Time-Based Blind SQL Injection

Advance Product Search 1.4.4 and earlier is vulnerable to unauthenticated time-based blind SQL injection. The plugin rebuilds the WordPress search SQL by hand and uses $wpdb-esclike which escapes LIKE wildcards but not single quotes, allowing injection through the ?s= parameter. id: CVE-2026-5607...

WP Fast Total Search <= 1.80.280 - Unauthenticated Time-Based Blind SQL Injection

WP Fast Total Search fulltext-search versions up to and including 1.80.280 contain an unauthenticated time-based blind SQL injection. The wpajaxnoprivwpftsautocomplete handler reads the formdatas parameter and feeds it into a WPQuery. The plugin's indexsqlwhere builds its cluster query with...