CVE-2026-63030-CVE-2026-60137-wp2shell-poc

wp2shell — WordPress REST API 시간 기반 블라인드 SQLi → RCE 개념 증명PoC 설명 pocwptot.py는 WordPress REST API 배치 엔드포인트의 시간 기반 블라인드 SQL 인젝션 취약점을 악용하여, 권한 상승 체인을 거쳐 Remote Code ExecutionRCE까지 도달하는 개념 증명PoC입니다. 테스트 대상 취약점: CVE-2026-63030 CVE-2026-60137 중요 경고 본 도구는 소유한 시스템 또는 명시적인 서면 테스트 승인을 받은 시스템에서만 사용하십시오. 오용 시...

CVE-2019-10708

Scms - SQL Injection exploit.py는 CVE-2019-10708 취약점에 대한 PoC로, multiprocessing을 이용해 인젝션을 수행하여 데이터베이스 이름과 백엔드 관리자 계정/비밀번호를 획득합니다20190401 이전 버전 권장. 사용법 root@kitploit: 測試是否可注入 python3 exploit.py http:localhost/js/scms.php --test sleep時間為60秒與取得資料庫 python3 exploit.py http:localhost/js/scms.php -s 60 --...

CVE-2022-31061

CVE-2022-31061 GLPI CVE-2022-31061에 대한 PoC 개념 증명 GLPI = 9.3.0 및 10.0.2에 대한 개념 증명 - 로그인 페이지에서의 인증되지 않은 SQL 인젝션 법적 고지 : 상호 동의 없이 이 스크립트를 사용하여 대상을 공격하는 것은 불법입니다. 최종 사용자는 자신의 위치에서 적용 가능한 모든 법률을 준수할 책임이 있습니다. 개발자는 어떠한 책임도 지지 않으며, 이 프로그램으로 인한 오용이나 손해에 대해 책임을 지지 않습니다. 컨텍스트 : 공개 공개 :...

TimeInjector

TimeInjector TimeInjector は、bash で書かれた CVE-2018-14714 のエクスプロイトスクリプトです。 脆弱性の有無を判断するために、このスクリプトはまずターゲットにアクセス可能かどうか、そしてログインセッションを確立できるかどうかを確認します。 その後、特定のページの存在をチェックし、時間ベースのインジェクションを実行して、システムがリモートコード実行（RCE）に対して脆弱かどうかを確認します。 システムがコマンド（例：sleep 3）を実行した際に応答が遅くなる場合、そのターゲットは脆弱である可能性があります。...

ghauri

Like Ghauri, consider supporting the developer...

CVE-2024-51482-ZoneMinder-CCTV-HTB-Reliable-EXP

README Hackthebox 머신: CCTV 애플리케이션: ZoneMinder 설명 동일한 문자에 대해 여러 번 시간 기반 블라인드 인젝션을 수행하고 가장 빈번한 결과를 선택하면 오류가 크게 줄어들고 신뢰성이 향상되지만, 시간이 많이 소요됩니다...

CVE-2026-71287

Cacti's sanitizesqlcolumn lib/functions.php sanitizes user-supplied ORDER BY column names using the regex . Because this allowlist retains letters, digits, underscore, parentheses, and dot intended to support expressions like COUNTid and table.column, a payload such as passes through completely...

CVE-2026-71288 Koha SQL Injection via order_by and {order}_ovalue Parameters in guided_reports.pl

Koha's guided report builder reports/guidedreports.pl reads the CGI parameter and, for each value, a dynamically-named parameter, and concatenates both directly into an SQL ORDER BY clause with no allowlist or validation. Since ORDER BY columns cannot be bound via prepared-statement placeholders,...

CVE-2026-71287

Cacti CVE-2026-71287 involves a flaw in sanitize_sql_column() in lib/functions.php. The function filters ORDER BY column names with preg_replace('/[^a-zA-Z0-9_().]/', '', $column), which leaves letters, digits, underscore, parentheses, and dot. This allows payloads like SLEEP(5) to pass unmodifie...

CVE-2026-15018

The Database Collation Fix plugin for WordPress is vulnerable to time-based SQL Injection via the 'force-collation-algorithm' parameter in all versions up to, and including, 1.2.10 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

CVE-2026-15018 Database Collation Fix <= 1.2.10 - Unauthenticated SQL Injection via 'force-collation-algorithm' Parameter

The Database Collation Fix plugin for WordPress is vulnerable to time-based SQL Injection via the 'force-collation-algorithm' parameter in all versions up to, and including, 1.2.10 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

PT-2026-65700

A pre-authentication blind SQL injection vulnerability in Koollab LMS allowed an unauthenticated attacker to use a time-based SQL oracle via the SSO OAuth endpoint to read sensitive database contents, including personally identifiable information, credentials, and valid JWT tokens that may enable...

CVE-2026-15670

The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' parameter in all versions up to, and including, 3.9.7 due to insufficient escaping on the user supplied parameter and lack of...

EUVD-2026-49696

The ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' parameter in all versions up to, and including, 3.4.5 due to insufficient escaping on the user supplied parameter and lack of sufficient...

CVE-2026-16811

The ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' parameter in all versions up to, and including, 3.4.5 due to insufficient escaping on the user supplied parameter and lack of sufficient...

CVE-2026-6251

The Chaty Pro plugin for WordPress is vulnerable to Authenticated Time-Based Blind SQL Injection in versions up to and including 3.5.5. This is due to the fetchcustomfield function in admin/class-admin-base.php retrieving the widgetid POST parameter via filterinputINPUTPOST, ... and directly...

CVE-2026-8082

CVE-2026-8082 affects the bpost-shipping-platform WordPress plugin before 3.2.3. The issue is improper sanitization of a parameter used in a SQL query during WooCommerce order submission, allowing unauthenticated attackers to perform time-based blind SQL injection on stores running this plugin. R...

📄 WordPress Exact Links 3.0.7 Unauthenticated Blind SQL Injection

WordPress Exact Links URL Shortener plugin version 3.0.7 contains an unauthenticated time-based blind SQL injection vulnerability through REST. A remote attacker can inject SQL through the vulnerable parameter and infer database contents through response timing. This proof of concept exploit...

📄 WordPress WP Directory Kit 1.4.3 Unauthenticated Blind SQL Injection

WordPress WP Directory Kit plugin version 1.4.3 contains an unauthenticated time-based blind SQL injection vulnerability. A remote attacker can inject SQL through the vulnerable parameter and infer database contents through response timing. This proof of concept exploit demonstrates the vulnerabl...

📄 WordPress WP Extended 3.0.12 Unauthenticated Blind SQL Injection

WordPress WP Extended plugin version 3.0.12 contains an unauthenticated time-based blind SQL injection vulnerability through X-Forwarded-For. A remote attacker can inject SQL through the vulnerable parameter and infer database contents through response timing. This proof of concept exploit...