CVE-2022-31061

CVE-2022-31061 PoC لـ GLPI CVE-2022-31061 إثبات مفهوم لـ GLPI = 9.3.0 و 10.0.2 - حقن SQL بدون مصادقة في صفحة تسجيل الدخول إخلاء مسؤولية قانوني : استخدام هذا السكريبت لمهاجمة هدف دون موافقة متبادلة غير قانوني. تقع على عاتق المستخدم النهائي مسؤولية الالتزام بجميع القوانين المعمول بها في مكانه. لا...

CVE-2026-63030-CVE-2026-60137-wp2shell-poc

wp2shell — إثبات مفهوم PoC لثغرة حقن SQL الأعمى القائم على الوقت في WordPress REST API → تنفيذ أكواد عن بُعد RCE الوصف pocwptot.py هو إثبات مفهوم PoC لاستغلال ثغرة حقن SQL الأعمى القائم على الوقت time‑based blind SQL injection في نقطة نهاية الدُفعات batch الخاصة بـ WordPress REST API، وتنفيذ سلسل...

CVE-2019-10708

Scms - SQL Injection exploit.py هو دليل إثبات PoC لثغرة CVE-2019-10708، يستخدم معالجة متعددة multiprocessing للحقن، للحصول على أسماء قواعد البيانات وبيانات اعتماد مدير النظام الخلفية يوصى باستخدام إصدارات قبل 20190401. Usage root@kitploit: 測試是否可注入 python3 exploit.py http:localhost/js/scms.php...

TimeInjector

TimeInjector Time injector هي أداة استغلال لـ CVE-2018-14714 مكتوبة بلغة bash لتحديد ما إذا كان الهدف عرضة للخطر، يعمل السكربت أولاً بالتحقق من إمكانية الوصول إلى الهدف وما إذا كان يمكن إنشاء جلسة تسجيل دخول. بعد ذلك، يتحقق من وجود صفحات محددة ويقوم بحقن زمني لمعرفة ما إذا كان النظام عرضة لتنفيذ...

ghauri

Like Ghauri, consider supporting the developer...

CVE-2024-51482-ZoneMinder-CCTV-HTB-Reliable-EXP

README Машина Hackthebox: CCTV Приложение: ZoneMinder Описание Выполнение множественных time-based blind-инъекций для одного и того же символа и выбор наиболее частого результата значительно снижает количество ошибок и повышает надёжность, хотя это занимает много времени...

CVE-2026-71287

Cacti's sanitizesqlcolumn lib/functions.php sanitizes user-supplied ORDER BY column names using the regex . Because this allowlist retains letters, digits, underscore, parentheses, and dot intended to support expressions like COUNTid and table.column, a payload such as passes through completely...

CVE-2026-71288 Koha SQL Injection via order_by and {order}_ovalue Parameters in guided_reports.pl

Koha's guided report builder reports/guidedreports.pl reads the CGI parameter and, for each value, a dynamically-named parameter, and concatenates both directly into an SQL ORDER BY clause with no allowlist or validation. Since ORDER BY columns cannot be bound via prepared-statement placeholders,...

CVE-2026-71287

Cacti CVE-2026-71287 involves a flaw in sanitize_sql_column() in lib/functions.php. The function filters ORDER BY column names with preg_replace('/[^a-zA-Z0-9_().]/', '', $column), which leaves letters, digits, underscore, parentheses, and dot. This allows payloads like SLEEP(5) to pass unmodifie...

CVE-2026-15018

The Database Collation Fix plugin for WordPress is vulnerable to time-based SQL Injection via the 'force-collation-algorithm' parameter in all versions up to, and including, 1.2.10 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

CVE-2026-15018 Database Collation Fix <= 1.2.10 - Unauthenticated SQL Injection via 'force-collation-algorithm' Parameter

The Database Collation Fix plugin for WordPress is vulnerable to time-based SQL Injection via the 'force-collation-algorithm' parameter in all versions up to, and including, 1.2.10 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

PT-2026-65700

A pre-authentication blind SQL injection vulnerability in Koollab LMS allowed an unauthenticated attacker to use a time-based SQL oracle via the SSO OAuth endpoint to read sensitive database contents, including personally identifiable information, credentials, and valid JWT tokens that may enable...

CVE-2026-15670

The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' parameter in all versions up to, and including, 3.9.7 due to insufficient escaping on the user supplied parameter and lack of...

EUVD-2026-49696

The ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' parameter in all versions up to, and including, 3.4.5 due to insufficient escaping on the user supplied parameter and lack of sufficient...

CVE-2026-16811

The ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' parameter in all versions up to, and including, 3.4.5 due to insufficient escaping on the user supplied parameter and lack of sufficient...

CVE-2026-6251

The Chaty Pro plugin for WordPress is vulnerable to Authenticated Time-Based Blind SQL Injection in versions up to and including 3.5.5. This is due to the fetchcustomfield function in admin/class-admin-base.php retrieving the widgetid POST parameter via filterinputINPUTPOST, ... and directly...

CVE-2026-8082

CVE-2026-8082 affects the bpost-shipping-platform WordPress plugin before 3.2.3. The issue is improper sanitization of a parameter used in a SQL query during WooCommerce order submission, allowing unauthenticated attackers to perform time-based blind SQL injection on stores running this plugin. R...

📄 WordPress Exact Links 3.0.7 Unauthenticated Blind SQL Injection

WordPress Exact Links URL Shortener plugin version 3.0.7 contains an unauthenticated time-based blind SQL injection vulnerability through REST. A remote attacker can inject SQL through the vulnerable parameter and infer database contents through response timing. This proof of concept exploit...

📄 WordPress WP Directory Kit 1.4.3 Unauthenticated Blind SQL Injection

WordPress WP Directory Kit plugin version 1.4.3 contains an unauthenticated time-based blind SQL injection vulnerability. A remote attacker can inject SQL through the vulnerable parameter and infer database contents through response timing. This proof of concept exploit demonstrates the vulnerabl...

📄 WordPress WP Extended 3.0.12 Unauthenticated Blind SQL Injection

WordPress WP Extended plugin version 3.0.12 contains an unauthenticated time-based blind SQL injection vulnerability through X-Forwarded-For. A remote attacker can inject SQL through the vulnerable parameter and infer database contents through response timing. This proof of concept exploit...