CVE-2022-31061

CVE-2022-31061 GLPI CVE-2022-31061 用 PoC GLPI = 9.3.0 かつ 10.0.2 向けの Proof of Concept - ログインページにおける非認証 SQL インジェクション 法的免責事項 : 相互の同意なしに本スクリプトを対象への攻撃に使用することは違法です。 自分の地域に適用されるすべての法律に従うことはエンドユーザーの責任です。 開発者は一切の責任を負わず、本プログラムによって引き起こされた誤用または損害についても責任を負いません。 背景 : 公開情報 :...

ghauri

Like Ghauri, consider supporting the developer Ghauri An advanced cross-platform tool that automates the process of detecting and exploiting SQL injection security flaws. Requirements Python 3 Python pip3 Installation cd to ghauri directory. install requirements: python3 -m pip install --upgrade ...

CVE-2024-51482-ZoneMinder-CCTV-HTB-Reliable-EXP

README Hackthebox Machine: CCTV アプリケーション: ZoneMinder 説明 同じ文字に対して複数回の時間ベースのブラインドインジェクションを実行し、最も頻繁に現れる結果を選択することで、エラーを大幅に削減し信頼性を向上させますが、時間がかかります。...

CVE-2019-10708

Scms - SQL Injection exploit.pyはCVE-2019-10708脆弱性に対するPoCであり、multiprocessingを用いて注入を実行し、データベース名とバックエンド管理者のアカウント・パスワードを取得します（20190401より前のバージョンを推奨） Usage 注入可能かテスト python3 exploit.py http:localhost/js/scms.php --test sleep時間を60秒に設定し、データベースを取得 python3 exploit.py http:localhost/js/scms.php -s 60 --db...

CVE-2026-63030-CVE-2026-60137-wp2shell-poc

wp2shell — WordPress REST API Time-Based Blind SQLi → RCE 概念実証 説明 pocwptot.py は、WordPress REST API のバッチエンドポイントにおける time‑based blind SQL injection の脆弱性を悪用し、Remote Code Execution RCE に 至るエスカレーションチェーンを実行する proof‑of‑concept PoC です。 対象の脆弱性: CVE-2026-63030 CVE-2026-60137 重要な警告...

TimeInjector

TimeInjector TimeInjector は、bash で書かれた CVE-2018-14714 のエクスプロイトスクリプトです。 脆弱性の有無を判断するために、このスクリプトはまずターゲットにアクセス可能かどうか、そしてログインセッションを確立できるかどうかを確認します。 その後、特定のページの存在をチェックし、時間ベースのインジェクションを実行して、システムがリモートコード実行（RCE）に対して脆弱かどうかを確認します。 システムがコマンド（例：sleep 3）を実行した際に応答が遅くなる場合、そのターゲットは脆弱である可能性があります。...

CVE-2026-96673

Versions of Photoview prior to 2.4.0 are vulnerable to an SQL injection flaw within the album download route. The root cause is the improper handling of the album_id path segment, which allows unauthenticated attackers to inject crafted SQL expressions. Successful exploitation enables attackers t...

CVE-2026-96673 Photoview through 2.4.0 SQL Injection via album download route

Photoview through 2.4.0 contains an SQL injection vulnerability in the album download route that allows unauthenticated attackers to inject SQL by manipulating the albumid path segment. Attackers can supply crafted SQL expressions in the albumid parameter to extract arbitrary data from the databa...

EUVD-2026-85345

Photoview through 2.4.0 contains an SQL injection vulnerability in the album download route that allows unauthenticated attackers to inject SQL by manipulating the albumid path segment. Attackers can supply crafted SQL expressions in the albumid parameter to extract arbitrary data from the databa...

CVE-2026-96673: Improper Neutralization of Special Elements used in an SQL Command

Photoview through 2.4.0 contains an SQL injection vulnerability in the album download route that allows unauthenticated attackers to inject SQL by manipulating the albumid path segment. Attackers can supply crafted SQL expressions in the albumid parameter to extract arbitrary data from the databa...

Astra Linux – Vulnerability in Zabbix

The Zabbix server can execute commands for configured scripts. After the command is executed, an audit entry is added to the “Audit Log”. Since the “clientip” field is not sanitized, it is possible to inject SQL code into the “clientip” field, resulting in time-based blind SQL injection attacks...

CVE-2026-72608 Koha Community Koha - Stored SQL Injection via Patron Card Layout image_name

A stored SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the tools = labelcreator permission to execute arbitrary SQL via the imagename field of a patron card layout. The imagename value is stored verbatim in the layout XML an...

CVE-2026-71287

Cacti's sanitizesqlcolumn lib/functions.php sanitizes user-supplied ORDER BY column names using the regex . Because this allowlist retains letters, digits, underscore, parentheses, and dot intended to support expressions like COUNTid and table.column, a payload such as passes through completely...

CVE-2026-71288 Koha SQL Injection via order_by and {order}_ovalue Parameters in guided_reports.pl

Koha's guided report builder reports/guidedreports.pl reads the CGI parameter and, for each value, a dynamically-named parameter, and concatenates both directly into an SQL ORDER BY clause with no allowlist or validation. Since ORDER BY columns cannot be bound via prepared-statement placeholders,...

CVE-2026-71287

Cacti CVE-2026-71287 involves a flaw in sanitize_sql_column() in lib/functions.php. The function filters ORDER BY column names with preg_replace('/[^a-zA-Z0-9_().]/', '', $column), which leaves letters, digits, underscore, parentheses, and dot. This allows payloads like SLEEP(5) to pass unmodifie...

CVE-2026-15360 Ajax Load More < 8.0.1 - Unauthenticated SQL Injection via custom_args

The Ajax Load More WordPress plugin before 8.0.1 does not properly sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated attackers to perform time-based blind SQL injection and extract sensitive data from the database...

📄 LiteLLM 1.83.6 Blind SQL Injection

A proof of concept exploit for a pre-authentication blind SQL injection vulnerability in LiteLLM version 1.83.6. The vulnerability affects LiteLLM proxy versions 1.81.16 through 1.83.6 and occurs because the virtual-key lookup interpolates an unauthenticated bearer token directly into a PostgreSQ...

CVE-2026-15018

The Database Collation Fix plugin for WordPress is vulnerable to time-based SQL Injection via the 'force-collation-algorithm' parameter in all versions up to, and including, 1.2.10 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

CVE-2026-15018 Database Collation Fix <= 1.2.10 - Unauthenticated SQL Injection via 'force-collation-algorithm' Parameter

The Database Collation Fix plugin for WordPress is vulnerable to time-based SQL Injection via the 'force-collation-algorithm' parameter in all versions up to, and including, 1.2.10 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

PT-2026-65700

A pre-authentication blind SQL injection vulnerability in Koollab LMS allowed an unauthenticated attacker to use a time-based SQL oracle via the SSO OAuth endpoint to read sensitive database contents, including personally identifiable information, credentials, and valid JWT tokens that may enable...