CVE-2024-9465

CVE-2024-9465 Checkpoint SQL Injection via Time-Based Attack CVE-2024-9465 SHODAN SEARCH root@kitploit: https://www.shodan.io/search?query=html%3A%22Expedition+Project%22 html:"Expedition Project" FOFA SEARCH root@kitploit: https://en.fofa.info/ body="Expedition Project" || title="Expedition...

CVE-2026-54597

CVE-2026-54597 - ITFlow Time-Based Blind SQL Injection Severity: High Advisory: GHSA-m63v-j7fw-hq2h Affected: ITFlow agent/ajax.php — expires parameter Fixed in: Commit 63d8691 Author: iltosec Summary A time-based blind SQL injection vulnerability in ITFlow's share link generation handler. The...

CVE-2026-52745

CordysCRM , an open-source AI-powered CRM supporting private deployment, is vulnerable to a time-based blind SQL injection in the POST /account-pool/page endpoint prior to version 1.7.0 . An authenticated user holding the MODULE_SETTING:UPDATE permission can craft a sort.name value that is inject...

CVE-2025-7606

CVE-2025-7606 code-projects AVL Rooms Project V1.0/city.php SQL injection NAME OF AFFECTED PRODUCTS AVL Rooms Vendor Homepage https://code-projects.org/avl-rooms-in-php-css-javascript-and-mysql-free-download/ submitter dazhi Vulnerable File /city.php VERSIONS V1.0 Software Link...

CVE-2023-48084-Revised

CVE-2023-48084 — updated PoC Repository: MettHK/CVE-2023-48084-Revised Updated version of Hamibubu/CVE-2023-48084 with multithreading, binary-search extraction, and CLI flags for database / table / column selection. Not the original repository. This is a derivative/improved PoC. Credit for the...

CVE-2024-36058

CVE-2024-36058 — Koha Library Software CVE ID: CVE-2024-36058 Product: Koha Library Software Vulnerability Type: Time-Based Blind SQL Injection CWE-89 CVSS Score: 8.1 High Authenticated Affected Versions: Below 22.05.22 Credits: Karolis Narvilas Description Koha is an open-source integrated libra...

EUVD-2026-82759

The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to time-based SQL Injection via 'albumid' Shortcode Attribute in all versions up to, and including, 1.8.44 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation o...

CVE-2024-55981

CVE-2024-55981 Nabz Image Gallery = v1.00 - SQL-инъекция без аутентификации Описание Плагин Nabz Image Gallery для WordPress подвержен SQL-инъекции в версиях до v1.00 включительно из-за недостаточного экранирования пользовательского параметра и отсутствия должной подготовки существующего...

blind-sql-bitshifting

Blind SQL Injection via Bitshifting This is a module that performs blind SQL injection by using the bitshifting method to calculate characters instead of guessing them. It requires 7/8 requests per character, depending on the configuration. Usage root@kitploit: import blind-sql-bitshifting as x...

CVE-2026-77927: Improper Neutralization of Special Elements used in an SQL Command

ClipBucket v5 before 5.5.3-182 contains a blind SQL injection vulnerability that allows authenticated users to extract arbitrary data from the database by submitting the checkphoto parameter as an array to bypass the cleanrequests sanitization function in ClipBucket.class.php. Attackers can pass...

cve-2025-6907

CVE‑2025‑6907 SQLi Exploit Tool File: exploit.c Author: Byte Reaper Target Service: CODEPROJECT Type: SQL Injection 🔎 Overview This is a standalone C-based SQL Injection exploit targeting the CVE‑2025‑6907 vulnerability in the CODEPROJECT service. It combines multiple advanced techniques: Automat...

frevvomapexec

frevvomapexec frevvomapexec is a script to verify the existence of a blind SQL injection vulnerability by injecting a delay of your choosing in seconds in Square 9 GlobalForms 6.2. To verify the vulnerability is legitimate, the end user will be required to do math e.g. Subtracting the smaller...

CVE-2025-41373

CVE-2025-41373 – Inyección SQL en Gandia Integra Total Autor: Byte Reaper CVE: CVE-2025-41373 Vulnerabilidad: Inyección SQL Autenticada Ruta Afectada: /encuestas/integrawebv4/integra/html/view/hislistadoacciones.php?idestudio= Descripción: Este endpoint concatena el parámetro idestudio directamen...

CVE-2025-9172

Exploit: Time-Based SQL Injection via /vibes/v1/beacon unauthenticated Browser Console PoC root@kitploit: async = const url = 'http://localhost/wordpress/index.php?restroute=/vibes/v1/beacon'; async function sendresource const body = type: 'navigation', resource, // injected into SQL unprepared...

CVE-2026-24417

CVE-2026-24417: OpenSTAManager tiene una inyección SQL ciega basada en tiempo con denegación de servicio amplificada Resumen...

CVE-2025-11177

Trigger the SQLi with a time-based payload in the public login root@kitploit: curl -w '\nTIME:%timetotal\n' -s \ -d 'log=anything%27%3B%20SELECT%20pgsleep5%3B%20--&pwd=irrelevant&wp-submit=Log+In' \ -d 'redirectto=' \ -d 'testcookie=1' \ 'http://target/wp-login.php'...

CVE-2026-24416

CVE-2026-24416: OpenSTAManager has a Time-Based Blind SQL Injection in Article Pricing Module Overview...

CVE-2025-61246

CVE-2025-61246 - Vulnerabilidad de Inyección SQL en Sistema de Compras en Línea Descripción general Este repositorio contiene una Prueba de Concepto PoC para CVE-2025-61246 , una vulnerabilidad crítica de Inyección SQL descubierta en la aplicación PHP Sistema de Compras en Línea. La vulnerabilida...

CVE-2026-76904

GeoServer WFS Inventory and Authorized Verification This repository contains two Python scripts for investigating GeoServer WFS endpoints. Overview wfsinventory.py Purpose: Inventory layers, XSD fields, and WFS values, and optionally verify candidates via a time-based check. Execution examples:...

Exploit-CVE-2023-6063-PoC-Vuln

CVE-2023-6063 — WP Fastest Cache SQL Injection PoC -red Proof of Concept PoC for CVE-2023-6063 , an unauthenticated, time-based blind SQL injection vulnerability affecting WP Fastest Cache ≤ 1.2.2. The vulnerability can be triggered through the wordpressloggedin cookie and may allow an attacker t...