CVE-2026-72898-safe-detection

CVE-2026-72898-safe-detection Simple script to achieve safe and non-destructive active detection of CVE-2026-72898 SQLi in Metabase It attempts to determine if a Metabase instance is vulnerable to the SQL injection vulnerability in the password reset endpoint. The script is designed to be safe an...

SQLi_Sleeps

SQLiSleeps It is a simple script that allows to find SQLi vulnerabilities, obtaining the response time greater than 20 seconds per medium and time-based injection. usage: SQLiSleeps2.py -h -u URLS -d DATA -c COOKIE Realiza una petición GET a múltiples URLs con diferentes datos. options: -h, --hel...

CVE-2025-9172

Exploit: Time-Based SQL Injection via /vibes/v1/beacon unauthenticated Browser Console PoC async = const url = 'http://localhost/wordpress/index.php?restroute=/vibes/v1/beacon'; async function sendresource const body = type: 'navigation', resource, // injected into SQL unprepared authenticated: 0...

CMS-made-simple-sqli-python3

CMS-made-simple-sqli-python3 CMS Made Simple 2.2.10 - SQL Injection rewritten for python3, CVE-2019-9053 I found it problematic to run this exploit on kali linux, since python2 doesn't have termcolor, so with very few brackets I made it working with python3. All credit goes to:...

sqlmap

sqlmap sqlmap is an open source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers. It comes with a powerful detection engine, many niche features for the ultimate penetration tester, and a broad range of switche...

CVE-2025-61246

CVE-2025-61246 - SQL Injection Vulnerability in Online Shopping System Overview This repository contains a Proof of Concept PoC for CVE-2025-61246 , a critical SQL Injection vulnerability discovered in the Online Shopping System PHP application. The vulnerability allows an unauthenticated attacke...

CVE-2019-9053

CVE 2019-9053 Detail Description This code is an implementation of a Time-Based Blind SQL Injection attack in Python 3. The attack is designed to exploit a SQL injection vulnerability in a Content Management System CMS Made Simple 2.2.8 through an HTTP request. Exploit Use: exploit.py -u...

CVE-2025-11177

Trigger the SQLi with a time-based payload in the public login curl -w '\nTIME:%timetotal\n' -s \ -d 'log=anything%27%3B%20SELECT%20pgsleep5%3B%20--&pwd=irrelevant&wp-submit=Log+In' \ -d 'redirectto=' \ -d 'testcookie=1' \ 'http://target/wp-login.php'...

CVE-2023-48084-Revised

CVE-2023-48084 — updated PoC Repository: MettHK/CVE-2023-48084-Revised Updated version of Hamibubu/CVE-2023-48084 with multithreading, binary-search extraction, and CLI flags for database / table / column selection. Not the original repository. This is a derivative/improved PoC. Credit for the...

CVE-2025-32429-Checker

CVE-2025-32429 Vulnerability Checker A Python-based vulnerability scanner for detecting CVE-2025-32429 SQL injection vulnerability in XWiki platforms. Features Single Target Scanning : Check individual targets with -t option Bulk Scanning : Scan multiple targets from a file with -l option WAF...

commend_sqli

CVE-2023-XXXXX Suggested description G8-VOIPREC Commend VoIPRec web interface is vulnerable to time-base blind SQL injections in "Code" parameter on login page. Additional Information PoC: POST /cgi-bin/SecComRecX.cgi HTTP/1.1 Host: 192.168.88.10 User-Agent: Mozilla/5.0 X11; Linux x8664; rv:109.0...

CVE-2026-24416

CVE-2026-24416: OpenSTAManager has a Time-Based Blind SQL Injection in Article Pricing Module Overview Field| Details ---|--- CVE ID| CVE-2026-24416 Severity| HIGH Advisory| View Advisory Discovered by| Lukasz Rybak Affected Products devcode-it/openstamanager versions: = 2.9.8 CWE Classification...

CVE-2026-14762-PoC-Exploit

CVE-2026-14762 – Code‑Projects Hotel & Tourism Reservation 1.0 SQL Injection Exploit -orange -red Fully featured, multi‑threaded, time‑based blind SQL injection exploit for CVE‑2026‑14762. Targets the /admin/rooms.php endpoint of the Code‑Projects Hotel & Tourism Reservation application version...

CVE-2026-24417

CVE-2026-24417: OpenSTAManager has a Time-Based Blind SQL Injection with Amplified Denial of Service Overview Field| Details ---|--- CVE ID| CVE-2026-24417 Severity| HIGH Advisory| View Advisory Discovered by| Lukasz Rybak Affected Products devcode-it/openstamanager versions: 2.9.8 CWE...

CVE-2026-119655

CoreShop through 1.5.5 contains an unauthenticated sql injection vulnerability in the api/Good/GetGoodsPageList endpoint via the unvalidated order parameter appended to ORDER BY. Attackers can inject subqueries that bypass SqlSugar's field check and use boolean-based or time-based blind technique...

CVE-2022-45808

CVE-2022-45808 LearnPress Plugin = 5.0.1...

CVE-2025-4396

CVE-2025-4396 — Relevanssi SQL Injection Time-Based Blind Disclaimer: This repository is intended for authorized penetration testing, security research, and educational purposes only. Unauthorized access to computer systems is illegal and unethical. Overview A proof-of-concept exploit for a...

CVE_2026_2576_PoC

CVE-2026-2576 — Business Directory Plugin SQLi PoC Unauthenticated Time-Based Blind SQL Injection Business Directory Plugin for WordPress ≤ 6.4.21 Table of Contents Vulnerability Overview Technical Analysis Lab Requirements Lab Setup Running the PoC Expected Output Patch Analysis References...

Zabbix-CVE-2024-42327-SQL-Injection-RCE

Zabbix-CVE-2024-42327 RCE PoC / / | / / / | \ / \ / // / / // /| | / / / / / | | / / // // / / // / // // // // / / / / / / / / | |/ / /// // // / / // / // / / / / / |// //// // // //// // NSFOCUS CERT detected that Zabbix released a security announcement and fixed the SQL injection...

CVE-2026-119655 CoreShop through 1.5.5 SQL Injection via order Parameter in GetGoodsPageList

CoreShop through 1.5.5 contains an unauthenticated sql injection vulnerability in the api/Good/GetGoodsPageList endpoint via the unvalidated order parameter appended to ORDER BY. Attackers can inject subqueries that bypass SqlSugar's field check and use boolean-based or time-based blind technique...