CVE-2025-5287

Description : Il s'agit d'un code d'exploitation qui fonctionne pour plusieurs URL et multi-thread pour l'injection SQL non authentifiée sur un plugin WP avec CVE-2025-5287 Exemple d'utilisation : usage: CVE-2025-5287.py -h --file FILE --fudge FUDGE --timeout TIMEOUT --threads THREADS --proxy PRO...

Seecret.it

📦 Seecret.it — Secure sharing via one-time link Seecret.it is an online service for sharing passwords, documents or sensitive information via encrypted one-time links. Your data remains invisible, secure, and self-destructs after viewing. Ideal for IT teams, businesses, freelancers, and anyone...

CVE-2025-7605

CVE-2025-7605 code-projects AVL Rooms Projet V1.0/profile.php Injection SQL NOM DU PRODUITS CONCERNÉS AVL Rooms Page d'accueil du fournisseur https://code-projects.org/avl-rooms-in-php-css-javascript-and-mysql-free-download/ Soumetteur dazhi Fichier vulnérable /profile.php VERSIONS V1.0 Lien du...

HLF_TxTime_spoofing

HLFTxTimespoofing HLFTxTimespoofing - une preuve de concept PoC couvrant le problème de la manipulation du temps de transaction en utilisant GetTxTimestamp ou GetHistoryForKey dans la blockchain Hyperledger Fabric. Testé sur les versions 2.5.5 et 3.0.0-beta Le projet se compose de plusieurs parti...

CVE-2021-39379

УЯЗВИМОСТЬ SQL-ИНЪЕКЦИИ В OPENSIS 8.0 CVE-2021-39379 В версии 8.0 openSIS существует уязвимость SQL-инъекции при использовании MySQL MariaDB в качестве базы данных приложения. Злоумышленник может выполнять SQL-команды в базе данных MySQL MariaDB через уязвимый параметр passwordstnid. Уязвимая...

CVE-2024-32640

CVE-2024-32640 PoC d'injection SQL basée sur le temps...

xzutils_backdoor_obfuscation

xzutilsbackdoorobfuscation This script recreates the obfuscation technique used for the XZ utils attack CVE-2024-3094. It has been tested for xzutils v5.6.0 only. ⚠️ This code is provided for educational purposes only and should not be used for malicious activities. Use at your own risks. ⚠️...

CVE-2024-1207

Booking Calendar = 9.9 - Injection SQL non authentifiée CVE-2024-1207 https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/booking/booking-calendar-99-unauthenticated-sql-injection POC: root@kitploit: POST /wp-admin/admin-ajax.php HTTP/1.1 Host: vulnerablesite.com User-Agent:...

Detect-CVE-2017-0144-attack

Programme Python de détection d'attaque CVE-2017-0144 Ce programme Python a pour mission de surveiller et d'inspecter le trafic réseau en continu et en temps réel. Il émettra une alerte sur la console lorsqu'il détecte une attaque CVE-2017-0144 EternalBlue. 1. Modèle du laboratoire Ce laboratoire...

CVE-2026-61797

CVE-2026-61797 — Injection SQL aveugle basée sur le temps dans le plugin PDF de GLPI Preuve de concept pour CVE-2026-61797 , une vulnérabilité d'injection SQL aveugle basée sur le temps affectant le plugin PDF de GLPI. La vulnérabilité peut être atteinte via : root@kitploit:...

commend_sqli

CVE-2023-XXXXX Description suggérée L'interface web de G8-VOIPREC Commend VoIPRec est vulnérable à des injections SQL aveugles basées sur le temps dans le paramètre « Code » de la page de connexion. Informations supplémentaires PoC: POST /cgi-bin/SecComRecX.cgi HTTP/1.1 Host: 192.168.88.10...

CVE-2026-81895

In Concrete CMS before 9.5.3, the Document Library block stored the file-set identifiers submitted through fsID without validating them as integers, and when the block was configured with setMode set to any it concatenated each stored identifier directly into the file-set filter query instead of...

CVE-2026-81895

Concrete CMS before 9.5.3 is affected by a stored, time-based blind SQL injection in the Document Library block . The block stored file-set identifiers submitted via fsID[] without validating them as integers. When configured with setMode=any, each stored identifier was concatenated directly into...

EUVD-2026-78837

In Concrete CMS before 9.5.3, the Document Library block stored the file-set identifiers submitted through fsID without validating them as integers, and when the block was configured with setMode set to any it concatenated each stored identifier directly into the file-set filter query instead of...

CVE-2025-4396

CVE-2025-4396 — Injection SQL aveugle basée sur le temps dans Relevanssi Avertissement : Ce dépôt est destiné uniquement à des tests d'intrusion autorisés, à la recherche en sécurité et à des fins éducatives. L'accès non autorisé à des systèmes informatiques est illégal et contraire à l'éthique...

CVE-2024-51482-POC

ZoneMinder Authenticated Time Based SQLi POC - CVE-2024-51482 ⚠️ For educational and authorized security research only. Running this tool against systems you do not own or lack written permission to test is illegal. Table of Contents ZoneMinder Authenticated Time Based SQLi POC - CVE-2024-51482...

CVE-2025-45809-PoC

CVE-2025-45809 — LiteLLM SQL Injection via /key/block Time-Based Blind SQLi LiteLLM v1.65.4 versions before v1.81.0 /key/block and /key/unblock endpoints have a SQL injection vulnerability in the key parameter. Attackers can use time-based blind injection techniques to steal database content and...

CVE-2026-52827 Kimai: Two-factor authentication bypass on the Kimai API

Kimai is an open-source time tracking application. Prior to 2.59.0, the KIMAISESSION cookie issued after password verification but before TOTP completion is accepted by every /api route because config/packages/security.yaml protects the API with ISAUTHENTICATED and...

CVE-2026-52826 Kimai: Improper Authorization in Kimai Project, Customer, and Activity Rate Edit Endpoints Allows Cross-Scope Rate Manipulation

Kimai is an open-source time tracking application. Prior to 2.57.0, GET or POST requests to /en/admin/project/id/rate/rate, /en/admin/customer/id/rate/rate, and /en/admin/activity/id/rate/rate independently resolve the authorized parent identifier and the attacker-selected child rate identifier...

CVE-2026-52825 Kimai: Improper Authorization in Kimai Team Member and Team Activity Assignment APIs Allows Expansion of Team Scope Beyond Authorized Visibility

Kimai is an open-source time tracking application. Prior to 2.58.0, POST /api/teams/id/members/userId and POST /api/teams/id/activities/activityId verify that a teamlead may edit the Team but do not verify accessuser for the referenced User or view access for the referenced Activity. A teamlead c...