CVE-2026-80594

CVE-2026-80594 affects the ims-pcu driver in the Linux kernel . The driver parses CDC union descriptors in ims_pcu_get_cdc_union_desc() by iterating through extra descriptor data but fails to validate that each descriptor's bLength field is at least 2. A malicious device presenting a descriptor w...

EUVD-2026-67470

In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - fix potential infinite loop in CDC union descriptor parsing The driver parses CDC union descriptors in imspcugetcdcuniondesc by iterating through the extra descriptor data. However, it does not verify that the...

CVE-2022-28346

CVE-2022-28346 Django QuerySet.annotate, aggregate, extra SQL injection Inizializzazione dell'ambiente root@kitploit: 1.python manage.py makemigrations 2.python manage.py migrate 3.访问http://x.x.x.x:8000/ 插入初始化数据 Riproduzione della vulnerabilità root@kitploit: 访问http://x.x.x.x:8000/demo POC:...

blind-sql-bitshifting

Blind SQL Injection via Bitshifting This is a module that performs blind SQL injection by using the bitshifting method to calculate characters instead of guessing them. It requires 7/8 requests per character, depending on the configuration. Usage root@kitploit: import blind-sql-bitshifting as x...

sqlmap

sqlmap sqlmap is an open source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers. It comes with a powerful detection engine, many niche features for the ultimate penetration tester, and a broad range of switche...

CVE-2023-23279

SQL injection nel Canteen Management System v1.0. Autore del bug: Tuannq Data di scoperta: 5/1/2023 Fornitore: https://www.sourcecodester.com/php/15688/canteen-management-system-project-source-code-php.html Account di accesso: [email protected]/rootadmin account Super Admin File vulnerabile:...

mssqli-duet

MSSQLi-DUET - Ferramenta de Enumeração de Usuários de Domínio Baseada em Injeção MSSQL Script de injeção SQL para MSSQL que extrai usuários de domínio de um ambiente Active Directory com base em força bruta de RID. Suporta várias formas de técnicas de bypass de WAF por meio da implementação de...

CVE-2024-1512

CVE-2024-1512 Konzeptnachweis Schwachstellenübersicht CVE-2024-1512 legt eine kritische Schwachstelle im MasterStudy LMS WordPress Plugin offen, speziell innerhalb der Implementierung der REST-Route /lms/stm-lms/order/items. Das Problem entsteht dadurch, dass das Plugin den Parameter 'user' nicht...

CVE-2021-45041

CVE-2021-45041 PoC per CVE-2021-45041 aka SCRMBT-177 - SQL-Injection autenticata in SuiteCRM = 8.0.0. Default: False --help Mostra questo messaggio e termina. https://github.com/manuelz120/CVE-2021-45041 Esempio di utilizzo: root@kitploit: .venv ➜ CVE-2021-45041 git:main ✗ ./exploit.py --host...

CVE-2021-24750

Verwendung Starten Sie mysql, wordpress und wordpress-cli mit docker-compose root@kitploit: docker-compose -f docker-compose.yaml up -d Installieren Sie wordpress, aktivieren Sie das Plugin und erstellen Sie einen Benutzer mit der Rolle subscriber über wordpress-cli root@kitploit: docker-compose...

CVE-2026-9848

CVE-2026-9848 CVE-2026-9848 é uma vulnerabilidade de Injeção SQL SQLi não autenticada que afeta o plugin WP Ticket Customer Support Ticket System & Helpdesk para WordPress até a versão 6.0.4, inclusive. A falha ocorre porque o plugin pega o parâmetro de busca s do WordPress e o concatena...

CVE-2021-44593

CVE-2021-44593 Divulgazione pubblica di CVE-2021-44593. Una vulnerabilità di SQL injection/caricamento arbitrario di file/esecuzione di codice remoto in Simple College Website. DESCRIZIONE Simple College Website 1.0 è vulnerabile a una SQL injection non autenticata basata su UNION nel parametro...

PoC-CVE-2025-69420

CVE-2025-69420 — OpenSSL TimeStamp Response Typverwechslungs-PoC Reiner Crash-only-Labor-Reproduzent für CVE-2025-69420 in OpenSSL. Der PoC lädt eine gültige RFC-3161-TimeStamp-Response, ändert das signierte ESS-Attribut im Speicher von VASN1SEQUENCE zu VASN1NULL und ruft TSRESPverifyresponse auf...

SQL-ThinkPHP-5.0.24-RCE-

SQL-ThinkPHP-5.0.24-RCE- SQL注入漏洞复现报告——OWASP靶场实战，通过UNION注入提取数据库29条用户凭证 ThinkPHP 5.0.24 RCE漏洞复现报告——CVE-2018-16385，验证代码执行能力...

CVE-2021-42667

CVE-2021-42667 CVE-2021-42667 - SQL-Injection-Schwachstelle im Online-Eventbuchungs- und Reservierungssystem Version 2.3.0. Technische Beschreibung: Eine SQL-Injection-Schwachstelle existiert in der Eventmanagement-Software Version 2.3.0. Ein Angreifer kann den anfälligen Parameter „id“ auf der...

CVE-2026-68515 OpenEXR: Heap out-of-bounds write in exrmultiview with subsampled channel union

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. In versions before 3.2.11, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13, exrmultiview can write past a heap allocation when it combines two attacker-supplied,...

CVE-2022-42098

KLiK-SocialMediaWebsite versione v1.0.1 Spiegazione della vulnerabilità: KLiK-SocialMediaWebsite v1.0.1 presenta vulnerabilità di SQL Injection su profile.php nel parametro id. Vettori d'attacco: KLiK-SocialMediaWebsite v1.0.1 Una volta creato un utente, è possibile trovare persone su KLiK tramit...

Wazuh Server 4.6.0 < 4.14.6 SQL Injection (CVE-2026-49392)

The version of Wazuh Server on the remote host is at least 4.6.0 and prior to 4.14.6. It is, therefore, affected by a SQL injection vulnerability: - DB::getFile and DB::searchFile concatenate a monitored file path into SQLite row filters without proper escaping on non-Windows systems. A local use...

wp2shell-poc

Wie funktioniert das überhaupt Wie sich dieser PoC von den öffentlichen wp2shell-Exploits unterscheidet Alle PoCs nutzen dieselben zwei Schwachstellen – die REST-Batch-Routen-Verwirrung CVE-2026-63030 und die authornotin SQL-Injection CVE-2026-60137 – mit derselben doppelt verschachtelten...

CVE-2026-49392

Wazuh (free and open source threat prevention, detection, and response platform) is affected by a local SQL injection in its File Integrity Monitoring (FIM) database layer. The vulnerable functions DB::getFile() and DB::searchFile() in src/syscheckd/src/db/src/file.cpp concatenate a monitored fil...