https://poc.intelseclab.com/tags/sql-injection/Latest proof-of-concept entries.Hugoen-usSun, 19 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-19_cve-2026-63030-cve-2026-60137-wp2shell-wordpress-core-preauth-rce/Sun, 19 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-19_cve-2026-63030-cve-2026-60137-wp2shell-wordpress-core-preauth-rce/Critical severity (CVSS 9.1) — web · CVE-2026-63030 (REST /batch/v1 route confusion, CVSS 7.5), CVE-2026-60137 (author__not_in SQL injection, CVSS 9.1); GHSA-ff9f-jf42-662q, GHSA-fpp7-x2x2-2mjf. Status: Weaponized — full pre-auth RCE confirmed against stock-default WordPress core, no plugins/misconfiguration required. Affects: WordPress core (REST API /batch/v1, WP_Query::author__not_in). Tags: wordpress, wp-core, sql-injection, route-confusion, cwe-89, cwe-436, unauthenticated, remote, privilege-escalation, rce, oembed, changeset.webCriticalwordpresswp-coresql-injectionroute-confusioncwe-89cwe-436unauthenticatedremoteprivilege-escalationrceoembedchangesethttps://poc.intelseclab.com/pocs/web/2026-07-11_cve-2026-42208-litellm-sqli-proxy-authbypass/Sat, 11 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-11_cve-2026-42208-litellm-sqli-proxy-authbypass/Critical severity (CVSS 9.8) — web · CVE-2026-42208 (GHSA-r75f-5x8p-qvmc). Status: Weaponized (public working PoC + Docker lab, actively exploited in the wild within 36 hours of disclosure). Affects: LiteLLM Proxy — open-source LLM/AI gateway (22,000+ GitHub stars) fronting OpenAI, Anthropic, and other model provider APIs. Tags: litellm, ai-gateway, llm-proxy, sql-injection, cwe-89, unauthenticated, remote, blind-sqli, kev-adjacent, credential-theft.webCriticallitellmai-gatewayllm-proxysql-injectioncwe-89unauthenticatedremoteblind-sqlikev-adjacentcredential-thefthttps://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-11391-ppom-woocommerce-blind-sqli/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-11391-ppom-woocommerce-blind-sqli/Critical severity (CVSS 9.8) — web · CVE-2025-11391. Status: Patched. Affects: PPOM for WooCommerce (woocommerce-product-addon plugin). Tags: wordpress, woocommerce, ppom, product-addon, sql-injection, blind-sqli, time-based, cwe-89, python, php.webCriticalwordpresswoocommerceppomproduct-addonsql-injectionblind-sqlitime-basedcwe-89pythonphphttps://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-64459-django-queryset-connector-sqli/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-64459-django-queryset-connector-sqli/Critical severity (CVSS 9.1) — web · CVE-2025-64459. Status: Weaponized. Affects: Django ORM (QuerySet.filter() / Q object construction). Tags: django, python, sql-injection, queryset, q-object, orm, cwe-89, data-exposure, sqlite.webCriticaldjangopythonsql-injectionquerysetq-objectormcwe-89data-exposuresqlitehttps://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-65354-grocery-sitem-name-sqli/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-65354-grocery-sitem-name-sqli/Critical severity (CVSS 9.8) — web · CVE-2025-65354. Status: PoC. Affects: PHP-based "Grocery" web application, Grocery/search_products_itname.php endpoint. Tags: php, sql-injection, boolean-based-blind-sqli, cwe-89, grocery, unauthenticated, python.webCriticalphpsql-injectionboolean-based-blind-sqlicwe-89groceryunauthenticatedpythonhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-27470-zoneminder-second-order-sqli/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-27470-zoneminder-second-order-sqli/High severity (CVSS 8.8) — web · CVE-2026-27470. Status: Weaponized. Affects: ZoneMinder. Tags: zoneminder, sql-injection, second-order-sqli, authenticated, credential-extraction, cwe-89, php.webHighzonemindersql-injectionsecond-order-sqliauthenticatedcredential-extractioncwe-89phphttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-6379-wp-photo-album-plus-sqli/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-6379-wp-photo-album-plus-sqli/Critical severity (CVSS 8.6) — web · CVE-2026-6379. Status: PoC. Affects: WordPress plugin "WP Photo Album Plus" (WPPA+) by opajaap. Tags: wordpress, wp-photo-album-plus, sql-injection, unauthenticated, time-based-blind, cwe-89.webCriticalwordpresswp-photo-album-plussql-injectionunauthenticatedtime-based-blindcwe-89https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-3359-formmaker-wordpress-sqli/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-3359-formmaker-wordpress-sqli/Critical severity — web · CVE-2026-3359. Status: PoC. Affects: WordPress "Form Maker" plugin by Web10. Tags: wordpress, sql-injection, form-maker, unauthenticated, admin-ajax, wp-plugin, data-exfiltration.webCriticalwordpresssql-injectionform-makerunauthenticatedadmin-ajaxwp-plugindata-exfiltrationhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-23723-wegia-sql-injection/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-23723-wegia-sql-injection/High severity — web · CVE-2026-23723 / GHSA-xfmp-2hf9-gfjp. Status: Weaponized. Affects: WeGIA (Web Gestão Integrada de Associações). Tags: wegia, sql-injection, authenticated, sqlmap, php, session-hijack, database-dump, error-based.webHighwegiasql-injectionauthenticatedsqlmapphpsession-hijackdatabase-dumperror-basedhttps://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-4112-sonicwall-sma-sqli-hash-extraction/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-4112-sonicwall-sma-sqli-hash-extraction/High severity (CVSS 7.2) — network · CVE-2026-4112 (SonicWall Advisory SNWLID-2026-0003). Status: Weaponized. Affects: SonicWall SMA 8200v management console (Jetty + Struts 2, port 8443). Tags: sonicwall, sma, sql-injection, blind-sqli, privilege-escalation, load-file, hash-extraction, appliance.networkHighsonicwallsmasql-injectionblind-sqliprivilege-escalationload-filehash-extractionappliancehttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-26198-ormar-orm-sqli/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-26198-ormar-orm-sqli/Critical severity (CVSS 9.8) — web · CVE-2026-26198 (GHSA-xxh2-68g9-8jqr). Status: PoC. Affects: Ormar (async Python ORM, commonly used with FastAPI/Starlette). Tags: sql-injection, python, ormar, orm, fastapi, sqlalchemy, cwe-89, unauthenticated.webCriticalsql-injectionpythonormarormfastapisqlalchemycwe-89unauthenticatedhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-24418-openstamanager-sqli-scadenzario/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-24418-openstamanager-sqli-scadenzario/High severity (CVSS 8.8) — web · CVE-2026-24418. Status: Weaponized. Affects: OpenSTAManager (devcode-it/openstamanager). Tags: sql-injection, error-based, openstamanager, php, extractvalue, rce, credential-theft, authenticated.webHighsql-injectionerror-basedopenstamanagerphpextractvaluercecredential-theftauthenticatedhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-24419-openstamanager-sqli-prima-nota/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-24419-openstamanager-sqli-prima-nota/High severity — web · CVE-2026-24419. Status: PoC. Affects: OpenSTAManager (devcode-it/openstamanager). Tags: sql-injection, error-based, openstamanager, php, extractvalue, credential-theft, authenticated.webHighsql-injectionerror-basedopenstamanagerphpextractvaluecredential-theftauthenticatedhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-24417-openstamanager-sqli-search-dos/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-24417-openstamanager-sqli-search-dos/High severity — web · CVE-2026-24417. Status: PoC. Affects: OpenSTAManager (devcode-it/openstamanager). Tags: sql-injection, time-based-blind, openstamanager, php, denial-of-service, ajax, authenticated.webHighsql-injectiontime-based-blindopenstamanagerphpdenial-of-serviceajaxauthenticatedhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-24416-openstamanager-sqli-article-pricing/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-24416-openstamanager-sqli-article-pricing/High severity — web · CVE-2026-24416. Status: PoC. Affects: OpenSTAManager (devcode-it/openstamanager). Tags: sql-injection, time-based-blind, openstamanager, php, ajax, credential-theft, authenticated.webHighsql-injectiontime-based-blindopenstamanagerphpajaxcredential-theftauthenticatedhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-34220-mikroorm-sql-injection/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-34220-mikroorm-sql-injection/High severity — web · CVE-2026-34220. Status: PoC. Affects: MikroORM (Node.js/TypeScript ORM). Tags: sql-injection, mikroorm, nodejs, typescript, orm, docker, database.webHighsql-injectionmikroormnodejstypescriptormdockerdatabasehttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-49048-joomcck-sqli/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-49048-joomcck-sqli/Critical severity (CVSS 8.7) — web · CVE-2026-49048 (Advisory ID JOOMCCK-2026-001). Status: PoC. Affects: JoomCCK (com_joomcck) — Content Construction Kit extension for Joomla, by JoomCoder. Tags: joomla, joomcck, com_joomcck, sql-injection, cwe-89, missing-authorization, cwe-862, unauthenticated, blind-sqli, union-based.webCriticaljoomlajoomcckcom_joomccksql-injectioncwe-89missing-authorizationcwe-862unauthenticatedblind-sqliunion-basedhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-49079-jetsearch-sqli/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-49079-jetsearch-sqli/High severity (CVSS 7.5) — web · CVE-2026-49079. Status: PoC. Affects: JetSearch plugin for WordPress. Tags: wordpress, jetsearch, sql-injection, cwe-89, unauthenticated, ajax, union-based, blind-sqli.webHighwordpressjetsearchsql-injectioncwe-89unauthenticatedajaxunion-basedblind-sqlihttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-54597-itflow-blind-sqli-expires/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-54597-itflow-blind-sqli-expires/High severity — web · CVE-2026-54597. Status: Weaponized. Affects: ITFlow (open-source MSP/IT management platform). Tags: itflow, sql-injection, blind-sqli, time-based, authenticated, cwe-89.webHighitflowsql-injectionblind-sqlitime-basedauthenticatedcwe-89https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-54596-itflow-sqli-recurring-invoice/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-54596-itflow-sqli-recurring-invoice/High severity — web · CVE-2026-54596. Status: Weaponized. Affects: ITFlow (open-source MSP/IT management platform). Tags: itflow, sql-injection, authenticated, technician-role, cwe-89.webHighitflowsql-injectionauthenticatedtechnician-rolecwe-89https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-26980-ghost-cms-blind-sqli/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-26980-ghost-cms-blind-sqli/Critical severity — web · CVE-2026-26980. Status: Weaponized. Affects: Ghost CMS. Tags: ghost-cms, sql-injection, blind-sqli, content-api, unauthenticated, boolean-oracle, mysql, sqlite.webCriticalghost-cmssql-injectionblind-sqlicontent-apiunauthenticatedboolean-oraclemysqlsqlitehttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-22243-egroupware-sqli/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-22243-egroupware-sqli/Critical severity — web · CVE-2026-22243. Status: PoC. Affects: EGroupware (groupware/collaboration suite). Tags: sql-injection, egroupware, php-type-juggling, authenticated, error-based-sqli, nextmatch, json.webCriticalsql-injectionegroupwarephp-type-jugglingauthenticatederror-based-sqlinextmatchjsonhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-1207-django-gis-rasterfield-sqli/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-1207-django-gis-rasterfield-sqli/High severity — web · CVE-2026-1207. Status: PoC. Affects: Django django.contrib.gis (GeoDjango) RasterField queries. Tags: django, gis, geodjango, sql-injection, rasterfield, postgis, python.webHighdjangogisgeodjangosql-injectionrasterfieldpostgispythonhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-41490-dagster-partition-sqli/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-41490-dagster-partition-sqli/High severity — web · CVE-2026-41490 (GHSA-mjw2-v2hm-wj34). Status: PoC. Affects: Dagster database I/O manager integrations: dagster-duckdb, dagster-snowflake, dagster-gcp (BigQuery), dagster-deltalake, dagster-snowflake-polars. Tags: dagster, sql-injection, graphql, duckdb, snowflake, bigquery, data-pipeline, dynamic-partitions.webHighdagstersql-injectiongraphqlduckdbsnowflakebigquerydata-pipelinedynamic-partitionshttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-37749-attendance-management-sqli-authbypass/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-37749-attendance-management-sqli-authbypass/Critical severity (CVSS 9.8) — web · CVE-2026-37749. Status: PoC. Affects: CodeAstro Simple Attendance Management System 1.0. Tags: php, sql-injection, authentication-bypass, cwe-89, unauthenticated, codeastro.webCriticalphpsql-injectionauthentication-bypasscwe-89unauthenticatedcodeastrohttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-2749-centreon-multi-vector-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-2749-centreon-multi-vector-rce/Critical severity — web · CVE-2026-2749 (bundled with related CVE-2026-2750, CVE-2026-2751). Status: Weaponized. Affects: Centreon (open-source IT infrastructure monitoring platform). Tags: centreon, path-traversal, rce, command-injection, sql-injection, clapi, monitoring, php.webCriticalcentreonpath-traversalrcecommand-injectionsql-injectionclapimonitoringphphttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-5076-armember-password-reset-takeover/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-5076-armember-password-reset-takeover/Critical severity (CVSS 9.8) — web · CVE-2026-5076 (chained with CVE-2026-5073, CVE-2026-5074). Status: PoC. Affects: ARMember – Membership Plugin & Content Restriction (WordPress plugin). Tags: wordpress, armember, membership-plugin, sql-injection, password-reset, plaintext-key, account-takeover, cwe-640.webCriticalwordpressarmembermembership-pluginsql-injectionpassword-resetplaintext-keyaccount-takeovercwe-640https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-23980-superset-sqli/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-23980-superset-sqli/Medium severity (CVSS 6.5) — web · CVE-2026-23980. Status: PoC. Affects: Apache Superset. Tags: apache-superset, sql-injection, error-based-sqli, postgresql, authenticated, api, python, cwe-89.webMediumapache-supersetsql-injectionerror-based-sqlipostgresqlauthenticatedapipythoncwe-89