Sqli — PoC Archivehttps://poc.intelseclab.com/tags/sqli/Latest proof-of-concept entries.Hugoen-usMon, 06 Jul 2026 00:00:00 +0000FreePBX Unauthenticated SQL Injection to RCE (CVE-2025-57819)https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-57819-freepbx-sqli-rce/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-06_cve-2025-57819-freepbx-sqli-rce/Critical severity (CVSS 9.8) — web · CVE-2025-57819. Status: Weaponized. Affects: Sangoma FreePBX administrator web UI (admin/ajax.php, endpoint module). Tags: freepbx, sangoma, sqli, unauthenticated, ajax-php, cron-jobs, reverse-shell, voip, asterisk, cwe-89.webCriticalfreepbxsangomasqliunauthenticatedajax-phpcron-jobsreverse-shellvoipasteriskcwe-89WordPress Contest Gallery Plugin Unauthenticated Blind SQL Injection — CVE-2026-3180https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-3180-contest-gallery-blind-sqli/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-3180-contest-gallery-blind-sqli/High severity — web · CVE-2026-3180. Status: PoC. Affects: WordPress "Contest Gallery" plugin. Tags: wordpress, sqli, blind-sqli, plugin, admin-ajax, unauthenticated, php, boolean-based.webHighwordpresssqliblind-sqlipluginadmin-ajaxunauthenticatedphpboolean-basedThe Events Calendar WordPress Plugin Unauthenticated Blind SQL Injection (CVE-2026-49772)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-49772-events-calendar-blind-sqli/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-49772-events-calendar-blind-sqli/Critical severity (CVSS 9.3) — web · CVE-2026-49772. Status: PoC. Affects: The Events Calendar (WordPress plugin, StellarWP / Liquid Web), experimental tec/v1 REST API. Tags: wordpress, sqli, blind-sqli, rest-api, the-events-calendar, unauthenticated, python.webCriticalwordpresssqliblind-sqlirest-apithe-events-calendarunauthenticatedpythonSparx Enterprise Architect / Pro Cloud Server Unauthenticated Binary-Protocol SQL Injection (CVE-2026-42096)https://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-42096-sparx-binary-protocol-sqli/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-42096-sparx-binary-protocol-sqli/Critical severity — network · CVE-2026-42096. Status: PoC. Affects: Sparx Systems Enterprise Architect / Pro Cloud Server (PCS). Tags: sqli, unauthenticated, sparx, enterprise-architect, pro-cloud-server, binary-protocol, python.networkCriticalsqliunauthenticatedsparxenterprise-architectpro-cloud-serverbinary-protocolpythonSequelize ORM JSON Cast SQL Injection — CVE-2026-30951https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-30951-sequelize-json-cast-sqli/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-30951-sequelize-json-cast-sqli/High severity — web · CVE-2026-30951. Status: PoC. Affects: Sequelize ORM v6 (Node.js). Tags: sequelize, sqli, orm, json-cast, nodejs, express, sqlite, boolean-based.webHighsequelizesqliormjson-castnodejsexpresssqliteboolean-basedProjeQtor Unauthenticated Login SQL Injection (CVE-2026-41462)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-41462-projeqtor-sqli/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-41462-projeqtor-sqli/Critical severity (CVSS 9.8) — web · CVE-2026-41462. Status: Weaponized. Affects: ProjeQtor project management tool. Tags: projeqtor, sqli, unauthenticated, login-bypass, stacked-queries, admin-creation, nuclei.webCriticalprojeqtorsqliunauthenticatedlogin-bypassstacked-queriesadmin-creationnucleiProFTPD mod_sql Pre-Auth SQL Injection Leading to RCE (CVE-2026-42167)https://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-42167-proftpd-sqli-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-42167-proftpd-sqli-rce/High severity (CVSS 8.1) — network · CVE-2026-42167. Status: PoC. Affects: ProFTPD (with mod_sql and SQL-backed logging configured). Tags: sqli, unauthenticated, proftpd, mod_sql, ftp, rce, backdoor, go.networkHighsqliunauthenticatedproftpdmod_sqlftprcebackdoorgoControl Web Panel Pre-Auth Blind SQL Injection to RCE — CVE-2026-57517https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-57517-cwp-blind-sqli-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-57517-cwp-blind-sqli-rce/Critical severity (CVSS 9.8) — web · CVE-2026-57517. Status: PoC. Affects: Control Web Panel (CWP) — user panel (port 2083). Tags: control-web-panel, cwp, sqli, into-dumpfile, webshell, unauth-rce, hosting-panel.webCriticalcontrol-web-panelcwpsqliinto-dumpfilewebshellunauth-rcehosting-panelBusiness Directory Plugin for WordPress — Unauthenticated Time-Based Blind SQL Injection (CVE-2026-2576)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-2576-business-directory-plugin-sqli/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-2576-business-directory-plugin-sqli/High severity (CVSS 7.5) — web · CVE-2026-2576. Status: Weaponized. Affects: Business Directory Plugin (Easy Listing Directories) for WordPress. Tags: wordpress, sqli, time-based-blind, business-directory-plugin, unauthenticated, cwe-89, wpdb, docker-lab.webHighwordpresssqlitime-based-blindbusiness-directory-pluginunauthenticatedcwe-89wpdbdocker-labDrupal Core PostgreSQL SQL Injection (CVE-2026-9082)https://poc.intelseclab.com/pocs/web/2026-05-30_drupal-core-postgresql-sql-injection/Sat, 30 May 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-05-30_drupal-core-postgresql-sql-injection/Critical severity — web · CVE-2026-9082 / SA-CORE-2026-004. Status: Patched. Affects: Drupal Core. Tags: SQLi, Drupal, PostgreSQL, JSON:API, unauthenticated, data-exfiltration.webCriticalSQLiDrupalPostgreSQLJSON:APIunauthenticateddata-exfiltration