#1Database assessment, SQL injection testing, auditing, encryption, and activity monitoring tools.
Kitploit recommended
abraxas/cakephp-window-sqliCakePHP 5.4.2 - High - Remote - SQLi - WindowExpression range/frame offsets spliced into SQL
abraxas/moodle-enrol-database-sqliMoodle 5.2.3 - High - Remote - SQLi - enrol_database concatenates course idnumber into SQL
abraxas/phpmyadmin-auth-plugin-unquotedphpMyAdmin 5.2.3 - High - Remote - SQLi - auth plugin identifier unquoted
abraxas/phpmyadmin-designer-json-sqliphpMyAdmin 5.2.3 - High - Remote - SQLi - Designer JSON unsanitized identifiers
abraxas/postgres-basebackup-symlinkPostgreSQL 18.6 - High - Remote - File write - pg_basebackup follows absolute tar symlink leftover of CVE-2026-6475
yym8538/cve-2026-0603Proof-of-concept and Docker lab reproducing CVE-2026-0603, a second-order SQL injection in Hibernate ORM bulk DELETE/UPDATE operations, with…
abraxas/cve-2026-22599Python PoC and Docker lab for CVE-2026-22599, an authenticated SQL injection in Strapi's Content-Type Builder write API via Knex raw defaultTo.
yym8538/cve-2026-26980Python PoC and Docker lab demonstrating unauthenticated SQL injection in TryGhost Ghost CMS Content API slug filter, extracting database values via a…
yym8538/cve-2026-34220Proof-of-concept and Docker lab reproducing CVE-2026-43220, a MikroORM SQL injection via unvalidated __raw properties in custom type columns, with…
yym8538/cve-2026-30951Proof-of-concept and vulnerable Node.js/Express/Sequelize app demonstrating CVE-2026-30951, a JSON cast-type SQL injection in Sequelize v6 where…
4minx/cve-2026-48842Python PoC for CVE-2026-48842, a pre-auth SQL injection in Roundcube's virtuser_query plugin. Confirms the flaw via time-based differential and…
dev-sec/chef-mysql-hardeningThis chef cookbook provides security configuration for mysql.
0xsemz/magento-cve-2019-7139-sqli-pocPython proof-of-concept exploit for CVE-2019-7139, an unauthenticated SQL injection in Magento's product_frontend_action endpoint, enumerating…
qucklecrabik/cve-2026-23921Proof-of-concept exploit for CVE-2026-23921, a time-based blind SQL injection in Zabbix API via the sortfield parameter, enabling data extraction…
abraxas/cve-2026-77635Disclosure pack and Python PoC for CVE-2026-77635, an unauthenticated SQL injection in CakePHP's jsonValue() with PostgresDriver, including a…
abraxas/cve-2026-79752CVE-2026-79752 disclosure pack for CakePHP 5.2.13 SQL injection via FunctionsBuilder::cast, with a Python PoC script and Docker lab for authorized…
shentao83/news-8.6.0-cve-2026-8726-backportMinimal security backport for CVE-2026-8726 in georgringer/news 8.6.0
hex0user/cve-2025-69295Documents CVE-2025-69295, a blind SQL injection in the TeconceTheme Coven Core WordPress component, covering technical details, impact, and detection…
