Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
nex-forms_SQL-Injection-CVE-2023-2114 — Quick Review about the SQL-Injection in the NEX-Forms Plugin for WordPress | Kitploit
Tools/GitHubGitHub/schmidalex/nex-forms_sql-injection-cve-2023-2114
Vulnerability AnalysisExploitationWeb Application ExploitationWeb SecurityPenetration Testing
GitHubschmidalex/nex-forms_sql-injection-cve-2023-2114

nex-forms_SQL-Injection-CVE-2023-2114

Quick Review about the SQL-Injection in the NEX-Forms Plugin for WordPress

View Repository

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share
23 years agoNot yet reviewed

nex-forms_SQL-Injection CVE-2023-2114

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-2114

https://wpscan.com/vulnerability/3d8ab3a5-1bf8-4216-91fa-e89541e5c43d

Quick Review about the SQL-Injection in the NEX-Forms Plugin for WordPress

Uploaded exploit

Note that this uploaded exploit code isnt for this particular vulnerability... But this is an example how you could make an exploit for this issue.

Vulnerable Versions

From Version 8.3 (Maybe earlier too) till version 8.4

The SQL-Injection itself

The SQL-Injection is placed in the authenticated area from NEX-Forms. When you edit a form and want to safe it, your client sends a post-request to the server with some parameters.

One of those parameters is called 'table' which is vulnerable. There was no sanitizing or filtering.

Screenshots

request save-button sql_error database

Download Tool