Tools

heavyghost-le/poc_sql_injection_in_parse_server_prior_6.5.7_-_7.1.0

Advanced PostgreSQL database enumeration tool exploiting CVE-2024-39309 in Parse Server - Comprehensive SQL injection exploitation for security…

galisko/cve-2025-24799

Unauthenticated SQL injection exploit for GLPI versions before 10.0.18, enabling database enumeration, credential extraction, and API token…

cve-search/cve-search

Local CVE/CPE vulnerability database with search, ranking, web interface, and API for offline vulnerability analysis and management.

nabeelmkhan/cve-2026-78837

Proof-of-concept exploit for CVE-2026-78837, an unauthenticated SQL injection in AppNitro MachForm v30 allowing enumeration of database column names…

cerberusmrxi/phpmyadmin-cve-2020-5504-exploit

Authorized SQL injection exploitation framework for CVE-2020-5504 in phpMyAdmin, featuring automated database enumeration, blind injection, proxy…

wattocyber/custom-oscp-tooling

OSCP-focused toolkit for read-only network, SMB, AD, DNS, web, and database enumeration; privesc scanning, hash identification, and…

cerberusmrxi/cve-2026-44680-mikroorm-sql-injection-exploit-framework

PoC tool for CVE-2026-44680 affecting MikroORM ≤7.0.13. Exploits JSON path injection to extract database contents via UNION-based attacks. Features…

tjnull/cygor

An modular asset discovery framework written in python to automate the repeating manual work

fantasy-fql/esapi-sqlinjection-cve-2025-5878-exploit

Exploit for CVE-2025-5878 targeting ESAPI's encodeForSQL() method with OracleCodec, enabling time-based blind SQL injection. Supports database…

strobelpierre/cve-2026-9082

Semi-passive scanner that detects Drupal installations vulnerable to CVE-2026-9082 (PostgreSQL SQL injection) via fingerprinting, version detection,…

trailofbits/cvedb

CVE querying library and utility that uses a local store syncing directly to the National Vulnerability Database

nu1l0/cve-2024-46636-sqli-modaps

SQL Injection vulnerability in NASA EOSDIS MODAPS due to improper input validation in the `category` parameter. This flaw allows attackers to…

msd0pe-1/cve-2023-31714

Proof-of-concept exploit for CVE-2023-31714, a pre-authentication SQL injection in Chitor-CMS < 1.1.2. Automates database enumeration and credential…

ignitetechnologies/mssql-pentest-cheatsheet

Practical MSSQL penetration testing cheat sheet covering enumeration, linked-server pivoting, privilege escalation, persistence, and command…

codingo/nosqlmap

Automated NoSQL database enumeration and web application exploitation tool.

proxydom/supahunter

Automated reconnaissance and exploitation framework for misconfigured Supabase instances. Features schema enumeration, Selenium-based key extraction,…

amnnrth/cve-2025-14847

This script is used to identify MongoDB services that are network-exposed and allow unauthenticated protocol handshakes.