Complete archive of 154 curated resources, newest first. The SQL Injection page shows the latest 50; the SQL Injection guide is the long-form write-up. This archive is not indexed by search engines.
| Added | Resource | Summary |
|---|---|---|
| 2026-09-17 NEW 2026 | From Bug to Schema: Exploring Error-Based SQL Injection on an Authenticating Portal intermediate AuthN | This paper details the discovery of an error-based SQL injection vulnerability within a production environment, identified through a Vulnerability Disclosure Program (VDP). The analysis focuses on how the vulnerability was found and exploited. The content emphasizes that this case study is for educational purposes, and all sensitive organizational data has been anonymized. No specific bounty payout amount is mentioned. → infosecwriteups.com |
| 2026-09-03 2026 | Over 3 Million WordPress Sites Affected by Migration Plugin Vulnerability news 2 min read | Vulnerability in the All-in-One WP Migration and Backup WordPress plugin, CVE-2026-19949, allows unauthenticated remote code execution. The flaw, a second-order SQL injection, exploits insufficiently escaped user input within the archive restore functionality. Attackers can leverage WordPress trackback functionality to extract a secret key, then use it to import a malicious .wpress archive containing a must-use plugin for RCE. Versions up to 7.109 are affected; version 7.110 patches the issue. → securityweek.com |
| 2026-08-31 2026 | ServiceNow Patches 3 Critical Code Injection Vulnerabilities news 2 min read | Reference to CVE-2026-18885, CVE-2026-18886, CVE-2026-74820, and CVE-2026-6876, critical vulnerabilities affecting the ServiceNow AI platform. These include three code injection flaws allowing arbitrary code execution, improper access control enabling data modification and privilege escalation, and an SQL injection vulnerability for database manipulation. Additionally, a high-severity sandbox escape flaw permits unauthenticated code execution. All exploit low-complexity attacks and do not require authentication or user interaction. → securityweek.com |
| 2026-08-28 2026 | Three CVSS 10.0 ServiceNow Flaws Could Let Unauthenticated Attackers Execute Code and SQL news 4 min read | Advisory detailing three CVSS 10.0 ServiceNow vulnerabilities, including CVE-2026-18885 (code injection), CVE-2026-18886 (improper access control), and CVE-2026-74820 (SQL injection), which allow unauthenticated attackers to execute arbitrary code and manipulate data. Also covers CVE-2026-6876, an 8.7 rated sandbox escape. Patches are available for affected Xanadu, Yokohama, Zurich, and Australia versions. → thehackernews.com |
| 2026-08-28 2026 | ServiceNow warns of three max severity security vulnerabilities news 2 min read | Advisory on three maximum-severity ServiceNow AI Platform vulnerabilities, including CVE-2026-18885 (code injection), CVE-2026-18886 (privilege escalation via code injection), and CVE-2026-74820 (SQL injection). These critical flaws, along with a high-severity sandbox escape (CVE-2026-6876), can be exploited by unauthenticated attackers with low complexity. Previous attacks have chained ServiceNow vulnerabilities, such as CVE-2024-4879, CVE-2024-5178, and CVE-2024-5217, for data theft. → bleepingcomputer.com |
| 2026-08-26 2026 | Metabase flaw hands attackers admin access with no login and it is already being exploited news | A critical vulnerability in Metabase, an open-source business intelligence tool, allows attackers to gain administrator access without authentication. This severe flaw is actively being exploited in the wild. The vulnerability, if exploited, could lead to complete system compromise. Users are strongly advised to update their Metabase instances immediately to patch this security hole. Further details on the exploit and mitigation can be found at the provided link. |
| 2026-08-26 2026 | From SQL Injection to Remote Code Execution: Following an Unexpected Attack Chain intermediate RCE | This write-up details a vulnerability discovery, responsibly disclosed and patched. The author stumbled upon an attack chain that escalated from an SQL injection to remote code execution. The technical details, including payloads and command output, are presented to illustrate the technique, with sensitive information redacted for security. The author emphasizes that the discovery was unexpected. → infosecwriteups.com |
| 2026-08-24 2026 | SQL injection remains a persistent cyber threat after two decades beginner 3 min read | Survey of SQL injection vulnerabilities, detailing how the persistent threat, despite being well-understood for over two decades, continues to impact organizations globally. This entry highlights significant past incidents like the Heartland Payment Systems breach (2008-2009), Sony attacks (2011), TalkTalk (2015), and the 2023 MOVEit Transfer breach, underscoring the severe consequences including data theft, financial losses, and reputational damage. It emphasizes that implementation weaknesses, inadequate governance, and insufficient developer awareness, rather than a lack of available security measures, allow SQLi to persist. |
| 2026-08-19 2026 | Early exploitation attempts observed of GeoServer zero day news 3 min read | Analysis of a GeoServer zero-day unauthenticated SQL injection vulnerability in `jsonArrayContains` reveals early internet-wide scanning and exploitation attempts. This flaw, potentially leading to remote code execution on H2 database deployments, echoes past real-world compromises like the 2024 breach of a U.S. federal agency exploiting CVE-2024-36401. Organizations should identify exposed GeoServer instances, monitor for suspicious activity, and await vendor patches. |
| 2026-08-18 2026 | They patched their SaaS and left the self-hosted OSS version vulnerable - AppFlowy Authenticated SQL Injection news 3 min read AuthZ | Writeup detailing an authenticated SQL injection vulnerability in the self-hosted open-source version of AppFlowy. The vulnerability exists in the `search_term` parameter for the `/api/workspace/{workspace-id}/quick-note` endpoint, allowing authenticated users to exfiltrate, modify, or delete database contents via unsanitized input embedded into JSON path queries. The AppFlowy team confirmed the issue was patched in their commercial cloud offering but remained silent regarding the open-source version. |
| 2026-08-17 2026 | Trezor Data Breach Analysis: 14000 Customers Exposed in ShipMonk Metabase SQL Injection Incident news 4 min read | Analysis of the Trezor data breach reveals a SQL injection vulnerability in ShipMonk's Metabase instance, exploited by attackers to exfiltrate PII of 14,000 customers. This incident highlights supply chain risks within the crypto sector, featuring MITRE ATT&CK techniques T1190 and T1068, and involves the ShinyHunters group for extortion. The breach exposed customer names, addresses, phone numbers, and emails, increasing phishing and social engineering risks for affected individuals. → rescana.com |
| 2026-08-12 2026 | Critical SQL Injection in Metabase via Password Reset: CVE-2026-72898 news 3 min read AuthN | Writeup of CVE-2026-72898, a critical SQL injection vulnerability in Metabase's password reset functionality. This unauthenticated flaw, with a CVSS score of 10.0, allows attackers to execute arbitrary SQL against the application database by exploiting undeclared fields in the request body. Exploitation can lead to administrative access and compromise of connected databases. Immediate upgrades to patched versions are strongly advised, along with auditing administrator accounts and reviewing logs for unauthorized activity. → bishopfox.com |
| 2026-08-11 2026 | Inside the Metabase SQLi: Exploited in the Wild news 4 min read | Writeup of GHSA-vwf4-m7j8-wcjf, a zero-day SQL Injection vulnerability in Metabase versions 1.58+, exploited in the wild. This analysis details the reverse engineering process, including decompiling Clojure code and identifying how Clojure's `merge` function, JSON keywordization, and HoneySQL's `:raw` keyword enable arbitrary blind SQL injection via the `/api/session/reset_password` endpoint. Recommendations include checking `/api/session/properties` and testing exploitability with a specific `curl` command. → wiz.io |
| 2026-08-10 2026 | Inside the Metabase SQLi: Exploited in the Wild news 4 min read | Writeup of the Metabase SQLi vulnerability, present in versions 1.58+, that targets the `/api/session/reset_password` endpoint. This vulnerability leverages Clojure's `merge` function, JSON keywordization, and HoneySQL's `:raw` keyword to achieve blind SQL injection. Wiz Research reverse-engineered the vulnerability, noting that versions 0.58.22 and 0.58.24 were affected, and patched versions are available. → wiz.io |
| 2026-08-08 2026 | Metabase Zero-Day Exploited in Wild Allows Admin Access Without Authentication news 2 min read | Writeup on a zero-day vulnerability impacting Metabase versions prior to specific patches, allowing unauthenticated remote attackers to inject SQL and gain administrator access. This critical flaw, with a CVSS score of 10.0, enables attackers to alter configurations, steal credentials, and read or export sensitive data. Affected versions include ranges within 0.58.0 through 0.63.0. Indicators of compromise involve specific API call patterns, and mitigation includes patching, blocking the `/api/session/reset_password` endpoint, and performing post-incident security checks. Framework was a reported victim, experiencing data exfiltration of customer PII. → thehackernews.com |
| 2026-08-07 2026 | Attackers Compile khunt Inside Oracle to Turn SQL Injection Into Windows SYSTEM Access intermediate 2 min read | Library of scripts and techniques for attackers to compile post-exploitation toolkits like khunt directly within Oracle databases. This method bypasses traditional endpoint detection by creating Java stored procedures that execute arbitrary commands on the Windows host, leveraging SQL injection flaws in web applications to gain initial access and then using Oracle's embedded JVM to achieve SYSTEM-level code execution. The toolkit includes components for command execution, credential theft, file manipulation, and archive unpacking. → thehackernews.com |
| 2026-08-06 2026 | Attackers hid malware inside Oracle Database after SQL injection breach intermediate 2 min read | Analysis of a campaign detailing attackers exploiting SQL injection to hide custom Java malware, dubbed Khunt, within Oracle databases. The technique leverages Oracle's embedded Java Virtual Machine (OJVM) to upload, compile, and execute malicious code directly from database objects, enabling persistent footholds and facilitating post-exploitation activities like credential theft and SYSTEM-level command execution by blending with legitimate database functionality. Huntress recommends monitoring for unexpected Java source objects and compiled classes in Oracle environments. → csoonline.com |
| 2026-08-06 2026 | Oracle SQL Injection Attack Enables Remote Code Execution intermediate 4 min read | Writeup detailing an Oracle SQL injection attack that achieved remote code execution by abusing `CREATE JAVA SOURCE` functionality. Threat actors deployed the `khunt` toolkit within the Oracle database, leveraging modules like `KhuntCmd` for OS command execution and `KhuntHash` for credential theft. This technique highlights how legitimate database features can be weaponized, underscoring the need for secure coding, least-privilege access, enhanced Oracle monitoring, and robust incident response. → esecurityplanet.com |
| 2026-08-05 2026 | Hackers run khunt post-exploitation toolkit from Oracle database advanced 2 min read | Toolkit for post-exploitation using Oracle database integration, discovered by Huntress. This attack leveraged a SQL injection vulnerability in a Java application to embed the "khunt" toolkit as Java objects within an Oracle database. The toolkit included components like KhuntCmd for OS command execution, KhuntHash for credential theft, and KhuntFS for file management, all triggered via SQL commands to gain SYSTEM-level privileges and potentially exfiltrate sensitive data like registry hives. → bleepingcomputer.com |
| 2026-08-05 2026 | Hackers Smuggle Post-Exploitation Toolkit Into Oracle Database Via Classic SQL Injection Flaw intermediate 3 min read | Library that details how a SQL injection vulnerability in a public-facing web application was used to smuggle a custom post-exploitation toolkit named "khunt" into an Oracle database. The attackers abused the `CREATE JAVA SOURCE` command to store and compile Java code as database objects, allowing them to run arbitrary OS commands from within the database, pivot to the underlying Windows server, and exfiltrate registry hives and system information. This technique, sometimes called "oraexec," exploits a blind spot in traditional endpoint security tooling. |
| 2026-08-04 2026 | Prompt Injection tops 2026 OWASP GenAI / LLM Top Ten vulnerabilities news 3 min read | Survey of the 2026 OWASP GenAI / LLM Top Ten vulnerabilities, confirming prompt injection as the top risk, followed by sensitive information disclosure and excessive agency. Unlike SQL injection, prompt injection lacks a definitive fix and requires continuous management. Excessive agency is rising due to increasingly autonomous AI agents with expanded capabilities like web browsing and tool execution, necessitating tightly scoped permissions and monitoring. The latest OWASP list is grounded in real-world incident data rather than solely expert opinion. |
| 2026-08-04 2026 | New cPanel Critical Flaw Could Let Hosting Customers Run SQL as Database Root news 3 min read | Reference to CVE-2026-58048 details a critical privilege escalation vulnerability in cPanel allowing authenticated hosting customers to execute arbitrary SQL commands as the database root. This flaw, stemming from an issue in the database renaming process where SQL mode is not preserved, can lead to operating-system-level compromise. The advisory also touches upon CVE-2026-58047, an HTTP request-smuggling issue in cpsrvd, and GCVE-25-2026-07-45-3 and GCVE-25-2026-07-45-1 related to Exim's unsafe string expansion and local directory traversal, respectively. → thehackernews.com |
| 2026-07-30 2026 | Snowflake SQL Injection via Compile-Time Constant Folding with SYSTEM$WAIT advanced 7 min read | Library for exploiting Snowflake SQL injection vulnerabilities by leveraging compile-time constant folding with the SYSTEM$WAIT function. This technique forces errors during the compilation phase, rather than execution, allowing the extraction of sensitive information through verbose compilation error messages, bypassing application-level error handling that suppresses runtime failures. → infosecwriteups.com |
| 2026-07-29 2026 | Discovering an Time-Based Blind SQL Injection in a Tamil Nadu Government Web Portal (TANGEDCO) intermediate 3 min read Bug Bounty | Writeup detailing an Oracle Time-Based Blind SQL Injection found in the TANGEDCO government web portal's password recovery function. The writeup explains how the vulnerability was identified by observing server response delays when using `DBMS_PIPE.RECEIVE_MESSAGE` and discusses its potential impact, including sensitive data extraction and bypassing application logic. It emphasizes the importance of parameterized queries and secure coding practices for prevention. → infosecwriteups.com |
| 2026-07-23 2026 | SQL injection isn't dead beginner 6 min read | Library for application security, Aikido Zen, acts as an in-app firewall that detects and blocks SQL injection attacks at runtime by monitoring user input as it approaches data sinks. It complements static analysis and AI-driven pentesting by providing a RASP solution that understands dangerous inputs at the code level, offering a crucial safety net for vulnerabilities that slip through secure coding practices or exist in dependencies. This approach is vital given the persistent threat of SQL injection, as highlighted by recent WordPress core vulnerabilities and ongoing challenges with secure coding, AI-generated code, and legacy systems. → aikido.dev |
| 2026-07-22 2026 | SQL injection isn't dead beginner 6 min read | Library for runtime protection against SQL injection, defending against vulnerabilities like the recent WordPress core flaw (CVE-2024-42005). This RASP solution, Aikido Zen, acts as an in-app firewall, blocking malicious input before it reaches data sinks. It complements static analysis by catching complex, logic-dependent injections that bypass traditional scanners and AI code generation, providing a crucial safety net for applications. → aikido.dev |
| 2026-07-21 2026 | Hackers Exploit Newly Patched WordPress Vulnerabilities news 3 min read | Writeup detailing the WP2Shell attack chain, which chains two WordPress Core vulnerabilities, CVE-2026-63030 and CVE-2026-60137, to achieve pre-authentication remote code execution. This allows attackers to run arbitrary shell commands on vulnerable websites without needing to log in. The vulnerabilities affect the core software, not just plugins, and have been observed in active exploitation. → techrepublic.com |
| 2026-07-20 2026 | Vulnerabilities in Windu CMS software news | Writeup on CERT Polska's coordinated disclosure of vulnerabilities in Windu CMS, specifically detailing CVE-2026-57309 (Blind SQL injection), CVE-2026-57310 (insecure password hashing with MD5/SHA1 static salt), and CVE-2026-57311 (arbitrary file upload leading to RCE), all confirmed in version 4.1. → cert.pl |
| 2026-07-19 2026 | From SQL Injection to Infrastructure-Level RCE: A PostgreSQL Superuser Compromise advanced 1 min read RCE | Writeup detailing a PostgreSQL superuser compromise, initiated by an SQL injection vulnerability in the `pJobNumber` parameter of a financial management web portal (`vsswb`). The exploit chain demonstrates unauthenticated Remote Code Execution (RCE) by leveraging `UNION SELECT` to extract database version and user information, revealing the application's use of the native `postgres` account. This superuser access allows for mass data exposure, including PII from tables like `public.vss01tpemployee`. → infosecwriteups.com |
| 2026-07-18 2026 | Unauthenticated RCE in WordPress core (wp2shell), via SQL injection intermediate 3 min read RCE | Library for runtime protection against SQL injection, including the unauthenticated RCE in WordPress core (wp2shell) via REST API batch-route confusion and SQL injection. Aikido Zen's embedded firewall blocks SQL injection, command injection, and path traversal at runtime, providing a defense for unpatched systems while updates are deployed. Aikido Intel tracks this vulnerability and others across open-source ecosystems in real-time. → aikido.dev |
| 2026-07-17 2026 | Unauthenticated RCE in WordPress core (wp2shell) news 3 min read | Library for runtime protection, Aikido Zen, offers an embedded firewall to block unauthenticated RCE via SQL injection in WordPress core, specifically targeting versions 6.9.0-6.9.4 and 7.0.0-7.0.1. This vulnerability, described as a REST API batch-route confusion and SQL injection issue, can be exploited by anonymous attackers. While immediate patching to 7.0.2 or 6.9.5 is paramount, Zen provides a temporary runtime defense against the SQL injection, preventing exploitation while updates are deployed. The vulnerability is tracked in Aikido Intel, a real-time feed of open-source vulnerabilities. → aikido.dev |
| 2026-07-16 2026 | The Security Bug That Almost Shipped news | A critical security vulnerability was discovered in an open-source project, narrowly avoiding inclusion in a production release. The bug, identified just before the planned deployment, would have allowed attackers to bypass authentication checks. Prompt action by the security team and developers prevented the issue from reaching users, highlighting the importance of last-minute security reviews. The content does not mention a specific bug bounty payout amount. → hackernoon.com |
| 2026-06-30 2026 | Vulnerabilities in Redeight CMS software news 1 min read | Analysis of Redeight CMS version 1.0 vulnerabilities, including CVE-2026-53690, an SQL injection via the userEmail parameter on the login endpoint, CVE-2026-53691, an unrestricted file upload leading to RCE through the FileAdd endpoint, and CVE-2026-53692, weak password storage using unsalted MD5. → cert.pl |
| 2026-06-24 2026 | Getting started with query parameterization beginner 8 min read | Library for preventing SQL injection attacks by demonstrating query parameterization with prepared statements and stored procedures. It details implementing parameterized queries using placeholders, precompiling statements with `Prepare()` for reuse, and utilizing stored procedures for greater control and security. Additional measures like input sanitization and validation are also discussed to bolster database querying defenses. → snyk.io |
| 2026-06-22 2026 | Vibe-Coding's Hidden Danger: SQL Injection Risks Go Live intermediate 3 min read | Analysis of SQL injection vulnerabilities in AI-generated "vibe-coding" applications, exemplified by the Boomberg website incident. This highlights how developers using tools like OpenAI, GitHub Copilot, and Google's offerings can inadvertently introduce common security flaws, such as those detailed in the OWASP Top 10, due to a lack of deep understanding of the generated code's underlying security implications. |
| 2026-06-21 2026 | Preventing SQL injection attacks in Node.js beginner 8 min read | Library for Node.js developers detailing SQL injection prevention techniques, including constructing vulnerable Express applications with PostgreSQL to demonstrate how user input manipulation leads to data leaks. It emphasizes using query placeholders and prepared statements with the `pg` library, validating and sanitizing input via `express-validator`, and utilizing tools like `npm audit` and the Snyk IDE extension for identifying known vulnerabilities in dependencies. → snyk.io |
| 2026-06-18 2026 | Preventing SQL injection in C# with Entity Framework intermediate 5 min read | Library for preventing SQL injection in C# applications utilizing Entity Framework. It details secure methods like LINQ queries, `FromSqlInterpolated`, and safe `FromSqlRaw` usage with explicit parameters, contrasting them with vulnerable string concatenation. The entry emphasizes using prepared statements and parameterization to treat user input strictly as data, and recommends code scanning tools like Snyk Code for detecting insecure constructions. → snyk.io |
| 2026-06-17 2026 | Rapid7 Analysis: CVE-2024-12356 news 35 min read | Analysis of CVE-2024-12356, a critical unauthenticated RCE in BeyondTrust Privileged Remote Access and Remote Support, reveals it was exploited as a zero-day alongside a newly discovered PostgreSQL vulnerability, CVE-2025-1094. Rapid7's research indicates CVE-2024-12356, more accurately an argument injection (CWE-88) than command injection (CWE-77), often relies on CVE-2025-1094 for RCE. While the BeyondTrust patch addresses both vulnerabilities, Rapid7 also found a method to exploit CVE-2025-1094 independently in certain implementations. → rapid7.com |
| 2026-06-15 2026 | Anatomy of a Critical SQL Injection: Lessons From CVE-2020-24932 intermediate | This content details a critical SQL injection vulnerability, CVE-2020-24932, providing an in-depth analysis of its mechanics. The article likely explores how the vulnerability was exploited, its potential impact, and lessons learned for developers and security professionals. The focus is on understanding the technical aspects of the SQL injection to prevent similar incidents in the future. No bug bounty payout amount is mentioned in the provided content. → hackernoon.com |
| 2026-06-12 2026 | Making A SQLi Lab Is Not Difficult, Build One With Me. beginner | This content is the second part of a series on building a SQL injection (SQLi) lab. The author highlights SQLi's intrusiveness, noting that it doesn't require privilege escalation and, in this lab's case, can be exploited without tools like Burp. The author also shares an inside joke about pronouncing "SQL" as "skweel." No specific bug bounty payout amount is mentioned in this excerpt. → infosecwriteups.com |
| 2026-06-11 2026 | From SQLi to RCE - Exploiting LangGraphs Checkpointer intermediate 6 min read | Library patches address vulnerabilities in LangGraph's AI agent checkpointer, allowing SQL injection (CVE-2025-67644, CVE-2026-27022) to chain into unsafe msgpack deserialization (CVE-2026-28277) for remote code execution. Vulnerable SQLite and Redis checkpointers are affected when `get_state_history()` is exposed with a user-controlled filter, enabling attackers to inject malicious msgpack payloads for arbitrary code execution. |
| 2026-06-10 2026 | SQL Injection in Password Reset: Full Database, One Email intermediate AuthN | A critical SQL injection vulnerability in a password reset function granted a researcher full read access to an entire database, including user records and password hashes. The vulnerability was discovered through a `ukey` parameter in a password reset email. Despite being reported in early 2025, the issue remained live at the time of the report. The researcher was able to extract all data from every table. No specific bounty payout amount was mentioned. → infosecwriteups.com |
| 2026-05-26 2026 | Ghost CMS Vulnerability Exploited to Hack Over 700 Websites news 2 min read | Writeup of CVE-2026-26980, an SQL injection vulnerability in Ghost CMS, details how threat actors exploited it for mass attacks. Unauthenticated attackers can extract sensitive data, including authentication tokens and user credentials. The vulnerability was leveraged to obtain Admin API Keys, allowing malicious JavaScript loaders for ClickFix attacks to be injected into articles. Over 700 websites, including those of DuckDuckGo, Harvard University, and Oxford University, were compromised by at least two active threat groups. → securityweek.com |
| 2026-05-25 2026 | Ghost CMS CVE-2026-26980 Exploited to Hijack 700 Sites for ClickFix Attacks news 3 min read | Writeup of CVE-2026-26980 in Ghost CMS, an SQL injection vulnerability allowing unauthenticated attackers to hijack admin API keys and poison over 700 sites. Threat actors injected malicious JavaScript loaders, often powered by Adspect, to facilitate ClickFix attacks through fake CAPTCHA pages and ultimately deliver malware like a modified Grape desktop client or a PuTTY client. The vulnerability was addressed in Ghost CMS version 6.19.1. → thehackernews.com |
| 2026-05-14 2026 | Avada Builder Flaws Expose One Million WordPress Sites news 1 min read | Analysis of CVE-2026-4782 and CVE-2026-4798 in Avada Builder, two vulnerabilities affecting nearly one million WordPress sites. The arbitrary file read flaw, CVSS 6.5, allows authenticated subscribers to read sensitive files like wp-config.php via the fusion_section_separator shortcode. The time-based SQL injection, CVSS 7.5, impacts sites with deactivated WooCommerce, exploiting an unescaped product_order parameter. Patches were released in versions 3.15.2 and 3.15.3. → infosecurity-magazine.com |
| 2026-05-13 2026 | Bug hunter tracks down three serious MCP database flaws one left unpatched news 3 min read | Writeup detailing three critical vulnerabilities discovered in MCP databases by a security researcher. One of these flaws, impacting Apache and Alibaba databases, remains unpatched by the vendor, highlighting ongoing supply chain security risks within open-source software. The article emphasizes how AI-driven tools are increasing vulnerability discovery rates, leading to a surge in patches and a growing "vulnpocalypse." → theregister.com |
| 2026-05-11 2026 | U.S. CISA adds a flaw in BerriAI LiteLLM to its Known Exploited Vulnerabilities catalog news 2 min read | CVE-2026-42208 is a critical SQL injection vulnerability in BerriAI LiteLLM versions 1.81.16 to 1.83.6, allowing unauthenticated attackers to access and potentially modify database data via a crafted Authorization header. This flaw was added to CISA's Known Exploited Vulnerabilities catalog due to rapid real-world exploitation observed shortly after disclosure, with attackers targeting sensitive information like virtual API keys and credentials. A fix is available in LiteLLM version 1.83.7. → securityaffairs.com |
| 2026-04-30 2026 | CVE-2026-42208: Critical Pre-Auth SQL Injection in LiteLLM Actively Exploited Within 36 Hours of Disclosure news 4 min read | Writeup of CVE-2026-42208, a critical pre-authentication SQL injection in LiteLLM, which was actively exploited within 36 hours of disclosure. Attackers leveraged improper handling of the HTTP Authorization header to inject SQL into PostgreSQL databases, targeting sensitive data like API keys and provider credentials. Exploitation involved schema enumeration and targeted UNION SELECT payloads, originating from IP addresses associated with 3xK Tech GmbH. Mitigation requires upgrading LiteLLM, rotating credentials, and auditing logs for suspicious activity. → rescana.com |
| 2026-04-30 2026 | CVE-2026-42208: LiteLLM SQL Injection Leaks Upstream API Keys news 7 min read AI | Writeup on CVE-2026-42208 detailing a pre-authentication SQL injection vulnerability in the LiteLLM AI gateway. This critical flaw, with a CVSS score of 9.3, allows attackers to extract all upstream API keys stored by LiteLLM, including those for OpenAI, Anthropic, and Google. Exploitation occurred rapidly after disclosure, underscoring the need to upgrade to LiteLLM version 1.83.7-stable immediately and rotate all exposed API keys. |
| 2026-04-29 2026 | CVE-2026-42208: LiteLLM bug exploited 36 hours after its disclosure news 2 min read AI | Writeup of CVE-2026-42208 in LiteLLM, an SQL injection vulnerability in the proxy API key verification. Attackers exploited this flaw rapidly, within 36 hours of its disclosure, targeting sensitive data like virtual API keys and provider credentials by crafting malicious Authorization headers. The vulnerability affected LiteLLM versions 1.81.16 to 1.83.6 and was patched in 1.83.7. → securityaffairs.com |
| 2026-04-29 2026 | Fresh LiteLLM Vulnerability Exploited Shortly After Disclosure news 2 min read AI | Library for securing AI gateways; a critical-severity SQL injection vulnerability (CVE-2026-42208, CVSS 9.3) in LiteLLM allowed unauthenticated attackers to exfiltrate database credentials and API keys by exploiting the proxy API key verification process. Attacks were observed shortly after disclosure, targeting database tables containing sensitive information. LiteLLM version 1.83.7 resolves this by properly parameterizing database queries. → securityweek.com |
| 2026-04-29 2026 | 38 Vulnerabilities Found in OpenEMR Medical Software news 1 min read Mobile | Analysis of OpenEMR reveals 38 CVE-assigned vulnerabilities, including critical SQL injection flaws (CVE-2026-24908, CVE-2026-23627) allowing database compromise and PHI exfiltration, and an authorization bypass (CVE-2026-24487) exposing patient data. These issues, primarily stemming from authorization flaws, were identified by Aisle and have since been patched by OpenEMR developers. → securityweek.com |
| 2026-04-29 2026 | LiteLLM CVE-2026-42208 SQL Injection Exploited within 36 Hours of Disclosure news 2 min read | Writeup of CVE-2026-42208, a critical SQL injection vulnerability in BerriAI's LiteLLM Python package, actively exploited within 36 hours of disclosure. The flaw, affecting versions between 1.81.16 and 1.83.7, allowed unauthenticated attackers to modify the LiteLLM proxy database, potentially accessing and altering credentials for LLM providers like OpenAI, Anthropic, and AWS. Exploitation attempts targeted tables such as `litellm_credentials.credential_values`, suggesting attackers sought to compromise cloud-grade credentials managed by the AI gateway. → thehackernews.com |
| 2026-04-28 2026 | Hackers are exploiting a critical LiteLLM pre-auth SQLi flaw news 2 min read | Library for securing LiteLLM, an open-source LLM gateway, against the CVE-2026-42208 pre-authentication SQL injection vulnerability. Attackers exploit this flaw in the API key verification step to access and modify sensitive data, including API keys, credentials, and environment secrets. The vulnerability allows unauthorized access to the proxy and managed credentials, with active exploitation observed targeting specific tables containing secrets from providers like OpenAI and Anthropic. A fix is available in LiteLLM version 1.83.7. → bleepingcomputer.com |
| 2026-04-22 2026 | CVE-2025-1094: PostgreSQL SQL Injection Vulnerability news 3 min read | Writeup of CVE-2025-1094, a critical SQL injection vulnerability in PostgreSQL affecting PQescapeLiteral(), PQescapeIdentifier(), PQescapeString(), and PQescapeStringConn() functions, as well as the psql terminal. Exploitation is possible through improper neutralization of quoting syntax and invalid multibyte characters, potentially leading to arbitrary code execution. Versions prior to 17.3, 16.7, 15.11, 14.16, and 13.19 are affected. |
| 2026-04-22 2026 | SQLMap Tamper Collection: Modern WAF Bypass Scripts (Cloudflare, AWS, Azure) intermediate 4 min read | Library for context-aware SQL transformation and WAF bypass, supporting Cloudflare, AWS, and Azure. It features a full SQL lexer with UUID tracking, multi-character operator support, and deterministic output preserving SQL validity. Transformations include keyword wrapping, space replacement, value encoding, and case alternation, with advanced options like homoglyphs and numeric obfuscation. The framework maintains SQL structure, handles nested subqueries, and offers reapplication protection, designed primarily for MySQL syntax. |
| 2026-04-22 2026 | SQL Injection and Postgres: An Adventure to Eventual RCE intermediate 21 min read | Library for leveraging PostgreSQL functions to achieve Remote Code Execution (RCE) via SQL Injection. This resource details exploiting an ORDER BY clause injection in a Flask application, demonstrating techniques for data exfiltration using error messages and the `query_to_xml` function to bypass row limitations and achieve command execution as the database user. |
| 2026-04-22 2026 | Pentesting PostgreSQL with SQL Injections intermediate 11 min read | Library for analyzing and exploiting SQL injection vulnerabilities specifically targeting PostgreSQL. It details bypass methods for web application firewalls, techniques for data exfiltration across various query clauses including SELECT, WHERE, FROM, and ORDER BY, and demonstrates how to exploit nested queries. The resource covers bypassing spaces, trailing data, quotation marks using dollar quoting or `CHR()` function, and utilizes time-based blind SQL injection with concatenation and conditional logic for data leakage. → onsecurity.io |
| 2026-04-22 2026 | NoSQL Injection: Advanced Exploitation Guide advanced 8 min read | Guide to exploiting NoSQL injection vulnerabilities, detailing how improper input sanitization allows attackers to bypass authentication on MongoDB and other databases. It covers identifying injections by manipulating syntax and using operators like `$gt` and `$ne`, and demonstrates advanced techniques such as extracting data through time delays using the `$where` operator. → intigriti.com |
| 2026-04-22 2026 | Exploits Explained: NoSQL Injection Returns Private Information beginner 4 min read | Writeup detailing a NoSQL injection vulnerability discovered in an application's `/api/[CLIENT_NAME]/Customers` and `/api/[CLIENT_NAME]/CustomerLogins` endpoints. The author leveraged MongoDB query operators, specifically `gt`, to bypass filters and extract sensitive PII, including email addresses, usernames, password hashes, and phone numbers, from the administrator user. The exploit involved manipulating the `$filter` parameter to retrieve data beyond the intended scope. |
| 2026-04-22 2026 | CVE-2025-52694 PoC: Critical SQL Injection in Advantech IoTSuite/SaaS-Composer news 1 min read | Toolchain for CVE-2025-52694, a critical unauthenticated SQL Injection vulnerability impacting Advantech IoTSuite/SaaS-Composer products prior to specific versions. The PoC offers a standalone Python script for time-based SQL injection tests and a nuclei template utilizing a clusterbomb attack to discover vulnerable `org_id` values. Exploitation allows for database dumping, data modification, and potential RCE by unsafely concatenating the `filename` parameter into PostgreSQL queries. |
| 2026-04-22 2026 | MCP Vulnerability Case Study: SQL Injection in the Postgres MCP Server intermediate 8 min read | Writeup on a SQL injection vulnerability in Anthropic's reference Postgres MCP server, allowing arbitrary SQL execution by terminating the read-only transaction with a `COMMIT;` statement. Though deprecated, the `@modelcontextprotocol/server-postgres` NPM package and `mcp/postgres` Docker image see significant weekly downloads. The vulnerability is patched in the Zed Industries fork (`@zeddotdev/postgres-context-server` v0.1.4) and an unreleased reference implementation. Users should avoid the deprecated server for sensitive data and consider the Zed Industries fork for mitigation. → securitylabs.datadoghq.com |
| 2026-04-22 2026 | BWAFSQLi: Bypassing Web Application Firewall with Adversarial SQL Injections advanced | BWAFSQLi: Bypassing Web Application Firewall with Adversarial SQL Injections → dl.acm.org |
| 2026-04-19 2026 | Unauthenticated SQL Injection in GUI — Fortinet PSIRT intermediate | Analysis of unauthenticated SQL injection in FortiWeb's GUI, allowing code execution via crafted HTTP/HTTPS requests. This vulnerability (CWE-89) has been observed exploited in the wild, with a workaround involving disabling the administrative interface. The report originates from Fortinet PSIRT, with credit to Kentaro Kawane. |
| 2026-04-19 2026 | CVE-2025-1094 WebSocket and SQL Injection Exploit Script news 2 min read | Exploit script for CVE-2025-1094, a PostgreSQL vulnerability enabling SQL Injection to achieve Remote Code Execution. This proof of concept demonstrates hijacking WebSocket connections after injecting malicious SQL using `lo_export` to read sensitive files, ultimately establishing a reverse shell. The script requires configuration of attacker IP/port, target URL, and WebSocket URL. |
| 2026-04-19 2026 | CVE-2025-1094: PostgreSQL psql SQL Injection (Fixed) — Rapid7 news 3 min read | Analysis of CVE-2025-1094, a high-severity SQL injection vulnerability in PostgreSQL's psql tool, impacting versions prior to 17.3, 16.7, 15.11, 14.16, and 13.19. Discovered by Rapid7, this flaw, with a CVSS 3.1 score of 8.1, arises from improper handling of escaped untrusted input containing invalid UTF-8 characters. Exploitation can lead to arbitrary code execution via meta-commands or arbitrary SQL statement execution. This vulnerability was found to be a prerequisite for exploiting CVE-2024-12356 against BeyondTrust products, though both are now patched. → rapid7.com |
| 2026-04-19 2026 | PostgreSQL CVE-2025-1094: Quoting APIs SQL Injection intermediate | Library detailing SQL injection vulnerabilities in PostgreSQL's quoting APIs, specifically PQescapeLiteral(), PQescapeIdentifier(), PQescapeString(), and PQescapeStringConn(). The vulnerability, identified as CVE-2025-1094, allows attackers to inject SQL when application inputs are constructed into psql commands. It also affects command-line utilities under specific client and server encoding conditions (BIG5, EUC_TW, MULE_INTERNAL). Versions prior to PostgreSQL 17.3, 16.7, 15.11, 14.16, and 13.19 are affected. |
| 2026-04-19 2026 | CVE-2025-26794: Blind SQL Injection in Exim 4.98 — Writeup intermediate 4 min read | Writeup detailing CVE-2025-26794, a blind SQL injection vulnerability in Exim 4.98 when SQLite is used as the DBM. The vulnerability arises from unsanitized SQL parameters within the ETRN command's semaphore handling in `hintsdb.h`, allowing remote users to craft malicious SQLite queries. This writeup covers the exploitation vector via the ETRN command to manipulate Exim's internal SQLite database, potential impacts including DoS and hypothetical RCE, and provides a Docker lab for reproduction. |
| 2026-04-17 2026 | April 2026 Patch Tuesday: Critical Vulnerabilities in SAP Adobe Microsoft SharePoint Fortinet and ColdFusion Threaten Enterprise Security news 6 min read | Advisory detailing critical vulnerabilities patched in April 2026 across SAP Business Planning and Consolidation (CVE-2026-27681, SQL injection), Adobe Acrobat Reader (CVE-2026-34621, RCE, actively exploited), Adobe ColdFusion (CVE-2026-34619, CVE-2026-27304, CVE-2026-27305, CVE-2026-27282, CVE-2026-27306, path traversal, ACE), Fortinet FortiSandbox (CVE-2026-39813, CVE-2026-39808, path traversal, command injection), and Microsoft SharePoint Server (CVE-2026-32201, spoofing, data exposure, actively exploited), posing risks of data exfiltration and system compromise. → rescana.com |
| 2026-04-16 2026 | SQLMap Cheat Sheet: Commands, Options, and Advanced Features intermediate 7 min read | Cheatsheet detailing sqlmap commands, options, and advanced features for automating SQL injection detection and exploitation. It covers system requirements, installation, various SQLi attack techniques including in-band (error-based, union-based, stacked queries, inline queries), out-of-band, inferential (boolean, time-based), and compound attacks, alongside essential options for reconnaissance, enumeration, and vulnerability scanning. |
| 2026-04-16 2026 | Identifying SQL Injections in a GraphQL API intermediate 3 min read | Writeup detailing a time-based SQL injection vulnerability discovered in a GraphQL API backed by a PostgreSQL database. The technique involves intercepting requests via Burp Suite, altering client-generated search terms with SQL payloads, and analyzing response times to confirm command execution and enumerate database schema. The writeup also touches on potential for privilege escalation and RCE via CVE-2019–9193, and reiterates parameterized queries as a key mitigation. |
| 2026-04-16 2026 | SQL Injection Cheat Sheet - Invicti beginner 18 min read | Library of SQL injection payloads and techniques for MySQL, Microsoft SQL Server, Oracle, PostgreSQL, and SQLite, offering detailed technical information and attack vectors. This resource is useful for penetration testers and developers interested in web application security, covering exploitation methods like UNION attacks, blind SQL injection with IF statements and CASE expressions, hex value usage, string concatenation, and error-based injection, also noting the role of DAST tools like Invicti for automated detection. → invicti.com |
| 2026-04-16 2026 | Exploiting Time-Based SQL Injections: Data Exfiltration intermediate | Exploiting Time-Based SQL Injections: Data Exfiltration |
| 2026-04-16 2026 | Second-Order SQL Injection with Stored Procedures and DNS-Based Egress advanced 14 min read | Writeup detailing the detection and exploitation of a second-order SQL injection vulnerability, leveraging Out-of-Band (OOB) techniques via DNS exfiltration. The technique involves exploiting a Microsoft Excel report export feature where a crafted payload in the date parameter, when processed by the `xp_dirtree` stored procedure, triggers DNS requests to an attacker-controlled server. This allows for the disclosure of sensitive database information, including usernames and tables, by chaining SQL Server UNC Path Injection with DNS-based data exfiltration. |
| 2026-04-16 2026 | When the Database Won't Talk: A Deep Dive into Blind SQLi intermediate 3 min read | Reference detailing Blind SQL Injection techniques, including Boolean-based, Time-based with SQL variants like `SLEEP()` and `pg_sleep()`, and Out-of-Band (OOB) methods involving DNS or HTTP callbacks. It highlights attacker exploitation methods and defense strategies such as parameterized queries, input sanitization, and monitoring for inconsistent behavior, response time variations, or external service interactions. The entry also mentions the Hadrian platform for detecting these vulnerabilities. |
| 2026-04-16 2026 | Advanced Boolean-Based SQLi Filter Bypass Techniques advanced 3 min read | Technique for bypassing libinjection filters in Web Application Firewalls using advanced boolean-based SQL injection. This method leverages MySQL string functions like `INSERT`, `REPEAT`, `REPLACE`, `RIGHT`, `WEIGHT_STRING`, conditional constructs such as `IF` statements, and the `RLIKE` operator for bruteforcing hashed passwords. It also incorporates comments and assignment operators (`:=`) within SQL syntax to evade detection by security tools. |
| 2026-04-16 2026 | WAF Bypass Techniques for SQL Injection intermediate | WAF Bypass Techniques for SQL Injection |
| 2026-04-16 2026 | Exploiting Second-Order SQL Injection to Retrieve the Flag intermediate | Exploiting Second-Order SQL Injection to Retrieve the Flag |
| 2026-04-16 2026 | Exploiting SQL Injection Vulnerability - Bug Bounty Writeup intermediate | Exploiting SQL Injection Vulnerability - Bug Bounty Writeup |
| 2026-04-15 2026 | SAP Security Patch Day April 2026: Critical Vulnerabilities CVSS 9.9 SQL Injection and Authorization Risks news 2 min read | Analysis of SAP Security Patch Day April 2026 highlights critical vulnerabilities, including a CVSS 9.9 SQL injection in SAP Business Planning and Consolidation and SAP Business Warehouse, allowing authenticated users to execute arbitrary SQL. A high-severity authorization flaw in SAP ERP and SAP S/4HANA, with a CVSS of 7.1, permits authenticated users to overwrite existing executable reports. Medium-priority issues affect SAP BusinessObjects BI Platform with denial-of-service and SAP Human Capital Management for SAP S/4HANA with information disclosure. Practitioners like SecurityBridge, Pathlock, and Layer Seven Security detail exploitation paths, internal authorization risks, and cross-layer exposure across SAP environments. |
| 2026-04-11 2026 | 400K WordPress Sites Exposed by Elementor Ally Plugin SQL Flaw news 3 min read | Library vulnerability in Elementor's Ally plugin, tracked as CVE-2026-2413, exposes over 400,000 WordPress sites to SQL injection attacks. Exploitable without authentication when the Remediation module is active, the flaw allows attackers to steal sensitive data like password hashes by manipulating database queries through crafted URL parameters. Elementor has released a patch, and users are advised to update the plugin, disable unused features, deploy a WAF, and enforce least privilege for database accounts. → esecurityplanet.com |
| 2026-04-10 2026 | SQL Injection in 2026: It Took One Apostrophe intermediate | SQL Injection in 2026: It Took One Apostrophe |
| 2026-04-10 2026 | Advanced SQL Injection Techniques in Modern Web Apps advanced 2 min read | Writeup detailing advanced SQL injection techniques like second-order, time-based blind, and WAF bypasses through encoding and case variation. It emphasizes prevention strategies such as parameterized queries, strict input validation, and least privilege for database users, and mentions tools like SQLi Detector for automated testing, highlighting real-world applications in e-commerce platforms, CMS systems, and API endpoints. |
| 2026-04-10 2026 | Bypassing WAF with Adversarial SQL intermediate | Bypassing WAF with Adversarial SQL → dl.acm.org |
| 2026-04-10 2026 | WAF Bypass Using JSON-Based SQL Injection Attacks intermediate 3 min read | Library entry detailing a WAF bypass technique using JSON-based SQL injection, building on research that found major vendors like Palo Alto Network, AWS, Cloudflare, F5, and Imperva failed to properly inspect JSON payloads. This method exploits the compatibility of databases such as PostgreSQL and MySQL with JSON, allowing malicious SQL commands to evade detection by many Web Application Firewalls. → picussecurity.com |
| 2026-04-10 2026 | SQL Injection Security Vulnerabilities beginner | SQL Injection Security Vulnerabilities |
| 2026-04-10 2026 | CVE Search: SQL Injection news | CVE Search: SQL Injection |
| 2026-04-10 2026 | SQL Injection - OWASP beginner 7 min read | Reference on SQL Injection attacks, detailing how attackers insert malicious SQL queries into application inputs to access, modify, or delete sensitive database data. It covers common attack vectors, the high severity risk associated with these vulnerabilities, and provides examples of exploitation in PHP, ASP, J2EE, and ASP.NET applications. The OWASP resource also points to prevention strategies like parameterized SQL statements and code review guides. → owasp.org |
| 2026-04-10 2026 | SQL Injection Tutorial & Examples - PortSwigger beginner 10 min read | Tutorial on SQL injection covers its definition, methods for finding and exploiting vulnerabilities such as retrieving hidden data, subverting application logic with UNION attacks, and blind SQL injection. It details manual detection techniques like using single quotes, SQL syntax, boolean conditions, and time delays, and mentions Burp Scanner for automated detection. The resource also addresses injection in different parts of SQL queries, including WHERE, UPDATE, INSERT, SELECT, and ORDER BY clauses, and provides practical examples. → portswigger.net |
| 2026-04-10 2026 | CVE-2026-26116: SQL Server SQL Injection news 3 min read | Writeup of CVE-2026-26116, a SQL Injection vulnerability affecting Microsoft SQL Server. Exploiting CWE-89, an authenticated attacker can elevate privileges over a network by manipulating SQL commands. Attackers with low-privilege accounts can craft malicious SQL statements to bypass authorization, access sensitive data, or gain administrative control. Mitigation involves applying Microsoft security updates, implementing parameterized queries, restricting network access, and enabling comprehensive auditing. → sentinelone.com |
| 2026-04-10 2026 | SQL Injection 2025 Advanced Exploitation & Defense Guide advanced 46 min read | Guide to advanced SQL injection exploitation and defense, detailing techniques like error-based, union-based, boolean-based, time-based blind, and out-of-band methods. It covers database-specific exploitation for MySQL and MSSQL, including file I/O, User-Defined Functions, and `xp_cmdshell`. The guide emphasizes the critical need for proper data sanitization and robust database security measures to prevent vulnerabilities such as CVE-2025-57423. |
| 2026-04-06 2026 | SQL Injection (SQLi) Guide - SecPortal beginner | SQL Injection (SQLi) Guide - SecPortal |
| 2026-04-06 2026 | CVE-2026-27697: Basercms SQLi Vulnerability news 3 min read | Writeup of CVE-2026-27697, an unauthenticated SQL injection vulnerability affecting baserCMS versions prior to 5.2.3. Exploitation allows attackers to manipulate database queries through the blog posts functionality, potentially leading to unauthorized data access, modification, or deletion. The vulnerability stems from improper input validation and can be mitigated by upgrading to baserCMS 5.2.3 or later, implementing WAF rules, or temporarily disabling the blog posts feature. → sentinelone.com |
| 2026-04-06 2026 | CVE-2026-5197: Student Membership System SQLi Vulnerability news 4 min read | Writeup of CVE-2026-5197, a SQL injection vulnerability in code-projects Student Membership System 1.0. The flaw in `/delete_user.php` allows remote authenticated attackers to inject malicious SQL commands via the ID parameter, potentially leading to unauthorized data access, modification, or deletion. Exploitation involves manipulating database queries using techniques like UNION-based or boolean-based blind injection. Mitigation includes implementing prepared statements, strict input validation, or WAF rules. → sentinelone.com |
| 2026-04-06 2026 | WAF Testing Guide: How to Validate Web Application Firewalls intermediate 10 min read | Guide to validating Web Application Firewalls (WAFs) using Breach and Attack Simulation (BAS). This approach continuously tests WAF efficacy against real-world attack payloads, including obfuscated SQL injection, XSS, RCE, and SSRF variants, as well as protocol-level vulnerabilities like HTTP vs. HTTPS inspection gaps. Agent-based BAS offers deterministic validation by isolating WAF behavior, providing accurate metrics on prevention rates, detection rates, and mitigation gaps without risking production environments. → picussecurity.com |
| 2026-04-06 2026 | Bug Bounty Bootcamp #29: Boolean Blind SQL Injection Part 2 intermediate | Bug Bounty Bootcamp #29: Boolean Blind SQL Injection Part 2 → infosecwriteups.com |
| 2026-04-03 2026 | What is SQL Injection? How to Prevent SQL Injection | Fortinet beginner | What is SQL Injection? How to Prevent SQL Injection | Fortinet |
| 2026-04-03 2026 | Bypassing WAFs in 2025: New Techniques and Evasion Tactics advanced | Bypassing WAFs in 2025: New Techniques and Evasion Tactics |
| 2026-04-03 2026 | 7 Types of SQL Injection Attacks & How to Prevent Them beginner 19 min read | Library detailing seven types of SQL injection attacks, including classic and blind SQLi. It explains how these attacks exploit un-sanitized user inputs to manipulate databases, leading to unauthorized access and data breaches. Prevention methods discussed include input sanitization, parameterized queries, least privilege access, and the use of Web Application Firewalls (WAFs). → sentinelone.com |
| 2026-04-03 2026 | SQLi Payloads - Classic, Blind, Error-Based, Time-Based, WAF Bypass intermediate 13 min read | Library of SQL injection payloads and techniques, covering classic, blind, error-based, and time-based methods. Includes bypass strategies for Web Application Firewalls (WAFs) and showcases tools like SQLMap, jSQL Injection, BBQSQL, and NoSQLMap for exploitation and scanning. Techniques range from simple character injections and comments to advanced blind SQL-bitshifting and server-time-based attacks, with examples for MySQL, MariaDB, and more. |
| 2026-04-03 2026 | SQL Injection for Bug Bounty Hunters | YesWeHack beginner 12 min read | Guide on SQL injection techniques for bug bounty hunters, covering blind SQLi, time-based attacks, and out-of-band callbacks. It details how to tailor payloads to SQL statements, integrate detection into bug bounty workflows, and exploit SQLi even in hardened systems, referencing vulnerabilities like CVE-2022-21661 in WordPress. → yeswehack.com |
| 2026-04-03 2026 | Exploiting an SQL Injection with WAF Bypass intermediate 11 min read | Tool for bypassing Web Application Firewalls (WAFs) to exploit SQL injection vulnerabilities. The process involves identifying a potential SQL injection using Burp Suite, confirming it manually via Burp Repeater, and then configuring sqlmap with specific techniques (`--technique=B`), exclusion strings (`--not-string`), proxy settings (`--proxy`), and modifying the User-Agent header to evade WAF detection. This enables successful exploitation of boolean-based blind SQL injection flaws. → vaadata.com |
| 2026-04-03 2026 | SQL Injection Bypassing WAF | OWASP intermediate 7 min read | Guide on bypassing Web Application Firewalls (WAFs) for SQL Injection attacks, detailing techniques like normalization vulnerabilities, HTTP Parameter Pollution (HPP), HTTP Parameter Fragmentation (HPF), and blind SQL injection exploitation. It covers various WAF bypassing strings and payload variations for common database functions and operators, illustrating how to evade signature-based detection and exploit application logic flaws. → owasp.org |
| 2026-04-03 2026 | PayloadsAllTheThings - SQL Injection beginner 13 min read | Reference detailing SQL Injection (SQLi) techniques, including entry point detection, DBMS identification, authentication bypass using tautologies and UNION queries, blind injection, error-based and timing attacks, and specific vulnerabilities like those affecting PDO prepared statements and WAF bypasses. It features tools such as sqlmap and ghauri, and discusses the impact of password hashing and salts on modern authentication bypass methods. |
| 2026-04-02 2026 | New "LeakyLooker" Flaws in Google Looker Studio Could Enable Cross-Tenant SQL Queries news 2 min read | Writeup detailing nine "LeakyLooker" vulnerabilities in Google Looker Studio, including cross-tenant unauthorized access, zero-click SQL injection on database connectors and stored credentials, SQL injection on BigQuery and Spanner through native functions and custom queries, data source leaks via hyperlinks and image rendering, XS leaks with timing oracles, and denial of wallet. These flaws could allow attackers to exfiltrate, insert, and delete data across various Google Cloud Platform services, impacting databases like BigQuery, Spanner, PostgreSQL, and MySQL. → thehackernews.com |
| 2025-08-14 2025 | NucleiFuzzer - Powerful Automation Tool For Detecting XSS, SQLi, SSRF, Open intermediate Fuzzing | "NucleiFuzzer is an automation tool designed for detecting vulnerabilities like XSS, SQLi, SSRF, and Open. It offers powerful capabilities for automated security testing." → kitploit.com |
| 2025-08-14 2025 | https://weekly.infosecwriteups.com/iw-weekly-39-10-000-bounty-zero-click-account-takeover-stored-xss-open-redirection-vulnerability-sql-injection-rce-reconnaissance-techniques-and-much-more/ news 3 min read RCE XSS | Writeup detailing a $10,000 bounty for a Facebook Reels crop/trim feature flaw, Zoom stored XSS, Facebook zero-click account takeover, io_uring Use-After-Free (CVE-2022-2602), Apple subdomain open redirection, and GraphQL pentesting. It also covers insecure CORS configurations, bug bounty automation, smart contract vulnerabilities, HTTP Basic Auth, SQL injection to RCE (CVE-2022-44015), RFC analysis, CTF challenges, CodeQL for GraphQL, reconnaissance techniques, SSRF, and EVM chain vulnerability analysis. |
| 2025-08-14 2025 | https://github.com/yeswehack/vulnerable-code-snippets beginner 2 min read SSRF XSS | Library of vulnerable code snippets for practicing application security analysis. This collection includes examples of Broken access control (CWE-284), SQL injection (CWE-89), Cross-Site Scripting (CWE-79), Server-Side Template Injection (CWE-1336), and many other common vulnerabilities, all runnable within an isolated Docker environment. New snippets are released weekly, and users can suggest additions via GitHub issues. |
| 2025-08-14 2025 | SQL Injection Wiki beginner | Library for identifying, exploiting, and escalating SQL injection vulnerabilities across various Database Management Systems. This comprehensive resource is structured to follow a typical escalation path, offering detailed information on techniques applicable to different versions of SQL databases. Contributions are welcomed via GitHub. |
| 2025-08-14 2025 | http://www.darknet.org.uk/2017/09/bsqlinjector-blind-sql-injection-tool-download-ruby/ intermediate | Tool written in Ruby for performing blind SQL injection. BSQLinjector identifies vulnerabilities by posing true/false questions to the database and analyzing application responses, a technique useful when generic error messages obscure traditional SQLi. Users can employ the `--test` switch to preview payloads before execution. This tool offers an alternative to automated solutions like sqlmap for blind SQL injection scenarios. |
| 2025-08-14 2025 | SQL Attack (Constraint-based) - Dhaval Kapil intermediate 4 min read | Library for exploiting SQL constraint-based vulnerabilities, similar to SQL injection but distinct. This technique leverages trailing whitespace trimming and `VARCHAR` length constraints in databases like MySQL and SQLite. An attacker can register a username with trailing spaces followed by a different character, tricking the application into inserting it and allowing them to authenticate as an existing user. Defense strategies include implementing `UNIQUE` constraints on relevant columns, using `id` as primary keys, and manually trimming input parameters. |
| 2025-08-14 2025 | SQL Injection Cheat Sheet by Netsparker beginner 18 min read | Library for SQL injection techniques, this cheat sheet details payloads and technical information for exploiting variants against MySQL, Microsoft SQL Server, Oracle, PostgreSQL, and SQLite. It covers UNION-based attacks, conditional statements like IF and CASE, hexadecimal encoding, and string manipulation methods to bypass filters. The resource also highlights the utility of Dynamic Application Security Testing (DAST) tools, such as Invicti and Acunetix, for automating the discovery and exploitation of SQL injection vulnerabilities. |
| 2025-08-14 2025 | Vulnerability analysis, Security Papers, Exploit Tutorials - Part 12975 beginner 36 min read | Library detailing MSSQL injection techniques, including basic SQL injection, blind SQL injection, and advanced methods utilizing extended stored procedures. It covers testing for vulnerabilities, bypassing authentication, evading audit logs, and includes a cheat sheet for MSSQL queries and countermeasures, as well as a Perl script for finding vulnerable sites. → exploit-db.com |
| 2025-08-14 2025 | SQL Injection Cheatsheet 2021 beginner 17 min read | Library containing SQL injection payloads and techniques, detailing in-band (Error-based, Union-based), inferential (Boolean-based, Time-based), and out-of-band methods. It includes best practices for prevention such as parameterized queries, input validation, stored procedures, least privilege, and WAFs, alongside specific payloads for authentication bypass and error-based extraction. |
| 2025-08-14 2025 | https://medium.com/bugbountywriteup/sql-injection-time-and-boolean-based-27239b6a55e8?source=twitterShare-1764222123d3-1576594710&_referrer=twitter&_branch_match_id=732557985002302401 intermediate | The content discusses SQL injection vulnerabilities, specifically focusing on time-based and boolean-based techniques. It explains how these methods can be exploited to manipulate database queries and extract sensitive information. The article likely provides examples, demonstrations, and insights on how to identify and mitigate SQL injection vulnerabilities in web applications. It is a valuable resource for bug bounty hunters, security researchers, and developers looking to enhance their understanding of SQL injection attacks. |
| 2025-08-14 2025 | https://vavkamil.cz/2019/10/09/understanding-the-full-potential-of-sqlmap-during-bug-bounty-hunting/ intermediate Bug Bounty | The content discusses maximizing the capabilities of SQLmap for bug bounty hunting. It covers understanding SQL injection vulnerabilities, using SQLmap to automate the process of exploiting these vulnerabilities, and tips for effective bug bounty hunting. The article emphasizes the importance of thorough testing and proper understanding of SQLmap's features to achieve successful results in identifying and exploiting vulnerabilities. It provides insights into leveraging SQLmap effectively to enhance bug bounty hunting efforts and improve the overall security posture of web applications. |
| 2025-08-14 2025 | https://portswigger.net/web-security/sql-injection/cheat-sheet beginner 2 min read | Cheatsheet of SQL injection syntax for common attack tasks, including string concatenation, substring extraction, query truncation with comments, database version and content enumeration, conditional errors, batched queries, time delays, DNS lookups, and DNS lookup with data exfiltration, useful for formulating complex attacks and exfiltrating sensitive information. → portswigger.net |
| 2025-08-14 2025 | SQL Injection 101: Common Defense Methods Hackers Should Be Aware Of beginner 5 min read | Reference detailing common SQL injection defense methods including user input escaping, whitelisting, stored procedures, and prepared statements. It emphasizes the principle of least privilege for database accounts and outlines techniques such as parameterized queries to distinguish between code and data, thereby mitigating risks associated with SQL injection vulnerabilities. → null-byte.wonderhowto.com |
| 2024-12-31 2024 | GitHub - danialhalo/SqliSniper: Advanced Time-based Blind SQL Injection fuzzer for HTTP Headers intermediate 3 min read Fuzzing Python | Tool for advanced time-based blind SQL injection fuzzing in HTTP headers. SqliSniper leverages multi-threading for rapid scanning and incorporates response time analysis to reduce false positives. It offers configurable payloads, custom headers, and direct Discord notifications for detected vulnerabilities, making it an efficient solution for security assessments. |
| 2024-11-13 2024 | SQLMap Command Generator beginner | SQLMap Command Generator |
| 2024-08-22 2024 | BChecks/vulnerability-classes/injection at main · PortSwigger/BChecks · GitHub intermediate Burp RCE XSS | BChecks collection for Burp Suite Professional and Burp Suite Enterprise Edition - PortSwigger/BChecks |
| 2023-11-07 2023 | 9 SQLi Detection Tools You Need to Know in 2023 beginner 3 min read | Library of 9 SQLi detection tools for 2024, including SQLMap, Invicti, Burp Suite, jSQL Injection, Appsider, Acunetix, Qualys WAS, HCL AppScan, and Imperva. These tools automate the identification and remediation of SQL injection vulnerabilities in web applications and APIs, mitigating risks such as data theft and unauthorized access. |
| 2023-10-05 2023 | Writeups for Damn Vulnerable Web Application (DVWA) beginner XSS | Writeups for Damn Vulnerable Web Application (DVWA) https://ift.tt/b6djesM |
| 2023-09-22 2023 | How to turn SQL injection into an RCE or a file read? Case study of 128 bug bounty reports intermediate Bug Bounty RCE Talks | The content discusses techniques for leveraging SQL injection vulnerabilities to achieve Remote Code Execution (RCE) or unauthorized file reads. It presents a case study based on 128 bug bounty reports, likely demonstrating real-world examples of such exploits. Viewers can gain insights into the process of escalating SQL injection vulnerabilities into more severe security breaches. The content is likely to provide practical examples and strategies for security researchers or professionals interested in understanding and mitigating these types of cyber threats. |
| 2023-09-03 2023 | TryHackMe | SQHell beginner | Try and find all the flags in the SQL Injections |
| 2023-06-08 2023 | Test website for SQL injection vulnerabilities using Python intermediate Python | Test website for SQL injection vulnerabilities using Python https://ift.tt/msKlYeM |
| 2023-06-01 2023 | Demystifying SQL Injection: A Comprehensive Guide to Understanding SQL Injection Risks beginner 9 min read | Guide to understanding SQL injection risks, detailing in-band, out-of-band, error-based, union-based, time-based, and boolean-based attack techniques. It includes practical examples, like injecting malicious code into search bars and exploiting vulnerabilities such as the Heartland Payment Systems breach, alongside prevention strategies. |
| 2023-05-27 2023 | open-appsec ML-based WAF protects against modern SQLi AutoSpear evasion techniques news 5 min read API Sec | Library protecting against advanced SQL injection evasion techniques, including those from the AutoSpear project. It utilizes machine learning to identify non-legitimate payloads rather than relying solely on traditional parsing and rule sets. This approach effectively counters evolving evasion methods like case swapping, whitespace substitution, comment injection, and various encoding combinations that bypass other WAF solutions such as AWS, Fortinet, F5, CloudFlare, and ModSecurity. |
| 2023-04-18 2023 | Tag Archives: SQL Injection beginner 5 min read | Library for securing Open Data Protocol (OData) connections, building on techniques used to mitigate SQL injection. It acts as an intermediate security layer, applying fine-grained constraints to OData API calls and masking query results based on user entitlements. This is demonstrated with a policy controlling access to the Netflix OData API, restricting minors to G or PG-13 rated movies, and includes authentication, authorization, and auditing of connections. |
| 2023-04-18 2023 | [ODATA-1110] Provide guidance for sql-injection type attacks beginner | [ODATA-1110] Provide guidance for sql-injection type attacks https://ift.tt/9J5LIQb |
| 2023-04-02 2023 | How I Found Multiple SQL Injections in 5 Minutes in Bug Bounty intermediate Bug Bounty | How I Found Multiple SQL Injections in 5 Minutes in Bug Bounty https://ift.tt/8yQVgw5 |
| 2022-11-03 2022 | SQL Injection in GraphQL intermediate | The content discusses the vulnerability of SQL injection in GraphQL, a query language for APIs. This security risk can occur when user input is not properly sanitized, allowing malicious actors to manipulate queries and potentially access or modify sensitive data in the database. It emphasizes the importance of input validation and sanitization to prevent SQL injection attacks in GraphQL applications. |
| 2022-04-11 2022 | Favorite tweet by @harshbothra_ beginner | Favorite tweet: 12 Free Practice Labs to Master SQL Injection 🧵 — Harsh Bothra (@harshbothra_) Apr 11, 2022 |
| 2022-01-16 2022 | How I Found multiple SQL Injection with FFUF and Sqlmap in a few minutes intermediate Fuzzing Recon | How I Found multiple SQL Injection with FFUF and Sqlmap in a few minutes |
| 2022-01-07 2022 | Advanced SQL Injection Cheatsheet advanced | Cheatsheet detailing advanced SQL injection techniques. It covers finding injection points, understanding website behavior, enumerating data, bypassing Web Application Firewalls (WAFs), and dumping databases. Methodologies include Error- or UNION-based, Boolean-based (content-based) Blind SQLi, and Time-based SQLi, along with stabilizing injections and bypassing whitespace filters. Privilege escalation and Local File Inclusion (LFI) are also addressed. |
| 2021-11-13 2021 | Web Attack Cheat Sheet beginner 61 min read API Sec Bug Bounty XSS | Cheatsheet detailing web attack techniques and tools, covering discovery, enumeration, scanning, monitoring, and attack methods. It includes specific vulnerabilities such as SSRF, XXE, OAuth, DNS Rebinding, HTTP/SMTP Header Injection, Web Shell, Reverse Shell, SQLi, XSS, XPath Injection, Path Traversal, LFI, SSTI, Information Disclosure, and WebDAV. The resource also lists generic tools for reconnaissance and attack surface mapping, including those for identifying Cloudflare origin IPs and mapping CIDR ranges. |
| 2021-10-04 2021 | 10 Types of Web Vulnerabilities that are Often Missed beginner 16 min read Bug Bounty IDOR SSRF XSS | Library detailing overlooked web vulnerabilities, including HTTP/2 Smuggling exploiting frontend/backend parsing differences, XXE via Office Open XML parsers by crafting malicious OOXML files, SSRF via XSS in PDF generators leveraging headless browser execution for internal resource access, and XSS via SVG files where image upload functionality is present. The resource highlights these as being a step beyond common OWASP Top 10 issues due to obscure delivery methods or common misunderstandings. → labs.detectify.com |
| 2021-04-16 2021 | DVWA 1.9+: Blind SQL Injection with SQLMap intermediate | The content discusses performing Blind SQL Injection on DVWA 1.9+ using SQLMap. It follows a previous article on manual SQL Injection with OWASP ZAP. The focus is on hacking DVWA through Blind SQL Injection techniques. |
| 2021-01-24 2021 | Exploiting Error Based SQL Injections & Bypassing Restrictions intermediate | The article discusses advancing attacks when encountering Error Based SQL Injections. It aims to provide insights on bypassing restrictions in such scenarios. The content likely includes strategies for exploiting vulnerabilities and overcoming limitations in SQL injection attacks. |
| 2021-01-24 2021 | Exploiting second order blind SQL injection intermediate | Hackerone hosted an online Capture The Flag (CTF) event named "12 days of hacky holiday CTF." |
| 2021-01-23 2021 | https://secnhack.in/website-penetration-testing-and-database-hacking-with-sqlmap/ intermediate 6 min read | Tutorial on website penetration testing and database hacking using the open-source tool sqlmap. This guide details how to detect and exploit SQL injection vulnerabilities, a critical flaw identified in the OWASP Top 10. It covers installation on various operating systems, upgrading the tool, and advanced techniques like using Google Dorks for reconnaissance to identify vulnerable parameters. The tutorial walks through commands to dump database names, tables, columns, and ultimately sensitive user credentials from compromised web applications. |
| 2021-01-20 2021 | Identifying & Exploiting SQL Injection: Manual & Automated intermediate | The article discusses identifying and exploiting SQL Injection vulnerabilities in applications. It covers methods for recognizing these vulnerabilities and exploiting them. The content likely includes manual and automated approaches for detecting and taking advantage of SQL Injection weaknesses in software systems. |
| 2020-04-17 2020 | SQL Injection Cheat Sheet by Netsparker beginner 18 min read | Library: Invicti SQL Injection Cheat Sheet, this resource offers detailed technical information and attack payloads for testing various SQL injection vulnerabilities across MySQL, Microsoft SQL Server, Oracle, PostgreSQL, and SQLite. It covers techniques such as UNION attacks, stacked queries, boolean-based blind SQL injection using IF and CASE statements, and bypassing filters with hex encoding and string concatenation. The cheat sheet also highlights the utility of DAST tools like Invicti and Acunetix for automating SQLi detection. |
| 2019-12-29 2019 | https://medium.com/bugbountywriteup/sql-injection-time-and-boolean-based-27239b6a55e8?source=twitterShare-1764222123d3-1576594710&_referrer=twitter&_branch_match_id=732557985002302401 intermediate | The content discusses SQL injection vulnerabilities, specifically focusing on time-based and boolean-based techniques. It explains how attackers can exploit these vulnerabilities to manipulate database queries and gain unauthorized access to sensitive information. The article likely provides examples, explanations, and possibly mitigation strategies for preventing SQL injection attacks. |
| 2019-11-17 2019 | Understanding the full potential of sqlmap during bug bounty hunting intermediate Bug Bounty | The content discusses utilizing sqlmap, a tool for detecting and exploiting SQL injection vulnerabilities, in bug bounty hunting and ethical hacking for offensive website security. It emphasizes understanding the full potential of sqlmap to effectively identify and exploit vulnerabilities. The focus is on leveraging this tool to enhance security testing efforts and maximize the outcomes of bug bounty programs. |
| 2019-10-05 2019 | SQL injection to RCE advanced RCE | The content discusses a case of SQL injection leading to Remote Code Execution (RCE) discovered during a recent customer penetration testing exercise. The author will detail the scenario in the following lines. |
| 2018-07-29 2018 | Making a Blind SQL Injection a Little Less Blind intermediate | The content discusses the author's experience finding a SQL Injection bug despite the belief that manual SQL Injections are no longer common. The author aims to shed light on this issue and shares insights on how to make a Blind SQL Injection less challenging. |
| 2018-07-19 2018 | Comprehensive Guide to Sqlmap (Target Options) intermediate | The article discusses the "target commands" in sqlmap, a tool for SQL injection attacks. These commands are used to specify the target website or application for the attack. Understanding and utilizing these commands effectively is crucial for successful SQL injection testing. |
| 2018-06-26 2018 | SQL Injection 101: Common Defense Methods Hackers Should Be Aware Of beginner 5 min read | Library on SQL injection defense methods, discussing user input escaping with MySQL examples, whitelisting versus blacklisting, stored procedures, and the superiority of prepared statements using parameterized queries. It also emphasizes the principle of least privilege for database accounts and separate users for different applications to minimize attack impact. → null-byte.wonderhowto.com |
| 2018-05-10 2018 | Barebones Application Security — SQL Injection (SQLi) beginner | The content discusses basic security measures for startups, focusing on SQL Injection (SQLi) vulnerabilities. It is part of a series on application security, highlighting the importance of safeguarding against SQL injection attacks. The series aims to provide startups with essential steps to enhance their security posture. |
| 2018-01-11 2018 | SQL Injection Wiki beginner | Library: SQL Injection Wiki, a comprehensive resource for identifying, exploiting, and escalating SQL injection vulnerabilities across various Database Management Systems. This wiki follows a typical escalation path, assuming basic SQL injection knowledge, and includes version-specific query information. Contributions are welcomed via GitHub. |
| 2017-09-22 2017 | BSQLinjector – Blind SQL Injection Tool Download in Ruby intermediate | Library for performing Blind SQL Injection attacks in Ruby, BSQLinjector utilizes true/false queries to extract data from SQL databases when direct error messages are suppressed. Similar in function to sqlmap, it offers a `--test` switch to preview payloads before execution. |
| 2016-12-28 2016 | SQL Attack (Constraint-based) - Dhaval Kapil advanced 4 min read | Writeup on SQL constraint-based attacks, demonstrating how trailing whitespace padding in SQL string comparisons and truncation of long strings in INSERT statements can be exploited. The attack allows an attacker to register a username with trailing spaces that is then effectively treated as an existing username due to SQL's whitespace handling. Subsequent logins can then be hijacked, as shown on MySQL and SQLite. Defenses include applying UNIQUE constraints to username columns and preferring IDs for data tracking. |
| 2016-04-20 2016 | Vulnerability analysis, Security Papers, Exploit Tutorials - Part 12975 news 36 min read | Paper detailing advanced MSSQL injection techniques, including ODBC error message attacks, UNION attacks, and exploiting extended stored procedures. It covers blind SQL injection enumeration, explains common vulnerabilities in applications like Joomla, Mambo, and WordPress, and provides methods for testing for SQL injection flaws using single quotes and OR/AND operations. The document also touches upon audit log evasion and the creation of mass MSSQL injection worms, concluding with countermeasures against these attacks. → exploit-db.com |