The newest SQL Injection resources are on the SQL Injection page. For a reading order instead of a date order, see the SQL Injection learning path.
| Date Added | Link | Excerpt |
|---|---|---|
| 2026-04-28 2026 | Hackers are exploiting a critical LiteLLM pre-auth SQLi flaw news 2 min read | Library for securing LiteLLM, an open-source LLM gateway, against the CVE-2026-42208 pre-authentication SQL injection vulnerability. Attackers exploit this flaw in the API key verification step to access and modify sensitive data, including API keys, credentials, and environment secrets. The vulnerability allows unauthorized access to the proxy and managed credentials, with active exploitation observed targeting specific tables containing secrets from providers like OpenAI and Anthropic. A fix is available in LiteLLM version 1.83.7. → bleepingcomputer.com |
| 2026-04-22 2026 | CVE-2025-1094: PostgreSQL SQL Injection Vulnerability news 3 min read | Writeup of CVE-2025-1094, a critical SQL injection vulnerability in PostgreSQL affecting PQescapeLiteral(), PQescapeIdentifier(), PQescapeString(), and PQescapeStringConn() functions, as well as the psql terminal. Exploitation is possible through improper neutralization of quoting syntax and invalid multibyte characters, potentially leading to arbitrary code execution. Versions prior to 17.3, 16.7, 15.11, 14.16, and 13.19 are affected. |
| 2026-04-22 2026 | SQLMap Tamper Collection: Modern WAF Bypass Scripts (Cloudflare, AWS, Azure) intermediate 4 min read | Library for context-aware SQL transformation and WAF bypass, supporting Cloudflare, AWS, and Azure. It features a full SQL lexer with UUID tracking, multi-character operator support, and deterministic output preserving SQL validity. Transformations include keyword wrapping, space replacement, value encoding, and case alternation, with advanced options like homoglyphs and numeric obfuscation. The framework maintains SQL structure, handles nested subqueries, and offers reapplication protection, designed primarily for MySQL syntax. |
| 2026-04-22 2026 | SQL Injection and Postgres: An Adventure to Eventual RCE intermediate 21 min read | Library for leveraging PostgreSQL functions to achieve Remote Code Execution (RCE) via SQL Injection. This resource details exploiting an ORDER BY clause injection in a Flask application, demonstrating techniques for data exfiltration using error messages and the `query_to_xml` function to bypass row limitations and achieve command execution as the database user. |
| 2026-04-22 2026 | Pentesting PostgreSQL with SQL Injections intermediate 11 min read | Library for analyzing and exploiting SQL injection vulnerabilities specifically targeting PostgreSQL. It details bypass methods for web application firewalls, techniques for data exfiltration across various query clauses including SELECT, WHERE, FROM, and ORDER BY, and demonstrates how to exploit nested queries. The resource covers bypassing spaces, trailing data, quotation marks using dollar quoting or `CHR()` function, and utilizes time-based blind SQL injection with concatenation and conditional logic for data leakage. → onsecurity.io |
| 2026-04-22 2026 | NoSQL Injection: Advanced Exploitation Guide advanced 8 min read | Guide to exploiting NoSQL injection vulnerabilities, detailing how improper input sanitization allows attackers to bypass authentication on MongoDB and other databases. It covers identifying injections by manipulating syntax and using operators like `$gt` and `$ne`, and demonstrates advanced techniques such as extracting data through time delays using the `$where` operator. → intigriti.com |
| 2026-04-22 2026 | Exploits Explained: NoSQL Injection Returns Private Information beginner 4 min read | Writeup detailing a NoSQL injection vulnerability discovered in an application's `/api/[CLIENT_NAME]/Customers` and `/api/[CLIENT_NAME]/CustomerLogins` endpoints. The author leveraged MongoDB query operators, specifically `gt`, to bypass filters and extract sensitive PII, including email addresses, usernames, password hashes, and phone numbers, from the administrator user. The exploit involved manipulating the `$filter` parameter to retrieve data beyond the intended scope. |
| 2026-04-22 2026 | CVE-2025-52694 PoC: Critical SQL Injection in Advantech IoTSuite/SaaS-Composer news 1 min read | Toolchain for CVE-2025-52694, a critical unauthenticated SQL Injection vulnerability impacting Advantech IoTSuite/SaaS-Composer products prior to specific versions. The PoC offers a standalone Python script for time-based SQL injection tests and a nuclei template utilizing a clusterbomb attack to discover vulnerable `org_id` values. Exploitation allows for database dumping, data modification, and potential RCE by unsafely concatenating the `filename` parameter into PostgreSQL queries. |
| 2026-04-22 2026 | MCP Vulnerability Case Study: SQL Injection in the Postgres MCP Server intermediate 8 min read | Writeup on a SQL injection vulnerability in Anthropic's reference Postgres MCP server, allowing arbitrary SQL execution by terminating the read-only transaction with a `COMMIT;` statement. Though deprecated, the `@modelcontextprotocol/server-postgres` NPM package and `mcp/postgres` Docker image see significant weekly downloads. The vulnerability is patched in the Zed Industries fork (`@zeddotdev/postgres-context-server` v0.1.4) and an unreleased reference implementation. Users should avoid the deprecated server for sensitive data and consider the Zed Industries fork for mitigation. → securitylabs.datadoghq.com |
| 2026-04-22 2026 | BWAFSQLi: Bypassing Web Application Firewall with Adversarial SQL Injections advanced | BWAFSQLi: Bypassing Web Application Firewall with Adversarial SQL Injections → dl.acm.org |
| 2026-04-19 2026 | Unauthenticated SQL Injection in GUI — Fortinet PSIRT intermediate | Analysis of unauthenticated SQL injection in FortiWeb's GUI, allowing code execution via crafted HTTP/HTTPS requests. This vulnerability (CWE-89) has been observed exploited in the wild, with a workaround involving disabling the administrative interface. The report originates from Fortinet PSIRT, with credit to Kentaro Kawane. |
| 2026-04-19 2026 | CVE-2025-1094 WebSocket and SQL Injection Exploit Script news 2 min read | Exploit script for CVE-2025-1094, a PostgreSQL vulnerability enabling SQL Injection to achieve Remote Code Execution. This proof of concept demonstrates hijacking WebSocket connections after injecting malicious SQL using `lo_export` to read sensitive files, ultimately establishing a reverse shell. The script requires configuration of attacker IP/port, target URL, and WebSocket URL. |
| 2026-04-19 2026 | CVE-2025-1094: PostgreSQL psql SQL Injection (Fixed) — Rapid7 news 3 min read | Analysis of CVE-2025-1094, a high-severity SQL injection vulnerability in PostgreSQL's psql tool, impacting versions prior to 17.3, 16.7, 15.11, 14.16, and 13.19. Discovered by Rapid7, this flaw, with a CVSS 3.1 score of 8.1, arises from improper handling of escaped untrusted input containing invalid UTF-8 characters. Exploitation can lead to arbitrary code execution via meta-commands or arbitrary SQL statement execution. This vulnerability was found to be a prerequisite for exploiting CVE-2024-12356 against BeyondTrust products, though both are now patched. → rapid7.com |
| 2026-04-19 2026 | PostgreSQL CVE-2025-1094: Quoting APIs SQL Injection intermediate | Library detailing SQL injection vulnerabilities in PostgreSQL's quoting APIs, specifically PQescapeLiteral(), PQescapeIdentifier(), PQescapeString(), and PQescapeStringConn(). The vulnerability, identified as CVE-2025-1094, allows attackers to inject SQL when application inputs are constructed into psql commands. It also affects command-line utilities under specific client and server encoding conditions (BIG5, EUC_TW, MULE_INTERNAL). Versions prior to PostgreSQL 17.3, 16.7, 15.11, 14.16, and 13.19 are affected. |
| 2026-04-19 2026 | CVE-2025-26794: Blind SQL Injection in Exim 4.98 — Writeup intermediate 4 min read | Writeup detailing CVE-2025-26794, a blind SQL injection vulnerability in Exim 4.98 when SQLite is used as the DBM. The vulnerability arises from unsanitized SQL parameters within the ETRN command's semaphore handling in `hintsdb.h`, allowing remote users to craft malicious SQLite queries. This writeup covers the exploitation vector via the ETRN command to manipulate Exim's internal SQLite database, potential impacts including DoS and hypothetical RCE, and provides a Docker lab for reproduction. |
| 2026-04-17 2026 | April 2026 Patch Tuesday: Critical Vulnerabilities in SAP Adobe Microsoft SharePoint Fortinet and ColdFusion Threaten Enterprise Security news 6 min read | Advisory detailing critical vulnerabilities patched in April 2026 across SAP Business Planning and Consolidation (CVE-2026-27681, SQL injection), Adobe Acrobat Reader (CVE-2026-34621, RCE, actively exploited), Adobe ColdFusion (CVE-2026-34619, CVE-2026-27304, CVE-2026-27305, CVE-2026-27282, CVE-2026-27306, path traversal, ACE), Fortinet FortiSandbox (CVE-2026-39813, CVE-2026-39808, path traversal, command injection), and Microsoft SharePoint Server (CVE-2026-32201, spoofing, data exposure, actively exploited), posing risks of data exfiltration and system compromise. → rescana.com |
| 2026-04-16 2026 | SQLMap Cheat Sheet: Commands, Options, and Advanced Features intermediate 7 min read | Cheatsheet detailing sqlmap commands, options, and advanced features for automating SQL injection detection and exploitation. It covers system requirements, installation, various SQLi attack techniques including in-band (error-based, union-based, stacked queries, inline queries), out-of-band, inferential (boolean, time-based), and compound attacks, alongside essential options for reconnaissance, enumeration, and vulnerability scanning. |
| 2026-04-16 2026 | Identifying SQL Injections in a GraphQL API intermediate 3 min read | Writeup detailing a time-based SQL injection vulnerability discovered in a GraphQL API backed by a PostgreSQL database. The technique involves intercepting requests via Burp Suite, altering client-generated search terms with SQL payloads, and analyzing response times to confirm command execution and enumerate database schema. The writeup also touches on potential for privilege escalation and RCE via CVE-2019–9193, and reiterates parameterized queries as a key mitigation. |
| 2026-04-16 2026 | SQL Injection Cheat Sheet - Invicti beginner 18 min read | Library of SQL injection payloads and techniques for MySQL, Microsoft SQL Server, Oracle, PostgreSQL, and SQLite, offering detailed technical information and attack vectors. This resource is useful for penetration testers and developers interested in web application security, covering exploitation methods like UNION attacks, blind SQL injection with IF statements and CASE expressions, hex value usage, string concatenation, and error-based injection, also noting the role of DAST tools like Invicti for automated detection. → invicti.com |
| 2026-04-16 2026 | Exploiting Time-Based SQL Injections: Data Exfiltration intermediate | Exploiting Time-Based SQL Injections: Data Exfiltration |
| 2026-04-16 2026 | Second-Order SQL Injection with Stored Procedures and DNS-Based Egress advanced 14 min read | Writeup detailing the detection and exploitation of a second-order SQL injection vulnerability, leveraging Out-of-Band (OOB) techniques via DNS exfiltration. The technique involves exploiting a Microsoft Excel report export feature where a crafted payload in the date parameter, when processed by the `xp_dirtree` stored procedure, triggers DNS requests to an attacker-controlled server. This allows for the disclosure of sensitive database information, including usernames and tables, by chaining SQL Server UNC Path Injection with DNS-based data exfiltration. |
| 2026-04-16 2026 | When the Database Won't Talk: A Deep Dive into Blind SQLi intermediate 3 min read | Reference detailing Blind SQL Injection techniques, including Boolean-based, Time-based with SQL variants like `SLEEP()` and `pg_sleep()`, and Out-of-Band (OOB) methods involving DNS or HTTP callbacks. It highlights attacker exploitation methods and defense strategies such as parameterized queries, input sanitization, and monitoring for inconsistent behavior, response time variations, or external service interactions. The entry also mentions the Hadrian platform for detecting these vulnerabilities. |
| 2026-04-16 2026 | Advanced Boolean-Based SQLi Filter Bypass Techniques advanced 3 min read | Technique for bypassing libinjection filters in Web Application Firewalls using advanced boolean-based SQL injection. This method leverages MySQL string functions like `INSERT`, `REPEAT`, `REPLACE`, `RIGHT`, `WEIGHT_STRING`, conditional constructs such as `IF` statements, and the `RLIKE` operator for bruteforcing hashed passwords. It also incorporates comments and assignment operators (`:=`) within SQL syntax to evade detection by security tools. |
| 2026-04-16 2026 | WAF Bypass Techniques for SQL Injection intermediate | WAF Bypass Techniques for SQL Injection |
| 2026-04-16 2026 | Exploiting Second-Order SQL Injection to Retrieve the Flag intermediate | Exploiting Second-Order SQL Injection to Retrieve the Flag |
| 2026-04-16 2026 | Exploiting SQL Injection Vulnerability - Bug Bounty Writeup intermediate | Exploiting SQL Injection Vulnerability - Bug Bounty Writeup |
| 2026-04-15 2026 | SAP Security Patch Day April 2026: Critical Vulnerabilities CVSS 9.9 SQL Injection and Authorization Risks news 2 min read | Analysis of SAP Security Patch Day April 2026 highlights critical vulnerabilities, including a CVSS 9.9 SQL injection in SAP Business Planning and Consolidation and SAP Business Warehouse, allowing authenticated users to execute arbitrary SQL. A high-severity authorization flaw in SAP ERP and SAP S/4HANA, with a CVSS of 7.1, permits authenticated users to overwrite existing executable reports. Medium-priority issues affect SAP BusinessObjects BI Platform with denial-of-service and SAP Human Capital Management for SAP S/4HANA with information disclosure. Practitioners like SecurityBridge, Pathlock, and Layer Seven Security detail exploitation paths, internal authorization risks, and cross-layer exposure across SAP environments. |
| 2026-04-11 2026 | 400K WordPress Sites Exposed by Elementor Ally Plugin SQL Flaw news 3 min read | Library vulnerability in Elementor's Ally plugin, tracked as CVE-2026-2413, exposes over 400,000 WordPress sites to SQL injection attacks. Exploitable without authentication when the Remediation module is active, the flaw allows attackers to steal sensitive data like password hashes by manipulating database queries through crafted URL parameters. Elementor has released a patch, and users are advised to update the plugin, disable unused features, deploy a WAF, and enforce least privilege for database accounts. → esecurityplanet.com |
| 2026-04-10 2026 | SQL Injection in 2026: It Took One Apostrophe intermediate | SQL Injection in 2026: It Took One Apostrophe |
| 2026-04-10 2026 | Advanced SQL Injection Techniques in Modern Web Apps advanced 2 min read | Writeup detailing advanced SQL injection techniques like second-order, time-based blind, and WAF bypasses through encoding and case variation. It emphasizes prevention strategies such as parameterized queries, strict input validation, and least privilege for database users, and mentions tools like SQLi Detector for automated testing, highlighting real-world applications in e-commerce platforms, CMS systems, and API endpoints. |
| 2026-04-10 2026 | Bypassing WAF with Adversarial SQL intermediate | Bypassing WAF with Adversarial SQL → dl.acm.org |
| 2026-04-10 2026 | WAF Bypass Using JSON-Based SQL Injection Attacks intermediate 3 min read | Library entry detailing a WAF bypass technique using JSON-based SQL injection, building on research that found major vendors like Palo Alto Network, AWS, Cloudflare, F5, and Imperva failed to properly inspect JSON payloads. This method exploits the compatibility of databases such as PostgreSQL and MySQL with JSON, allowing malicious SQL commands to evade detection by many Web Application Firewalls. → picussecurity.com |
| 2026-04-10 2026 | SQL Injection Security Vulnerabilities beginner | SQL Injection Security Vulnerabilities |
| 2026-04-10 2026 | CVE Search: SQL Injection news | CVE Search: SQL Injection |
| 2026-04-10 2026 | SQL Injection - OWASP beginner 7 min read | Reference on SQL Injection attacks, detailing how attackers insert malicious SQL queries into application inputs to access, modify, or delete sensitive database data. It covers common attack vectors, the high severity risk associated with these vulnerabilities, and provides examples of exploitation in PHP, ASP, J2EE, and ASP.NET applications. The OWASP resource also points to prevention strategies like parameterized SQL statements and code review guides. → owasp.org |
| 2026-04-10 2026 | SQL Injection Tutorial & Examples - PortSwigger beginner 10 min read | Tutorial on SQL injection covers its definition, methods for finding and exploiting vulnerabilities such as retrieving hidden data, subverting application logic with UNION attacks, and blind SQL injection. It details manual detection techniques like using single quotes, SQL syntax, boolean conditions, and time delays, and mentions Burp Scanner for automated detection. The resource also addresses injection in different parts of SQL queries, including WHERE, UPDATE, INSERT, SELECT, and ORDER BY clauses, and provides practical examples. → portswigger.net |
| 2026-04-10 2026 | CVE-2026-26116: SQL Server SQL Injection news 3 min read | Writeup of CVE-2026-26116, a SQL Injection vulnerability affecting Microsoft SQL Server. Exploiting CWE-89, an authenticated attacker can elevate privileges over a network by manipulating SQL commands. Attackers with low-privilege accounts can craft malicious SQL statements to bypass authorization, access sensitive data, or gain administrative control. Mitigation involves applying Microsoft security updates, implementing parameterized queries, restricting network access, and enabling comprehensive auditing. → sentinelone.com |
| 2026-04-10 2026 | SQL Injection 2025 Advanced Exploitation & Defense Guide advanced 46 min read | Guide to advanced SQL injection exploitation and defense, detailing techniques like error-based, union-based, boolean-based, time-based blind, and out-of-band methods. It covers database-specific exploitation for MySQL and MSSQL, including file I/O, User-Defined Functions, and `xp_cmdshell`. The guide emphasizes the critical need for proper data sanitization and robust database security measures to prevent vulnerabilities such as CVE-2025-57423. |
| 2026-04-06 2026 | SQL Injection (SQLi) Guide - SecPortal beginner | SQL Injection (SQLi) Guide - SecPortal |
| 2026-04-06 2026 | CVE-2026-27697: Basercms SQLi Vulnerability news 3 min read | Writeup of CVE-2026-27697, an unauthenticated SQL injection vulnerability affecting baserCMS versions prior to 5.2.3. Exploitation allows attackers to manipulate database queries through the blog posts functionality, potentially leading to unauthorized data access, modification, or deletion. The vulnerability stems from improper input validation and can be mitigated by upgrading to baserCMS 5.2.3 or later, implementing WAF rules, or temporarily disabling the blog posts feature. → sentinelone.com |
| 2026-04-06 2026 | CVE-2026-5197: Student Membership System SQLi Vulnerability news 4 min read | Writeup of CVE-2026-5197, a SQL injection vulnerability in code-projects Student Membership System 1.0. The flaw in `/delete_user.php` allows remote authenticated attackers to inject malicious SQL commands via the ID parameter, potentially leading to unauthorized data access, modification, or deletion. Exploitation involves manipulating database queries using techniques like UNION-based or boolean-based blind injection. Mitigation includes implementing prepared statements, strict input validation, or WAF rules. → sentinelone.com |
| 2026-04-06 2026 | WAF Testing Guide: How to Validate Web Application Firewalls intermediate 10 min read | Guide to validating Web Application Firewalls (WAFs) using Breach and Attack Simulation (BAS). This approach continuously tests WAF efficacy against real-world attack payloads, including obfuscated SQL injection, XSS, RCE, and SSRF variants, as well as protocol-level vulnerabilities like HTTP vs. HTTPS inspection gaps. Agent-based BAS offers deterministic validation by isolating WAF behavior, providing accurate metrics on prevention rates, detection rates, and mitigation gaps without risking production environments. → picussecurity.com |
| 2026-04-06 2026 | Bug Bounty Bootcamp #29: Boolean Blind SQL Injection Part 2 intermediate | Bug Bounty Bootcamp #29: Boolean Blind SQL Injection Part 2 → infosecwriteups.com |
| 2026-04-03 2026 | What is SQL Injection? How to Prevent SQL Injection | Fortinet beginner | What is SQL Injection? How to Prevent SQL Injection | Fortinet |
| 2026-04-03 2026 | Bypassing WAFs in 2025: New Techniques and Evasion Tactics advanced | Bypassing WAFs in 2025: New Techniques and Evasion Tactics |
| 2026-04-03 2026 | 7 Types of SQL Injection Attacks & How to Prevent Them beginner 19 min read | Library detailing seven types of SQL injection attacks, including classic and blind SQLi. It explains how these attacks exploit un-sanitized user inputs to manipulate databases, leading to unauthorized access and data breaches. Prevention methods discussed include input sanitization, parameterized queries, least privilege access, and the use of Web Application Firewalls (WAFs). → sentinelone.com |
| 2026-04-03 2026 | SQLi Payloads - Classic, Blind, Error-Based, Time-Based, WAF Bypass intermediate 13 min read | Library of SQL injection payloads and techniques, covering classic, blind, error-based, and time-based methods. Includes bypass strategies for Web Application Firewalls (WAFs) and showcases tools like SQLMap, jSQL Injection, BBQSQL, and NoSQLMap for exploitation and scanning. Techniques range from simple character injections and comments to advanced blind SQL-bitshifting and server-time-based attacks, with examples for MySQL, MariaDB, and more. |
| 2026-04-03 2026 | SQL Injection for Bug Bounty Hunters | YesWeHack beginner 12 min read | Guide on SQL injection techniques for bug bounty hunters, covering blind SQLi, time-based attacks, and out-of-band callbacks. It details how to tailor payloads to SQL statements, integrate detection into bug bounty workflows, and exploit SQLi even in hardened systems, referencing vulnerabilities like CVE-2022-21661 in WordPress. → yeswehack.com |
| 2026-04-03 2026 | Exploiting an SQL Injection with WAF Bypass intermediate 11 min read | Tool for bypassing Web Application Firewalls (WAFs) to exploit SQL injection vulnerabilities. The process involves identifying a potential SQL injection using Burp Suite, confirming it manually via Burp Repeater, and then configuring sqlmap with specific techniques (`--technique=B`), exclusion strings (`--not-string`), proxy settings (`--proxy`), and modifying the User-Agent header to evade WAF detection. This enables successful exploitation of boolean-based blind SQL injection flaws. → vaadata.com |
| 2026-04-03 2026 | SQL Injection Bypassing WAF | OWASP intermediate 7 min read | Guide on bypassing Web Application Firewalls (WAFs) for SQL Injection attacks, detailing techniques like normalization vulnerabilities, HTTP Parameter Pollution (HPP), HTTP Parameter Fragmentation (HPF), and blind SQL injection exploitation. It covers various WAF bypassing strings and payload variations for common database functions and operators, illustrating how to evade signature-based detection and exploit application logic flaws. → owasp.org |