CVE-2024-12727 Sophos coming in with an unauthenticated SQLi in their firewall appliance 👏

Looks like I'm not the only one who found a twexit SQLi vuln 😬

You should know that while you were asleep, one new XSS vuln, and two new SQLi vulns were found.

This is such awesome feedback to get! Always nice to hear when something I made helped people out. 🥰

Cheatsheet is here: tib3rius.com/sqli

Cloudflare leaked 10% of bot traffic to my homelab. Installed SafeLine WAF via Docker in 5 minutes. Free, self-hosted, blocks SQLi, XSS, DDoS. Guide: https://www.valtersit.com/guides/security/safeline-waf-docker-homelab-api-protection/ #homelab #docker #security

Maybe they are though. Twexit fan updated their bio to read “8 sqli (these numbers are counting non-twexit Adrianus sites)” 💀

Found a time-based SQLi on gori.gov.ge.

Not your typical SQLi vector... 😈

Ronin vulns: A Ruby library that tests URLs for Local File Inclusion (LFI), Remote File Inclusion (RFI), SQL injection (SQLi), and Cross Site Scripting (XSS), Server Side Template Injection (SSTI), and Open Redirects.

github.com/ronin-rb/ron...

#infosec
#cybersecurity
#threatdetection
#xss #SQLi

Added the "safe" OR-based payloads to my SQL injection cheatsheet: #sa...us.com/sqli#safe-or-based-payloads" class="hover:underline text-blue-600 dark:text-sky-400 no-card-link" target="_blank" rel="noopener" data-link="bsky">tib3rius.com/sqli#sa...

Video explanation here if you missed it: youtu.be/EpCA4HF-aUM

Still looking for an MSSQL one or a more reliable SQLite one, if anyone wants to help out. 👀

By the way, this isn't just twexit and mastochist. Every single website that Adrianus has ever made is vulnerable to SQLi.

And folks say SQLi is dead 😏

:( all of shreyan's websites have SQLi

ServiceNow AI flaws: unauth SQLi = arbitrary SQL on the instance DB. Two 9.3 criticals. Patch self-hosted now. https://intel.threadlinqs.com/threat/TL-2026-2653 #ThreatIntel #CVE_2026_13016 #CVE_2026_86857 #ServiceNow

also if we're still doing SQLi in the fucking TWENTY THIRD CENTURY we deserve to fucking perish

Last month I breached a bank with Spring2026!. Today I found SQLi on a login portal for a financial company. It feels like 2016 ❤️

Steht SQLi für Structured Querry Language injection? 💉

Rhino Security has found 6 vulns in the Infoblox NetMRI network automation and configuration management solution.

Bugs include an auth bypass via hardcoded credentials, privlege escalation via cookie forgery, an unauth command injection, and an SQLi

Quite bad

rhinosecuritylabs.com/research/inf...

Hoi #infosec people, afayk are SQLi attacks still a thing in the wild?

SQLi *and* a LFI today.
All of your files are belong to me 💁🏻‍♀️
This box is just riddled with all kinds of holes. Love it. 👏🏻

#hacker #SQLi #LFI #HTB #infosec #cybersecurity

Stará dobrá SQLi 🤦

oh i’ll have to look if they ever update the “your id” here, but this is what was used years ago to steal peoples sessions on uh…..damn what was the site everyone used for checking blocks before clearsky? php application that also had a bunch of sqli problems lol

bugbountyhunting.com

Bugbounty write ups search engine. A large collection of articles with examples of finding different types of vulnerabilities: XSS, SSRF, SQLI, RCE, IDOR.

Creator twitter.com/payloadartist

#pentest #cybersecurity

GDorks

Collection of lists of different types of Google dorks:
- SQLi
- Joomla
- Lavarel
- CCTV
- XSS
- WordPress
- LFI
and others.

github.com/Ishanoshada/...

Contributor twitter.com/ishanoshada