SQLMap 1 ~ CyLab Security Academy Write-up | Exploiting SQL Injection and Accessing Protected Data
Medium2026-10-30
Web
Not rated
BUG BOUNTY WRITEUPS
SQL injection writeups
SQL injection hasn't gone away. These writeups cover classic, blind and time-based SQLi, plus NoSQL and ORM edge cases in modern stacks.
77 reports and writeups from 2024 to 2026. 45 carry a severity from the disclosing platform, 34 of them rated High or Critical. Last updated 2026-10-30.
Latest SQL injection reports
Search and filter all writeupsBeyond the Syllabus: SQL Injection, Zero Trust and a 1-Week Bootcamp | GCF Parul University (Part…
Medium2026-10-30
Web
Not rated
Web, API
Not rated
>> XSS vs SQL Injection (SQLi): Understanding Two Common Web Application Vulnerabilities
Medium2026-10-27
Web
Not rated
SQL Injection vulnerability found on IBM.com subdomain
HackerOneIBM2026-10-16
Web
Not rated
SQL Injection found on ibm.com subdomain
HackerOneIBM2026-10-12
Web
Critical
`SHOW [CREATE|GRANTS] ...` / `mariadb-dump` Unescaped SQL Generation
HackerOneMariaDB2026-10-07
Web
Not rated
From Bug to Schema: Exploring Error-Based SQL Injection on an Authenticating Portal
InfoSec Write-ups2026-09-01
Web
Not rated
Critical SQL Injection WDM API (████████)
HackerOneEssity2026-08-27
Web, API
Critical
DDP methods getThreadsList / getThreadMessages leaks private thread content to any authenticated low privilege user (unpatched sibling of #1446767)
HackerOneRocket.Chat2026-08-20
Web
High
Unauthenticated SQL Injection via REST Batch Route Confusion ████████
HackerOneEssity2026-07-21
Web
Critical
Error-Based SQL Injection in ████████.com Login/Password Reset (username parameter)
HackerOneEssity2026-07-03
Web
Critical
Blind SQL injection via clientid parameter in zone‑include.php
HackerOneRevive Adserver2026-06-03
Web
High
SQL Injection in Column Type Parameter Allows Arbitrary SQL Execution
HackerOneNextcloud2026-05-15
Web, Cloud
High
Complete authentication bypass to admin permissions
HackerOneRocket.Chat2026-04-22
Web
Critical
SQL Injection Detection Bypass in AWS WAF Managed Rules (AWSManagedRulesSQLiRuleSet)
HackerOneAWS VDP2026-04-15
Web, Cloud
Not rated
SQL Injection vulnerability found on ibm.com endpoint
HackerOneIBM2026-03-12
Web, API
Critical
SQLi at █████ parameter
HackerOneMars2026-02-24
Web
Critical
SQLi At `███████` via `theme_name`
HackerOneMars2026-02-24
Web
Critical
SQL injection in structure plugin
HackerOneExpressionEngine2026-01-26
Web
Medium
SQL Injection - data[account][id] parameter
HackerOneU.S. Dept Of Defense2026-01-12
Web
High
SQL Injection in URI Path Leading to Full Database Disclosure on ████████
HackerOneU.S. Dept Of Defense2026-01-12
Web
High
SQL Injection via URL
HackerOneU.S. Dept Of Defense2026-01-12
Web
High
SQL Injection - entryid parameter in 'formbuilderv2-confirmation.php'
HackerOneU.S. Dept Of Defense2026-01-12
Web
High
Error-based blind SQL injection
HackerOneU.S. Dept Of Defense2026-01-12
Web
Medium
SQLi in LASCO CME Query
HackerOneU.S. Dept Of Defense2026-01-12
Web
High
SQL Injection - JSON 'name' parameter
HackerOneU.S. Dept Of Defense2026-01-12
Web
High
SQL injection identified on IBM endpoint.
HackerOneIBM2026-01-07
Web, API
Critical
Potential SQL Injection when annotating FilteredRelation on PostgreSQL
HackerOneDjango2025-12-02
Web
High
SQL Injection in Django ORM via Unvalidated `_connector` in Q Objects
HackerOneDjango2025-11-06
Web
Critical
Error-Based & Time-Based SQL Injection in 'keyword' Parameter of admin-search.php Allowing Full Database Access in Revive Adserver v6.0.0
HackerOneRevive Adserver2025-10-24
Web
High
SQL Injection when using FilteredRelation
HackerOneDjango2025-09-15
Web
Critical
SQL injection in JSONField KeyTransform
HackerOneDjango2025-09-12
Web
High
Woocommerce SQL Injection in WC_Report_Coupon_Usage
HackerOneAutomattic2025-06-24
Web
Medium
Apache Airflow Sql injection by authenticated user
HackerOneInternet Bug Bounty2025-05-27$505 bounty
Web
Low
SQLi | in URL paths
HackerOneMTN Group2025-03-06
Web
Critical
CVE-2024-53908: Django Potential SQL injection in `HasKey(lhs, rhs)` on Oracle
HackerOneInternet Bug Bounty2025-02-07
Web
High
Time-based blind SQL injection
HackerOneU.S. Dept Of Defense2025-01-24
Web
Medium
Boolen Based Blind Sql Injection Via User Agent in ███.mil
HackerOneU.S. Dept Of Defense2025-01-24
Web
Medium
SQL injection in URL path leads to Database Access
HackerOneMTN Group2025-01-08
Web
Critical
SQL Injection
HackerOneU.S. Dept Of Defense2024-10-25
Web
High
Data Theft in Salesforce: Manipulating Public Links
Researcher blogSalesforce2024-09-16
Web
Not rated
Directory Traversal, SQL Injection and Server-Side Request Forgery
Researcher blogSage2024-09-10
Web
Not rated
Breaking Down Barriers: Exploiting Pre-Auth SQL Injection In WhatsUp Gold - CVE-2024-6670
Researcher blogProgress (WhatsUp Gold)2024-08-30
Source Code, Binary
Not rated
Blind Sql Injection in https://████
HackerOneU.S. Dept Of Defense2024-08-29
Web
Medium
Bypassing airport security via SQL injection
Researcher blog2024-08-29
Web
Not rated
SQL injection in https://demor.adr.acronis.com/ via the username parameter
HackerOneAcronis2024-08-28
Web
High
CVE-2024-42005: Potential SQL injection in QuerySet.values() and values_list()
HackerOneInternet Bug Bounty2024-08-24$4,263 bounty
Web
High
World of SELECT-only PostgreSQL Injections: (Ab)using the filesystem
Researcher blog2024-08-19
Web
Not rated
Exploiting authorization by nonce in WordPress plugins
Researcher blogWordfence2024-08-05
Web, Source Code
Not rated
No Database No Table, how do you do MSSQL Injection?
Researcher blog2024-08-04
Web
Not rated
SQL injection in /errors/viewbuild/
HackerOneValve2024-07-30
Web
Critical
NoSQL injection leaks visitor token and livechat messages
HackerOneRocket.Chat2024-07-11
Web
Medium
From Long-Term Hacking to Instant Rewards: Finding SQLi in 3 Minutes Worth $3125
Medium2024-07-06$3,125 bounty
Web
Not rated
Sqli on ██████ search functionality
HackerOneMars2024-06-25
Web
Medium
sqli on █████████ search functionality
HackerOneMars2024-06-25
Web
Medium
MongoDB NoSQL Injection with Aggregation Pipelines
Researcher blog2024-06-23
Web
Not rated
From a GLPI patch bypass to RCE
Researcher blogGLPI2024-06-20
Web, Source Code
Not rated
Super Blind SQL Injection- $20000 bounty | Thousands of targets still vulnerable
Medium2024-06-08$20,000 bounty
Web
Not rated
How I Got My First €€€€ Bounty
Medium2024-06-03
Web
Not rated
Hacking Apple - SQL Injection to Remote Code Execution
Researcher blogApple, Mura CMS, Masa CMS2024-05-08
Web, Source Code
Not rated
SQL injection on ██████████ via 'where' parameter
HackerOneU.S. Dept Of Defense2024-05-03
Web
Medium
Subdomain Fuzzing worth 35k bounty!
Medium2024-03-18$35,000 bounty
Web
Not rated
$20,300 Bounties from a 200 Hour Hacking Challenge
Researcher blog2024-03-04$20,300 bounty
Web
Not rated
Defeating Length Filters to Dump the Database - SQLi
Researcher blog2024-02-23
Web
Not rated
Security Vulnerabilities in Apex Code Could Leak Salesforce Data
Researcher blog2024-02-20
Web
Not rated
Blind SQL Injection on █████ via URI Path
HackerOneMars2024-02-14
Web
Critical
CVE-2024-0685 Ninja Contact Forms Data Export SQLi
Researcher blogWordfence2024-02-10$165 bounty
Web, Source Code
Not rated
Null Byte on Steroids
Medium2024-02-06
Web
Not rated
SQL Injection on prod.oidc-proxy.prod.webservices.mozgcp.net via invite_code parameter - Mozilla social inscription
HackerOneMozilla2024-01-30
Web
Critical
Time based SQL injection at████████
HackerOneU.S. Dept Of Defense2024-01-26
Web
High
SQL injection at ███████
HackerOneSony2024-01-24
Web
Critical
A christmas tale: pwning GTB Central Console (CVE-2024-22107 & CVE-2024-22108)
Researcher blogGTB Technologies2024-01-23
Web, Source Code
Not rated
SQL Injection on PostgreSQL
Medium2024-01-23
Web
Not rated
Multiple Vulnerabilities On GestSup 3.2.44
Researcher blogGetSup2024-01-22
Web, Source Code
Not rated
Web
Not rated
Blind Boolean Based SQLi By Manipulating URL
Medium2024-01-08
Web
Not rated
Every entry links to the original report or article. Secure Hyperloop doesn't copy the content. Severity comes from the disclosing platform (HackerOne). Writeups without a platform rating show "Not rated". The index has 2,810 items in total.