Web Vulnerability Scanners
Web vulnerability scanners test HTTP/HTTPS endpoints for injection flaws, broken authentication, sensitive data exposure, and logic errors. Use these tools to continuously monitor your public-facing applications before attackers do.
Important Web Vulnerabilities Scanners
Online Generic SQL Injection Vulnerability Scanner
Detect SQL Injection vulnerabilities in your web applications
Free and Online Generic XSS Scanner
XSS Vulnerability is a type of vulnerability typically found in web applications. It occurs when user input data is not correctly filtered or sanitized before being returned to the end-user.
Generic SSRF Vulnerability Scanner
Server-side request forgery (SSRF), is a vulnerability that allows an attacker to execute unauthorized requests from the perspective of the webserver. SSRF can be used to access sensitive data, such as internal network resources and user data, or to launch attacks on other systems from the webserver.The impact of SSRF attacks can be significant. They can allow attackers to arbitrary command execution, access internal apps, and even scan ports in the local network.
Generic Server Side Template Injection (SSTI) Vulnerability Scanner
Detects 'Server Side Template Injection (SSTI)' vulnerability in Web Application. Identifies injectable template contexts that allow server-side evaluation of attacker-controlled expressions, enabling data exposure or remote code execution if exploited.
Online Generic File Inclusion - LFI/RFI Vulnerability Scanner
File inclusion vulnerabilities are a type of vulnerability that occurs when an attacker is able to include a file, usually through using inputs on the webserver. These vulnerabilities can lead to information disclosure, arbitrary code execution, and full system compromise.
Generic Blind XXE Scanner
Generic Blind XXE Scanner
Generic Command Injection Vulnerability Scanner
A command injection vulnerability occurs when an attacker is able to pass malicious input to a program and have that input executed as an OS command. This can allow attackers to run operation system-level command execution. Command injection is often possible due to insecure coding practices that do not properly validate or sanitize user input.
HTTP Header Command Injection Vulnerability Fuzz & Scanner
You can fuzz HTTP headers for command injection using this tool.
Cache Poisoning to Stored XSS Vulnerability Scanner
This scanner identifies vulnerabilities where cache poisoning could lead to stored XSS, enabling attackers to inject malicious scripts that are executed when the cached content is served.
### Arachni ### Web Application Source Code Disclosure Scanner
Detects 'Source Code Disclosure' vulnerability in Web Application affecting exposed source/config files and repository artifacts. This scanner finds accessible source files, backups, and repository metadata that may reveal sensitive code and secrets.
### Arachni ### Generic Code Injection Vulnerability Scanner
Detects 'Code Injection' vulnerability. This scanner identifies weaknesses in web applications, built with technologies like PHP, Ruby, Python, Java, and ASP, where an attacker can introduce and execute arbitrary code. Detecting this critical flaw prevents unauthorized server access and potential system compromise.
Halo ITSM SQL Injection Scanner
Detects 'SQL Injection' vulnerability in Halo ITSM.
Windows LFI Vulnerability Scanner
Detect and Protect Against Windows LFI Vulnerabilities
Generic Linux LFI Detection Scanner
Identify and Mitigate Local File Inclusion Vulnerabilities in Linux Systems
J2EE LFI Vulnerability Scanner
Detect potential Local File Inclusion (LFI) vulnerabilities within J2EE applications, focusing on unauthorized access to critical files such as web.xml, which could lead to sensitive information disclosure.
CPAS Management System SQL Injection Scanner
Detects 'SQL Injection' vulnerability in CPAS Management System affects v. 4. This scanner identifies critical flaws allowing unauthorized data retrieval and server compromise through SQL queries.
Fronsetiav Cross-Site Scripting Scanner
Targets the 'WSDL Location' parameter in show_operations.jsp, enabling attackers to inject malicious scripts that execute in victims' browsers.
Top 38 Parameters XSS Vulnerability Scanner
Detecting Cross-Site Scripting (XSS) Through Top 38 Parameters
Zoo Management System 1.0 - SQL Injection
Zoo Management System 1.0 contains a SQL injection vulnerability via the username parameter on the login page. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of the affected site.
Metabase - Unauthenticated SQL Injection
Metabase contains a sql injection caused by improper sanitization of input in the '/reset_password' database endpoint, letting remote unauthenticated attackers gain administrator access, exploit requires no special privileges.
SiYuan <=3.7.2 - SQL Injection
SiYuan before v3.7.3 contains a SQL injection caused by direct concatenation of the keyword parameter in /api/filetree/searchDocs endpoint, letting attackers with publish RoleReader token or unauthenticated in publish mode read and modify database content.
Wuzhicms 4.1.0 - SQL Injection
Wuzhicms 4.1.0 contains a SQL injection vulnerability via the grouppid parameter of /coreframe/app/member/admin/group.php. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of the affected site.
Company Visitor Management System 1.0 - SQL Injection
Company Visitor Management System 1.0 contains a SQL injection vulnerability via the login page in the username parameter. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of the affected site.
SiYuan - SQL Execution
SiYuan
Loan Management System 1.0 - SQL Injection
Loan Management System 1.0 contains a SQL injection vulnerability via the username parameter. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of the affected site.
Advantech WISE-IoTSuite/SaaS - SQL Injection
Advantech WISE-IoTSuite/SaaS Composer suffers from an unauthenticated SQL Injection vulnerability due to the unsafe use of the `filename` parameter within the URL path in PostgreSQL queries. Remote attackers can exploit this flaw by injecting SQL code (such as the use of `pg_sleep` for time delays) to verify the vulnerability, and may gain further impact such as Remote Code Execution (RCE) depending on the privileges granted to the database user.
Windmill < 1.603.3 - SQL Injection
Windmill versions 1.276.0 through 1.603.2 contain an authenticated SQL injection vulnerability in the folder owner management endpoint. The addowner API endpoint passes user-supplied input directly into a SQL query without sanitization, enabling JSONB path injection. An authenticated user with operator-level access can extract sensitive data including JWT secrets, password hashes, API tokens, and database credentials, leading to full privilege escalation and remote code execution.
ChurchCRM - SQL Injection
A vulnerability exists in ChurchCRM 5.13.0 and prior that allows an attacker to execute arbitrary SQL queries by exploiting a time-based blind SQL Injection vulnerability in the EditEventTypes functionality. The newCountName parameter is directly concatenated into an SQL query without proper sanitization, allowing an attacker to manipulate database queries and execute arbitrary commands, potentially leading to data exfiltration, modification, or deletion.
St. Joe ERP system - SQL Injection
A SQL injection vulnerability exists in the St. Joe ERP system ("ERP") that allows unauthenticated remote attackers to execute arbitrary SQL commands via crafted HTTP POST requests to the login endpoint. The application fails to properly sanitize user-supplied input before incorporating it into SQL queries, enabling direct manipulation of the backend database.
E-Learning System 1.0 - SQL Injection
E-Learning System 1.0 contains an unauthenticated SQL injection caused by unsanitized input, letting remote attackers execute arbitrary code on the server and gain a reverse shell, exploit requires no authentication.
FUXA <= 1.1.12 - Unauthenticated SQL Injection
FUXA
CVE-2025-2294 Scanner
CVE-2025-2294 Scanner - Local File Inclusion (LFI) vulnerability in Kubio AI Page Builder
Nortek Linear eMerge E3-Series - SQL Injection
Nortek Linear eMerge E3-Series 0.32-08f, 0.32-07p, 0.32-07e, 0.32-09c, 0.32-09b, 0.32-09a, and 0.32-08e were discovered to contain a SQL injection vulnerability via the idt parameter.
XWiki Platform - SQL Injection
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 9.4-rc-1 through 16.10.5 and 17.0.0-rc-1 through 17.2.2, it's possible for anyone to inject SQL using the parameter sort of the getdeleteddocuments.vm. It's injected as is as an ORDER BY value.
GeoServer jsonArrayContains CQL Filter - SQL Injection
GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. GeoTools FilterToSqlHelper.constructEquality writes the expected argument of the jsonArrayContains CQL function RAW into the SQL string while only escaping the JSON pointer. A single quote in the value parameter breaks out of the PostgreSQL jsonb_path_exists string literal, enabling unauthenticated SQL injection. When the PostGIS backend runs with superuser privileges, the injection escalates to operating system command execution through PostgreSQL COPY TO PROGRAM. Users are advised to upgrade to either version 2.21.4, or version 2.22.2 to resolve this issue. Users unable to upgrade should enable the PostGIS DataStore preparedStatements setting and disable encode functions as a workaround.
Drupal Core - Anonymous SQL Injection via PostgreSQL Entity Query
Drupal core from 8.9.0 before 10.4.10, 10.5.0 before 10.5.10, 10.6.0 before 10.6.9, 11.0.0 before 11.1.10, 11.2.0 before 11.2.12, and 11.3.0 before 11.3.10 contains an SQL injection caused by improper neutralization of special elements in SQL commands, letting attackers execute arbitrary SQL queries, exploit requires crafted input.
Chef Automate < 4.13.295 SQL Injection
In Progress Chef Automate, versions earlier than 4.13.295, on Linux x86 platform, an authenticated attacker can gain access to Chef Automate restricted functionality in the compliance service via improperly neutralized inputs used in an SQL command using a well-known token. Remediation:Upgrade to version 4.13.295 or later.
ZEROF Web Server 2.0 - SQL Injection
ZEROF Web Server 2.0 allows SQL Injection via the /HandleEvent endpoint. Attackers can exploit this vulnerability by manipulating the request parameters to execute arbitrary SQL queries.
XWiki - HQL Injection
XWiki is vulnerable to Hibernate Query Language (HQL) injection in the wiki and space search REST API starting in version 4.3-milestone-1 and prior to versions 16.10.9, 17.4.2, and 17.5.0. The vulnerability allows attackers to inject malicious HQL queries through the orderField parameter, potentially leading to data extraction, authentication bypass, or remote code execution depending on database backend and configuration.
Citrix SD-WAN and NetScaler SD-WAN - SQL Injection
Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 contain an SQL injection vulnerability. An unauthenticated attacker can exploit improper validation of input in specific components, which could allow for execution of arbitrary SQL queries against the backend database. This could result in information disclosure, manipulation of data, or complete compromise of affected systems.
mJobTime <= 15.7.2 - Unauthenticated Blind SQL Injection to RCE
mJobtime v15.7.2 contains a sql injection caused by crafted POST request to /Default.aspx/update_profile_Server, letting unauthenticated attackers execute arbitrary SQL statements remotely, exploit requires no special privileges.
Grandstream UCM6200 - SQL Injection
Grandstream UCM6200 series contains an unauthenticated remote SQL injection caused by crafted HTTP requests, letting attackers execute shell commands as root on versions before 1.0.19.20 or inject HTML in emails before 1.0.20.17.
CVE-2023-30192 Scanner
CVE-2023-30192 Scanner - SQL Injection vulnerability in PrestaShop possearchproducts
CVE-2025-22952 Scanner
CVE-2025-22952 Scanner - Server Side Request Forgery vulnerability in Elestio Memos
Mingsoft MCMS 5.1 - SQL Injection
Mingsoft MCMS 5.1 contains a SQL injection vulnerability in POST /ms/cms/content/list.do via the contentCategoryId parameter (mapped to categoryId in ContentBizImpl.java / IContentDao.xml). The original PoC uses a time-based SLEEP payload. Snyk's write-up uses an authenticated request (PR:Low), while NVD rates it as unauthenticated (PR:N); this template probes the endpoint without credentials first. No vendor-fixed version was listed by Snyk at disclosure.
Django QuerySet.order_by - SQL Injection
Django 3.1.x before 3.1.13 and 3.2.x before 3.2.5 contain a SQL injection caused by untrusted input in QuerySet.order_by, letting attackers execute arbitrary SQL commands, exploit requires attacker to control order_by input.
Fortinet FortiClientEMS 7.4.4 - SQL Injection
Fortinet FortiClientEMS version 7.4.4 and earlier contains an unauthenticated SQL injection vulnerability in the /api/v1/init_consts endpoint. The 'Site' HTTP header value is passed directly into the PostgreSQL search_path without sanitization, allowing remote unauthenticated attackers to inject arbitrary SQL commands. This can lead to information disclosure, database manipulation, or OS command execution when chained with PostgreSQL functions.
Prestashop posstaticfooter <= 1.0.0 - SQL Injection
Prestashop posstaticfooter
CVE-2023-25280 Scanner
CVE-2023-25280 Scanner - OS Command Injection vulnerability in D-Link DIR820LA1_FW105B03
CVE-2023-5974 Scanner
This scanner targets the 'path' parameter in download-file.php, allowing unauthenticated attackers to force the server into making arbitrary requests to internal or external resources.
LiteLLM - SQL Injection
LiteLLM 1.81.16 to
CVE-2020-15415 Scanner
CVE-2020-15415 Scanner - Command Injection vulnerability in DrayTek Vigor
FreePBX - Remote Code Execution
FreePBX 15, 16, and 17 contain a remote code execution caused by insufficiently sanitized user-supplied data in endpoints, letting unauthenticated attackers manipulate the database and execute code remotely, exploit requires no authentication.
### Arachni ### Command İnjection Scanner
A command injection vulnerability occurs when an attacker is able to pass malicious input to a program and have that input executed as an OS command. This can allow attackers to run operation system-level command execution. Command injection is often possible due to insecure coding practices that do not properly validate or sanitize user input.
Fortinet FortiWeb - SQL Injection
An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] in FortiWeb may allow an unauthenticated attacker to execute unauthorized SQL code or commands via crafted HTTP or HTTPS requests.
Django - SQL injection
An issue was discovered in Django 3.2 before 3.2.14 and 4.0 before 4.0.6. The Trunc() and Extract() database functions are subject to SQL injection if untrusted data is used as a kind/lookup_name value. Applications that constrain the lookup name and kind choice to a known safe list are unaffected.
Sangoma Switchvox < 8.4.0.2 - Unauthenticated SQL Injection
Sangoma Switchvox before version 8.4.0.2 contains an unauthenticated SQL injection vulnerability in the /pa endpoint (PhoneAppsHandler.pm). The PhoneIP field extracted from an XML POST body is concatenated directly into an unparameterized PostgreSQL query that runs as a database superuser. An attacker can break out of the single-quoted SQL string context and leverage PostgreSQL COPY TO PROGRAM to execute arbitrary operating system commands without authentication.
Craft CMS < 4.18.9, < 5.11.2 - Unauthenticated SQL Injection
Craft CMS
Run all Web Vulnerabilities checks at once.
S4E covers 311+ scanners in this category with continuous monitoring and full remediation guidance.
Start Free Scan →