#6123·sqlmap

report-json flag generates report of only last endpoint scanned of bulkfile

Author: JacopoFoschi2Created Sep 17, 2026Updated Sep 17, 2026
Labelsbug report

Describe the bug When using the bulkfile option to scan multiple endpoints the generated json report consists only of the results of the last endpoint that was scanned

To Reproduce

  1. Create a simple bulkfile that can contain just 2 endpoints
  2. scan them with --report-json
  3. The report should contain finding of only the last endpoint scanned See relevant info.txt for more info

Expected behavior I expected a report file containing every vulnerability and finding of every scanned endpoint instead of it overwriting them

Screenshots N/A

Running environment:

  • sqlmap version 1.10.9.12#dev
  • Installation method github clone
  • Operating system: Windows 10 pro
  • Python version 3.14

Target details:

  • MariaDB
  • SQLi techniques found by sqlmap: boolean-based blind, error-based, time-based blind, UNION query for first endpoint. boolean-based blind, time-based blind for second endpoint. Only shows the ones of second endpoint

Additional context To show you the issue I have run the command 3 times so that I could give the generated reports to you:

  1. Scanning the bulkfile bulk_report.json
  2. Scanning only the first endpoint first_report.json
  3. Scanning only the second endpoint second_report.json

Here is the bulkfile I have used bulkfile.txt

And here are relevant infos and detailed instruction on how to replicate enviroment relevant info.txt