report-json flag generates report of only last endpoint scanned of bulkfile
Author: JacopoFoschi2Created Sep 17, 2026Updated Sep 17, 2026
Labelsbug report
Describe the bug When using the bulkfile option to scan multiple endpoints the generated json report consists only of the results of the last endpoint that was scanned
To Reproduce
- Create a simple bulkfile that can contain just 2 endpoints
- scan them with --report-json
- The report should contain finding of only the last endpoint scanned See relevant info.txt for more info
Expected behavior I expected a report file containing every vulnerability and finding of every scanned endpoint instead of it overwriting them
Screenshots N/A
Running environment:
- sqlmap version 1.10.9.12#dev
- Installation method github clone
- Operating system: Windows 10 pro
- Python version 3.14
Target details:
- MariaDB
- SQLi techniques found by sqlmap: boolean-based blind, error-based, time-based blind, UNION query for first endpoint. boolean-based blind, time-based blind for second endpoint. Only shows the ones of second endpoint
Additional context To show you the issue I have run the command 3 times so that I could give the generated reports to you:
- Scanning the bulkfile bulk_report.json
- Scanning only the first endpoint first_report.json
- Scanning only the second endpoint second_report.json
Here is the bulkfile I have used bulkfile.txt
And here are relevant infos and detailed instruction on how to replicate enviroment relevant info.txt
Source: sqlmapproject/sqlmap