CVE-2025-62228 Apache Flink CDC, Apache Flink CDC, Apache Flink CDC, Apache Flink CDC, Apache Flink CDC: SQL injection via maliciously crafted identifiers

Apache Flink CDC version 3.4.0 was vulnerable to a SQL injection via maliciously crafted identifiers eg. crafted database name or crafted table name. Even through only the logged-in database user can trigger the attack, we recommend users update Flink CDC version to 3.5.0 which address this issue...

CVE-2025-62228

CVE-2025-62228 affects Apache Flink CDC: version 3.4.0 is vulnerable to SQL injection via maliciously crafted identifiers (e.g., database or table names). The issue can be triggered by a logged-in database user, with remediation to upgrade to 3.5.0 (or apply fixes per advisories). Connected docum...

PT-2025-41380

Name of the Vulnerable Software and Affected Versions Apache Flink CDC version 3.4.0 Description The software is susceptible to a SQL injection due to maliciously crafted identifiers, such as a crafted database name or table name. The attack can only be triggered by a logged-in database user...

Apache Flink CDC SQL注入漏洞

Apache Flink CDC is a real-time data capture framework from the Apache Foundation. An SQL injection vulnerability exists in Apache Flink CDC version 3.4.0, which stems from improper handling of specially crafted identifiers such as database names or table names, which could lead to SQL injection...

EUVD-2021-0970

Malware in sbrugna...

EUVD-2024-0285

Malicious code in bioql PyPI...

EUVD-2023-46326

Malicious code in bioql PyPI...

Exploit for Unrestricted Upload of File with Dangerous Type in Apache Activemq

This repository contains a collection of proof-of-concept PoC exploits and tools for various vulnerabilities. The exploits are categorized by the affected product or framework, and the vulnerability class/vector is also identified. The PoCs are: 1. ActiveMQ/ActiveMQExP.py: This is a PoC exploit f...

org.apache.zeppelin:zeppelin-flink-cmd (>=0.10.0 <=0.11.2), org.apache.zeppelin:zeppelin-spark-submit (>=0.10.0 <=0.11.2) +1 more potentially affected by CVE-2024-51775 via org.apache.zeppelin:zeppelin-shell (>=0.10.0 <=0.11.2)

org.apache.zeppelin:zeppelin-shell MAVEN version =0.10.0, =0.10.0, =0.10.0, =0.10.0, =0.11.2 Source cves: CVE-2024-51775 Source advisory: SNYK:JAVA-ORGAPACHEZEPPELIN-11444035...

CVE-2024-34457

On versions before 2.1.4, after a regular user successfully logs in, they can manually make a request using the authorization token to view everyone's user flink information, including executeSQL and config. Mitigation: all users should upgrade to 2.1.4...

CVE-2024-0960

A vulnerability was found in flink-extended ai-flow 0.3.1. It has been declared as critical. Affected by this vulnerability is the function cloudpickle.loads of the file \aiflow\cli\commands\workflowcommand.py. The manipulation leads to deserialization. The attack can be launched remotely. The...

CVE-2023-41834

Improper Neutralization of CRLF Sequences in HTTP Headers in Apache Flink Stateful Functions 3.1.0, 3.1.1 and 3.2.0 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via crafted HTTP requests. Attackers could potentially inject malicious content...

Prink: $K_s$-Anonymization for Streaming Data in Apache Flink

In this paper, we present Prink, a novel and practically applicable concept and fully implemented prototype for ks-anonymizing data streams in real-world application architectures. Building upon the pre-existing, yet rudimentary CASTLE scheme, Prink for the first time introduces semantics-aware...

org.apache.pinot:pinot-flink-connector (>=1.0.0 <=1.2.0), org.apache.pinot:pinot-minion-builtin-tasks (>=1.0.0 <=1.2.0) +1 more potentially affected by CVE-2024-56325 via org.apache.pinot:pinot-controller (>=1.0.0 <=1.2.0)

org.apache.pinot:pinot-controller MAVEN version =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.2.0 Source cves: CVE-2024-56325 Source advisory: SNYK:JAVA-ORGAPACHEPINOT-9637840...

org.apache.pinot:pinot-distribution (>=0.1.0 <=0.9.3), org.apache.pinot:pinot-flink-connector (>=1.0.0 <=1.2.0) +6 more potentially affected by CVE-2024-56325 via org.apache.pinot:pinot-controller (>=0.1.0 <=1.2.0)

org.apache.pinot:pinot-controller MAVEN version =0.1.0, =0.1.0, =1.0.0, =0.9.0, =0.1.0, =0.8.0, =0.8.0, =0.1.0, =0.1.0, =0.9.3 Source cves: CVE-2024-56325 Source advisory: OSV:GHSA-6JWP-4WVJ-6597...

ai.chronon:flink_2.12 (>=0.0.62 <=def544ccef5f753238ecc4adfc2eaa7d2fc36d53-0.0.91), ai.chronon:online_2.12 (>=0.0.25 <=def544ccef5f753238ecc4adfc2eaa7d2fc36d53-0.0.91) +4792 more potentially affected by CVE-2024-31141 via org.apache.kafka:kafka-clients (>=2.3.0 <=3.7.0)

org.apache.kafka:kafka-clients MAVEN version =2.3.0, =0.0.62, =0.0.25, =0.0.25, =0.0.86, =0.0.86, =thread-pool-0.0.24-dev, =0.0.6, =0.0.2, =0.1, =0.2.7, =0.2.7, =3.0.1, =2.8.4-alpha1, =1.0.0, =1.0.5 and more Source cves: CVE-2024-31141 Source advisory: OSV:GHSA-2X2G-32R7-P4X8...

cn.langpy:db-listener (>=0.0.9-jdk8 <=1.0.4-jdk8), cn.tenmg:flink-connector-mysql-cdc-log (=1.0.0) +62 more potentially affected by CVE-2023-1419 via io.debezium:debezium-connector-mysql (>=0.3.1 <=2.2.1.Final)

io.debezium:debezium-connector-mysql MAVEN version =0.3.1, =0.0.9-jdk8, =2.10.6.9, =4.3, =4.2, =4.2, =5.0, =2.1.0, =3.0.1 - dev.daodao.data:zipper-core =0.0.1 - io.cdap.delta:mysql-delta-plugins =0.10.0 and more Source cves: CVE-2023-1419 Source advisory: OSV:GHSA-HVW5-3MGW-7RCF...

cn.langpy:db-listener (>=0.0.9-jdk8 <=1.0.4-jdk8), cn.tenmg:flink-cdc-log-base (=1.0.0) +225 more potentially affected by CVE-2023-1419 via io.debezium:debezium-core (>=0.1.0 <=2.2.1.Final)

io.debezium:debezium-core MAVEN version =0.1.0, =0.0.9-jdk8, =2.10.6.9, =2.10.6.9, =2.10.6.9, =2.10.6.9, =2.10.6.9, =2.10.7.4-SNAPSHOT-35e64fa and more Source cves: CVE-2023-1419 Source advisory: OSV:GHSA-HVW5-3MGW-7RCF...

Apache Flink JobManager Traversal

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Apache Flink JobManager Traversal', 'Description' = %q This module exploits an unauthenticated directory traversal vulnerability in Apache Flink...

org.apache.pinot:pinot-compatibility-verifier (=0.10.0), org.apache.pinot:pinot-distribution (>=0.1.0 <=0.10.0) +7 more potentially affected by CVE-2024-39676 via org.apache.pinot:pinot-controller (>=0.10.0 <=0.9.3)

org.apache.pinot:pinot-controller MAVEN version =0.10.0, =0.1.0, =0.11.0, =0.9.0, =0.1.0, =0.8.0, =0.8.0, =0.1.0, =0.1.0, =0.10.0 Source cves: CVE-2024-39676 Source advisory: OSV:GHSA-8GJ9-R4HV-3JJW...