CVE-2019-12384

CVE-2019-12384 Jackson RCE And SSRF 0x01 python -m SimpleHTTPServer root@kitploit: python -m SimpleHTTPServer Serving HTTP on 0.0.0.0 port 8000 ... 127.0.0.1 - - 24/Jul/2019 03:06:32 "GET /inject.sql HTTP/1.1" 200 - inject.sql root@kitploit: CREATE ALIAS SHELLEXEC AS $$ String shellexecString cmd...

jdbc-sqlxml-xxe

jdbc-sqlxml-xxe h2-jdbc CVE-2021-23463 https://github.com/h2database/h2database/issues/3195 SQLXML XXE vulnerability reproduction. mysql-jdbc CVE-2021-2471 SQLXML XXE vulnerability reproduction...

Apache Gravitino < 1.2.1 - Unauthenticated Remote Code Execution

Apache Gravitino 1.2.1 contains a remote code execution caused by unsanitized H2 JDBC URL via testConnection API using H2's INIT parameter, letting unauthenticated attackers execute arbitrary Java code remotely, exploit requires H2 usage. id: CVE-2026-41042 info: name: Apache Gravitino 1.2.1 -...

cve-2026-41042

CVE-2026-41042: Apache Gravitino 1.2.1 Unauthenticated RCE Self-contained, stdlib-only proof of concept for CVE-2026-41042: unauthenticated remote code execution in Apache Gravitino before 1.2.1 via the H2 JDBC INIT connection setting. No auth headers, no extra drivers, no pip installs...

CVE-2025-70829

CVE-2025-70829: Information Exposure in Datart 中文文档 1. Vulnerability Overview CVE ID : CVE-2025-70829 Product : Datart Version : v1.0.0-rc.3 Vulnerability Type : Information Exposure An information exposure vulnerability in Datart v1.0.0-rc.3 allows authenticated attackers to access sensitive dat...

metabase-cve-2023-38646

cd /metabase-poc cat README.md 'EOF' CVE-2023-38646 — Metabase Pre-Auth Remote Code Execution Summary CVSS 9.8. Metabase versions before 0.46.6.1 / 1.46.6.1 and equivalent earlier branches expose a pre-authentication RCE via the /api/setup/validate endpoint, which is meant to validate database...

CVE-2023-34468-PoC

CVE-2023-34468 PoC for Apache NiFi Educational proof-of-concept PoC for CVE-2023-34468 affecting Apache NiFi versions prior to 1.22.0. This repository demonstrates how abuse of H2 JDBC URL configuration can lead to authenticated remote code execution RCE in vulnerable Apache NiFi installations...

WSO2-2021-1259

WSO2-2021-1259: H2 RCE via Malicious JDBC Connection String in WSO2 ESB Due to the improper input validation, a remote code execution attack could be carried out using malicious H2 JDBC Connection Strings. Vendor Disclosure: The vendor's disclosure and fix for this vulnerability can be found here...

CVE-2026-33725

Metabase is an open source business intelligence and embedded analytics tool. In Metabase Enterprise prior to versions 1.54.22, 1.55.22, 1.56.22, 1.57.16, 1.58.10, and 1.59.4, authenticated admins on Metabase Enterprise Edition can achieve Remote Code Execution RCE and Arbitrary File Read via the...

CVE-2026-33725

Metabase is an open source business intelligence and embedded analytics tool. In Metabase Enterprise prior to versions 1.54.22, 1.55.22, 1.56.22, 1.57.16, 1.58.10, and 1.59.4, authenticated admins on Metabase Enterprise Edition can achieve Remote Code Execution RCE and Arbitrary File Read via the...

CVE-2025-70829

An information exposure vulnerability in Datart v1.0.0-rc.3 allows authenticated attackers to access sensitive data via a custom H2 JDBC connection string...

BIT-NIFI-2023-34468 Apache NiFi: Potential Code Injection with Database Services using H2

The DBCPConnectionPool and HikariCPConnectionPool Controller Services in Apache NiFi 0.0.2 through 1.21.0 allow an authenticated and authorized user to configure a Database URL with the H2 driver that enables custom code execution. The resolution validates the Database URL and rejects H2 JDBC...