CVE-2026-72898

CVE-2026-72898 Metabase password-reset unauthenticated SQL injection ★ CVE-2026-72898 Metabase /api/session/resetpassword unauthenticated blind SQLi PoC ★ https://github.com/user-attachments/assets/4efe5ae3-2a41-4567-815b-ee3f731a5a59 Overview CVE-2026-72898 is an unauthenticated SQL injection in...

Metabase 0.63.4 SQL Injection

A proof of concept exploit for an unauthenticated SQL injection vulnerability in Metabase version 0.63.4. The vulnerability exists in public shared cards containing field-filter template tags, where a specially structured parameter value can be interpreted by HoneySQL as raw query structure rathe...

SQL Injection

Overview honeysql:honeysql is a SQL as Clojure data structures. Build queries programmatically -- even at runtime -- without having to bash strings together. Affected versions of this package are vulnerable to SQL Injection via seq-sql function in format.cljc file. Remediation Upgrade...