Mysql-Readfile

Introduction このプロジェクトは主に load data local infile を使用して、攻撃者のホスト（Windows プラットフォーム）上の任意のファイルを取得します。アクセスするファイルは file.txt にリストアップできます。これは、何らかの状況で Mysql の接続設定を制御できる場合に非常に有意義です。 Project usage Step 1: 偽の Mysql サーバーを起動する python2 Mysql-Read.py Step 2: 悪意のあるサーバーに接続する Referer...

mariadb-13-rce-lab

MariaDB 13.0.1-rc RCE ラボ 未改変の標準 MariaDB 13.0.1-rc Docker イメージ 上で、uid 999 mysql としてリモートコード実行を行います。 2つのエクスプロイト亜種: 亜種| ファイル| 要件| 備考 ---|---|---|--- Pure SQL （推奨）| exploitpuresql.py| 低権限 MariaDB アカウント + TCP| ホストアクセス不要、docker 不要、/proc/mem 不要、root パスワード不要 ホスト支援型 PoC| exploit.py| Docker ホスト上の root|...

CVE-2023-22884-Airflow-SQLi

Apache Airflow SQLインジェクション PoC CVE-2023-22884 CVE-2023-22884 の PoC は、2.4.0 より前のバージョンに影響する Apache Airflow の RCE 脆弱性です。 公式レポートの説明には次のように記載されています: Apache Software Foundation Apache Airflow および Apache Software Foundation Apache Airflow MySQL Provider における、コマンドに使用される特殊要素の不適切な無害化（'Command...

Nuclei: Local File Read via MySQL Client Sandbox Bypass

A vulnerability in Nuclei's JavaScript MySQL client library allows arbitrary local file reads that bypass the -allow-local-file-access -lfa sandbox restriction. Affected Component The issue is in the nuclei/mysql JavaScript library used by javascript: protocol templates. The MySQL client connecti...

CVE-2026-76803

Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the nuclei/mysql JavaScript library does not enforce the local-file sandbox when a JavaScript template supplies the allowAllFiles MySQL DSN option. An untrusted javascript: template scanning an...

CVE-2026-76803 Nuclei: Local File Read via MySQL Client Sandbox Bypass

Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the nuclei/mysql JavaScript library does not enforce the local-file sandbox when a JavaScript template supplies the allowAllFiles MySQL DSN option. An untrusted javascript: template scanning an...

CVE-2026-76803

The Nuclei vulnerability scanner (versions 3.0.0 through 3.10.0 ) contains a flaw in its nuclei/mysql JavaScript library. The library fails to enforce local-file sandbox restrictions when a javascript: template provides the allowAllFiles MySQL DSN option. This allows an attacker controlling a MyS...

CVE-2026-76803 Nuclei: Local File Read via MySQL Client Sandbox Bypass

Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the nuclei/mysql JavaScript library does not enforce the local-file sandbox when a JavaScript template supplies the allowAllFiles MySQL DSN option. An untrusted javascript: template scanning an...

EUVD-2026-45493

In the Linux kernel, the following vulnerability has been resolved: apparmor: fix use-after-free in rawdata dedup loop aareplaceprofiles walks ns-rawdatalist to dedup the incoming policy blob against entries already attached to existing profiles. Per the kernel-doc on struct aaloaddata, list...

CVE-2026-63827

Root cause: Linux kernel AppArmor uses a use-after-free in the rawdata dedup loop (aa_replace_profiles) due to unsafe refcount handling when traversing ns->rawdata_list. The dedup path calls aa_get_profile_loaddata() which has plain kref_get() semantics, allowing a zero counter to be dereferen...

PT-2026-61143

Name of the Vulnerable Software and Affected Versions Linux kernel version 7.1-rc5 Description A use-after-free issue exists in the AppArmor module of the Linux kernel during the rawdata deduplication loop. The function aa replace profiles iterates through ns-rawdata list to deduplicate incoming...

PT-2026-57365

Name of the Vulnerable Software and Affected Versions BabelDOC versions prior to 0.6.3 Description BabelDOC contains a flaw that allows arbitrary Python code execution when processing a specially crafted PDF file. The issue exists in the vendored PDF parser within the CMapDB. load data function,...

The vulnerability of the load_data() function in the llama_index/readers/obsidian/base.py file of the ObsidianReader plugin, which allows an intruder to gain unauthorized access to protected information.

The vulnerability of the loaddata function in the llamaindex/readers/obsidian/base.py file of the ObsidianReader plugin is related to path traversal. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information...

EUVD-2026-23293

DataEase is an open-source data visualization and analytics platform. Versions 2.10.20 and below contain a JDBC parameter blocklist bypass vulnerability in the MySQL datasource configuration. The Mysql class uses Lombok's @Data annotation, which auto-generates a public setter for the...

CVE-2026-40899

DataEase is an open-source data visualization and analytics platform. Versions 2.10.20 and below contain a JDBC parameter blocklist bypass vulnerability in the MySQL datasource configuration. The Mysql class uses Lombok's @Data annotation, which auto-generates a public setter for the...

CVE-2026-40899

DataEase

DataEase 安全漏洞

DataEase is an open-source data visualization and analysis tool developed by DataEase. It helps users quickly analyze data and gain insights into business trends, thereby enabling improvements and optimizations in operations. DataEase versions 2.10.20 and earlier contain security vulnerabilities...

CVE-2026-32949

SQLBot is an intelligent data query system based on a large language model and RAG. Versions prior to 1.7.0 contain a Server-Side Request Forgery SSRF vulnerability that allows an attacker to retrieve arbitrary system and application files from the server. An attacker can exploit the...

CVE-2026-32949: Server-Side Request Forgery (SSRF)

SQLBot is an intelligent data query system based on a large language model and RAG. Versions prior to 1.7.0 contain a Server-Side Request Forgery SSRF vulnerability that allows an attacker to retrieve arbitrary system and application files from the server. An attacker can exploit the...

PT-2026-7031

A vulnerability was identified in code-projects Online Reviewer System 1.0. The affected element is an unknown function of the file /system/system/admins/assessments/pretest/loaddata.php. Such manipulation of the argument difficulty id leads to sql injection. It is possible to launch the attack...