406 matches found
Metabase - Unauthenticated SQL Injection
Metabase contains a sql injection caused by improper sanitization of input in the '/resetpassword' database endpoint, letting remote unauthenticated attackers gain administrator access, exploit requires no special privileges. id: CVE-2026-72898 info: name: Metabase - Unauthenticated SQL Injection...
Metabase - Local File Inclusion
Metabase is an open source data analytics platform. In affected versions a local file inclusion security issue has been discovered with the custom GeoJSON map admin-settings-maps-custom maps-add a map support and potential local file inclusion including environment variables. URLs were not...
PoC-Metabase-CVE-2021-41277
Questo repository non contiene un README...
cve-2023-38646-poc
Metabase Pre Authentication RCE CVE-2023-38646 CVE-2023-38646 è una vulnerabilità di esecuzione remota di codice in Metabase. La vulnerabilità deriva da un difetto di sicurezza nella gestione delle stringhe di connessione JDBC da parte di Metabase quando processa l'endpoint API non autenticato...
CVE-2023-38646
CVE-2023-38646 Das ursprüngliche Skript stammt von securezeron Während der Tests habe ich festgestellt, dass die Reverse-Shell, die von diesem POC generiert wurde, nach der Base64-Kodierung aufgrund des '='-Zeichens am Ende fehlschlug. Ich habe es leicht modifiziert, um dieses Problem zu beheben...
CVE-2023-38646
CVE-2023-38646-exploit "यह भेद्यता, जिसे CVE-2023–38646 नामित किया गया है, हमलावरों को बिना किसी प्रमाणीकरण की आवश्यकता के सर्वर पर मनमाने कमांड निष्पादित करने की अनुमति देती है।" cve-2023-38646 के लिए एक त्वरित रिवर्स शेल एक्सप्लॉइट स्क्रिप्ट। मुझे यह भेद्यता नहीं मिली, मैंने केवल स्क्रिप्ट बनाई...
cve-2023-38646-metabase-ReverseShell
cve-2023-38646-metabase-ReverseShell कमांड चलाएं go run .\CVE-2023-38646-metabase-ReverseShell.go -u http://target.com:targetPort -h Your VPS IPaddr -p NC listen Port नोट जब आप लक्ष्य होस्ट इनपुट करें, तो कृपया http:// या https:// डालना न भूलें।...
CVE-2023-38646
CVE-2023-38646 - RCE no Metabase As versões do Metabase open source anteriores a 0.46.6.1 e do Metabase Enterprise anteriores a 1.46.6.1 permitem que atacantes executem comandos arbitrários no servidor, com o mesmo nível de privilégio do servidor. Não é necessária autenticação para exploração. As...
Exploit-CVE-2023-38646-Metabase
Exploit CVE-2023-38646 Metabase prima di 0.46.6.1 open source e prima di 1.46.6.1 Enterprise Exploit per la vulnerabilità di Esecuzione di Codice Remoto RCE identificata in Metabase versioni precedenti alla 0.46.6.1 open source e 1.46.6.1 Enterprise. La vulnerabilità consente agli attaccanti di...
metabase-cve-2023-38646
cd /metabase-poc cat README.md 'EOF' CVE-2023-38646 — Esecuzione di codice remoto pre-autenticazione in Metabase Riepilogo CVSS 9.8. Le versioni di Metabase precedenti a 0.46.6.1 / 1.46.6.1 e rami precedenti equivalenti espongono una RCE pre-autenticazione tramite l'endpoint /api/setup/validate,...
Metabase-Setup-Endpoint-SQLi-Fix
CVE-2026-72898: SQLi-Patch für den Metabase-Setup-Endpunkt Dieses Repository enthält den Hotfix für CVE-2026-72898 , eine nicht authentifizierte SQL-Injection-Schwachstelle im Setup-Endpunkt von selbst gehosteten Metabase-Instanzen. Ohne den Patch können Angreifer die Validierung des Setup-Tokens...
The vulnerability of the Metabase data visualization and reporting software lies in the lack of security measures for query structures, allowing attackers to enhance their privileges and execute arbitrary code.
The vulnerability of the Metabase data visualization and reporting software relates to the lack of measures taken to protect the SQL query structure during the processing of the resetpassword parameter. Exploiting this vulnerability allows a malicious actor to enhance their privileges and execute...
Metabase < 0.46.6.1 - Remote Code Execution
Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 allow attackers to execute arbitrary commands on the server, at the server's privilege level. Authentication is not required for exploitation. The other fixed versions are 0.45.4.1, 1.45.4.1, 0.44.7.1, 1.44.7.1, 0.43.7.2...
CVE-2026-72898 vulnerabilities
Vulnerabilities for packages: metabase...
Exploit for CVE-2026-72898
🔴 CVE-2026-72898 - Unauthenticated SQL Injection Met...
Metabase 0.58.x < 0.58.24 / 0.59.x < 0.59.21 / 0.60.x < 0.60.17 / 0.61.x < 0.61.11 / 0.62.x < 0.62.9 / 0.63.x < 0.63.5 / 1.58.x < 1.58.24 / 1.59.x < 1.59.21 / 1.60.x < 1.60.17 / 1.61.x < 1.61.11 / 1.62.x < 1.62.9 / 1.63.x < 1.63.5 Multiple Vulnerabilities
The version of Metabase installed on the remote host is 0.58.x prior to 0.58.24, 0.59.x prior to 0.59.21, 0.60.x prior to 0.60.17, 0.61.x prior to 0.61.11, 0.62.x prior to 0.62.9, 0.63.x prior to 0.63.5, 1.58.x prior to 1.58.24, 1.59.x prior to 1.59.21, 1.60.x prior to 1.60.17, 1.61.x prior to...
Metabase SQL Injection Vulnerability
Metabase contains a SQL Injection vulnerability that allows an unauthenticated remote attacker to inject arbitrary SQL into the Metabase application database, which can give them administrator access to the instance. From there, the attacker could change the application configuration, steal store...
Metabase 0.63.4 SQL Injection
A proof of concept exploit for an unauthenticated SQL injection vulnerability in Metabase version 0.63.4. The vulnerability exists in public shared cards containing field-filter template tags, where a specially structured parameter value can be interpreted by HoneySQL as raw query structure rathe...
Metabase 0.63.4 SQL Injection
A proof of concept exploit for an unauthenticated SQL injection vulnerability in Metabase version 0.63.4. The vulnerability allows an attacker-controlled user-id value supplied to the password reset endpoint to reach a HoneySQL query as raw SQL. On installations using the default embedded H2...
