CVE-2024-9264-Fixed

🛠️ CVE-2024-9264 - Exploit RCE de Grafana corregido Esta es una versión corregida del exploit de prueba de concepto para CVE-2024-9264 , una vulnerabilidad crítica de ejecución remota de código en Grafana a través de expresiones SQL y DuckDB. 🔗 Aviso original: Grafana Security Release ❌ PoC...

CVE-2024-9264-RCE-Exploit

CVE-2024-9264-RCE-Exploit in Grafana via SQL Expressions Description Proof Of Concept for Remote Code Execution in Grafana CVE-2024-9264 This repository contains a Python script that exploits a Remote Code Execution RCE vulnerability in Grafana's SQL Expressions feature. By leveraging insufficien...

CVE-2024-9264

CVE-2024-9264 Authenticated RCE in Grafana v11.0 via SQL Expressions - PoC Exploit CVE-2024-9264 - Grafana v11.0 Authenticated Remote Code Execution RCE PoC Introduction CVE-2024-9264 is a critical remote-code-execution and local-file-inclusion flaw introduced in Grafana 11’s experimental “SQL...

day05-grafana-sqlexpr-lab

Day 5 – Grafana SQL Expressions → DuckDB LFI CVE-2024-9264 TL;DR: On affected Grafana 11.x builds, a logged-in Viewer can use SQL Expressions. Grafana forwards the expression to DuckDB on the server. With readtext / readblob, you can read local files LFI. We plant a flag at /opt/flag.txt. Build →...

CVE-2026-27876

CVE-2026-27876: Escritura Arbitraria de Archivos en Expresiones SQL de Grafana que Deriva en RCE CVSS 9.1 Crítico | Escritura Arbitraria de Archivos | Ejecución Remota de Código Demo https://github.com/user-attachments/assets/c84a4b63-7928-4dba-a069-3bafa036ce56 Resumen La función de Expresiones...

CVE-2024-9264

Exploit RCE CVE-2024-9264 en Grafana a través de Expresiones SQL Descripción Prueba de Concepto para Ejecución Remota de Código en Grafana CVE-2024-9264 Este repositorio contiene un script de Python que explota una vulnerabilidad de Ejecución Remota de Código RCE en la función de Expresiones SQL ...

CVE-2026-27876

🚨 CVE-2026-27876 - Grafana Critical RCE via SQL Expressions A chained vulnerability allowing arbitrary file writes through SQL Expressions, leading to full Remote Code Execution RCE on the host. 📋 Overview CVE ID : CVE-2026-27876 Severity : Critical CVSS v3.1: 9.1 Published : March 27, 2026 CWE :...

CVE-2024-9264

CVE-2024-9264 - PoC de LFI/RCE en Grafana SQL Expressions DuckDB Prueba de concepto en Python para CVE-2024-9264, una vulnerabilidad de Grafana SQL Expressions que puede permitir la inclusión autenticada de archivos locales y la ejecución de comandos cuando duckdb está disponible en el PATH del...

grafana: Grafana: Information disclosure via SQL Expressions vulnerability

A flaw was found in Grafana. An authenticated attacker can exploit a vulnerability in SQL Expressions to read arbitrary files from the Grafana server's filesystem. This information disclosure is possible only when the sqlExpressions feature toggle is enabled...

grafana: Grafana: Information disclosure via SQL Expressions vulnerability

A flaw was found in Grafana. An authenticated attacker can exploit a vulnerability in SQL Expressions to read arbitrary files from the Grafana server's filesystem. This information disclosure is possible only when the sqlExpressions feature toggle is enabled...

grafana: Grafana: Information disclosure via SQL Expressions vulnerability

A flaw was found in Grafana. An authenticated attacker can exploit a vulnerability in SQL Expressions to read arbitrary files from the Grafana server's filesystem. This information disclosure is possible only when the sqlExpressions feature toggle is enabled...

Exploit for Code Injection in Grafana

CVE-2026-27876: Grafana SQL Expressions Arbitrary File Write t...

Exploit for Command Injection in Grafana

CVE-2024-9264 - Grafana SQL Expressions DuckDB LFI/RCE PoC Py...

GO-2026-5409 Grafana: SQL Expressions Read File From Disk in github.com/grafana/grafana

Grafana: SQL Expressions Read File From Disk in github.com/grafana/grafana. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please...

Linux Distros Unpatched Vulnerability : CVE-2026-33380

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability in SQL Expressions allows an authenticated attacker to read arbitrary files from the Grafana server's filesystem. Only instances with the...

BIT-GRAFANA-2026-33380 SQL Expressions Read File From Disk

A vulnerability in SQL Expressions allows an authenticated attacker to read arbitrary files from the Grafana server's filesystem. Only instances with the sqlExpressions feature toggle enabled are vulnerable...

SUSE CVE-2026-33380

A vulnerability in SQL Expressions allows an authenticated attacker to read arbitrary files from the Grafana server's filesystem. Only instances with the sqlExpressions feature toggle enabled are vulnerable...

EUVD-2026-30145

A vulnerability in SQL Expressions allows an authenticated attacker to read arbitrary files from the Grafana server's filesystem. Only instances with the sqlExpressions feature toggle enabled are vulnerable...

Grafana: SQL Expressions Read File From Disk

A vulnerability in SQL Expressions allows an authenticated attacker to read arbitrary files from the Grafana server's filesystem. Only instances with the sqlExpressions feature toggle enabled are vulnerable...

GHSA-GXCP-JJXH-RWP4 Grafana: SQL Expressions Read File From Disk

A vulnerability in SQL Expressions allows an authenticated attacker to read arbitrary files from the Grafana server's filesystem. Only instances with the sqlExpressions feature toggle enabled are vulnerable...