CVE-2023-38646

CVE-2023-38646 Metabase Pre-Auth RCE Metabase open source anterior a 0.46.6.1 y Metabase Enterprise anterior a 1.46.6.1 permiten a los atacantes ejecutar comandos arbitrarios en el servidor, al nivel de privilegio del servidor. No se requiere autenticación para la explotación. Las otras versiones...

CVE-2023-38646

CVE-2023-38646 Fork ofkh4sh3i's removing the need for Burp Collector. CVE-2023-38646 Pre-Auth RCE in Metabase: Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 allow attackers to execute arbitrary commands on the server, at the server's privilege level. Authentication ...

CVE-2023-38646

CVE-2023-38646 - Metabase RCE Metabase 开源版 0.46.6.1 之前版本以及 Metabase Enterprise 1.46.6.1 之前版本允许攻击者以服务器的权限级别在服务器上执行任意命令。利用该漏洞无需身份验证。其他已修复版本包括 0.45.4.1、1.45.4.1、0.44.7.1、1.44.7.1、0.43.7.2 和 1.43.7.2。 如果目标 Metabase 版本存在漏洞，此脚本将允许你作为攻击者在目标系统上获取 shell 连接。 使用方法 root@kitploit: python3 CVE-2023-38646.py -u...

CVE-2026-21043

Path traversal in Wallpaper service prior to SMR Jul-2026 Release 1 allows local privileged attackers to access files with system server privilege...

Open WebUI's chat completion API allows tool restrictions to be bypassed

Summary Open WebUI v0.6.43 contains a vulnerability in its chat completion API, which allows attackers to bypass tool restrictions, potentially enabling unauthorized actions or access. Details In the chatcompletion API, the parameters toolids and toolservers are supplied by the user. These...

CVE-2026-6477

Use of inherently dangerous function PQfn..., resultisint=0, ... in PostgreSQL libpq loexport, loread, lolseek64, and lotell64 functions allows the server superuser to overwrite a client stack buffer with an arbitrarily-large response. Like gets, PQfn..., resultisint=0, ... stores arbitrary-lengt...

CVE-2026-32176

Improper neutralization of special elements used in an sql command 'sql injection' in SQL Server allows an authorized attacker to elevate privileges locally...

CVE-2026-20926 Windows SMB Server Elevation of Privilege Vulnerability

...

CVE-2023-50104

ZZCMS 2023 has a file upload vulnerability in 3/Ebak5.1/upload/index.php, allowing attackers to exploit this loophole to gain server privileges and execute arbitrary code...

EUVD-2002-0976

Malware in sbrugna...

EUVD-2020-1746

Malware in sbrugna...

EUVD-2017-9975

Malware in sbrugna...

EUVD-2006-0221

Malware in sbrugna...

EUVD-2019-11649

Malware in sbrugna...

EUVD-2021-8076

Malicious code in bioql PyPI...

EUVD-2025-24368

Malicious code in bioql PyPI...

Linux Distros Unpatched Vulnerability : CVE-2020-14586

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Security: Privileges. Supported versions that are affected are 8.0.20 and prior...

CVE-2025-47811

In Wing FTP Server through 7.4.4, the administrative web interface listening by default on port 5466 runs as root or SYSTEM by default. The web application itself offers several legitimate ways to execute arbitrary system commands i.e., through the web console or the task scheduler, and they are...

CVE-2025-6713 MongoDB Server may be susceptible to privilege escalation due to $mergeCursors stage

An unauthorized user may leverage a specially crafted aggregation pipeline to access data without proper authorization due to improper handling of the $mergeCursors stage in MongoDB Server. This may lead to access to data without further authorisation. This issue affects MongoDB Server MongoDB...

CVE-2025-36048 IBM webMethods Integration Sever code execution

IBM webMethods Integration Server 10.5, 10.7, 10.11, and 10.15 could allow a privileged user to escalate their privileges when handling external entities due to execution with unnecessary privileges...