61 matches found
CVE-2025-1094-Lab-Setup
🛠️ CVE-2025-1094 Lab Setup ⚠️ Disclaimer This lab is for educational and research purposes only. Do NOT use any of the information or techniques demonstrated here on systems you do not own or have explicit permission to test. Unauthorized use of these methods may violate laws and result in severe...
CVE-2026-25212
CVE-2026-25212 – Percona PMM RCE PoC Critical – CVSS 9.9 – Authenticated Remote Code Execution in PMM 3.7. Description This proof‑of‑concept exploits a vulnerability where an internal PostgreSQL user in PMM retains 'SUPERUSER' privileges. An authenticated attacker with 'pmm-admin' rights can abus...
EUVD-2026-114382
pgAdmin 4's Import/Export Data tool wraps a user's query export in a psql \copy ... TO command and checks that the query's parentheses are balanced so that nothing can escape the wrapper. The check rejected a backslash inside a single-quoted string, but not inside a double-quoted identifier, wher...
PT-2026-134153
Name of the Vulnerable Software and Affected Versions pgAdmin 4 versions prior to 9.19 Description An ordinary database user can execute operating system commands on the host machine running pgAdmin 4 as the account running the application. This occurs through the Import/Export Data tool, which...
Jitterbit Agent Unauthenticated SOAP JdbcEngine COPY TO PROGRAM RCE — Detect
Fingerprint / reachability check for Jitterbit Agent Unauthenticated SOAP JdbcEngine COPY TO PROGRAM RCE !/usr/bin/env python3 -- coding: utf-8 -- """Detection for Jitterbit Agent Unauthenticated SOAP JdbcEngine COPY TO PROGRAM RCE""" from kittysploit import from lib.protocols.http.httpclient...
Sangoma Switchvox CVE-2026-9586 /pa SQLi RCE
Exploits CVE-2026-9586 via the unauthenticated /pa XML phone-notification endpoint. Injects stacked PostgreSQL into the PhoneIP field and uses COPY ... TO PROGRAM to run a shell command as the database superuser. !/usr/bin/env python3 -- coding: utf-8 -- """Sangoma Switchvox CVE-2026-9586...
CVE-2026-53557
SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.9.0, an authenticated user can supply a crafted sheet"tableName" value in the Excel datasource configuration submitted through POST /api/v1/datasource/, and SQLBot stores that value without safe...
CVE-2026-53557 SQLBot: Second-Order SQL Injection via Excel Datasource Leading to Remote Command Execution
SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.9.0, an authenticated user can supply a crafted sheet"tableName" value in the Excel datasource configuration submitted through POST /api/v1/datasource/, and SQLBot stores that value without safe...
EUVD-2026-82564
SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.9.0, an authenticated user can supply a crafted sheet"tableName" value in the Excel datasource configuration submitted through POST /api/v1/datasource/, and SQLBot stores that value without safe...
Command Injection
Overview awslabs.postgres-mcp-server is an An AWS Labs Model Context Protocol MCP server for postgres Affected versions of this package are vulnerable to Command Injection via the SQL validation process. An attacker can execute arbitrary operating system commands by submitting a specially crafted...
CVE-2026-87911
An OS command injection weakness in the read-only enforcement of the SQL validation component in Amazon awslabs postgres-mcp-server before 1.1.7 might allow an unauthenticated actor to execute operating system commands on the host of a self-managed PostgreSQL server by placing a crafted COPY ... ...
CVE-2026-87911 Read-only enforcement bypass enabling operating system command execution in the SQL validation component of Amazon awslabs postgres-mcp-server
An OS command injection weakness in the read-only enforcement of the SQL validation component in Amazon awslabs postgres-mcp-server before 1.1.7 might allow an unauthenticated actor to execute operating system commands on the host of a self-managed PostgreSQL server by placing a crafted COPY ... ...
CVE-2026-87911 Read-only enforcement bypass enabling operating system command execution in the SQL validation component of Amazon awslabs postgres-mcp-server
An OS command injection weakness in the read-only enforcement of the SQL validation component in Amazon awslabs postgres-mcp-server before 1.1.7 might allow an unauthenticated actor to execute operating system commands on the host of a self-managed PostgreSQL server by placing a crafted COPY ... ...
CVE-2026-87911
CVE-2026-87911 is a CRITICAL (CVSS 9.6) OS command injection vulnerability in the SQL validation component of Amazon awslabs postgres-mcp-server prior to version 1.1.7. The flaw lies in the read-only enforcement , which can be bypassed by injecting a crafted COPY ... TO PROGRAM statement into con...
EUVD-2026-75127
An OS command injection weakness in the read-only enforcement of the SQL validation component in Amazon awslabs postgres-mcp-server before 1.1.7 might allow an unauthenticated actor to execute operating system commands on the host of a self-managed PostgreSQL server by placing a crafted COPY ... ...
CVE-2026-87911
An OS command injection weakness in the read-only enforcement of the SQL validation component in Amazon awslabs postgres-mcp-server before 1.1.7 might allow an unauthenticated actor to execute operating system commands on the host of a self-managed PostgreSQL server by placing a crafted COPY ... ...
PT-2026-89138
An OS command injection weakness in the read-only enforcement of the SQL validation component in Amazon awslabs postgres-mcp-server before 1.1.7 might allow an unauthenticated actor to execute operating system commands on the host of a self-managed PostgreSQL server by placing a crafted COPY ... ...
CVE-2026-87911: Improper Neutralization of Special Elements used in an OS Command
An OS command injection weakness in the read-only enforcement of the SQL validation component in Amazon awslabs postgres-mcp-server before 1.1.7 might allow an unauthenticated actor to execute operating system commands on the host of a self-managed PostgreSQL server by placing a crafted COPY ... ...
CVE-2026-42167 - ProFTPD mod_sql post-authentication SQLi - RCE
!/usr/bin/env python3 """ CVE-2026-42167 — ProFTPD modsql post-authentication SQL injection - RCE postauthstorrce.py --host --port 21 \ --user --password \ --shell-host --shell-port 4444 SUMMARY ------- ProFTPD's modsql logs FTP activity through user-supplied SQL. Its escaping helper isescapedtex...
