EUVD-2026-86347

PyMongo: PYTHON-5986 Host injection in PyMongo connection string parsing via percent-encoded delimiters...

cve-2023-38646-poc

Metabase 사전 인증 RCE CVE-2023-38646 CVE-2023-38646는 Metabase의 원격 코드 실행 취약점입니다. 이 취약점은 Metabase가 인증되지 않은 API 엔드포인트 /api/setup/validate를 처리할 때 JDBC 연결 문자열 처리에 보안 결함이 있어 발생합니다. 공격자는 특정 JDBC 연결 문자열을 구성하여 이 엔드포인트를 통해 서버에서 임의의 명령을 실행할 수 있으며, 인증이 필요하지 않습니다. 구체적으로, 공격자는 먼저 /api/session/properties에 접근하여...

CVE-2026-11115-Database-Connection-String-Injection-via-Env-Variable

CVE-2026-11115 – Env 변수를 통한 데이터베이스 연결 문자열 주입 프로그램 코드Python dbconnector.py - Constructs DB connection string from environment import os, psycopg2 def connect: Reads DBURL; attacker can override via environment injection if they control an env var dburl = os.getenv'DBURL',...

WSO2-2021-1259

WSO2-2021-1259: 악성 JDBC 연결 문자열을 통한 WSO2 ESB의 H2 RCE 잘못된 입력 검증으로 인해 악성 H2 JDBC 연결 문자열을 사용하여 원격 코드 실행 공격이 수행될 수 있습니다. 벤더 공개: 이 취약점에 대한 벤더의 공개 및 수정 사항은 여기에서 확인할 수 있습니다. CVE가 없는 이유: 저와 벤더 모두 이 취약점에 대해 CVE를 요청하지 않았습니다. 요구 사항: 이 취약점은 다음을 필요로 합니다: 유효한 사용자 자격 증명 개념 증명: 더 많은 세부 사항과 악용 과정은 이 PDF에서 확인할 수 있습...

CVE-2023-38646

CVE-2023-38646 CVE-2023-38646 Metabase 0.46.6 익스플로잇 이 도구는 소프트웨어 플랫폼의 취약점CVE-2023-38646을 악용합니다. 이 익스플로잇은 잘못 처리된 데이터베이스 연결 문자열을 이용하여 조작된 요청을 통해 원격 코드 실행을 가능하게 합니다. 개요 이 도구는: 대상 URL에서 설정 토큰setup token을 가져옵니다. 제공된 명령어를 Base64로 인코딩합니다. 인코딩된 명령어로 페이로드를 구성합니다. 페이로드를 전송하여 취약점을 악용합니다. 설치 저장소를 클론합니다: git...

CVE-2023-34468

CVE-2023-34468 익스플로잇 개요 이 저장소는 Apache NiFi 0.0.21.21.0에 존재하는 치명적인 원격 코드 실행 취약점CVSS 9.8인 CVE-2023-34468 을 위한 Python 기반 익스플로잇 도구를 제공합니다. 이 취약점은 임베디드 트리거가 포함된 H2 데이터베이스 연결 문자열을 조작하여 인증된 사용자가 임의 코드를 실행할 수 있게 합니다. ⚠️ 경고: 교육 및 공인된 테스트 목적으로만 사용하세요. 컴퓨터 시스템에 대한 무단 액세스는 불법입니다. 취약점 세부 정보 CVE ID:...

CVE-2026-12717

A flaw was found in BigQuery Data Transfer Service. An authenticated attacker can achieve arbitrary code execution within the connector container by supplying crafted Java Database Connectivity JDBC connection string parameters. Successful exploitation can further allow the attacker to escalate...

SUSE CVE-2026-96748

PyMongo's connection string parsing decodes percent-encoded characters in the host portion before the host list is separated on its delimiters. When an application places a hostname value supplied by an unauthenticated party into a connection string, that party may cause additional servers of the...

Linux Distros Unpatched Vulnerability : CVE-2026-96748

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - PyMongo's connection string parsing decodes percent-encoded characters in the host portion before the host list is separated on its delimiters. When an...

AZL-105107 CVE-2026-96748 affecting package python-pymongo 4.2.0-9

PyMongo's connection string parsing decodes percent-encoded characters in the host portion before the host list is separated on its delimiters. When an application places a hostname value supplied by an unauthenticated party into a connection string, that party may cause additional servers of the...

DEBIAN-CVE-2026-96748

PyMongo's connection string parsing decodes percent-encoded characters in the host portion before the host list is separated on its delimiters. When an application places a hostname value supplied by an unauthenticated party into a connection string, that party may cause additional servers of the...

CVE-2026-96748

PyMongo's connection string parsing decodes percent-encoded characters in the host portion before the host list is separated on its delimiters. When an application places a hostname value supplied by an unauthenticated party into a connection string, that party may cause additional servers of the...

UBUNTU-CVE-2026-96748

PyMongo's connection string parsing decodes percent-encoded characters in the host portion before the host list is separated on its delimiters. When an application places a hostname value supplied by an unauthenticated party into a connection string, that party may cause additional servers of the...

CVE-2026-96748 Connection redirection via percent-encoded delimiter injection in connection string hosts

PyMongo's connection string parsing decodes percent-encoded characters in the host portion before the host list is separated on its delimiters. When an application places a hostname value supplied by an unauthenticated party into a connection string, that party may cause additional servers of the...

CVE-2026-96748 Connection redirection via percent-encoded delimiter injection in connection string hosts

PyMongo's connection string parsing decodes percent-encoded characters in the host portion before the host list is separated on its delimiters. When an application places a hostname value supplied by an unauthenticated party into a connection string, that party may cause additional servers of the...

CVE-2026-96748 Connection redirection via percent-encoded delimiter injection in connection string hosts

PyMongo's connection string parsing decodes percent-encoded characters in the host portion before the host list is separated on its delimiters. When an application places a hostname value supplied by an unauthenticated party into a connection string, that party may cause additional servers of the...

CVE-2026-96748

The PyMongo database driver is vulnerable to connection redirection due to percent-encoded delimiter injection in connection string hosts. The root cause is that PyMongo decodes percent-encoded characters in the host portion before separating the host list by delimiters. If an application include...

CVE-2026-96748

PyMongo's connection string parsing decodes percent-encoded characters in the host portion before the host list is separated on its delimiters. When an application places a hostname value supplied by an unauthenticated party into a connection string, that party may cause additional servers of the...

Connection redirection via percent-encoded delimiter injection in connection string hosts

PyMongo's connection string parsing decodes percent-encoded characters in the host portion before the host list is separated on its delimiters. When an application places a hostname value supplied by an unauthenticated party into a connection string, that party may cause additional servers of the...

PT-2026-98232

Name of the Vulnerable Software and Affected Versions PyMongo affected versions not specified Description Connection string parsing decodes percent-encoded characters in the host portion before the host list is separated by its delimiters. If an application incorporates a hostname provided by an...