142 matches found
CVE-2026-11115-Database-Connection-String-Injection-via-Env-Variable
CVE-2026-11115 – 通过环境变量进行数据库连接字符串注入 程序代码（Python） root@kitploit: dbconnector.py - Constructs DB connection string from environment import os, psycopg2 def connect: Reads DBURL; attacker can override via environment injection if they control an env var dburl = os.getenv'DBURL',...
cve-2023-38646-poc
Metabase Pre Authentication RCE CVE-2023-38646 CVE-2023-38646是Metabase中的一个远程代码执行漏洞。该漏洞源于Metabase在处理未经身份验证的API端点/api/setup/validate时，对JDBC连接字符串的处理存在安全缺陷。攻击者可以通过构造特定的JDBC连接字符串，利用该端点在服务器上执行任意命令，而无需进行身份验证。...
WSO2-2021-1259
WSO2-2021-1259：WSO2 ESB 中通过恶意 JDBC 连接字符串实现的 H2 远程代码执行（RCE） 由于输入验证不当，攻击者可利用恶意的 H2 JDBC 连接字符串发起远程代码执行攻击。 厂商披露： 该漏洞的厂商披露与修复方案可在此处查看。 为何没有 CVE？ 我和厂商均未为此漏洞申请 CVE。 利用条件： 该漏洞需要： 有效的用户凭据 概念验证（PoC）： 更多详情及利用过程可参见此 PDF。...
CVE-2023-38646
CVE-2023-38646 CVE-2023-38646 Metabase 0.46.6 漏洞利用工具 该工具利用软件平台中的一个漏洞（CVE-2023-38646）。该漏洞通过精心构造的请求，利用对数据库连接字符串处理不当的问题，实现远程代码执行。 概述 该工具的功能： 从目标 URL 获取设置令牌（setup token）。 对提供的命令进行 Base64 编码。 使用编码后的命令构造攻击载荷。 发送攻击载荷以利用该漏洞。 安装 克隆仓库： root@kitploit: git clone https://github.com/SUT0L/CVE-2023-38646.git cd...
CVE-2023-34468
CVE-2023-34468 漏洞利用工具 概述 本仓库提供了一个基于 Python 的漏洞利用工具，针对 CVE-2023-34468 ——Apache NiFi 0.0.2 至 1.21.0 版本中存在的一个严重远程代码执行漏洞（CVSS 9.8）。该工具允许已认证用户通过操纵内嵌触发器的 H2 数据库连接字符串来执行任意代码。 ⚠️ 警告： 仅限教育和授权测试用途。未经授权访问计算机系统属违法行为。 漏洞详情 CVE ID： CVE-2023-34468 受影响版本： Apache NiFi 0.0.2–1.21.0 影响： 远程代码执行（RCE） CVSS 评分： 9.8（严重）...
CVE-2026-84967
A component of the MongoDB extension for Visual Studio Code does not neutralize special characters in a connection string before that value is placed into a command line the extension composes for an integrated terminal. An unauthenticated remote unauthorized-user who persuades a developer to...
EUVD-2026-70525
A component of the MongoDB extension for Visual Studio Code does not neutralize special characters in a connection string before that value is placed into a command line the extension composes for an integrated terminal. An unauthenticated remote unauthorized-user who persuades a developer to...
CVE-2026-84967
The MongoDB extension for Visual Studio Code fails to neutralize special characters in a connection string before embedding it into a command line composed for the Launch MongoDB Shell integrated terminal. An unauthenticated remote attacker who convinces a developer to accept a user-supplied conn...
PT-2026-85071
Name of the Vulnerable Software and Affected Versions MongoDB extension for Visual Studio Code affected versions not specified Description A component of the MongoDB extension for Visual Studio Code fails to neutralize special characters within a connection string before incorporating that value...
CVE-2026-12717
An Improper Input Validation vulnerability in CData JDBC driver integration in Google Cloud BigQuery Data Transfer Service versions prior to 2026-05-01 on Google Cloud Platform allows an authenticated attacker to achieve remote code execution in the connector container and escalate privileges in...
EUVD-2026-66420
An Improper Input Validation vulnerability in CData JDBC driver integration in Google Cloud BigQuery Data Transfer Service versions prior to 2026-05-01 on Google Cloud Platform allows an authenticated attacker to achieve remote code execution in the connector container and escalate privileges in...
PT-2026-82091
Name of the Vulnerable Software and Affected Versions Google Cloud BigQuery Data Transfer Service versions prior to 2026-05-01 Description Improper input validation in the CData JDBC driver integration allows an authenticated attacker to achieve remote code execution within the connector containe...
CVE-2026-53572
KEDA is a Kubernetes-based Event Driven Autoscaling component. Prior to 2.20.0, pkg/scalers/postgresqlscaler.go constructs libpq-style connection strings from tenant-controlled host, port, userName, dbName, sslmode, and password values, while escapePostgreConnectionParameter only quotes values...
AZL-96989 CVE-2026-53572 affecting package keda 2.14.1-18
KEDA is a Kubernetes-based Event Driven Autoscaling component. Prior to 2.20.0, pkg/scalers/postgresqlscaler.go constructs libpq-style connection strings from tenant-controlled host, port, userName, dbName, sslmode, and password values, while escapePostgreConnectionParameter only quotes values...
CVE-2026-53572 KEDA: PostgreSQL connection string parameter injection via incomplete whitespace escaping
KEDA is a Kubernetes-based Event Driven Autoscaling component. Prior to 2.20.0, pkg/scalers/postgresqlscaler.go constructs libpq-style connection strings from tenant-controlled host, port, userName, dbName, sslmode, and password values, while escapePostgreConnectionParameter only quotes values...
CVE-2026-53572 KEDA: PostgreSQL connection string parameter injection via incomplete whitespace escaping
KEDA is a Kubernetes-based Event Driven Autoscaling component. Prior to 2.20.0, pkg/scalers/postgresqlscaler.go constructs libpq-style connection strings from tenant-controlled host, port, userName, dbName, sslmode, and password values, while escapePostgreConnectionParameter only quotes values...
CVE-2026-53572
KEDA (Kubernetes-based Event Driven Autoscaling) is affected by a PostgreSQL connection string parameter injection in pkg/scalers/postgresql_scaler.go prior to version 2.20.0 . The root cause is that escapePostgreConnectionParameter() only quotes values containing a literal space, leaving tabs, n...
EUVD-2026-64131
KEDA is a Kubernetes-based Event Driven Autoscaling component. Prior to 2.20.0, pkg/scalers/postgresqlscaler.go constructs libpq-style connection strings from tenant-controlled host, port, userName, dbName, sslmode, and password values, while escapePostgreConnectionParameter only quotes values...
CVE-2026-75910 Incorrect privilege assignment in the Amazon aws-athena-query-federation ClickHouse connector deployment template
Incorrect privilege assignment in the ClickHouse connector deployment template in Amazon Athena Federated Query prior to v2026.17.1 could allow an authenticated remote user to read arbitrary AWS Secrets Manager secrets in the deploying account by pointing the connector's connection string at an...