Grafana-CVE-2024-9264

Grafana-CVE-2024-9264 root@kitploit: POST /api/ds/query?dstype=expr&expression=true&requestId=Q100 HTTP/1.1 Host: 127.0.0.1:3000 Content-Type: application/json Cookie: grafanasession=a739fa9aeb235f2790f17de00fefe528 Content-Length: 368 "from": "1696154400000", "to": "1696345200000", "queries":...

KismetMobileDashboard

KismetMobileDashboard ESTO ES ANTIGUO. El nuevo kismet tiene websockets, lo que facilitaría la construcción de algo así. Esta es una importante nueva reescritura de la interfaz móvil. Idealmente quiero probarla más, pero con el hackersummercamp a la vuelta de la esquina, simplemente no tengo...

log4j_RCE_CVE-2021-44832

Log4j 2.17.0 RCE -- CVE-2021-44832 Reproducción 1. Inicia el servidor jndi malicioso root@kitploit: java -jar JNDI-Injection-Exploit-1.0-SNAPSHOT-all.jar -C "/System/Applications/Calculator.app/Contents/MacOS/Calculator" -A "127.0.0.1" 2. Modifica la parte DataSource en config/log4j2.xml con la...

Quartz-1

Para compilar: % mvn install -DskipTests Nota: a. el jar final de Quartz se encuentra en quartz/target b. si no tienes los jars de bibliotecas de terceros de Oracle y/o Weblogic necesarios para la compilación no se pueden encontrar en los repositorios públicos de Maven debido a las licencias,...

CVE-2026-31816-rshell

Exploit de Reverse Shell CVE-2026-31816 Descripción General Esta herramienta explota CVE-2026-31816 para establecer una conexión de reverse shell en un servidor Budibase objetivo. Cadena de Ataque : Bypass de Autenticación → Subida de Plugin DATASOURCE → Ejecución de Código en el Servidor → Rever...

DataEase_Postgresql_JDBC_Bypass-CVE-2025-49002

fofa语法：title="DataEase" poc: "POST /de2api/datasource/validate HTTP/1.1 Host: your-ip Accept-Encoding: gzip, deflate, br, zstd sec-ch-ua: ""Google Chrome"";v=""135"", ""Not-A.Brand"";v=""8"", ""Chromium"";v=""135"" User-Agent: Mozilla/5.0 Windows NT 10.0; Win64; x64 AppleWebKit/537.36 KHTML, like...

CVE-2026-54350-Budibase-NoSQL-Injection

CVE-2026-54350 — Inyección de operadores NoSQL no autenticada en Budibase Inyección de operadores JSON/NoSQL no autenticada en Budibase. Cualquier visitante anónimo de una aplicación Budibase publicada que exponga una consulta PÚBLICA respaldada por una fuente de datos de documentos MongoDB,...

CVE-2026-19475

An authenticated user with permission to query a SQL datasource Microsoft SQL Server, PostgreSQL, or MySQL could bypass the fix for CVE-2026-33375 by injecting the $timeGroup macro through a WHERE clause, which Grafana's regex-based macro parsing fails to reject. Evaluating the injected macro...

CVE-2026-82243

Budibase Server before 3.41.3 contains a server-side request forgery vulnerability in the datasource verify endpoint that allows builder-level users to supply arbitrary URLs without SSRF validation. Attackers can exploit this to leak internal CouchDB credentials by making requests to...

CVE-2026-82241

Budibase backend-core @budibase/backend-core, as used by @budibase/server omits the shared address space range 100.64.0.0/10 from its default SSRF blacklist DEFAULTBLACKLIST used by REST datasource query previews. When the default blacklist is active i.e., a self-hosted deployment has not defined...

CVE-2026-82243 Budibase Server before 3.41.3 SSRF with Credential Leakage

Budibase Server before 3.41.3 contains a server-side request forgery vulnerability in the datasource verify endpoint that allows builder-level users to supply arbitrary URLs without SSRF validation. Attackers can exploit this to leak internal CouchDB credentials by making requests to...

CVE-2026-82243

Budibase Server before 3.41.3 is affected by a server-side request forgery (SSRF) vulnerability in the datasource verify endpoint . The root cause is that builder-level users can supply arbitrary URLs without SSRF validation, allowing them to make server-side requests to attacker-controlled hosts...

CVE-2026-82243 Budibase Server before 3.41.3 SSRF with Credential Leakage

Budibase Server before 3.41.3 contains a server-side request forgery vulnerability in the datasource verify endpoint that allows builder-level users to supply arbitrary URLs without SSRF validation. Attackers can exploit this to leak internal CouchDB credentials by making requests to...

EUVD-2026-67695

Budibase Server before 3.41.3 contains a server-side request forgery vulnerability in the datasource verify endpoint that allows builder-level users to supply arbitrary URLs without SSRF validation. Attackers can exploit this to leak internal CouchDB credentials by making requests to...

CVE-2026-82241

Budibase 's @budibase/backend-core (used by @budibase/server) contains a Server-Side Request Forgery (SSRF) vulnerability caused by an incomplete default SSRF blacklist. The DEFAULT_BLACKLIST omits the 100.64.0.0/10 shared address space range. In self-hosted deployments using the default blacklis...

CVE-2026-82241 Budibase backend-core SSRF via incomplete default blacklist

Budibase backend-core @budibase/backend-core, as used by @budibase/server omits the shared address space range 100.64.0.0/10 from its default SSRF blacklist DEFAULTBLACKLIST used by REST datasource query previews. When the default blacklist is active i.e., a self-hosted deployment has not defined...

clickhouse-datasource silently drops TLS over PDC

When the ClickHouse plugin uses Native protocol the default with PDC or secure SOCKS, it asks for TLS but the connection library ignores that and talks to ClickHouse in the clear. Username, password, queries, and results can be read on the hop after the proxy. The server certificate is never...

Budibase authenticated arbitrary S3 signed upload URL issuance via `/api/attachments/:datasourceId/url`

Summary Budibase 3.39.7 allows a low-privilege authenticated published-app user with the built-in BASIC role to obtain arbitrary S3 pre-signed upload URLs backed by a workspace datasource's stored server-side credentials. The affected endpoint is: POST /api/attachments/:datasourceId/url The calle...

Astra Linux – Vulnerability in Jackson-Databind

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource...

SUSE CVE-2026-17183

An authenticated user with permission to create or edit alert rules can bypass datasource query authorization by marking an alert rule query as a server-side expression while referencing a real datasource UID incorrect authorization. This can expose data accessible through Grafana's configured...