Jackson_RCE-CVE-2019-12384

환경 구축 프로젝트를 idea로 가져온 후 maven을 설정하고 자동으로 라이브러리 종속성을 가져오도록 설정하세요. 그런 다음 로컬 웹 빈 디렉토리에 다음 파일을 작성하여 exec.sql로 저장하고 HTTP 서버를 시작하세요: root@kitploit: CREATE ALIAS SHELLEXEC AS $$ String shellexecString cmd throws java.io.IOException String command = "/bin/bash", "-c", cmd; java.util.Scanner s = new...

CVE-2023-34468

CVE-2023-34468: Apache NiFi の DB コンポーネントを介したリモートコード実行 Apache NiFi 0.0.2 から 1.21.0 の DBCPConnectionPool および HikariCPConnectionPool コントローラサービスでは、認証済みかつ承認済みのユーザーが、任意のコード実行を可能にする H2 ドライバーを使用したデータベース URL を設定できます。 ベンダー開示: この脆弱性に関するベンダーの開示と修正はこちらで確認できます。 前提条件: この脆弱性には以下が必要です: 有効なユーザー認証情報 概念実証:...

CVE-2025-56819

CVE-2025-56819 Datart v.1.0.0-rc.3의 문제로 인해 원격 공격자가 INIT 연결 매개변수를 통해 임의 코드를 실행할 수 있습니다. root@kitploit: POST /api/v1/data-provider/test HTTP/1.1 Host: test.com:8080 Content-Type: application/json Content-Length: 520 "name": "jdbc-data-provider", "type": "JDBC", "properties": "dbType": "H2", "url":...

Another-Metabase-RCE-CVE-2023-38646

Metabase의 사전 인증 RCECVE-2023-38646 확장 설명 여기 이것은 H2 및 PostgreSQL 엔진에서 '데이터베이스가 이미 사용 중' 오류를 피하는 데 도움이 되었습니다. root@kitploit: "token": "TOKEN", "details": "isondemand": false, "isfullsync": false, "issample": false, "cachettl": null, "refingerprint": false, "autorunqueries": true, "schedules":,...

H2-database-CVE-2022-23221

H2 Database RCE CVE-2022-23221 whs41반고늘상@straightSang 1. 요약 참고: https://nvd.nist.gov/vuln/detail/cve-2022-23221 H2는 관계형 데이터베이스 관리 시스템으로, SQL 엔진 안에서 Java 코드를 직접 컴파일하고 실행할 수 있는 기능을 제공한다. H2 드라이버는 JDBC URL을 파싱하여 애플리케이션과 데이터베이스 간의 연결을 설정한다. 이때 URL에 포함된 설정 파라미터를 통해 데이터베이스의 초기 상태나 동작을 제어할 수 있다. 문제가 되는...

CVE-2023-34468-PoC

针对 Apache NiFi 的 CVE-2023-34468 PoC 针对影响 Apache NiFi 1.22.0 之前版本的 CVE-2023-34468 的教育性概念验证（PoC）。本仓库演示了如何滥用 H2 JDBC URL 配置，从而在存在漏洞的 Apache NiFi 安装中实现经过身份验证的远程代码执行（RCE）。 概述 CVE-2023-34468 是一个影响 Apache NiFi 控制器服务的经过身份验证的远程代码执行漏洞。 该漏洞源于可以使用 INIT=RUNSCRIPT 功能配置 H2 JDBC URL，当启用易受攻击的控制器服务时，可允许任意代码执行。...

CVE-2023-34468

CVE-2023-34468 — Apache NiFi ExecuteSQL H2 RUNSCRIPT RCE PoC 편집 가능한 Apache NiFi ExecuteSQL 프로세서를 악용하여 H2 RUNSCRIPT 페이로드로 Bash 리버스 셸을 통한 원격 명령 실행을 트리거하는 간단한 Python PoC입니다. 승인된 테스트 및 연구 목적으로만 사용하십시오. 소유하지 않았거나 테스트에 대한 명시적 허가를 받지 않은 시스템에는 사용하지 마십시오. 동작 방식 root@kitploit: ExecuteSQL processor update -...

CVE-2026-71554

A flaw was found in h2, a Python library for HTTP/2. This vulnerability allows a remote attacker to perform request smuggling. The library incorrectly processes HTTP/2 requests that contain more than one Host header. When these requests are downgraded to HTTP/1.1 by a consuming application, the...

Malicious code in h2-codex (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0176fe223a6df20d633d05a3e0ab21c2e87d0169342e820beadccc5817acc7bc The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-15583 Malicious code in h2-codex (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0176fe223a6df20d633d05a3e0ab21c2e87d0169342e820beadccc5817acc7bc The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Astra Linux – Vulnerability in h2database

The org.h2.util.JdbcUtils.getConnection method of the H2 database takes the class name of the driver and the URL of the database as parameters. An attacker may pass in a JNDI driver name and a URL that points to an LDAP or RMI server, allowing for remote code execution. This vulnerability can be...

Astra Linux – Vulnerability in h2database

The H2 Console before version 2.1.210 allowed remote attackers to execute arbitrary code through a jdbc:h2:mem JDBC URL that contained the IGNOREUNKNOWNSETTINGS=TRUE;FORBID CREATION=FALSE;INIT=RUNSCRIPT substring. This is a different vulnerability than CVE-2021-42392. source-iocs-preserved...

a-gpt (>=0.1.0, <=0.4.0), a11ywatch_cli (>=0.0.16, <=0.10.15) +13712 more potentially affected by unknown CVE via h2 (>=0.1.26, <=0.3.27)

h2 CARGO version =0.1.26, =0.1.0, =0.0.16, =0.2.0, =0.1.0, =0.2.1, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.2.0-beta.4, =0.2.0-beta.7 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0258...

Metabase 0.63.4 SQL Injection

A proof of concept exploit for an unauthenticated SQL injection vulnerability in Metabase version 0.63.4. The vulnerability allows an attacker-controlled user-id value supplied to the password reset endpoint to reach a HoneySQL query as raw SQL. On installations using the default embedded H2...

CVE-2026-17603

Nexus Repository 3 did not sufficiently restrict which HikariCP connection-pool properties could be set through the DataStore configuration API. A user holding the nx-datastores-update permission could set the connectionInitSql property to execute arbitrary SQL against the configured database on...

EUVD-2026-54513

Nexus Repository 3 did not sufficiently restrict which HikariCP connection-pool properties could be set through the DataStore configuration API. A user holding the nx-datastores-update permission could set the connectionInitSql property to execute arbitrary SQL against the configured database on...

Linux Distros Unpatched Vulnerability : CVE-2026-71554

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - h2 is a pure-Python implementation of a HTTP/2 protocol stack. Versions up to and including 4.4.0 accept request header blocks containing more than one Host...

HTTP Request Smuggling

Overview h2 is a Pure-Python HTTP/2 protocol implementation Affected versions of this package are vulnerable to HTTP Request Smuggling via the processing of HTTP/2 request headers containing multiple Host headers. An attacker can interfere with downstream HTTP/1.1 applications by crafting request...

CVE-2026-71554 h2: Duplicate Host header could facilitate request smuggling

h2 is a pure-Python implementation of a HTTP/2 protocol stack. Versions up to and including 4.4.0 accept request header blocks containing more than one Host header, and forward every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request...

Security Bulletin: IBM Maximo Application Suite uses httpcore5-h2-5.3.4.jar which is vulnerable to CVE-2026-54428

Summary IBM Maximo Application Suite uses httpcore5-h2-5.3.4.jar which is vulnerable to CVE-2026-54428. This bulletin contains information regarding the vulnerability and its fixture. Vulnerability Details CVEID:CVE-2026-54428 DESCRIPTION: Allocation of resources without limits or throttling in t...