104 matches found
CVE-2019-12384
CVE-2019-12384 Jackson RCE And SSRF 0x01 python -m SimpleHTTPServer root@kitploit: python -m SimpleHTTPServer Serving HTTP on 0.0.0.0 port 8000 ... 127.0.0.1 - - 24/Jul/2019 03:06:32 "GET /inject.sql HTTP/1.1" 200 - inject.sql root@kitploit: CREATE ALIAS SHELLEXEC AS $$ String shellexecString cmd...
H2-database-CVE-2022-23221
H2 Database RCE CVE-2022-23221 whs41반고늘상@straightSang 1. Resumen Referencia: https://nvd.nist.gov/vuln/detail/cve-2022-23221 H2 es un sistema de gestión de bases de datos relacionales que proporciona la capacidad de compilar y ejecutar código Java directamente dentro del motor SQL. El controlador...
CVE-2022-41828
CVE-2022-41828 Controlador JDBC de Amazon AWS Redshift - Ejecución remota de código RCE El controlador JDBC de Amazon para Redshift es un controlador JDBC tipo 4 que proporciona conectividad a bases de datos a través de las interfaces de programación de aplicaciones API JDBC estándar disponibles ...
CVE-2025-70828
CVE-2025-70828 Resumen Se descubrió una vulnerabilidad de lectura arbitraria de archivos en Datart v1.0.0-rc.3. La aplicación no valida correctamente la URL de conexión JDBC durante la configuración de la fuente de datos. Detalles de la vulnerabilidad Tipo de vulnerabilidad: Validación de entrada...
Security Bulletin: IBM® Data Server driver for JDBC and SQLJ is vulnerable to remote code execution when jdbc url is under user control (CVE-2026-9762)
Summary IBM® Db2® is vulnerable to remote code execution when jdbc url is under user control. Vulnerability Details CVEID:CVE-2026-9762 DESCRIPTION: IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to remote code execution when jdbc url is under user control. CWE:CWE-94:...
CVE-2026-42537
Apache Ranger suffers Remote Code Execution via JDBC URL Injection in versions
EUVD-2026-55251
Remote Code Execution via JDBC URL Injection in Apache Ranger = 2.8.0 Users are recommended to upgrade to version 2.9.0, which fixes this issue...
IBM DB2 Remote Code Execution (7279479) (Unix)
According to its self-reported version number, IBM Db2 is affected by a remote code execution vulnerability: - IBM Data Server Driver for JDBC and SQLJ is vulnerable to remote code execution when jdbc url is under user control. CVE-2026-9762 Note that Nessus has not tested for this issue but has...
CVE-2026-9762 IBM® Data Server driver for JDBC and SQLJ is vulnerable to remote code execution when jdbc url is under user control
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to remote code execution when jdbc url is under user control...
CVE-2026-9762 IBM® Data Server driver for JDBC and SQLJ is vulnerable to remote code execution when jdbc url is under user control
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to remote code execution when jdbc url is under user control...
CVE-2026-12787
A vulnerability was found in zhilink 智互联深圳科技有限公司 ADP Application Developer Platform 应用开发者平台 1.0.0. This affects an unknown part of the component testConnection Endpoint. The manipulation of the argument jdbcUrl results in deserialization. The attack may be performed from remote. The exploit has...
EUVD-2026-38151
A vulnerability was found in zhilink 智互联深圳科技有限公司 ADP Application Developer Platform 应用开发者平台 1.0.0. This affects an unknown part of the component testConnection Endpoint. The manipulation of the argument jdbcUrl results in deserialization. The attack may be performed from remote. The exploit has...
Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')
Overview Affected versions of this package are vulnerable to Use of Externally-Controlled Input to Select Classes or Code 'Unsafe Reflection' via the processing of JDBC connection URL parameters. An attacker can execute arbitrary code by supplying a crafted connection URL that causes the loading...
CVE-2026-32939
DataEase is an open source data visualization analysis tool. Versions 2.10.19 and below have inconsistent Locale handling between the JDBC URL validation logic and the H2 JDBC engine's internal parsing. DataEase uses String.toUpperCase without specifying an explicit Locale, causing its security...
CVE-2025-13268
A flaw has been found in Dromara dataCompare up to 1.0.1. The affected element is the function DbConfig of the file src/main/java/com/vince/xq/project/system/dbconfig/service/DbconfigServiceImpl.java of the component JDBC URL Handler. Executing manipulation can lead to injection. The attack can b...
CVE-2025-13268 Dromara dataCompare JDBC URL DbconfigServiceImpl.java DbConfig injection
A flaw has been found in Dromara dataCompare up to 1.0.1. The affected element is the function DbConfig of the file src/main/java/com/vince/xq/project/system/dbconfig/service/DbconfigServiceImpl.java of the component JDBC URL Handler. Executing manipulation can lead to injection. The attack can b...
EUVD-2024-52643
Malicious code in bioql PyPI...
EUVD-2025-9898
Malicious code in bioql PyPI...