CVE-2019-12384

CVE-2019-12384 Jackson RCE And SSRF 0x01 python -m SimpleHTTPServer python -m SimpleHTTPServer Serving HTTP on 0.0.0.0 port 8000 ... 127.0.0.1 - - 24/Jul/2019 03:06:32 "GET /inject.sql HTTP/1.1" 200 - inject.sql CREATE ALIAS SHELLEXEC AS $$ String shellexecString cmd throws java.io.IOException...

CVE-2022-41828

CVE-2022-41828 Amazon AWS Redshift JDBC Driver Remote Code Execution RCE The Amazon JDBC Driver for Redshift is a Type 4 JDBC driver that provides database connectivity through the standard JDBC application program interfaces APIs available in the Java Platform, Enterprise Editions. The Driver...

CVE-2025-70828

CVE-2025-70828 Summary An arbitrary file read vulnerability was discovered in Datart v1.0.0-rc.3. The application fails to properly validate the JDBC connection URL during data source configuration. Vulnerability Details Vulnerability Type: Improper Input Validation CWE-20 / Arbitrary File Read...

H2-database-CVE-2022-23221

H2 Database RCE CVE-2022-23221 1. 요약 참고: https://nvd.nist.gov/vuln/detail/cve-2022-23221 H2는 관계형 데이터베이스 관리 시스템으로, SQL 엔진 안에서 Java 코드를 직접 컴파일하고 실행할 수 있는 기능을 제공한다. H2 드라이버는 JDBC URL을 파싱하여 애플리케이션과 데이터베이스 간의 연결을 설정한다. 이때 URL에 포함된 설정 파라미터를 통해 데이터베이스의 초기 상태나 동작을 제어할 수 있다. 문제가 되는 H2 2.1.210 이전 버전에는 JDBC...

CVE-2026-75431_PowerJob_jwt_key_predictable

PowerJob JWT Signing Key Predictable Key Derived from Default JDBC URL → Token Forgery 1. Summary The PowerJob Server's JWT HS256 signing key is derived by BASE64-decoding a hardcoded constant concatenated with the MD5 of the default JDBC URL DefaultSecretProvider / JwtServiceImpl. The JDBC URL i...

Security Bulletin: IBM® Data Server driver for JDBC and SQLJ is vulnerable to remote code execution when jdbc url is under user control (CVE-2026-9762)

Summary IBM® Db2® is vulnerable to remote code execution when jdbc url is under user control. Vulnerability Details CVEID:CVE-2026-9762 DESCRIPTION: IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to remote code execution when jdbc url is under user control. CWE:CWE-94:...

CVE-2026-42537 Apache Ranger: Remote Code Execution via JDBC URL Injection

Remote Code Execution via JDBC URL Injection in Apache Ranger = 2.8.0 Users are recommended to upgrade to version 2.9.0, which fixes this issue...

EUVD-2026-55251

Remote Code Execution via JDBC URL Injection in Apache Ranger = 2.8.0 Users are recommended to upgrade to version 2.9.0, which fixes this issue...

CVE-2026-42537

Apache Ranger versions prior to 2.9.0 (

CVE-2026-42537

Remote Code Execution via JDBC URL Injection in Apache Ranger = 2.8.0 Users are recommended to upgrade to version 2.9.0, which fixes this issue...

CVE-2026-42537: Improper Control of Generation of Code

Remote Code Execution via JDBC URL Injection in Apache Ranger = 2.8.0 Users are recommended to upgrade to version 2.9.0, which fixes this issue...

IBM DB2 Remote Code Execution (7279479) (Unix)

According to its self-reported version number, IBM Db2 is affected by a remote code execution vulnerability: - IBM Data Server Driver for JDBC and SQLJ is vulnerable to remote code execution when jdbc url is under user control. CVE-2026-9762 Note that Nessus has not tested for this issue but has...

CVE-2026-9762 IBM® Data Server driver for JDBC and SQLJ is vulnerable to remote code execution when jdbc url is under user control

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to remote code execution when jdbc url is under user control...

CVE-2026-9762 IBM® Data Server driver for JDBC and SQLJ is vulnerable to remote code execution when jdbc url is under user control

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to remote code execution when jdbc url is under user control...

CVE-2026-9762: Improper Control of Generation of Code

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to remote code execution when jdbc url is under user control...

CVE-2026-41042: Improper Input Validation

Unauthenticated callers can supply a malicious H2 JDBC URL through the testConnection API, which executes arbitrary Java code on the server via H2's INIT parameter. Vulnerability in Apache Gravitino. This issue affects Apache Gravitino: before 1.2.1. Users are recommended to upgrade to version...

CVE-2026-53751 DataEase: H2 JDBC URL Filter Bypass Leads to Remote Code Execution (RCE)

DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, the H2 database JDBC URL validation logic can be bypassed with special Unicode characters whose case-conversion behavior differs between DataEase validation and H2 parsing, allowing attackers to smuggle dangerous...

CVE-2026-53751: Improper Control of Generation of Code

DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, the H2 database JDBC URL validation logic can be bypassed with special Unicode characters whose case-conversion behavior differs between DataEase validation and H2 parsing, allowing attackers to smuggle dangerous...

PT-2026-53441

H2O.ai H2O through 3.46.0.4 allows attackers to arbitrarily set the JDBC URL, leading to deserialization attacks, file reads, and command execution. Exploitation can occur when an attacker has access to post to the ImportSQLTable URI with a JSON document containing a connection url property with...

CVE-2026-12787

A vulnerability was found in zhilink 智互联深圳科技有限公司 ADP Application Developer Platform 应用开发者平台 1.0.0. This affects an unknown part of the component testConnection Endpoint. The manipulation of the argument jdbcUrl results in deserialization. The attack may be performed from remote. The exploit has...