EUVD-2026-76153

Improper restriction of XML external entity references in the RemoteQueryCachePlugin in AWS Advanced JDBC Wrapper 3.3.0 through 4.2.0 might allow an actor with write access to the shared cache infrastructure to disclose sensitive files from application hosts that read cached query results,...

CVE-2026-75431_PowerJob_jwt_key_predictable

Clave de Firma JWT de PowerJob Predecible Clave Derivada de la URL JDBC Predeterminada → Falsificación de Tokens 1. Resumen La clave de firma JWT HS256 del servidor PowerJob se deriva decodificando en BASE64 una constante codificada concatenada con el MD5 de la URL JDBC predeterminada...

obridge

OBridge OBridge 提供了一个简单的 Java 源代码生成器，用于调用 Oracle PL/SQL 包过程。 支持的输入、输出参数和返回值包括： BINARYINTEGER BOOLEAN CHAR CLOB BLOB DATE NCHAR NUMBER NVARCHAR2 OBJECT - Oracle 对象类型 PLSINTEGER TABLE - Oracle 对象类型的表 TIMESTAMP VARCHAR2 RAW 以下类型无法实现，因为 JDBC 驱动程序不支持它们： 在源代码中声明的类型 %ROWTYPE 参数 生成的代码可兼容 Java 1.6 编译。 用法 ...

WSO2-2021-1259

WSO2-2021-1259: H2 RCE via Malicious JDBC Connection String in WSO2 ESB Due to the improper input validation, a remote code execution attack could be carried out using malicious H2 JDBC Connection Strings. Vendor Disclosure: The vendor's disclosure and fix for this vulnerability can be found here...

...[ More ]

Apache Impala versions 2.7.0 through 4.5.1 suffer from an insufficient authorization vulnerability that leads to remote code execution. A table created with STORED BY JDBC takes a driver.url property that Impala uses to fetch a remote JAR and load the named driver class on first query, and the...

jdbc.postgresql.org: pgjdbc: Client-side Denial of Service via malicious SCRAM-SHA-256 authentication

A flaw was found in pgjdbc, an open-source PostgreSQL JDBC Driver. A malicious server can exploit this vulnerability by instructing the driver to perform SCRAM-SHA-256 Salted Challenge Response Authentication Mechanism Secure Hash Algorithm 256 authentication with an excessively large iteration...

CVE-2023-25157

Lab CVE-2023-25157 y CVE-2023-25158 Este lab utiliza GeoServer/PostGIS para investigar la inyección SQL en filtros OGC en un entorno local, con separación clara entre el modo operador/setup y el modo atacante. CVE-2023-25157: superficie del producto GeoServer, las solicitudes WFS/WMS entran en la...

hekate

Hekate - A VMWare Workspace ONE Access Remote Code Execution Exploit Steven Seeley of Qihoo 360 Vulnerability Research Institute Original rogue MySQL server by LandGrey Details Hekate is pronounced as heh-ka-teh Date: Tue Feb 22 13:37:00 CST 2022 Version: 21.08.0.1 latest File:...

CVE-2026-33725

CVE-2026-33725 A proof-of-concept exploit for CVE-2026-33725, a Remote Code Execution and Arbitrary File Read via H2 JDBC INIT Injection in EE Serialization Import in Metabase. Vulnerable Versions Metabase Enterprise ≥ v1.47 and v1.54.22 Metabase Enterprise ≥ v1.54.0 and v1.54.22 Metabase...

DataEase_Postgresql_JDBC_Bypass-CVE-2025-49002

fofa语法：title="DataEase" poc: "POST /de2api/datasource/validate HTTP/1.1 Host: your-ip Accept-Encoding: gzip, deflate, br, zstd sec-ch-ua: ""Google Chrome"";v=""135"", ""Not-A.Brand"";v=""8"", ""Chromium"";v=""135"" User-Agent: Mozilla/5.0 Windows NT 10.0; Win64; x64 AppleWebKit/537.36 KHTML, like...

EXPLOIT-CVE-2026-40901

DataEase — Unauthenticated RCE via a 4-vulnerability chain CVE-2026-40901 & friends Auth bypass → JDBC blocklist bypass arbitrary file read → SQL injection → Java deserialization in Quartz → remote code execution asroot. Self-contained local lab Docker + working PoC. Fixed in DataEase v2.10.21...

cp30_XXE_partial_fix

c3p0 c3p0 是一个成熟、高并发的 JDBC 连接池库，支持 PreparedStatement 的缓存和复用。它采用 LGPL v.2.1 或 EPL v.1.0 协议，由您自行选择。 c3p0 目前在 github 上维护。 c3p0 可通过 Sonatype 的开源软件仓库 作为托管依赖项获取，地址为 groupId: com.mchange, artifactId: c3p0。至于 version 的可选值，请查看此处。 您仍可在 sourceforge 上找到历史版本。 每个发行版均附带文档，也可在在线文档中查看。 以下是当前 开发快照 的最新 CHANGELOG 和...

CVE-2025-70828

CVE-2025-70828 摘要 在 Datart v1.0.0-rc.3 中发现了一个任意文件读取漏洞。该应用程序在数据源配置期间未能正确验证 JDBC 连接 URL。 漏洞详情 漏洞类型： 不当输入验证（CWE-20）/ 任意文件读取 受影响版本： Datart v1.0.0-rc.3 严重程度： 高危（可能导致敏感信息泄露） 描述 该漏洞存在于数据源配置模块中。应用程序未严格清理 JDBC 配置中的 url 参数。具有数据源配置权限的远程攻击者可以向 JDBC URL 注入恶意参数（特别是 allowLoadLocalInfile=true）。 通过将 JDBC...

CVE-2023-40037

CVE-2023-40037: Validación incompleta de las URL de conexión JDBC y JNDI en Apache NiFi Apache NiFi 1.21.0 hasta 1.23.0 admiten acceso JDBC y JNDI JMS en varios Processors y Controller Services con una validación de URL de conexión que no proporciona protección suficiente contra entradas...

cve-2026-41042

CVE-2026-41042: Apache Gravitino 1.2.1 RCE no autenticado Prueba de concepto autocontenida, solo con la biblioteca estándar, para CVE-2026-41042: ejecución remota de código no autenticada en Apache Gravitino anterior a 1.2.1 mediante el ajuste de conexión INIT de H2 JDBC. Sin cabeceras de...

CVE-2025-70829

CVE-2025-70829: Exposición de información en Datart 中文文档 1. Descripción general de la vulnerabilidad CVE ID : CVE-2025-70829 Producto : Datart Versión : v1.0.0-rc.3 Tipo de vulnerabilidad : Exposición de información Una vulnerabilidad de exposición de información en Datart v1.0.0-rc.3 permite a...

metabase-cve-2023-38646

cd /metabase-poc cat README.md -p 4444 -P 8000 -u http://localhost:3000 -l — 攻击者回调 IP（当目标为本地容器时，通常为 Docker 桥接网关，例如 172.17.0.1） -p — 反向数据通道回连的端口...

CVE-2023-21971_Analysis

CVE-2023-21971 Connector/J RCE Analysis分析 参考 Remote Code Execution RCE in com.mysql:mysql-connector-j | CVE-2023-21971 | Snyk New Vulnerability in MySQL JDBC Driver: RCE and Unauthorized DB Access MYSQL JDBC反序列化解析 - 跳跳糖 tttang.com 漏洞概述 Oracle MySQL 的 MySQL Connectors...

CVE-2025-56819

CVE-2025-56819 Datart v.1.0.0-rc.3 中的一个问题允许远程攻击者通过 INIT 连接参数执行任意代码。 root@kitploit: POST /api/v1/data-provider/test HTTP/1.1 Host: test.com:8080 Content-Type: application/json Content-Length: 520 "name": "jdbc-data-provider", "type": "JDBC", "properties": "dbType": "H2", "url":...

CVE-2026-85528

Improper input validation of the auto-configuration account identifier in Snowflake JDBC Driver versions 4.2.0 through 4.3.3 allowed a credential-bearing login request to be redirected to an attacker-selected HTTPS endpoint. An attacker able to control the account value could cause the driver to...