Mysql-Readfile

简介 该项目主要利用 load data local infile 来获取攻击者的主机（Windows 平台）上的任意文件，需要访问的文件可以列在 file.txt 中。当我们在某些情况下能够控制 Mysql 的连接配置时，这将非常有意义。 项目使用方法 步骤 1：启动伪造的 Mysql 服务器 python2 Mysql-Read.py 步骤 2：连接恶意服务器 参考 https://mp.weixin.qq.com/s/rQ9BpavBeMnS6xUOidZ5OA https://mp.weixin.qq.com/s/m4IYDn98KA2yGAhv67Gg...

mariadb-13-rce-lab

MariaDB 13.0.1-rc RCE 实验室 在未经修改的原版 MariaDB 13.0.1-rc Docker 镜像 上以 uid 999（mysql）身份执行远程代码。 两种漏洞利用变体： 变体| 文件| 要求| 备注 ---|---|---|--- 纯 SQL （推荐）| exploitpuresql.py| 低权限 MariaDB 账户 + TCP| 无需宿主机访问、无需 docker、无需 /proc/mem、无需 root 密码 宿主机辅助 PoC| exploit.py| Docker 宿主机上的 root| 通过 /proc//mem 写入 JOP 链...

CVE-2023-22884-Airflow-SQLi

Apache Airflow SQL注入PoC CVE-2023-22884 CVE-2023-22884的PoC是一个影响2.4.0之前版本的Apache Airflow RCE漏洞。 官方报告描述如下： 在Apache软件基金会的Apache Airflow和Apache Airflow MySQL Provider中存在命令中特殊元素未正确中和（'命令注入'）漏洞。该问题影响Apache Airflow版本：2.5.1之前；Apache Airflow MySQL Provider版本：4.0.0之前。来源 受影响版本的该软件包存在命令注入漏洞，原因是未对LOAD DATA LOC...

PT-2026-97931

Name of the Vulnerable Software and Affected Versions Mini-XML version 4.0.5 Description A memory leak occurs during the parsing of malformed XML. Specially crafted XML input can cause text nodes allocated by the mxmlNewText function to become unlinked before a parse error transfers control to th...

Nuclei: Local File Read via MySQL Client Sandbox Bypass

A vulnerability in Nuclei's JavaScript MySQL client library allows arbitrary local file reads that bypass the -allow-local-file-access -lfa sandbox restriction. Affected Component The issue is in the nuclei/mysql JavaScript library used by javascript: protocol templates. The MySQL client connecti...

GHSA-XHMX-W2J4-RW3Q Nuclei: Local File Read via MySQL Client Sandbox Bypass

A vulnerability in Nuclei's JavaScript MySQL client library allows arbitrary local file reads that bypass the -allow-local-file-access -lfa sandbox restriction. Affected Component The issue is in the nuclei/mysql JavaScript library used by javascript: protocol templates. The MySQL client connecti...

CVE-2026-76803

Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the nuclei/mysql JavaScript library does not enforce the local-file sandbox when a JavaScript template supplies the allowAllFiles MySQL DSN option. An untrusted javascript: template scanning an...

CVE-2026-76803

The Nuclei vulnerability scanner (versions 3.0.0 through 3.10.0 ) contains a flaw in its nuclei/mysql JavaScript library. The library fails to enforce local-file sandbox restrictions when a javascript: template provides the allowAllFiles MySQL DSN option. This allows an attacker controlling a MyS...

CVE-2026-76803 Nuclei: Local File Read via MySQL Client Sandbox Bypass

Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the nuclei/mysql JavaScript library does not enforce the local-file sandbox when a JavaScript template supplies the allowAllFiles MySQL DSN option. An untrusted javascript: template scanning an...

CVE-2026-76803 Nuclei: Local File Read via MySQL Client Sandbox Bypass

Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the nuclei/mysql JavaScript library does not enforce the local-file sandbox when a JavaScript template supplies the allowAllFiles MySQL DSN option. An untrusted javascript: template scanning an...

CVE-2026-76803: Improper Access Control

Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the nuclei/mysql JavaScript library does not enforce the local-file sandbox when a JavaScript template supplies the allowAllFiles MySQL DSN option. An untrusted javascript: template scanning an...

PT-2026-96834

Name of the Vulnerable Software and Affected Versions Nuclei versions 3.0.0 through 3.9.9 Description The nuclei/mysql JavaScript library fails to enforce the local-file sandbox when a JavaScript template uses the allowAllFiles MySQL DSN option. This allows an untrusted javascript: template...

CVE-2026-63827

Root cause: Linux kernel AppArmor uses a use-after-free in the rawdata dedup loop (aa_replace_profiles) due to unsafe refcount handling when traversing ns->rawdata_list. The dedup path calls aa_get_profile_loaddata() which has plain kref_get() semantics, allowing a zero counter to be dereferen...

EUVD-2026-45493

In the Linux kernel, the following vulnerability has been resolved: apparmor: fix use-after-free in rawdata dedup loop aareplaceprofiles walks ns-rawdatalist to dedup the incoming policy blob against entries already attached to existing profiles. Per the kernel-doc on struct aaloaddata, list...

PT-2026-61143

Name of the Vulnerable Software and Affected Versions Linux kernel version 7.1-rc5 Description A use-after-free issue exists in the AppArmor module of the Linux kernel during the rawdata deduplication loop. The function aa replace profiles iterates through ns-rawdata list to deduplicate incoming...

PT-2026-57365

Name of the Vulnerable Software and Affected Versions BabelDOC versions prior to 0.6.3 Description BabelDOC contains a flaw in its vendored PDF parser where the CMapDB. load data function deserializes untrusted pickle data when loading CMap files. An attacker can use hex-encoded absolute paths or...

The vulnerability of the load_data() function in the llama_index/readers/obsidian/base.py file of the ObsidianReader plugin, which allows an intruder to gain unauthorized access to protected information.

The vulnerability of the loaddata function in the llamaindex/readers/obsidian/base.py file of the ObsidianReader plugin is related to path traversal. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information...

CVE-2026-40899

DataEase is an open-source data visualization and analytics platform. Versions 2.10.20 and below contain a JDBC parameter blocklist bypass vulnerability in the MySQL datasource configuration. The Mysql class uses Lombok's @Data annotation, which auto-generates a public setter for the...

EUVD-2026-23293

DataEase is an open-source data visualization and analytics platform. Versions 2.10.20 and below contain a JDBC parameter blocklist bypass vulnerability in the MySQL datasource configuration. The Mysql class uses Lombok's @Data annotation, which auto-generates a public setter for the...

CVE-2026-40899

DataEase