Exploit for SQL Injection in Metabase

Metabase SQL Injection RCE !Exploitation Demoexploitoutpu...

EUVD-2026-55690

Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the '/resetpassword' database endpoint and gain administrator access to the connected Metabase instance...

Metabase SQL injection

RISK EVALUATION Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL. In the worst case an attacker could gain administrative privileges. 2. RECOMMENDED PRACTICES Fixed in v58.24, v59.21, v60.17, v61.11, v62.9 and v63.5. See https://www.metabase.com/blog/security-update. 3...

CVE-2025-51543

A security vulnerability exists in Cicool builder version 3.4.4 , allowing an attacker to perform a password reset for the administrator account. The root cause is an accessible /administrator/auth/reset_password API endpoint. This flaw could lead to unauthorized administrative access. As a tempo...