Exploit for SQL Injection in Metabase

Metabase SQL Injection RCE !Exploitation Demoexploitoutpu...

EUVD-2026-55690

Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the '/resetpassword' database endpoint and gain administrator access to the connected Metabase instance...

CVE-2025-51543

A security vulnerability exists in Cicool builder version 3.4.4 , allowing an attacker to perform a password reset for the administrator account. The root cause is an accessible /administrator/auth/reset_password API endpoint. This flaw could lead to unauthorized administrative access. As a tempo...