Apache Gravitino < 1.2.1 - Unauthenticated Remote Code Execution

Apache Gravitino 1.2.1 contains a remote code execution caused by unsanitized H2 JDBC URL via testConnection API using H2's INIT parameter, letting unauthenticated attackers execute arbitrary Java code remotely, exploit requires H2 usage. id: CVE-2026-41042 info: name: Apache Gravitino 1.2.1 -...

CVE-2025-64328_FreePBX-framework-Command-Injection

CVE-2025-64328 FreePBX の framework モジュールにおける認証済みコマンドインジェクション CVE-2025-64328 FreePBX の framework モジュールにおける認証済みコマンドインジェクションのシンプルな概念実証リポジトリです。 完全な解説はこちら: https://theyhack.me/CVE-2025-64328-FreePBX-Authenticated-Command-Injection/ curl による概念実証 $ curl -s \ -XPOST --cookie-jar /tmp/freepbx-cookie --dat...

SuiteCRM 8.10.1 Authenticated Server-Side Request Forgery

SuiteCRM versions through 7.15.1 and 8.10.1 contain an authenticated server-side request forgery vulnerability in CalendarAccount testConnection. The proof of concept submits a supplied CalDAV server URL to demonstrate server-side request handling...

Exploit for CVE-2026-69137

CVE-2026-69137 - SuiteCRM Authenticated SSRF Authenticated se...

CVE-2026-63044 Apache InLong: Authenticated SSRF via POST /api/node/testConnection

Server-Side Request Forgery SSRF vulnerability in Apache InLong. Any authenticated user no admin role required can cause the InLong Manager server to make outbound HTTP requests or TCP connections to arbitrary internal hosts and ports. This issue affects Apache InLong: from 2.0.0 before 2.4.0...

CVE-2026-63044 Apache InLong: Authenticated SSRF via POST /api/node/testConnection

Server-Side Request Forgery SSRF vulnerability in Apache InLong. Any authenticated user no admin role required can cause the InLong Manager server to make outbound HTTP requests or TCP connections to arbitrary internal hosts and ports. This issue affects Apache InLong: from 2.0.0 before 2.4.0...

Server-Side Request Forgery (SSRF)

SpringBlade is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to insufficient validation of user-supplied URLs in the /ureport/datasource/testConnection endpoint, which allows an authenticated attacker to send crafted requests and scan internal or otherwise restricted...

Arbitrary Code Injection

Overview Affected versions of this package are vulnerable to Arbitrary Code Injection via the testConnection API when a malicious H2 JDBC URL is supplied, which leverages the H2 INIT parameter. An attacker can execute arbitrary Java code on the server by sending a crafted request to the API...

CVE-2026-41042

Unauthenticated callers can supply a malicious H2 JDBC URL through the testConnection API, which executes arbitrary Java code on the server via H2's INIT parameter. Vulnerability in Apache Gravitino. This issue affects Apache Gravitino: before 1.2.1. Users are recommended to upgrade to version...

EUVD-2026-42221

Unauthenticated callers can supply a malicious H2 JDBC URL through the testConnection API, which executes arbitrary Java code on the server via H2's INIT parameter. Vulnerability in Apache Gravitino. This issue affects Apache Gravitino: before 1.2.1. Users are recommended to upgrade to version...

CVE-2026-41042

Unauthenticated callers can supply a malicious H2 JDBC URL through the testConnection API, which executes arbitrary Java code on the server via H2's INIT parameter. Vulnerability in Apache Gravitino. This issue affects Apache Gravitino: before 1.2.1. Users are recommended to upgrade to version...

CVE-2026-41042 Apache Gravitino: Unauthenticated callers can supply a malicious H2 JDBC URL through the testConnection API, which executes arbitrary Java code on the server via H2's INIT parameter

Unauthenticated callers can supply a malicious H2 JDBC URL through the testConnection API, which executes arbitrary Java code on the server via H2's INIT parameter. Vulnerability in Apache Gravitino. This issue affects Apache Gravitino: before 1.2.1. Users are recommended to upgrade to version...

CVE-2026-41042: Improper Input Validation

Unauthenticated callers can supply a malicious H2 JDBC URL through the testConnection API, which executes arbitrary Java code on the server via H2's INIT parameter. Vulnerability in Apache Gravitino. This issue affects Apache Gravitino: before 1.2.1. Users are recommended to upgrade to version...

CVE-2026-42147

Coolify vulnerability CVE-2026-42147 affects prior to 4.0.0-beta.474: testConnection() validates only URL format for the S3 storage endpoint, allowing an authenticated user with storage management permissions to trigger server-side requests to internal or metadata-service URLs. This can enable SS...

CVE-2026-42147 Coolify: SSRF via S3 Storage Endpoint in testConnection()

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, S3 storage endpoint validation only checks URL format and testConnection sends a server-side request to the configured endpoint, allowing an authenticated user with storage...

CVE-2026-47381

NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, a user in one workspace could exercise another workspace's integration through the testConnection endpoint by supplying its ID, because the integration was fetched in a bypass scope and the caller's permission check...

EUVD-2026-38618

NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, a user in one workspace could exercise another workspace's integration through the testConnection endpoint by supplying its ID, because the integration was fetched in a bypass scope and the caller's permission check...

CVE-2026-47381

NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, a user in one workspace could exercise another workspace's integration through the testConnection endpoint by supplying its ID, because the integration was fetched in a bypass scope and the caller's permission check...

CVE-2026-47381: Authentication Bypass by Spoofing

NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, a user in one workspace could exercise another workspace's integration through the testConnection endpoint by supplying its ID, because the integration was fetched in a bypass scope and the caller's permission check...

CVE-2026-12787 zhilink 智互联(深圳)科技有限公司 ADP Application Developer Platform 应用开发者平台 testConnection Endpoint deserialization

A vulnerability was found in zhilink 智互联深圳科技有限公司 ADP Application Developer Platform 应用开发者平台 1.0.0. This affects an unknown part of the component testConnection Endpoint. The manipulation of the argument jdbcUrl results in deserialization. The attack may be performed from remote. The exploit has...