Skip to content
Threat Feed
Subscribe

Product

Metabase

2 briefs RSS
critical advisory

Critical Pre-Authentication RCE in Metabase (CVE-2023-38646)

A critical pre-authentication Remote Code Execution vulnerability in Metabase allows unauthenticated attackers to execute arbitrary system commands via malicious H2 database connection strings.

Metabase
1r 2t 1c
critical advisory

Critical SQL Injection and Privilege Escalation Vulnerability in Metabase

An unauthenticated remote attacker can exploit a vulnerability in Metabase to perform SQL injection and escalate privileges.

PoC Metabase +2 sql-injection privilege-escalation web-application
2t 1c updated