sql-injection

3 articles · newest first

A business intelligence dashboard interface displaying charts and data tables, representative of the kind of analytics platform Metabase provides

One free BI tool had a password-reset bug that handed out admin — hackers found it first

A single API endpoint let anyone become an administrator on thousands of self-hosted Metabase servers, and Framework, n8n and Kilo Code already got hit before the patch even shipped.

Priya Nair · 5d ago · 7 min

Software

a hacker tweeted a map-server bug tuesday morning. by wednesday, attackers were already inside

GeoServer's jsonArrayContains function scored a 9.8, needed zero credentials, and WatchTowr watched the exploitation start within hours of the tweet that disclosed it.

Priya Nair · Aug 17 · 6 min

A Framework laptop, the computer maker that disclosed a data breach tied to a Metabase zero-day vulnerability

Software

framework just told every customer their data leaked — the bug was a password reset box

A password-reset endpoint with a CVSS 10.0 score let attackers become Metabase admins with zero credentials — and Framework's customers paid for it.

Priya Nair · Aug 9 · 6 min