#sql-injection
-
Arista Patches Actively Exploited VeloCloud Orchestrator Zero-Day
Arista has shipped fixes for on-premises VeloCloud Orchestrator: a critical SQL injection flaw is already being exploited and lets authenticated users escalate to superuser privileges.
-
Zero-Day in Metabase: SQL Injection with CVSS 10.0 Used to Steal Customer Data
A critical vulnerability in the Metabase analytics platform allowed an unauthenticated attacker to gain administrator privileges. Among those affected are laptop maker Framework and the form service Tally.
-
Hackers Hid the khunt Toolkit Inside an Oracle Database
Through an SQL injection, attackers planted a post-exploitation kit directly inside an Oracle database, compiling it as a Java object. The technique, according to Huntress, is spotted extremely rarely in real-world attacks.
-
Critical cPanel Vulnerability: A Hosting Customer Could Run SQL as the Database Root
cPanel has patched CVE-2026-58048 (CVSS 9.4), which let a hosting account holder execute arbitrary SQL commands with administrative privileges. The same release fixes two more flaws that broke through account boundaries.