[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"all-banners":3,"SkipToContent_34xgpJIRRkpiT6ls6jE4NHf7VpvQCQBEwi69exi4oT0":57,"FooterNav_JsYsxvLufb1W12aeknKZ89on0MD0bNDTiB5EYxyxmU":64,"FooterSocial_u16tCafBUeGMoDrdLfTINytP2JB5msc6iB3VDUutAoU":70,"vulnerability-29947":77},[4,13,23,35,43,50],{"title":5,"slug":6,"text":7,"link":8,"external":9,"targets":10,"cta":8,"variant":12,"priority":12,"campaign_id":6},"PHP2Shell, Node2Shell, *sshole detections - pricing page","node2shell-exploit","Detect PHP2Shell, Node2Shell & *sshole with every paid plan.",null,false,[11],"\u002Fpricing","secondary",{"title":14,"slug":15,"text":16,"link":17,"external":18,"targets":19,"cta":22,"variant":12,"priority":12,"campaign_id":15},"Office Hours #15","office-hours-15","[Live Office Hours, Wed Nov 18] Behind the login, beyond the scan","https:\u002F\u002Fzoom.us\u002Fwebinar\u002Fregister\u002F5117815316917\u002FWN_BUp1qET2THa_5h65whpx9g",true,[20,21],"\u002Fwebinars\u002Foffice-hours","\u002Fwebinars","Save your spot",{"title":24,"slug":25,"text":26,"link":27,"external":9,"targets":28,"cta":34,"variant":12,"priority":12,"campaign_id":25},"*sshole, PHP2Shell & Node2Shell - HP, Vuln DB, product page","sshole-detect-exploit","🚨 Detect *sshole & Node2Shell with any paid plan. Get proof with our Sniper exploit","https:\u002F\u002Fpentest-tools.com\u002Fpricing",[29,30,31,32,33],"\u002F","\u002Fvulnerabilities-exploits","\u002Fvulnerabilities-exploits\u002Fopenssh-musl-authentication-bypass-cve-2026-123158-sshole_29981","\u002Fvulnerabilities-exploits\u002Fnode2shell-http2shell-brotli-decoder-remote-code-execution_29896","\u002Fproduct","See pricing options",{"title":36,"slug":37,"text":38,"link":27,"external":9,"targets":39,"cta":41,"variant":12,"priority":12,"campaign_id":42},"*sshole - Exploit on Sniper: Auto-Exploiter page","sshole-exploit-sniper","🚨 Exclusive exploit for *sshole now live",[40],"\u002Fexploit-helpers\u002Fsniper","Use it with the Exploit plan","sshole-exploit",{"title":44,"slug":45,"text":46,"link":27,"external":18,"targets":47,"cta":49,"variant":12,"priority":12,"campaign_id":42},"*sshole exploit - Exploit on the NS page","sshole-exploit-ns","🚨 Go beyond *sshole detection: get proof of exploitation",[48],"\u002Fnetwork-vulnerability-scanning\u002Fnetwork-security-scanner-online","Pick the Exploit plan",{"title":51,"slug":52,"text":53,"link":27,"external":18,"targets":54,"cta":34,"variant":12,"priority":12,"campaign_id":42},"*sshole exploit - WS, free tools","sshole-exploit-mainpw","Detect *sshole with every paid plan. Prove it with Exploit.",[55,56],"\u002Fwebsite-vulnerability-scanning\u002Fwebsite-scanner","\u002Ffor\u002Ffree",["Island",58],{"key":59,"params":60,"result":62},"SkipToContent_34xgpJIRRkpiT6ls6jE4NHf7VpvQCQBEwi69exi4oT0",{"props":61},"{}",{"head":63},{},["Island",65],{"key":66,"params":67,"result":68},"FooterNav_JsYsxvLufb1W12aeknKZ89on0MD0bNDTiB5EYxyxmU",{"props":61},{"head":69},{},["Island",71],{"key":72,"params":73,"result":75},"FooterSocial_u16tCafBUeGMoDrdLfTINytP2JB5msc6iB3VDUutAoU",{"props":74},"{\"text-color\":\"gray\"}",{"head":76},{},{"id":78,"detectable_with":79,"vuln_details":85,"vuln_id":106,"name":107,"published":108,"updated":108},29947,{"tool":80,"engine":83},{"id":81,"name":82},1,"Network Scanner",{"id":81,"name":84},"Sniper",{"id":78,"codename":8,"description":86,"severity":87,"risk_description":88,"public_description":89,"public_recommendation":90,"recommendation":91,"references":92,"cvssv3":96,"epss_score":97,"epss_percentile":98,"cve":99,"in_cisa_catalog":18,"date":101,"software_type":102,"vendor":103,"product":103,"ptt_exploit_capabilities":104},"We found that the target server is vulnerable to CVE-2026-72898, an unauthenticated SQL injection affecting Metabase. The password-reset API endpoint (\u002Fapi\u002Fsession\u002Freset_password) accepts user-supplied JSON fields (such as token or user-id) that are not properly sanitized: an attacker can submit a HoneySQL structure where a string is expected, injecting arbitrary SQL into the backend query executed against the application database (core_user). We confirmed this vulnerability without authentication by submitting crafted POST requests and observing that the injected structure is parsed into the query layer and executed against the real user table.","critical","Successful exploitation can lead to full compromise of the Metabase instance, including creation or takeover of administrator accounts, data exfiltration, and further lateral movement into connected systems. The issue is critical and trivial to exploit remotely, making the likelihood of attack high and the potential impact severe.","Metabase contains an unauthenticated SQL injection in the password reset API endpoint (\u002Fapi\u002Fsession\u002Freset_password) where user-supplied JSON fields (such as token or user-id) are not properly sanitized. An attacker can submit crafted POST requests to inject arbitrary SQL into the backend database queries executed by that endpoint. The flaw allows extraction or modification of data in the connected Metabase database and can be used to create or take over administrator accounts. The vulnerability requires no authentication and only HTTP access to the endpoint to be exploited.","Update Metabase to the latest vendor-patched release immediately.","We recommend upgrading Metabase to the latest vendor-patched release immediately (58.24, 59.21, 60.17, 61.11, 62.9, 63.5 or later). If an immediate upgrade is not possible, restrict access to the reset_password endpoint via network controls or a web application firewall and monitor for suspicious POST requests to that API.",[93,94,95],"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-72898","https:\u002F\u002Fgithub.com\u002Fmetabase\u002Fmetabase\u002Fsecurity\u002Fadvisories\u002FGHSA-vwf4-m7j8-wcjf","https:\u002F\u002Fsecurityonline.info\u002Fmetabase-sql-injection-zero-day-exploited\u002F",10,0.98208,0.99914,[100],"CVE-2026-72898","2026-08-10T00:00:00Z","Data instrumentation, visualization, and querying","Metabase",[105],"CUSTOM","NETSCAN-SNIPER-CVE-2026-72898","Metabase - Unauthenticated SQL Injection","2026-10-13T00:00:00Z"]