PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Reproducing CVE-2023-38646: Metabase Pre-auth RCE

calif.io | vulnerability | CVE-2023-38646 | #rce | #vulnerability-research | #pre-auth | #exploitation | #metabase | #web | #cve-2023-38646
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

# Reproducing CVE-2023-38646: Metabase Pre-auth RCE Walking a pre-auth remote code execution bug back from the patch. Duc Nguyen and Jang Nguyen July 27, 2023 web _By Duc Nguyen and Jang Nguyen_...
CVE
CVE-2023-38646
Published
Collected

Related coverage

research · slcyber.io
Chaining our way to Pre-Auth RCE in Metabase (CVE-2023-38646)
# Chaining our way to Pre-Auth RCE in Metabase (CVE-2023-38646) Get research alerts Share on social ) July 22, 2023 7 min read ### Table of Contents TOC Element Metabase is an open source business...
research · slcyber.io
Advisory: Metabase Pre-Auth RCE (CVE-2023-38646)
# Advisory: Metabase Pre-Auth RCE (CVE-2023-38646) Get research alerts Share on social ) July 22, 2023 1 min read ### Table of Contents TOC Element Summary Impact Affected Software Product...
research · slcyber.io
More Critical Bugs in Adobe Experience Manager: Pre-Auth RCE
Chaining an unauthenticated bulk import, an in-band XXE, leaked IMS credentials and Groovy execution into full pre-auth RCE on Adobe Experience Manager Cloud.
Critical · vulnerability · github.com
CVE-2026-109618/109619: Two Independent Pre-Auth RCE Chains on PHP 8.5.11 (Lab Reproduction & PoC)
Provides definitive lab evidence and control ladders clarifying the actual exploitability of php2shell, refuting circulating unworkable cached-zval UAF theories while proving concrete RCE vectors on stock PHP 8.5.11.
Critical · vulnerability · github.com
php2shell (CVE-2026-109618 / CVE-2026-109619): PHP Pre-Auth RCE PoC, Source Patch & Comprehensive Defense Guide
Provides critical stopgap mitigations, source-level patches, and multi-web-server WAF rules for teams securing PHP deployments, especially for unpatched legacy and end-of-life installations.
vulnerability · netspi.com
PHP2Shell Unauthenticated RCE on PHP: CVE-2026-109618 & CVE-2026-109619
# PHP2Shell Unauthenticated RCE on PHP: CVE-2026-109618 & CVE-2026-109619 October 21, 2026 ### Team NetSPI The PHP project has disclosed two critical vulnerabilities, CVE-2026-109618 and...
Back