PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

CVE-2026-33725: Technical Analysis and Proof of Concept

yokai.hakaisecurity.io | vulnerability | CVE-2026-33725 | #ai-security | #vulnerability-research | #research
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Em 24 de março de 2026, foi identificada uma vulnerabilidade de alta criticidade no Metabase Enterprise que leva à execução remota de comandos, descoberta por “Hacktron AI e Rahul Maini”, conforme creditado aqui. A falha foi catalogada sob o identificador “CVE-2026-33725“. A vulnerabilidade permite que um administrador autenticado na plataforma injete parâmetros arbitrários na URL […]
CVE
CVE-2026-33725
Published
Collected

Related coverage

vulnerability · yokai.hakaisecurity.io
[EN] CVE-2026-33725: Technical Analysis and Proof of Concept
On March 24, 2026, a high-criticality vulnerability was identified in Metabase Enterprise leading to remote command execution, discovered by “Hacktron AI and Rahul Maini,” as credited here. The flaw was cataloged under the identifier “CVE-2026-33725“. The vulnerability allows an authenticated administrator on the platform to inject arbitrary parameters into the JDBC connection URL through a […]
research · vercel.com
DeepsecBench: evaluating model performance in finding cybersecurity vulnerabilities
Today we're releasing DeepsecBench, a benchmark that evaluates how well different models find security vulnerabilities in application code.
vulnerability · yokai.hakaisecurity.io
OsCommerce v4 RCE: Unveiling the file upload bypass threat
In my recent research, I identified a critical vulnerability in osCommerce v4, specifically a Remote Code Execution (RCE) vulnerability enabled by bypassing file upload restrictions. I’ve always enjoyed testing file upload bypass techniques in my assessments. Vulnerabilities Identified in OsCommerce Version 4 The CVE-2024-22724 was assigned to the discovery of this vulnerability. The issue […]
vulnerability · yokai.hakaisecurity.io
Fortigate - Autenticação de Desvio Levando à Assunção Completa do Dispositivo
Pesquisa de vulnerabilidade 1Day pela Equipe de Pesquisa da Hakai Este post trata da jornada para criar uma Prova de Conceito sobre a CVE-2022-40684, esta vulnerabilidade foi atribuída pela Fortinet como uma falha de autenticação usando uma vulnerabilidade de caminho ou canal alternativo [CWE-288]. Linha do Tempo 07/10/2022 – Primeira notícia sobre a vulnerabilidade, […]
vulnerability · yokai.hakaisecurity.io
Windows Admin-to-Kernel Elevation of Privilege (CVE-2024-21338)
On February 13th, 2024, Microsoft disclosed the CVE-2024-21338 based on the security report which allows for read/write in the kernel memory.
vulnerability · yokai.hakaisecurity.io
GLPI - SQL injection through dynamic reports
This post details the journey of our Research Team in uncovering a SQL Injection vulnerability in GLPI, an open-source ITSM tool predominantly used in Brazil and France. We observed many companies using GLPI, and we decided to focus on finding vulnerabilities that could allow access to users’ credentials and potentially some Remote Code Execution (RCE) […]
Back