The Hacker News

Metabase Zero-Day Exploited in Wild Allows Admin Access Without Authentication

Metabase says a CVSS 10.0 zero-day SQL injection was exploited in the wild; the flaw can grant admin access and expose ...

Metabase SQLi zero-day exploited in customer data-theft attacks

A critical Metabase SQL injection vulnerability was exploited in zero-day attacks to breach customer instances in data theft ...

This 'classic' decades-old SQL injection flaw could let hackers take over entire Windows servers

Huntress spotted a white whale - a malicious toolkit stored as a database object.

Hackers run khunt post-exploitation toolkit from Oracle database

Hackers exploited a SQL injection vulnerability to install a post-exploitation toolkit directly inside an Oracle database ...
The Hacker News

New cPanel Critical Flaw Could Let Hosting Customers Run SQL as Database Root

Panel patches CVE-2026-58048, which could let authenticated customers run SQL as database root and, in some setups, ...