57
55
57
60
55
55
30
Inside the Metabase SQLi: Exploited in the Wild
Wiz reverse engineers Metabase SQLi CVE-2026-72898, exploited in the wild, using AI to speed defenses.
Wiz published an analysis of Metabase CVE-2026-72898, a SQL injection vulnerability that is being exploited in the wild. The write-up reverse engineers the flaw and applies AI to accelerate defensive guidance for responders. Organizations running Metabase should treat the flaw as actively targeted.
72
57
[remote] CVE-2026-42167 - ProFTPD mod_sql post-authentication SQLi - RCE
Exploit-DB published a PoC for CVE-2026-42167, post-authentication SQL injection in ProFTPD mod_sql leading to remote code execution.
Exploit-DB entry 52658 provides a remote exploit for CVE-2026-42167, a SQL injection in ProFTPD's mod_sql module that is reachable after authentication and can lead to remote code execution. Successful exploitation requires valid credentials on the target FTP service.
45
60
60
60
60
35
60
FreePBX Patches Critical SQLi, File-Upload, and AUTHTYPE Bypass Flaws Enabling RCE
60
35
30
60
60
60
60
57
60
30
60
60
45
60
45
30
47
30
45
60
57
60
45
42