tag
Command-Execution
Percona PMM Authenticated RCE via PostgreSQL COPY TO PROGRAM (CVE-2026-25212)
CVE-2026-25212 arises because PMM's internal PostgreSQL user retains SUPERUSER privileges instead of being restricted. An attacker authenticated with only pmm-admin rights can use Grafana's "Add data source" feature to register an arbitrary PostgreSQL data…
local-mcp exec Tool Sandbox/Restriction Bypass (CVE-2026-6130)
This is not a standalone PoC script but the actual local-mcp MCP server codebase, whose exec tool contains the real CVE-2026-6130 bypass: a workaround using a generated batch file plus base64 encoding that circumvents intended command-execution restrictions…
PostgreSQL Referential-Integrity Owner-Switched Implicit Cast RCE
This PoC demonstrates that PostgreSQL's referential-integrity (RI) enforcement for foreign keys switches its effective role to the referenced table's owner before invoking any implicit cast needed to compare the foreign-key value against the primary-key type.…
OpenVPN Connect Server-Pushed Option Current-User Command Execution
A malicious OpenVPN server can push an echo option to a connected OpenVPN Connect for Windows client that decodes into the internal script.win.user.disconnect script key. OpenVPN Connect then executes that pushed command when the client disconnects, even…